API tools faq
paste
Guest User

Untitled

a guest
Aug 8th, 2015
293
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 29.04 KB | None | 0 0
raw download clone embed print report
  1. OTL logfile created on: 2015-08-08 14:51:58 - Run 3
  2. OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\PC\Downloads
  3. 64bit- Home Premium Edition N Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
  4. Internet Explorer (Version = 8.0.7601.17514)
  5. Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
  6.  
  7. 4,00 Gb Total Physical Memory | 2,35 Gb Available Physical Memory | 58,83% Memory free
  8. 7,99 Gb Paging File | 5,22 Gb Available in Paging File | 65,36% Paging File free
  9. Paging file location(s): ?:\pagefile.sys [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
  12. Drive C: | 232,88 Gb Total Space | 12,12 Gb Free Space | 5,21% Space Free | Partition Type: NTFS
  13. Drive D: | 61,96 Gb Total Space | 9,76 Gb Free Space | 15,75% Space Free | Partition Type: NTFS
  14. Drive E: | 93,51 Gb Total Space | 18,67 Gb Free Space | 19,97% Space Free | Partition Type: NTFS
  15.  
  16. Computer Name: KOMPUTER | User Name: PC | Logged in as Administrator.
  17. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
  18. Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
  19.  
  20. [color=#E56717]========== Processes (SafeList) ==========[/color]
  21.  
  22. PRC - [2015-08-08 12:01:26 | 002,433,024 | ---- | M] (CipSoft GmbH) -- C:\Program Files (x86)\Tibia\Tibia.exe
  23. PRC - [2015-08-07 12:10:40 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\PC\Downloads\OTL.exe
  24. PRC - [2015-07-31 08:19:29 | 000,813,896 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  25. PRC - [2015-07-24 01:23:38 | 002,895,552 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exe
  26. PRC - [2015-07-24 01:23:38 | 001,861,312 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
  27. PRC - [2015-06-13 15:09:55 | 000,568,904 | ---- | M] () -- C:\Program Files (x86)\puush\puush.exe
  28. PRC - [2014-10-04 12:09:23 | 000,013,608 | ---- | M] () -- C:\Program Files\Common Files\System\svc\dllhost.exe
  29. PRC - [2010-05-20 15:26:30 | 000,762,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\vVX3000.exe
  30.  
  31.  
  32. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  33.  
  34. MOD - [2015-08-08 12:01:27 | 001,454,080 | ---- | M] () -- C:\Program Files (x86)\ElfBot NG\elfbot.dll
  35. MOD - [2015-07-31 08:19:28 | 016,308,040 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.130\PepperFlash\pepflashplayer.dll
  36. MOD - [2015-07-31 08:19:27 | 001,405,768 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.130\libglesv2.dll
  37. MOD - [2015-07-31 08:19:27 | 000,081,224 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.130\libegl.dll
  38. MOD - [2015-07-24 01:24:00 | 002,410,176 | ---- | M] () -- C:\Program Files (x86)\Steam\video.dll
  39. MOD - [2015-07-24 01:23:38 | 000,703,168 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.DLL
  40. MOD - [2015-07-07 22:41:46 | 000,169,984 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\openvr_api.dll
  41. MOD - [2015-07-03 18:12:46 | 004,962,816 | ---- | M] () -- C:\Program Files (x86)\Steam\v8.dll
  42. MOD - [2015-07-03 18:12:28 | 039,553,928 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dll
  43. MOD - [2015-07-03 18:12:28 | 001,556,992 | ---- | M] () -- C:\Program Files (x86)\Steam\icui18n.dll
  44. MOD - [2015-07-03 18:12:28 | 001,187,840 | ---- | M] () -- C:\Program Files (x86)\Steam\icuuc.dll
  45. MOD - [2015-07-03 18:12:24 | 000,778,240 | ---- | M] () -- C:\Program Files (x86)\Steam\SDL2.dll
  46. MOD - [2015-06-13 15:09:55 | 000,568,904 | ---- | M] () -- C:\Program Files (x86)\puush\puush.exe
  47. MOD - [2014-12-01 23:31:16 | 002,396,672 | ---- | M] () -- C:\Program Files (x86)\Steam\libavcodec-56.dll
  48. MOD - [2014-12-01 23:31:16 | 000,485,888 | ---- | M] () -- C:\Program Files (x86)\Steam\libswscale-3.dll
  49. MOD - [2014-12-01 23:31:16 | 000,479,744 | ---- | M] () -- C:\Program Files (x86)\Steam\libavformat-56.dll
  50. MOD - [2014-12-01 23:31:16 | 000,442,880 | ---- | M] () -- C:\Program Files (x86)\Steam\libavutil-54.dll
  51. MOD - [2014-12-01 23:31:16 | 000,332,800 | ---- | M] () -- C:\Program Files (x86)\Steam\libavresample-2.dll
  52. MOD - [2011-04-12 14:10:29 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_pl_b77a5c561934e089\mscorlib.resources.dll
  53. MOD - [2010-11-21 05:49:51 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5cae93d923c8378370758489e5535820\System.Runtime.Remoting.ni.dll
