Untitled

OTL logfile created on: 2016-06-07 09:30:13 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Zakon\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

3,97 Gb Total Physical Memory | 2,13 Gb Available Physical Memory | 53,70% Memory free
7,93 Gb Paging File | 5,84 Gb Available in Paging File | 73,65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 107,03 Gb Total Space | 22,78 Gb Free Space | 21,28% Space Free | Partition Type: NTFS
Drive E: | 931,51 Gb Total Space | 450,73 Gb Free Space | 48,39% Space Free | Partition Type: NTFS

Computer Name: ZAKON-KOMPUTER | User Name: Zakon | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2016-06-07 09:29:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Zakon\Downloads\OTL.exe
PRC - [2016-06-05 23:09:56 | 000,716,890 | -H-- | M] () -- C:\Program Files (x86)\badu\qq.exe
PRC - [2016-06-01 08:51:06 | 000,941,720 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2016-05-24 09:31:13 | 010,273,256 | ---- | M] (Blizzard Entertainment) -- C:\Program Files (x86)\Battle.net\Battle.net.7348\Battle.net.exe
PRC - [2016-05-24 09:31:09 | 001,334,760 | ---- | M] () -- C:\Program Files (x86)\Battle.net\Battle.net.7348\Battle.net Helper.exe
PRC - [2016-05-19 09:01:52 | 004,403,688 | ---- | M] (Blizzard Entertainment) -- C:\ProgramData\Battle.net\Agent\Agent.4949\Agent.exe
PRC - [2016-04-23 13:32:42 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2015-08-07 06:22:17 | 000,410,744 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2015-07-24 06:22:16 | 002,634,896 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
PRC - [2015-07-24 06:22:13 | 001,871,504 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
PRC - [2015-05-21 08:02:42 | 000,743,688 | ---- | M] (DEVGURU Co., LTD.) -- C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
PRC - [2014-08-20 09:27:43 | 000,242,256 | ---- | M] () -- C:\ProgramData\MobileBrServ\mbbService.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2016-06-05 23:09:56 | 000,716,890 | -H-- | M] () -- C:\Program Files (x86)\badu\qq.exe
MOD - [2016-06-01 08:50:42 | 001,745,560 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.79\libglesv2.dll
MOD - [2016-06-01 08:50:36 | 000,091,288 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\51.0.2704.79\libegl.dll
MOD - [2016-05-24 09:31:38 | 000,293,040 | ---- | M] () -- C:\Program Files (x86)\Battle.net\Battle.net.7348\ortp.dll
MOD - [2016-05-24 09:31:34 | 000,984,576 | ---- | M] () -- C:\Program Files (x86)\Battle.net\Battle.net.7348\ffmpegsumo.dll
MOD - [2016-05-24 09:31:34 | 000,133,632 | ---- | M] () -- C:\Program Files (x86)\Battle.net\Battle.net.7348\libEGL.dll
MOD - [2016-05-24 09:31:26 | 003,384,832 | ---- | M] () -- C:\Program Files (x86)\Battle.net\Battle.net.7348\libGLESv2.dll
MOD - [2016-05-24 09:31:22 | 037,241,856 | ---- | M] () -- C:\Program Files (x86)\Battle.net\Battle.net.7348\libcef.dll
MOD - [2016-05-24 09:31:09 | 001,334,760 | ---- | M] () -- C:\Program Files (x86)\Battle.net\Battle.net.7348\Battle.net Helper.exe
MOD - [2015-07-24 06:22:16 | 000,011,920 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV:[b]64bit:[/b] - [2015-11-29 07:53:16 | 001,369,856 | ---- | M] (Flexera Software LLC) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe -- (FlexNet Licensing Service 64)
SRV:[b]64bit:[/b] - [2015-07-24 06:22:13 | 001,155,216 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe -- (GfExperienceService)
SRV:[b]64bit:[/b] - [2015-07-24 06:22:11 | 005,544,592 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe -- (NvStreamSvc)
SRV:[b]64bit:[/b] - [2015-05-21 08:02:42 | 000,743,688 | ---- | M] (DEVGURU Co., LTD.) [Auto | Running] -- C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe -- (ss_conn_service)
SRV:[b]64bit:[/b] - [2009-07-14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2009-07-14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2016-05-12 19:58:15 | 000,269,504 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2016-04-23 13:32:42 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2016-03-23 19:08:24 | 000,327,808 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2015-11-18 15:29:48 | 001,369,432 | ---- | M] (Disc Soft Ltd) [On_Demand | Stopped] -- E:\DAEMON Tools Lite\DiscSoftBusService.exe -- (Disc Soft Lite Bus Service)
