API tools faq
paste
Advertisement
Guest User

OTL.txt

a guest
Oct 22nd, 2014
161
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 47.78 KB | None | 0 0
raw download clone embed print report
  1. OTL logfile created on: 2014-10-22 17:06:13 - Run 1
  2. OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\admin\Downloads
  3. 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
  4. Internet Explorer (Version = 8.0.7600.16385)
  5. Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
  6.  
  7. 3,98 Gb Total Physical Memory | 2,03 Gb Available Physical Memory | 51,07% Memory free
  8. 7,96 Gb Paging File | 5,69 Gb Available in Paging File | 71,41% Paging File free
  9. Paging file location(s): ?:\pagefile.sys [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
  12. Drive C: | 99,36 Gb Total Space | 12,26 Gb Free Space | 12,34% Space Free | Partition Type: NTFS
  13. Drive D: | 99,36 Gb Total Space | 18,02 Gb Free Space | 18,13% Space Free | Partition Type: NTFS
  14. Drive E: | 99,36 Gb Total Space | 1,71 Gb Free Space | 1,72% Space Free | Partition Type: NTFS
  15.  
  16. Computer Name: ADMIN-KOMPUTER | User Name: admin | Logged in as Administrator.
  17. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
  18. Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
  19.  
  20. [color=#E56717]========== Processes (SafeList) ==========[/color]
  21.  
  22. PRC - [2014-10-22 16:39:09 | 000,098,304 | ---- | M] (Hewlett-Packard Company) -- C:\Users\admin\Desktop\HP_USB_Disk_Storage_Format_Tool_2.2.3_[www.programosy.pl].exe
  23. PRC - [2014-10-22 14:46:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\admin\Downloads\OTL.exe
  24. PRC - [2014-10-12 13:17:13 | 000,066,872 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
  25. PRC - [2014-10-10 04:04:06 | 000,854,344 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  26. PRC - [2014-09-08 19:33:01 | 000,230,792 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe
  27. PRC - [2014-08-01 12:23:11 | 004,085,896 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
  28. PRC - [2014-08-01 12:22:29 | 000,050,344 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
  29. PRC - [2014-06-15 23:42:10 | 000,202,080 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
  30. PRC - [2014-05-20 01:10:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
  31. PRC - [2014-04-30 20:28:45 | 002,199,840 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
  32. PRC - [2014-04-30 20:28:32 | 001,617,696 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
  33. PRC - [2012-01-25 16:23:54 | 000,240,408 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\SeaPort.EXE
  34.  
  35.  
  36. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  37.  
  38. MOD - [2014-10-10 04:04:02 | 008,910,664 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\pdf.dll
  39. MOD - [2014-10-10 04:03:53 | 001,681,224 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\ffmpegsumo.dll
  40. MOD - [2014-08-01 12:22:38 | 019,329,904 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll
  41. MOD - [2014-08-01 12:22:32 | 000,301,152 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\aswProperty.dll
  42. MOD - [2014-02-10 13:44:24 | 004,592,128 | ---- | M] () -- C:\Users\admin\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libglesv2.dll
  43. MOD - [2014-02-10 13:44:24 | 000,112,128 | ---- | M] () -- C:\Users\admin\AppData\Local\Google\Chrome\User Data\SwiftShader\3.2.6.45159\libegl.dll
  44.  
  45.  
  46. [color=#E56717]========== Services (SafeList) ==========[/color]
  47.  