  54. MOD - [2010-11-21 05:49:27 | 012,432,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
  55. MOD - [2010-11-21 05:49:20 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
  56. MOD - [2010-11-21 05:49:03 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\System.Xml.ni.dll
  57. MOD - [2010-11-21 05:49:00 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\System.Configuration.ni.dll
  58. MOD - [2010-11-21 05:48:59 | 007,963,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
  59. MOD - [2010-11-21 05:48:52 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
  60. MOD - [2009-12-09 16:19:54 | 000,036,352 | ---- | M] () -- C:\Program Files (x86)\ElfBot NG\elfload.dll
  61.  
  62.  
  63. [color=#E56717]========== Services (SafeList) ==========[/color]
  64.  
  65. SRV:[b]64bit:[/b] - [2015-07-16 17:59:54 | 000,984,768 | ---- | M] (@ByELDI) [Disabled | Stopped] -- C:\Program Files\KMSpico\Service_KMS.exe -- (Service KMSELDI)
  66. SRV:[b]64bit:[/b] - [2014-10-04 12:09:23 | 000,013,608 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\System\svc\dllhost.exe -- (DHCPArbSvc)
  67. SRV:[b]64bit:[/b] - [2011-05-24 23:18:38 | 000,365,568 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
  68. SRV:[b]64bit:[/b] - [2011-05-24 23:03:38 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
  69. SRV:[b]64bit:[/b] - [2010-05-20 15:26:28 | 000,199,536 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)
  70. SRV:[b]64bit:[/b] - [2009-07-14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
  71. SRV - [2015-07-24 01:23:38 | 000,838,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
  72. SRV - [2015-06-03 16:42:38 | 000,327,296 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
  73. SRV - [2012-04-30 18:17:38 | 000,104,872 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
  74. SRV - [2009-06-10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
  75.  
  76.  
  77. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  78.  
  79. DRV:[b]64bit:[/b] - [2012-06-22 03:01:00 | 000,056,336 | ---- | M] (Corel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
  80. DRV:[b]64bit:[/b] - [2011-05-25 00:26:56 | 009,359,872 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
  81. DRV:[b]64bit:[/b] - [2011-05-24 22:25:42 | 000,309,760 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
  82. DRV:[b]64bit:[/b] - [2011-03-30 14:46:44 | 000,114,704 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
  83. DRV:[b]64bit:[/b] - [2010-11-21 05:25:00 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
  84. DRV:[b]64bit:[/b] - [2010-11-21 05:24:15 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
  85. DRV:[b]64bit:[/b] - [2010-11-21 05:24:15 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
  86. DRV:[b]64bit:[/b] - [2010-11-21 05:24:15 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
  87. DRV:[b]64bit:[/b] - [2010-11-21 05:24:14 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
  88. DRV:[b]64bit:[/b] - [2010-05-25 22:04:38 | 000,050,240 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mal2gf2a.sys -- (miditech2902_al2gf2_wdm)
  89. DRV:[b]64bit:[/b] - [2010-05-25 22:04:36 | 000,407,616 | ---- | M] (Ploytec GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mal2gf2u.sys -- (miditech2902_al2gf2_usb)
  90. DRV:[b]64bit:[/b] - [2010-05-24 14:07:58 | 000,253,728 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService)
  91. DRV:[b]64bit:[/b] - [2010-05-20 15:26:30 | 002,060,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VX3000.sys -- (VX3000)
  92. DRV:[b]64bit:[/b] - [2010-02-18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
  93. DRV:[b]64bit:[/b] - [2010-02-05 20:15:44 | 000,920,864 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netr28x.sys -- (netr28x)
  94. DRV:[b]64bit:[/b] - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
  95. DRV:[b]64bit:[/b] - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
  96. DRV:[b]64bit:[/b] - [2009-07-14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
  97. DRV:[b]64bit:[/b] - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
  98. DRV:[b]64bit:[/b] - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
  99. DRV:[b]64bit:[/b] - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
  100. DRV:[b]64bit:[/b] - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
  101. DRV:[b]64bit:[/b] - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
  102. DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
  103.  