SRV - [2015-08-07 06:22:17 | 000,410,744 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2015-07-24 06:22:13 | 001,871,504 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)
SRV - [2015-06-04 23:12:14 | 000,837,312 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2014-08-20 09:27:43 | 000,242,256 | ---- | M] () [Auto | Running] -- C:\ProgramData\MobileBrServ\mbbService.exe -- (Mobile Broadband HL Service)
SRV - [2012-07-09 01:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009-06-10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:[b]64bit:[/b] - [2016-04-25 00:35:58 | 000,221,824 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:[b]64bit:[/b] - [2016-04-25 00:35:52 | 000,129,152 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:[b]64bit:[/b] - [2015-11-22 19:48:05 | 000,047,160 | ---- | M] (Disc Soft Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dtliteusbbus.sys -- (dtliteusbbus)
DRV:[b]64bit:[/b] - [2015-11-22 19:47:43 | 000,030,264 | ---- | M] (Disc Soft Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dtlitescsibus.sys -- (dtlitescsibus)
DRV:[b]64bit:[/b] - [2015-08-07 13:06:30 | 000,204,648 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:[b]64bit:[/b] - [2015-07-24 06:22:11 | 000,019,600 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys -- (NvStreamKms)
DRV:[b]64bit:[/b] - [2015-07-03 06:28:26 | 000,047,976 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
DRV:[b]64bit:[/b] - [2014-09-17 11:47:48 | 000,010,752 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vmulti.sys -- (vmulti)
DRV:[b]64bit:[/b] - [2014-09-15 09:11:42 | 000,023,968 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SaiMini.sys -- (SaiMini)
DRV:[b]64bit:[/b] - [2014-09-15 09:11:40 | 000,051,488 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SaiBus.sys -- (SaiNtBus)
DRV:[b]64bit:[/b] - [2014-09-15 09:11:38 | 000,179,904 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\_hid_0738_1704.sys -- (_hid_0738_1704)
DRV:[b]64bit:[/b] - [2014-09-15 09:11:38 | 000,046,528 | ---- | M] (Saitek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\_usb_0738_1704.sys -- (_usb_0738_1704)
DRV:[b]64bit:[/b] - [2012-09-13 05:10:04 | 000,879,760 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:[b]64bit:[/b] - [2011-11-03 04:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:[b]64bit:[/b] - [2010-11-20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2010-11-20 15:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2010-11-20 15:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2010-11-20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2010-11-20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:[b]64bit:[/b] - [2010-10-19 23:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:[b]64bit:[/b] - [2010-07-01 19:11:24 | 000,012,352 | ---- | M] () [Kernel | "Start" not found. | Unknown] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV:[b]64bit:[/b] - [2010-06-14 09:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:[b]64bit:[/b] - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009-07-14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009-07-14 02:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2010-06-14 09:32:54 | 000,016,448 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=187
IE - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pl-pl/?ocid=iehp
IE - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = pl
IE - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 76 CE E2 A1 B7 D6 D0 01  [binary data]
IE - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\..\SearchScopes\{342DF12F-7A5B-4501-86F5-074B390D17F6}: "URL" = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=435371&p={searchTerms}
IE - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>


[color=#E56717]========== FireFox ==========[/color]

FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll File not found


O1 HOSTS File: ([2016-06-05 18:40:47 | 000,001,103 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       down.baidu2016.com
O1 - Hosts: 127.0.0.1       123.sogou.com
O1 - Hosts: 127.0.0.1       www.czzsyzgm.com
O1 - Hosts: 127.0.0.1       www.czzsyzxl.com
O1 - Hosts: 127.0.0.1       union.baidu2019.com
O1 - Hosts: 127.0.0.1 genuine.microsoft.com
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O1 - Hosts: 127.0.0.1 sls.microsoft.com
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office12\GR469A~1.DLL (Microsoft Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [cpuminer] C:\Users\Zakon\AppData\Roaming\cpuminer\cpm.exe ()
O4:[b]64bit:[/b] - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [R.A.T.TE] C:\Program Files\Mad Catz\R.A.T.TE\RAT_TE_Profiler.exe (Mad Catz Inc)
O4:[b]64bit:[/b] - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [TabletDriver] C:\Program Files\TabletDriver\TabletDriver.exe (Graphic Tablet Company Shenzhen)
O4 - HKLM..\Run: [apphide] C:\Program Files (x86)\badu\qq.exe ()
O4 - HKLM..\Run: [gmsd_pl_006010060]  File not found
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-933766652-1149224944-1223024121-1000..\Run: [AdobeBridge]  File not found
O4 - HKU\S-1-5-21-933766652-1149224944-1223024121-1000..\Run: [CCleaner Monitoring] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-933766652-1149224944-1223024121-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer:  =
O8:[b]64bit:[/b] - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{871D508A-BB56-44EE-B848-D4639B28EF32}: DhcpNameServer = 192.168.8.1 192.168.8.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B227F17-DAE6-409D-9A01-49FD4EEF3D00}: DhcpNameServer = 192.168.8.1 192.168.8.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C2962AB5-78DC-412C-96C8-F95B14CD03C8}: DhcpNameServer = 192.168.8.1 192.168.8.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F11F4FCD-32EB-4F3D-BE17-BBA8C8661E51}: DhcpNameServer = 192.168.0.1
O18:[b]64bit:[/b] - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~2\Office12\GRA32A~1.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:[b]64bit:[/b] - HKLM ShellExecuteHooks: {98C066AB-D735-4339-9E52-A34875141B56} - C:\Users\Zakon\AppData\Roaming\Microsoft\Windows\Cookies\plumach.dll ()
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~2\Office12\GR469A~1.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2015-11-26 21:07:33 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2016-06-05 18:57:46 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{ba8bf217-907f-11e5-829d-0c5b8f279a64}\Shell - "" = AutoRun
O33 - MountPoints2\{ba8bf217-907f-11e5-829d-0c5b8f279a64}\Shell\AutoRun\command - "" = G:\setup.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\autoplay.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2016-06-06 23:16:18 | 000,000,000 | ---D | C] -- C:\Users\Zakon\Desktop\Santa Zombies
[2016-06-06 23:12:32 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Roaming\Construct2
[2016-06-06 23:11:18 | 000,000,000 | ---D | C] -- C:\Program Files\Construct 2
[2016-06-05 22:37:59 | 000,000,000 | ---D | C] -- C:\Users\Zakon\Desktop\3D
[2016-06-05 20:17:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tibia
[2016-06-05 20:17:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tibia
[2016-06-05 19:33:02 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2016-06-05 18:57:28 | 000,000,000 | ---D | C] -- C:\Users\Zakon\Start Menu
[2016-06-05 18:40:47 | 000,410,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\systemcpl.dll
[2016-06-05 18:40:47 | 000,001,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sppcomapi.dll
[2016-06-05 18:35:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\badu
[2016-06-05 18:35:23 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Roaming\gplyra
[2016-06-05 18:35:22 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Roaming\cpuminer
[2016-06-05 18:34:00 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Local\3810282D-6C19-47B0-8283-5C6C29A7E108
[2016-06-05 18:33:59 | 000,000,000 | ---D | C] -- C:\extensions
[2016-06-05 18:33:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sudient
[2016-06-05 18:33:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pwaied
[2016-06-05 18:33:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mujoge
[2016-06-05 18:23:58 | 000,000,000 | ---D | C] -- C:\Users\Zakon\Documents\Unreal Projects
[2016-06-05 18:22:55 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Roaming\Unreal Engine
[2016-06-05 18:22:33 | 000,984,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ucrtbase.dll
[2016-06-05 18:22:33 | 000,901,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ucrtbase.dll
[2016-06-05 18:22:33 | 000,066,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-private-l1-1-0.dll
[2016-06-05 18:22:33 | 000,063,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-private-l1-1-0.dll
[2016-06-05 18:22:33 | 000,022,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-math-l1-1-0.dll
[2016-06-05 18:22:33 | 000,020,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-math-l1-1-0.dll
[2016-06-05 18:22:33 | 000,019,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-multibyte-l1-1-0.dll