  48. SRV:[b]64bit:[/b] - [2014-08-22 15:14:34 | 000,368,624 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
  49. SRV:[b]64bit:[/b] - [2014-08-22 15:14:34 | 000,023,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
  50. SRV:[b]64bit:[/b] - [2014-08-01 12:22:29 | 000,050,344 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
  51. SRV:[b]64bit:[/b] - [2014-04-30 20:28:23 | 021,007,192 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
  52. SRV:[b]64bit:[/b] - [2011-11-11 21:50:40 | 000,027,760 | ---- | M] (VIA Technologies, Inc.) [Disabled | Stopped] -- C:\Windows\SysNative\ViakaraokeSrv.exe -- (VIAKaraokeService)
  53. SRV:[b]64bit:[/b] - [2009-07-14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
  54. SRV:[b]64bit:[/b] - [2009-07-14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
  55. SRV - [2014-10-18 16:52:14 | 002,529,616 | ---- | M] (LogMeIn Inc.) [Auto | Stopped] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
  56. SRV - [2014-10-18 15:16:36 | 000,417,552 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe -- (LMIGuardianSvc)
  57. SRV - [2014-10-12 13:17:13 | 000,066,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
  58. SRV - [2014-09-25 14:07:46 | 000,267,440 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
  59. SRV - [2014-09-23 06:32:08 | 000,833,728 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
  60. SRV - [2014-09-09 17:17:35 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
  61. SRV - [2014-06-15 23:42:10 | 000,202,080 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe -- (KSS)
  62. SRV - [2014-05-20 01:10:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
  63. SRV - [2014-05-12 07:24:42 | 000,860,472 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
  64. SRV - [2014-05-12 07:24:40 | 001,809,720 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
  65. SRV - [2014-04-30 20:28:32 | 001,617,696 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)
  66. SRV - [2014-04-03 20:21:48 | 000,315,008 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
  67. SRV - [2013-10-01 14:14:40 | 005,087,584 | ---- | M] (TeamViewer GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8)
  68. SRV - [2013-07-19 13:01:38 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Users\admin\AppData\Local\Temp\7zS1C6C\hpslpsvc64.dll -- (HPSLPSVC)
  69. SRV - [2013-07-04 13:50:26 | 000,384,840 | ---- | M] (BlueStack Systems, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc)
  70. SRV - [2013-07-04 13:50:04 | 000,393,032 | ---- | M] (BlueStack Systems, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc)
  71. SRV - [2012-07-09 00:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
  72. SRV - [2012-06-02 02:42:18 | 000,951,936 | ---- | M] (ASUSTeK Computer Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe -- (asHmComSvc)
  73. SRV - [2012-06-02 02:42:18 | 000,920,736 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe -- (asComSvc)
  74. SRV - [2012-05-03 03:23:30 | 001,475,200 | ---- | M] (ASUSTeK Computer Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AsusFanControlService\1.01.06\AsusFanControlService.exe -- (AsusFanControlService)
  75. SRV - [2012-02-17 23:26:00 | 000,149,120 | ---- | M] (ASUSTeK Computer Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe -- (AsSysCtrlService)
  76. SRV - [2012-01-25 16:23:54 | 000,240,408 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\SeaPort.EXE -- (BBUpdate)
  77. SRV - [2012-01-25 16:23:54 | 000,192,792 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BBSvc.EXE -- (BBSvc)
  78. SRV - [2011-09-19 16:59:40 | 000,278,336 | ---- | M] (NVIDIA) [Disabled | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe -- (nTuneService)
  79. SRV - [2010-02-19 14:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
  80. SRV - [2009-06-10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
  81.  
  82.  
  83. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  84.  