  104.  
  105. [color=#E56717]========== Standard Registry (SafeList) ==========[/color]
  106.  
  107.  
  108. [color=#E56717]========== Internet Explorer ==========[/color]
  109.  
  110. IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  111. IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  112. IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  113. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  114.  
  115.  
  116. IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  117.  
  118. IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  119.  
  120. IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  121.  
  122. IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  123.  
  124. IE - HKU\S-1-5-21-3686471688-3043328272-1202343854-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
  125. IE - HKU\S-1-5-21-3686471688-3043328272-1202343854-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pl-pl/?ocid=iehp
  126. IE - HKU\S-1-5-21-3686471688-3043328272-1202343854-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = pl
  127. IE - HKU\S-1-5-21-3686471688-3043328272-1202343854-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  128. IE - HKU\S-1-5-21-3686471688-3043328272-1202343854-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
  129. IE - HKU\S-1-5-21-3686471688-3043328272-1202343854-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  130.  
  131.  
  132. [color=#E56717]========== FireFox ==========[/color]
  133.  
  134. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.51.2: C:\Program Files\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
  135. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.51.2: C:\Program Files\Java\jre1.8.0_51\bin\plugin2\npjp2.dll (Oracle Corporation)
  136. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
  137. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll (Google Inc.)
  138. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll (Google Inc.)
  139. FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
  140.  
  141.  
  142.  
  143. [color=#E56717]========== Chrome ==========[/color]
  144.  
  145. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\
  146. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\
  147. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.0_0\
  148. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0\
  149. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.9.1_0\
  150. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\
  151. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\
  152. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl\0.8.4.1_0\
  153. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.36.2_0\
  154. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\llnhnfikffkjbdnfallfpgikamegbbag\1.0_0\
  155. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\
  156. CHR - Extension: No name found = C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\
  157.  
  158. O1 HOSTS File: ([2009-06-10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
  159. O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_51\bin\ssv.dll (Oracle Corporation)
  160. O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_51\bin\jp2ssv.dll (Oracle Corporation)
  161. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
  162. O4:[b]64bit:[/b] - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
  163. O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
  164. O4:[b]64bit:[/b] - HKLM..\Run: [VX3000] C:\Windows\vVX3000.exe (Microsoft Corporation)
  165. O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  166. O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  167. O4 - HKU\S-1-5-21-3686471688-3043328272-1202343854-1000..\Run: [puush] C:\Program Files (x86)\puush\puush.exe ()
  168. O4 - HKU\S-1-5-21-3686471688-3043328272-1202343854-1000..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
  169. O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
  170. O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
  171. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  172. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
  173. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
  174. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
  175. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
  176. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
  177. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
  178. O9:[b]64bit:[/b] - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found
  179. O9:[b]64bit:[/b] - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - Reg Error: Key error. File not found
  180. O13[b]64bit:[/b] - gopher Prefix: missing
  181. O13 - gopher Prefix: missing
  182. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 91.123.191.2 91.123.176.2
  183. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D7CECD7E-E5A1-4FF1-82C3-DA8C49989E4D}: DhcpNameServer = 91.123.191.2 91.123.176.2
  184. O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
  185. O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
  186. O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
  187. O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
  188. O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  189. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  190. O32 - HKLM CDRom: AutoRun - 1
  191. O34 - HKLM BootExecute: (autocheck autochk *)
  192. O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
  193. O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
  194. O35 - HKLM\..comfile [open] -- "%1" %*
  195. O35 - HKLM\..exefile [open] -- "%1" %*
  196. O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
  197. O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
  198. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  199. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  200. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  201. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  202. O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
  203.  