[2016-06-05 18:22:33 | 000,019,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-multibyte-l1-1-0.dll
[2016-06-05 18:22:33 | 000,017,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-string-l1-1-0.dll
[2016-06-05 18:22:33 | 000,017,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-string-l1-1-0.dll
[2016-06-05 18:22:33 | 000,017,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-stdio-l1-1-0.dll
[2016-06-05 18:22:33 | 000,017,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-stdio-l1-1-0.dll
[2016-06-05 18:22:33 | 000,016,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-runtime-l1-1-0.dll
[2016-06-05 18:22:33 | 000,016,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-runtime-l1-1-0.dll
[2016-06-05 18:22:33 | 000,015,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-convert-l1-1-0.dll
[2016-06-05 18:22:33 | 000,015,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-convert-l1-1-0.dll
[2016-06-05 18:22:33 | 000,014,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-time-l1-1-0.dll
[2016-06-05 18:22:33 | 000,014,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-time-l1-1-0.dll
[2016-06-05 18:22:33 | 000,014,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-2-0.dll
[2016-06-05 18:22:33 | 000,014,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-2-0.dll
[2016-06-05 18:22:33 | 000,013,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-filesystem-l1-1-0.dll
[2016-06-05 18:22:33 | 000,013,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-filesystem-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-process-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-process-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-heap-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-heap-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-conio-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-conio-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-utility-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-utility-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-locale-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-locale-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-crt-environment-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-crt-environment-l1-1-0.dll
[2016-06-05 18:22:33 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-2-0.dll
[2016-06-05 18:22:33 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-2-0.dll
[2016-06-05 18:22:33 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-1.dll
[2016-06-05 18:22:33 | 000,012,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-1.dll
[2016-06-05 18:22:33 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-eventing-provider-l1-1-0.dll
[2016-06-05 18:22:33 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-eventing-provider-l1-1-0.dll
[2016-06-05 18:22:33 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l2-1-0.dll
[2016-06-05 18:22:33 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l2-1-0.dll
[2016-06-05 18:22:33 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-timezone-l1-1-0.dll
[2016-06-05 18:22:33 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-timezone-l1-1-0.dll
[2016-06-05 18:22:33 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l2-1-0.dll
[2016-06-05 18:22:33 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l2-1-0.dll
[2016-06-05 18:22:33 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-2-0.dll
[2016-06-05 18:22:33 | 000,011,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-2-0.dll
[2016-05-30 00:25:44 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Local\UnrealEngineLauncher
[2016-05-30 00:24:30 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Local\UnrealEngine
[2016-05-30 00:24:30 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Local\EpicGamesLauncher
[2016-05-30 00:24:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Epic
[2016-05-22 13:55:18 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Local\Adobe
[2016-05-22 13:55:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2016-05-22 13:55:11 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Roaming\Adobe
[2016-05-16 14:46:25 | 000,000,000 | ---D | C] -- C:\Users\Zakon\Documents\Mount&Blade Warband Savegames
[2016-05-16 14:44:54 | 000,000,000 | ---D | C] -- C:\Users\Zakon\Documents\Mount&Blade Warband
[2016-05-16 14:44:54 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Roaming\Mount&Blade Warband
[2016-05-09 21:45:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2016-05-09 21:45:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Works
[2016-05-09 21:45:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio
[2016-05-09 21:45:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2016-05-09 21:45:18 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2016-05-09 21:43:56 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2016-05-09 21:43:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8
[2016-05-09 21:43:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2016-05-09 21:43:36 | 000,000,000 | ---D | C] -- C:\Users\Zakon\AppData\Local\Microsoft Help
[2016-05-09 21:43:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2016-05-09 21:43:24 | 000,000,000 | RH-D | C] -- C:\MSOCache