  85. DRV:[b]64bit:[/b] - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
  86. DRV:[b]64bit:[/b] - [2014-10-22 15:27:48 | 000,032,512 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hitmanpro37.sys -- (hitmanpro37)
  87. DRV:[b]64bit:[/b] - [2014-10-11 13:27:46 | 000,142,528 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
  88. DRV:[b]64bit:[/b] - [2014-08-01 12:23:04 | 000,427,360 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsp.sys -- (aswSP)
  89. DRV:[b]64bit:[/b] - [2014-08-01 12:22:41 | 001,041,168 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
  90. DRV:[b]64bit:[/b] - [2014-08-01 12:22:41 | 000,224,896 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
  91. DRV:[b]64bit:[/b] - [2014-08-01 12:22:41 | 000,093,568 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
  92. DRV:[b]64bit:[/b] - [2014-08-01 12:22:41 | 000,092,008 | ---- | M] (AVAST Software) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswStm.sys -- (aswStm)
  93. DRV:[b]64bit:[/b] - [2014-08-01 12:22:41 | 000,079,184 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
  94. DRV:[b]64bit:[/b] - [2014-08-01 12:22:41 | 000,065,776 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
  95. DRV:[b]64bit:[/b] - [2014-08-01 12:22:41 | 000,029,208 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswHwid.sys -- (aswHwid)
  96. DRV:[b]64bit:[/b] - [2014-07-17 18:05:06 | 000,125,584 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
  97. DRV:[b]64bit:[/b] - [2014-05-20 04:44:03 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
  98. DRV:[b]64bit:[/b] - [2014-05-12 07:26:10 | 000,063,704 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebAccessControl)
  99. DRV:[b]64bit:[/b] - [2014-05-12 07:25:56 | 000,025,816 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
  100. DRV:[b]64bit:[/b] - [2014-04-30 20:28:22 | 000,018,776 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys -- (NvStreamKms)
  101. DRV:[b]64bit:[/b] - [2014-03-31 18:42:44 | 000,040,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
  102. DRV:[b]64bit:[/b] - [2013-12-05 15:10:07 | 000,017,280 | ---- | M] (Scott) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\USBDrv_AMD64.sys -- (awUSB)
  103. DRV:[b]64bit:[/b] - [2013-04-10 12:09:24 | 000,849,992 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
  104. DRV:[b]64bit:[/b] - [2013-03-01 17:25:55 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
  105. DRV:[b]64bit:[/b] - [2012-05-31 20:06:14 | 000,032,400 | ---- | M] (NT Kernel Resources) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ndisrd.sys -- (ndisrd)
  106. DRV:[b]64bit:[/b] - [2012-05-12 13:31:00 | 000,121,416 | ---- | M] (MotioninJoy) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MijXfilt.sys -- (MotioninJoyXFilter)
  107. DRV:[b]64bit:[/b] - [2012-04-15 23:32:14 | 001,071,032 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\wcmvcam64.sys -- (WCMVCAM)
  108. DRV:[b]64bit:[/b] - [2012-03-01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
  109. DRV:[b]64bit:[/b] - [2011-12-07 20:42:28 | 000,074,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
  110. DRV:[b]64bit:[/b] - [2011-11-11 21:50:34 | 002,182,768 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)
  111. DRV:[b]64bit:[/b] - [2011-11-03 04:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
  112. DRV:[b]64bit:[/b] - [2011-09-22 10:49:56 | 000,056,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
  113. DRV:[b]64bit:[/b] - [2011-09-08 17:40:24 | 000,508,520 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rtlh64.sys -- (RTL8169)
  114. DRV:[b]64bit:[/b] - [2011-03-11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
  115. DRV:[b]64bit:[/b] - [2011-03-11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
  116. DRV:[b]64bit:[/b] - [2010-07-01 19:11:24 | 000,012,352 | ---- | M] () [Kernel | "Start" not found. | Unknown] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
  117. DRV:[b]64bit:[/b] - [2009-09-15 13:59:30 | 000,042,088 | ---- | M] (NVIDIA Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvoclk64.sys -- (nvoclk64)
  118. DRV:[b]64bit:[/b] - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
  119. DRV:[b]64bit:[/b] - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
  120. DRV:[b]64bit:[/b] - [2009-07-14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
  121. DRV:[b]64bit:[/b] - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
  122. DRV:[b]64bit:[/b] - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
  123. DRV:[b]64bit:[/b] - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
  124. DRV:[b]64bit:[/b] - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
  125. DRV:[b]64bit:[/b] - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
  126. DRV:[b]64bit:[/b] - [2009-03-18 18:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
  127. DRV - [2013-07-04 13:50:16 | 000,070,984 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys -- (BstHdDrv)
  128. DRV - [2012-08-01 15:44:04 | 000,014,544 | ---- | M] (OpenLibSys.org) [File_System | On_Demand | Stopped] -- C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys -- (WinRing0_1_2_0)
  129. DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
  130.  
  131.  
  132. [color=#E56717]========== Standard Registry (SafeList) ==========[/color]
  133.  
  134.  