  204. [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
  205.  
  206. [2015-08-07 22:58:41 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
  207. [2015-08-07 22:58:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElfBot NG
  208. [2015-08-07 22:58:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ElfBot NG
  209. [2015-08-07 22:00:07 | 000,000,000 | ---D | C] -- C:\_OTL
  210. [2015-08-06 16:45:07 | 000,000,000 | ---D | C] -- C:\AdwCleaner
  211. [2015-08-06 16:02:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft
  212. [2015-08-06 16:02:17 | 000,000,000 | ---D | C] -- C:\Users\PC\AppData\Roaming\DVDVideoSoft
  213. [2015-08-06 15:26:31 | 000,000,000 | ---D | C] -- C:\Users\PC\Desktop\MP3
  214. [2015-08-05 18:05:22 | 000,000,000 | ---D | C] -- C:\Users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikacje Chrome
  215. [2015-08-05 13:19:24 | 000,000,000 | ---D | C] -- C:\Users\PC\AppData\Roaming\REAPER
  216. [2015-08-05 13:19:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\REAPER (x64)
  217. [2015-08-05 13:19:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Propellerhead Software
  218. [2015-08-05 13:19:13 | 000,000,000 | ---D | C] -- C:\Program Files\REAPER (x64)
  219. [2015-08-03 14:10:18 | 000,000,000 | ---D | C] -- C:\Users\PC\Desktop\DarkOT Client
  220. [2015-07-28 15:31:55 | 000,000,000 | ---D | C] -- C:\Users\PC\Desktop\kawalek kotny
  221. [2015-07-23 13:34:40 | 000,000,000 | ---D | C] -- C:\Users\PC\AppData\Local\CEF
  222. [2015-07-19 11:45:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
  223. [2015-07-18 12:40:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico
  224. [2015-07-18 12:40:19 | 000,090,112 | ---- | C] (Vestris Inc.) -- C:\Windows\SysNative\Vestris.ResourceLib.dll
  225. [2015-07-18 12:40:19 | 000,000,000 | ---D | C] -- C:\Program Files\KMSpico
  226. [2015-07-15 18:45:01 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
  227. [2015-07-14 12:10:43 | 000,000,000 | ---D | C] -- C:\Program Files\Counter Strike 1.6 Standard
  228. [2015-07-10 11:45:41 | 000,000,000 | ---D | C] -- C:\Users\PC\Documents\Criterion Games
  229. [2015-07-10 11:36:02 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx
  230. [2015-07-10 11:35:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Catalyst
  231. [2015-07-10 11:08:29 | 000,000,000 | ---D | C] -- C:\R.G. Catalyst
  232.  
  233. [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
  234.  
  235. [2015-08-08 14:30:01 | 000,001,048 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
  236. [2015-08-08 14:00:36 | 000,014,896 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  237. [2015-08-08 14:00:36 | 000,014,896 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  238. [2015-08-08 13:30:02 | 000,001,044 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
  239. [2015-08-08 12:39:08 | 000,961,064 | ---- | M] () -- C:\Users\PC\Desktop\ss+(2015-08-08+at+12.38.32).jpg
  240. [2015-08-08 12:00:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
  241. [2015-08-08 12:00:18 | 3219,300,352 | -HS- | M] () -- C:\hiberfil.sys
  242. [2015-08-07 22:58:17 | 000,000,940 | ---- | M] () -- C:\Users\PC\Desktop\ElfBot NG.lnk
  243. [2015-08-07 22:57:39 | 000,000,967 | ---- | M] () -- C:\Users\Public\Desktop\Tibia.lnk
  244. [2015-08-06 14:37:08 | 000,002,189 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
  245. [2015-08-05 13:19:16 | 000,000,828 | ---- | M] () -- C:\Users\Public\Desktop\REAPER (x64).lnk
  246. [2015-07-29 15:48:55 | 001,668,226 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
  247. [2015-07-29 15:48:55 | 000,739,694 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
  248. [2015-07-29 15:48:55 | 000,653,526 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
  249. [2015-07-29 15:48:55 | 000,155,268 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
  250. [2015-07-29 15:48:55 | 000,121,398 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
  251. [2015-07-19 11:45:11 | 000,110,688 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
  252. [2015-07-18 12:39:25 | 000,001,156 | ---- | M] () -- C:\Users\Public\Desktop\Counter-Strike 1.6 Standard.lnk
  253. [2015-07-10 11:35:59 | 000,001,797 | ---- | M] () -- C:\Users\PC\Desktop\Need for Speed - Most Wanted.lnk
  254.  