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2016-06-07 09:29:17 | 001,666,088 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2016-06-07 09:29:17 | 000,738,970 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
[2016-06-07 09:29:17 | 000,652,990 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2016-06-07 09:29:17 | 000,155,080 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
[2016-06-07 09:29:17 | 000,121,392 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2016-06-07 09:23:32 | 000,001,044 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2016-06-07 09:23:21 | 005,037,448 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2016-06-07 09:23:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2016-06-07 09:23:09 | 3193,090,048 | -HS- | M] () -- C:\hiberfil.sys
[2016-06-07 02:35:42 | 000,009,904 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2016-06-07 02:35:42 | 000,009,904 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2016-06-07 02:29:42 | 000,000,132 | ---- | M] () -- C:\Users\Zakon\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2016-06-07 02:16:00 | 000,001,048 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2016-06-07 01:58:00 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2016-06-06 23:11:33 | 000,000,843 | ---- | M] () -- C:\Users\Public\Desktop\Construct 2.lnk
[2016-06-06 12:27:05 | 002,467,352 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 06-06-16 12.27.05.png
[2016-06-06 12:26:11 | 002,353,532 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 06-06-16 12.26.11.png
[2016-06-06 12:24:06 | 002,355,433 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 06-06-16 12.24.06.png
[2016-06-05 20:17:09 | 000,000,963 | ---- | M] () -- C:\Users\Public\Desktop\Tibia.lnk
[2016-06-05 18:57:46 | 000,000,000 | ---- | M] () -- C:\autoexec.bat
[2016-06-05 18:40:51 | 000,002,048 | ---- | M] () -- C:\Windows\SysWow64\winver.exe
[2016-06-05 18:40:49 | 000,410,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\systemcpl.dll
[2016-06-05 18:40:48 | 000,001,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\sppcomapi.dll
[2016-06-05 18:40:47 | 000,113,543 | ---- | M] () -- C:\Windows\SysWow64\slmgr.vbs
[2016-06-02 20:37:42 | 001,461,993 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 06-02-16 20.37.41.png
[2016-05-30 11:45:37 | 002,396,104 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-30-16 11.45.36.png
[2016-05-30 00:26:23 | 000,001,262 | ---- | M] () -- C:\Users\Public\Desktop\Epic Games Launcher.lnk
[2016-05-29 12:23:07 | 002,433,652 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-29-16 12.23.07.png
[2016-05-29 12:21:56 | 002,387,588 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-29-16 12.21.56.png
[2016-05-29 12:21:47 | 002,381,946 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-29-16 12.21.47.png
[2016-05-29 12:20:40 | 002,378,380 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-29-16 12.20.40.png
[2016-05-28 22:18:34 | 002,007,183 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-28-16 22.18.33.png
[2016-05-28 22:18:18 | 001,968,030 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-28-16 22.18.18.png
[2016-05-28 22:05:40 | 001,709,681 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-28-16 22.05.40.png
[2016-05-28 21:23:15 | 002,377,167 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-28-16 21.23.15.png
[2016-05-28 19:28:19 | 002,166,166 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-28-16 19.28.18.png
[2016-05-27 20:32:55 | 001,035,357 | ---- | M] () -- C:\Users\Zakon\Desktop\sylwia.png
[2016-05-25 12:38:06 | 002,295,066 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-25-16 12.38.05.png
[2016-05-25 11:31:15 | 001,007,833 | ---- | M] () -- C:\Users\Zakon\Desktop\wallpaper-460111.jpg
[2016-05-17 20:47:42 | 000,109,346 | ---- | M] () -- C:\Users\Zakon\Desktop\13235761_1071255209610826_115889402_n.jpg
[2016-05-17 19:47:43 | 000,080,100 | ---- | M] () -- C:\Users\Zakon\Desktop\13227864_1071235469612800_1877903650_n.jpg
[2016-05-16 17:23:56 | 000,013,209 | ---- | M] () -- C:\Users\Zakon\Desktop\3f01477aca09d86b02b83b0f551b6af2.jpg
[2016-05-16 17:22:10 | 000,064,991 | ---- | M] () -- C:\Users\Zakon\Desktop\556e7edbf5ebaf899bed6f78fdeaf9fb.jpg
[2016-05-16 14:27:41 | 000,000,207 | ---- | M] () -- C:\Users\Zakon\Desktop\Mount & Blade Warband.url
[2016-05-14 11:01:39 | 002,246,230 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-14-16 11.01.39.png
[2016-05-14 11:01:34 | 002,256,609 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-14-16 11.01.33.png
[2016-05-12 19:58:15 | 000,797,376 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2016-05-12 19:58:15 | 000,142,528 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2016-05-12 19:32:45 | 002,363,534 | ---- | M] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-12-16 19.32.44.png