  135. [color=#E56717]========== Internet Explorer ==========[/color]
  136.  
  137. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
  138. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
  139. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
  140. IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
  141. IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  142. IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  143. IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
  144. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
  145. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
  146. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
  147. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
  148. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
  149. IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  150. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  151. IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
  152.  
  153. IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
  154. IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
  155. IE - HKCU\..\SearchScopes,DefaultScope =
  156. IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
  157. IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SAVJ_plPL525
  158. IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  159.  
  160. [color=#E56717]========== FireFox ==========[/color]
  161.  
  162. FF - prefs.js..browser.search.useDBForOrder: true
  163. FF - prefs.js..extensions.enabledAddons: YoutubeDownloader%40PeterOlayev.com:2.3.6
  164. FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:31.0
  165. FF - user.js - File not found
  166.  
  167. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll File not found
  168. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.5.1: C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll (EA Digital Illusions CE AB)
  169. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.67.2: C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
  170. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.67.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
  171. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  172. FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
  173. FF - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.5.1: C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll (EA Digital Illusions CE AB)
  174. FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
  175. FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  176. FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
  177. FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
  178. FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
  179. FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  180. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
  181. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
  182. FF - HKCU\Software\MozillaPlugins\@onlive.com/OnLiveGameClientDetector,version=1.0.0: C:\Program Files (x86)\OnLive\Plugin\npolgdet.dll (OnLive)
  183. FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
  184. FF - HKCU\Software\MozillaPlugins\electronicarts.com/GameFacePlugin: C:\Users\admin\AppData\Roaming\Electronic Arts\Game Face\npGameFacePlugin.dll (Electronic Arts)
  185. FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  186.  
  187. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-08-01 12:22:43 | 000,000,000 | ---D | M]
  188. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 31.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
  189. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 31.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
  190. FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 31.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
  191. FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 31.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
  192.  
  193. [2013-08-23 19:47:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\admin\AppData\Roaming\mozilla\Extensions
  194. [2014-09-25 20:17:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\admin\AppData\Roaming\mozilla\Firefox\Profiles\7b64n4ve.default\extensions
  195. [2014-09-25 20:17:28 | 000,077,763 | ---- | M] () (No name found) -- C:\Users\admin\AppData\Roaming\mozilla\firefox\profiles\7b64n4ve.default\extensions\YoutubeDownloader@PeterOlayev.com.xpi
  196. [2014-07-28 10:28:42 | 000,967,685 | ---- | M] () (No name found) -- C:\Users\admin\AppData\Roaming\mozilla\firefox\profiles\7b64n4ve.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
  197. [2014-09-09 17:17:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
  198. [2014-09-09 17:17:36 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
  199.  
  200. [color=#E56717]========== Chrome ==========[/color]
  201.  
  202. CHR - default_search_provider: (Enabled)
  203. CHR - default_search_provider: search_url =
  204. CHR - default_search_provider: suggest_url =
  205. CHR - plugin: Shockwave Flash (Enabled) = C:\Users\admin\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.202\pepflashplayer.dll
  206. CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
  207. CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\ppGoogleNaClPluginChrome.dll
  208. CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\pdf.dll
  209. CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
  210. CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
  211. CHR - plugin: Java(TM) Platform SE 7 U13 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
  212. CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll
  213. CHR - plugin: OnLive Game Client Detector (Enabled) = C:\Program Files (x86)\OnLive\Plugin\npolgdet.dll
  214. CHR - plugin: Unity Player (Enabled) = C:\Users\admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
  215. CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll
  216. CHR - plugin: Java Deployment Toolkit 7.0.130.20 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
  217. CHR - Extension: No name found = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\3.0.0.18_0\
  218. CHR - Extension: No name found = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.8.6_0\
  219. CHR - Extension: No name found = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.10.3_0\
  220. CHR - Extension: No name found = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\10.0.2204.148_0\
  221. CHR - Extension: No name found = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpobadmlgbdpiiegjfaoimffjngaminj\15.0.1_0\
  222. CHR - Extension: No name found = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmolgbmkhjnoekekdogckilbbedhdnoh\1.0.206_0\
  223. CHR - Extension: No name found = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\komhbcfkdcgmcdoenjcjheifdiabikfi\3.0_0\
  224. CHR - Extension: No name found = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
  225. CHR - Extension: No name found = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpppefjehmjbiplimkfjeamnohldmko\1.8.7_0\
  226. CHR - Extension: No name found = C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgbdhkpacgdhfabeceekiafonfkipohm\1.0_0\
  227.  