  255. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  256.  
  257. [2015-08-08 12:39:07 | 000,961,064 | ---- | C] () -- C:\Users\PC\Desktop\ss+(2015-08-08+at+12.38.32).jpg
  258. [2015-08-07 22:58:17 | 000,000,940 | ---- | C] () -- C:\Users\PC\Desktop\ElfBot NG.lnk
  259. [2015-08-05 13:19:16 | 000,000,828 | ---- | C] () -- C:\Users\Public\Desktop\REAPER (x64).lnk
  260. [2015-07-14 12:12:09 | 000,001,156 | ---- | C] () -- C:\Users\Public\Desktop\Counter-Strike 1.6 Standard.lnk
  261. [2015-07-10 11:35:59 | 000,001,797 | ---- | C] () -- C:\Users\PC\Desktop\Need for Speed - Most Wanted.lnk
  262. [2015-06-16 21:05:10 | 001,640,128 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
  263. [2015-06-13 14:50:08 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
  264. [2015-06-13 14:48:04 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
  265. [2015-06-13 14:44:23 | 000,013,931 | ---- | C] () -- C:\Windows\SysWow64\RaCoInst.dat
  266.  
  267. [color=#E56717]========== ZeroAccess Check ==========[/color]
  268.  
  269. [2009-07-14 07:00:09 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
  270.  
  271. [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  272.  
  273. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  274.  
  275. [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
  276.  
  277. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  278.  
  279. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  280. "" = C:\Windows\SysNative\shell32.dll -- [2010-11-21 05:24:20 | 014,174,208 | ---- | M] (Microsoft Corporation)
  281. "ThreadingModel" = Apartment
  282.  
  283. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  284. "" = %SystemRoot%\system32\shell32.dll -- [2010-11-21 05:24:28 | 012,872,192 | ---- | M] (Microsoft Corporation)
  285. "ThreadingModel" = Apartment
  286.  
  287. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
  288. "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
  289. "ThreadingModel" = Free
  290.  
  291. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  292. "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-21 05:24:46 | 000,606,208 | ---- | M] (Microsoft Corporation)
  293. "ThreadingModel" = Free
  294.  
  295. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
  296. "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
  297. "ThreadingModel" = Both
  298.  
  299. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  300.  
  301. [color=#E56717]========== LOP Check ==========[/color]
  302.  
  303. [2015-08-06 21:14:18 | 000,000,000 | ---D | M] -- C:\Users\Kamil\AppData\Roaming\Spotify
  304. [2015-07-10 16:21:29 | 000,000,000 | ---D | M] -- C:\Users\Kamil\AppData\Roaming\uTorrent
  305. [2015-07-05 13:29:15 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\.minecraft
  306. [2015-08-07 23:20:02 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\AIMP3
  307. [2015-08-06 16:20:49 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\DVDVideoSoft
  308. [2015-06-18 19:02:21 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Image-Line
  309. [2015-07-02 16:50:59 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\java
  310. [2015-06-18 21:10:16 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Opera Software
  311. [2015-06-13 14:46:53 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\puush
  312. [2015-08-05 13:21:29 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\REAPER
  313. [2015-08-08 12:19:02 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Tibia
  314. [2015-06-23 18:03:42 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\Tibiacast
  315. [2015-08-08 14:40:35 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\TS3Client
  316. [2015-07-03 12:16:05 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\uTorrent
  317.  
  318. [color=#E56717]========== Purity Check ==========[/color]
  319.  
  320.  
  321.  
  322. [color=#E56717]========== Alternate Data Streams ==========[/color]
  323.  
  324. @Alternate Data Stream - 231 bytes -> C:\ProgramData\TEMP:6BE50C2B
  325.  
  326. < End of report >
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!