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2016-06-06 23:11:33 | 000,000,939 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Construct 2.lnk
[2016-06-06 23:11:33 | 000,000,843 | ---- | C] () -- C:\Users\Public\Desktop\Construct 2.lnk
[2016-06-06 12:27:05 | 002,467,352 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 06-06-16 12.27.05.png
[2016-06-06 12:26:11 | 002,353,532 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 06-06-16 12.26.11.png
[2016-06-06 12:24:06 | 002,355,433 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 06-06-16 12.24.06.png
[2016-06-05 20:17:09 | 000,000,963 | ---- | C] () -- C:\Users\Public\Desktop\Tibia.lnk
[2016-06-05 18:57:46 | 000,000,000 | ---- | C] () -- C:\autoexec.bat
[2016-06-05 18:40:47 | 000,113,543 | ---- | C] () -- C:\Windows\SysWow64\slmgr.vbs
[2016-06-05 18:40:47 | 000,002,048 | ---- | C] () -- C:\Windows\SysWow64\winver.exe
[2016-06-02 20:37:42 | 001,461,993 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 06-02-16 20.37.41.png
[2016-05-30 11:45:37 | 002,396,104 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-30-16 11.45.36.png
[2016-05-30 00:24:16 | 000,001,262 | ---- | C] () -- C:\Users\Public\Desktop\Epic Games Launcher.lnk
[2016-05-30 00:24:16 | 000,001,262 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk
[2016-05-29 12:23:07 | 002,433,652 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-29-16 12.23.07.png
[2016-05-29 12:21:56 | 002,387,588 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-29-16 12.21.56.png
[2016-05-29 12:21:47 | 002,381,946 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-29-16 12.21.47.png
[2016-05-29 12:20:40 | 002,378,380 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-29-16 12.20.40.png
[2016-05-28 22:18:34 | 002,007,183 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-28-16 22.18.33.png
[2016-05-28 22:18:18 | 001,968,030 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-28-16 22.18.18.png
[2016-05-28 22:05:40 | 001,709,681 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-28-16 22.05.40.png
[2016-05-28 21:23:15 | 002,377,167 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-28-16 21.23.15.png
[2016-05-28 19:28:19 | 002,166,166 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-28-16 19.28.18.png
[2016-05-27 20:32:53 | 001,035,357 | ---- | C] () -- C:\Users\Zakon\Desktop\sylwia.png
[2016-05-25 12:38:06 | 002,295,066 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-25-16 12.38.05.png
[2016-05-25 11:31:15 | 001,007,833 | ---- | C] () -- C:\Users\Zakon\Desktop\wallpaper-460111.jpg
[2016-05-17 20:47:42 | 000,109,346 | ---- | C] () -- C:\Users\Zakon\Desktop\13235761_1071255209610826_115889402_n.jpg
[2016-05-17 19:47:43 | 000,080,100 | ---- | C] () -- C:\Users\Zakon\Desktop\13227864_1071235469612800_1877903650_n.jpg
[2016-05-16 17:23:56 | 000,013,209 | ---- | C] () -- C:\Users\Zakon\Desktop\3f01477aca09d86b02b83b0f551b6af2.jpg
[2016-05-16 17:22:10 | 000,064,991 | ---- | C] () -- C:\Users\Zakon\Desktop\556e7edbf5ebaf899bed6f78fdeaf9fb.jpg
[2016-05-16 14:27:41 | 000,000,207 | ---- | C] () -- C:\Users\Zakon\Desktop\Mount & Blade Warband.url
[2016-05-14 11:01:39 | 002,246,230 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-14-16 11.01.39.png
[2016-05-14 11:01:34 | 002,256,609 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-14-16 11.01.33.png
[2016-05-12 19:32:45 | 002,363,534 | ---- | C] () -- C:\Users\Zakon\Desktop\Hearthstone Screenshot 05-12-16 19.32.44.png
[2016-04-08 00:49:09 | 000,000,034 | ---- | C] () -- C:\Users\Zakon\AppData\Roaming\AdobeWLCMCache.dat
[2016-01-09 19:35:41 | 000,000,132 | ---- | C] () -- C:\Users\Zakon\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2016-01-09 17:35:22 | 000,000,021 | ---- | C] () -- C:\Windows\SurCode.INI
[2015-11-29 07:53:17 | 000,000,133 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
[2015-11-29 07:44:43 | 000,007,604 | ---- | C] () -- C:\Users\Zakon\AppData\Local\resmon.resmoncfg
[2015-11-25 18:40:20 | 000,644,608 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2015-11-25 18:40:20 | 000,258,048 | ---- | C] () -- C:\Windows\SysWow64\libFLAC.dll
[2015-08-14 19:31:26 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2015-08-14 19:12:47 | 037,819,000 | ---- | C] () -- C:\Windows\SysWow64\nvcompiler.dll
[2015-08-14 18:45:28 | 001,637,758 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[color=#E56717]========== ZeroAccess Check ==========[/color]