  228. O1 HOSTS File: ([2014-10-04 11:59:08 | 000,000,000 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
  229. O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
  230. O2:[b]64bit:[/b] - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
  231. O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
  232. O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
  233. O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
  234. O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No CLSID value found.
  235. O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
  236. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
  237. O4:[b]64bit:[/b] - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
  238. O4:[b]64bit:[/b] - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
  239. O4:[b]64bit:[/b] - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
  240. O4 - HKLM..\Run: [] File not found
  241. O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
  242. O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
  243. O4 - HKCU..\Run: [korogashi] wscript.exe //B "korogashi.vbe" File not found
  244. O4 - HKLM..\RunOnce: [] File not found
  245. O4 - Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\korogashi.vbe ()
  246. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  247. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
  248. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
  249. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0
  250. O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
  251. O13[b]64bit:[/b] - gopher Prefix: missing
  252. O13 - gopher Prefix: missing
  253. O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
  254. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C1073027-3E0D-47CD-8EA5-0144ACAFCEC6}: DhcpNameServer = 192.168.1.1
  255. O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
  256. O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
  257. O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
  258. O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
  259. O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  260. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  261. O32 - HKLM CDRom: AutoRun - 1
  262. O32 - AutoRun File - [2014-10-04 11:59:08 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
  263. O32 - AutoRun File - [2014-10-22 15:35:54 | 000,021,833 | ---- | M] () - C:\autoupdate.log -- [ NTFS ]
  264. O33 - MountPoints2\{5c01da56-8272-11e2-a7fc-10bf487bca68}\Shell - "" = AutoRun
  265. O33 - MountPoints2\{5c01da56-8272-11e2-a7fc-10bf487bca68}\Shell\AutoRun\command - "" = G:\setup.exe
  266. O33 - MountPoints2\{777814fa-0bd6-11e3-80c6-10bf487bca68}\Shell - "" = AutoRun
  267. O33 - MountPoints2\{777814fa-0bd6-11e3-80c6-10bf487bca68}\Shell\AutoRun\command - "" = G:\AutoRun.exe
  268. O33 - MountPoints2\{77781508-0bd6-11e3-80c6-10bf487bca68}\Shell - "" = AutoRun
  269. O33 - MountPoints2\{77781508-0bd6-11e3-80c6-10bf487bca68}\Shell\AutoRun\command - "" = G:\AutoRun.exe
  270. O33 - MountPoints2\{77781518-0bd6-11e3-80c6-10bf487bca68}\Shell - "" = AutoRun
  271. O33 - MountPoints2\{77781518-0bd6-11e3-80c6-10bf487bca68}\Shell\AutoRun\command - "" = G:\AutoRun.exe
  272. O33 - MountPoints2\H\Shell - "" = AutoRun
  273. O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\launch.exe
  274. O34 - HKLM BootExecute: (autocheck autochk *)
  275. O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
  276. O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
  277. O35 - HKLM\..comfile [open] -- "%1" %*
  278. O35 - HKLM\..exefile [open] -- "%1" %*
  279. O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
  280. O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
  281. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  282. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  283. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  284. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  285. O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
  286.  
  287. [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
  288.  