[2009-07-14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2010-11-20 15:27:25 | 014,174,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010-11-20 14:21:19 | 012,872,192 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

[color=#E56717]========== LOP Check ==========[/color]

[2016-03-16 14:41:31 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\.mono
[2015-11-29 08:43:34 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\Autodesk
[2016-02-19 12:39:35 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\Battle.net
[2016-06-06 23:12:32 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\Construct2
[2016-06-05 18:35:27 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\cpuminer
[2016-01-09 20:48:29 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\DAEMON Tools Lite
[2016-02-21 11:10:14 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\DBP-F
[2016-04-23 13:42:28 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\e-Deklaracje
[2016-04-23 13:42:28 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1
[2015-11-08 22:53:18 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\GameRanger
[2016-06-05 18:35:26 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\gplyra
[2016-02-16 19:22:45 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\keit.co
[2016-03-10 08:01:28 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\LolClient
[2016-05-28 17:49:32 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\Mount&Blade Warband
[2015-12-20 18:37:37 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\NapiProjekt
[2016-06-05 23:00:33 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\OBS
[2016-01-09 17:35:22 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\PACE Anti-Piracy
[2016-01-09 17:27:17 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\PDAppFlex
[2016-03-09 20:55:58 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\Riot Games
[2016-01-09 20:58:46 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\Samsung
[2016-02-20 09:52:12 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\The Creative Assembly
[2016-06-05 20:17:18 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\Tibia
[2016-06-05 18:22:55 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\Unreal Engine
[2016-06-06 14:44:07 | 000,000,000 | ---D | M] -- C:\Users\Zakon\AppData\Roaming\uTorrent

[color=#E56717]========== Purity Check ==========[/color]


[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 242 bytes -> C:\ProgramData\TEMP:6BE50C2B
@Alternate Data Stream - 1251 bytes -> C:\ProgramData\Microsoft:M85aDV2RGo0AfRXmyN0mAnsm
@Alternate Data Stream - 1247 bytes -> C:\ProgramData\Microsoft:FRkV4F04GH0fyga0
@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:56E2E879
@Alternate Data Stream - 1170 bytes -> C:\Users\Zakon\AppData\Local\t5Za44SPXuU:u2oHFVRSt9MlOE5rtI
@Alternate Data Stream - 1022 bytes -> C:\Users\Zakon\AppData\Local\Temp:WCbV0OfzcRaIxNsncjyv

< End of report >