  289. [2014-10-22 16:39:38 | 000,098,304 | ---- | C] (Hewlett-Packard Company) -- C:\Users\admin\Desktop\HP_USB_Disk_Storage_Format_Tool_2.2.3_[www.programosy.pl].exe
  290. [2014-10-22 16:32:43 | 000,098,304 | ---- | C] (Hewlett-Packard Company) -- C:\Users\admin\Desktop\HP_USB_Disk_Storage_Format_Tool_2.2.3(dobreprogramy.pl).exe
  291. [2014-10-22 16:23:56 | 000,000,000 | ---D | C] -- C:\UsbFix
  292. [2014-10-22 14:54:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
  293. [2014-10-22 14:53:55 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro
  294. [2014-10-22 14:53:37 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
  295. [2014-10-22 13:54:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client
  296. [2014-10-22 13:54:01 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
  297. [2014-10-22 13:51:52 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Local\GHISLER
  298. [2014-10-20 20:17:15 | 000,000,000 | ---D | C] -- C:\Users\admin\VirtualBox VMs
  299. [2014-10-20 20:01:46 | 000,000,000 | ---D | C] -- C:\Users\admin\.VirtualBox
  300. [2014-10-20 20:00:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
  301. [2014-10-20 19:59:35 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
  302. [2014-10-20 13:51:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi
  303. [2014-10-14 13:08:04 | 000,000,000 | ---D | C] -- C:\Users\admin\Desktop\Nowy folder
  304. [2014-10-14 11:48:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PRO-EVO Editing Studio 2014
  305. [2014-10-12 20:27:19 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\Windows\SysWow64\sqlite3.dll
  306. [2014-10-12 19:31:45 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
  307. [2014-10-12 19:31:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
  308. [2014-10-12 19:31:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Kaspersky Lab
  309. [2014-10-12 19:27:35 | 000,374,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
  310. [2014-10-11 19:32:11 | 000,000,000 | ---D | C] -- C:\Users\admin\Documents\NFS ProStreet
  311. [2014-10-11 19:27:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts
  312. [2014-10-11 15:05:58 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Local\ESN
  313. [2014-10-11 15:05:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battlelog Web Plugins
  314. [2014-10-11 15:04:23 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs
  315. [2014-10-11 14:50:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 3
  316. [2014-10-11 13:27:46 | 000,142,528 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys
  317. [2014-10-11 13:26:24 | 000,205,352 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\VBoxNetFltNobj.dll
  318. [2014-10-10 15:53:51 | 000,319,912 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
  319. [2014-10-10 15:53:45 | 000,189,352 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
  320. [2014-10-10 15:53:45 | 000,189,352 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
  321. [2014-10-10 15:53:45 | 000,111,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
  322. [2014-10-10 15:53:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
  323. [2014-10-09 20:38:44 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\.minecraft
  324. [2014-10-06 14:13:17 | 000,122,584 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
  325. [2014-10-03 19:04:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
  326. [2014-10-03 19:04:36 | 000,091,352 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
  327. [2014-10-03 19:04:36 | 000,063,704 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys
  328. [2014-10-03 19:04:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware
  329. [2014-10-01 16:13:57 | 000,000,000 | ---D | C] -- C:\ztemp
  330. [2014-10-01 16:13:57 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\ztemp
  331. [2014-10-01 16:13:57 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\Imminent
  332. [2014-09-23 17:13:42 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
  333. [2014-09-23 15:22:21 | 000,000,000 | ---D | C] -- C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Robocraft
  334. [7 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
  335. [4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
  336. [3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
  337.  
  338. [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
  339.  
  340. [2014-10-22 17:07:00 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
  341. [2014-10-22 16:39:09 | 000,098,304 | ---- | M] (Hewlett-Packard Company) -- C:\Users\admin\Desktop\HP_USB_Disk_Storage_Format_Tool_2.2.3_[www.programosy.pl].exe
  342. [2014-10-22 16:38:00 | 000,001,046 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
  343. [2014-10-22 16:32:35 | 000,098,304 | ---- | M] (Hewlett-Packard Company) -- C:\Users\admin\Desktop\HP_USB_Disk_Storage_Format_Tool_2.2.3(dobreprogramy.pl).exe
  344. [2014-10-22 16:21:01 | 001,666,088 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
  345. [2014-10-22 16:21:01 | 000,738,970 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
  346. [2014-10-22 16:21:01 | 000,652,990 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
  347. [2014-10-22 16:21:01 | 000,155,080 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
  348. [2014-10-22 16:21:01 | 000,121,392 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
  349. [2014-10-22 15:40:46 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  350. [2014-10-22 15:40:45 | 000,010,240 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  351. [2014-10-22 15:32:33 | 004,916,120 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
  352. [2014-10-22 15:30:31 | 000,122,584 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
  353. [2014-10-22 15:29:09 | 000,001,042 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
  354. [2014-10-22 15:28:12 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
  355. [2014-10-22 15:27:48 | 000,032,512 | ---- | M] () -- C:\Windows\SysNative\drivers\hitmanpro37.sys
  356. [2014-10-22 15:27:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
  357. [2014-10-22 15:27:05 | 3207,323,648 | -HS- | M] () -- C:\hiberfil.sys
  358. [2014-10-22 15:08:31 | 000,009,448 | ---- | M] () -- C:\Windows\SysNative\.crusader
  359. [2014-10-22 14:54:52 | 000,001,895 | ---- | M] () -- C:\Users\Public\Desktop\HitmanPro.lnk
  360. [2014-10-22 14:13:04 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
  361. [2014-10-21 19:07:46 | 000,000,630 | ---- | M] () -- C:\Users\admin\Desktop\Games — skrót.lnk
  362. [2014-10-15 18:37:08 | 000,000,927 | ---- | M] () -- C:\Users\admin\Desktop\Roaming — skrót.lnk
  363. [2014-10-14 13:08:02 | 009,432,021 | ---- | M] () -- C:\Users\admin\Desktop\1 vs 1 - SkyIslands 1-os.rar
  364. [2014-10-12 13:17:13 | 000,066,872 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe
  365. [2014-10-12 13:17:06 | 000,103,736 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
  366. [2014-10-11 15:27:15 | 000,348,928 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
  367. [2014-10-11 13:27:46 | 000,142,528 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys
  368. [2014-10-11 13:26:24 | 000,205,352 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\VBoxNetFltNobj.dll
  369. [2014-10-10 15:53:38 | 000,319,912 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
  370. [2014-10-10 15:53:38 | 000,189,352 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
  371. [2014-10-10 15:53:38 | 000,189,352 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
  372. [2014-10-10 15:53:38 | 000,111,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
  373. [2014-10-10 14:37:02 | 000,255,092 | ---- | M] () -- C:\Users\admin\Documents\cc_20141010_143647.reg
  374. [2014-10-09 16:39:12 | 000,365,964 | ---- | M] () -- C:\Users\admin\Desktop\WRZ_Faktura_indywidualna_172-691-3183-4378_14_10_F010_Z.pdf
  375. [2014-10-08 20:21:16 | 000,000,782 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
  376. [2014-10-06 14:12:59 | 000,001,062 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  377. [2014-10-04 11:59:08 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
  378. [2014-10-04 11:59:08 | 000,000,000 | ---- | M] () -- C:\autoexec.bat
  379. [2014-10-02 20:15:51 | 000,000,000 | -HS- | M] () -- C:\Users\admin\AppData\Local\LumaEmu
  380. [2014-09-30 16:14:06 | 000,047,954 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\korogashi.vbe
  381. [2014-09-25 14:07:45 | 000,701,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
  382. [2014-09-25 14:07:45 | 000,071,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
  383. [7 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
  384. [4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
  385. [3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
  386.  
  387. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  388.  
  389. [2014-10-22 15:27:48 | 000,032,512 | ---- | C] () -- C:\Windows\SysNative\drivers\hitmanpro37.sys
  390. [2014-10-22 15:27:08 | 004,916,120 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
  391. [2014-10-22 15:08:31 | 000,009,448 | ---- | C] () -- C:\Windows\SysNative\.crusader
  392. [2014-10-22 14:54:52 | 000,001,895 | ---- | C] () -- C:\Users\Public\Desktop\HitmanPro.lnk
  393. [2014-10-22 13:54:16 | 000,002,077 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
  394. [2014-10-21 19:07:46 | 000,000,630 | ---- | C] () -- C:\Users\admin\Desktop\Games — skrót.lnk
  395. [2014-10-15 18:37:08 | 000,000,927 | ---- | C] () -- C:\Users\admin\Desktop\Roaming — skrót.lnk
  396. [2014-10-14 13:08:38 | 009,432,021 | ---- | C] () -- C:\Users\admin\Desktop\1 vs 1 - SkyIslands 1-os.rar
  397. [2014-10-12 19:28:29 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif
  398. [2014-10-10 14:36:50 | 000,255,092 | ---- | C] () -- C:\Users\admin\Documents\cc_20141010_143647.reg
  399. [2014-10-09 16:39:15 | 000,365,964 | ---- | C] () -- C:\Users\admin\Desktop\WRZ_Faktura_indywidualna_172-691-3183-4378_14_10_F010_Z.pdf
  400. [2014-10-08 20:21:16 | 000,000,782 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
  401. [2014-10-05 21:07:59 | 000,001,062 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  402. [2014-10-04 11:59:08 | 000,000,000 | ---- | C] () -- C:\autoexec.bat
  403. [2014-10-02 20:15:51 | 000,000,000 | -HS- | C] () -- C:\Users\admin\AppData\Local\LumaEmu
  404. [2014-10-01 13:07:09 | 000,047,954 | ---- | C] () -- C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\korogashi.vbe
  405. [2014-07-02 20:24:34 | 000,000,858 | ---- | C] () -- C:\Users\admin\AppData\Local\recently-used.xbel
  406. [2014-06-19 09:48:51 | 000,000,024 | ---- | C] () -- C:\Users\admin\AppData\Roaming\temp.ini
  407. [2014-01-15 21:56:16 | 000,025,157 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
  408. [2014-01-14 22:56:30 | 000,014,464 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsUpIO.sys
  409. [2013-12-17 16:16:12 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
  410. [2013-10-19 16:26:49 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
  411. [2013-10-19 16:26:44 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
  412. [2013-07-24 21:10:07 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
  413. [2013-07-23 14:36:18 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
  414. [2013-07-23 14:36:17 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
  415. [2013-07-23 14:36:17 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
  416. [2013-07-23 14:36:17 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
  417. [2013-07-03 19:25:39 | 000,003,584 | ---- | C] () -- C:\Users\admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  418. [2013-05-02 17:05:46 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
  419. [2013-02-20 14:17:56 | 001,637,078 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
  420. [2013-02-17 21:47:57 | 000,007,613 | ---- | C] () -- C:\Users\admin\AppData\Local\resmon.resmoncfg
  421.  
  422. [color=#E56717]========== ZeroAccess Check ==========[/color]
  423.  
  424. [2009-07-14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
  425.  
  426. [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  427.  
  428. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  429.  
  430. [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
  431.  
  432. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  433.  
  434. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  435. "" = C:\Windows\SysNative\shell32.dll -- [2012-06-09 07:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation)
  436. "ThreadingModel" = Apartment
  437.  
  438. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  439. "" = %SystemRoot%\system32\shell32.dll -- [2012-06-09 06:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
  440. "ThreadingModel" = Apartment
  441.  
  442. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
  443. "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
  444. "ThreadingModel" = Free
  445.  
  446. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  447. "" = %systemroot%\system32\wbem\fastprox.dll -- [2009-07-14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
  448. "ThreadingModel" = Free
  449.  
  450. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
  451. "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
  452. "ThreadingModel" = Both
  453.  
  454. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  455.  
  456. [color=#E56717]========== Alternate Data Streams ==========[/color]
  457.  
  458. @Alternate Data Stream - 160 bytes -> C:\ProgramData\MTA San Andreas All:NT2
  459. @Alternate Data Stream - 160 bytes -> C:\ProgramData:NT2
  460. @Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:6CC69D3C
  461. @Alternate Data Stream - 1014 bytes -> C:\Users\admin\AppData\Local\Temp:qCazaNQ17JeeHT5TuFka8WRr1PwTA
  462.  
  463. < End of report >
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!