API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Apr 9th, 2013
191
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 47.64 KB | None | 0 0
raw download clone embed print report
  1. OTL logfile created on: 2013-04-09 22:40:13 - Run 4
  2. OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Admin\Downloads
  3. 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
  4. Internet Explorer (Version = 9.0.8112.16421)
  5. Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
  6.  
  7. 7,96 Gb Total Physical Memory | 5,55 Gb Available Physical Memory | 69,72% Memory free
  8. 15,92 Gb Paging File | 12,94 Gb Available in Paging File | 81,24% Paging File free
  9. Paging file location(s): ?:\pagefile.sys [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
  12. Drive C: | 292,87 Gb Total Space | 238,32 Gb Free Space | 81,37% Space Free | Partition Type: NTFS
  13. Drive D: | 638,54 Gb Total Space | 537,26 Gb Free Space | 84,14% Space Free | Partition Type: NTFS
  14.  
  15. Computer Name: ADMIN-KOMPUTER | User Name: Admin | Logged in as Administrator.
  16. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
  17. Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
  18.  
  19. [color=#E56717]========== Processes (SafeList) ==========[/color]
  20.  
  21. PRC - [2013-04-09 22:37:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Downloads\OTL.exe
  22. PRC - [2013-04-07 20:07:20 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  23. PRC - [2013-03-29 21:53:56 | 001,631,144 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exe
  24. PRC - [2013-03-29 21:53:56 | 000,543,656 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe
  25. PRC - [2013-03-21 11:47:59 | 000,154,176 | ---- | M] (GG Network S.A.) -- C:\Users\Admin\AppData\Local\GG\Application\ggapp.exe
  26. PRC - [2013-03-16 02:59:42 | 005,852,440 | ---- | M] (Pokki) -- C:\Users\Admin\AppData\Local\Pokki\Engine\pokki.exe
  27. PRC - [2013-03-13 20:33:02 | 001,822,424 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe
  28. PRC - [2013-02-27 16:30:51 | 003,381,824 | ---- | M] (GG Network S.A.) -- C:\Users\Admin\AppData\Local\GG\Application\gghub.exe
  29. PRC - [2013-02-27 16:30:51 | 003,234,368 | ---- | M] (GG Network S.A.) -- C:\Users\Admin\AppData\Local\GG\Application\ggdrive\ggdrive.exe
  30. PRC - [2013-02-18 16:53:07 | 001,151,152 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe
  31. PRC - [2013-02-18 16:53:07 | 000,968,880 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
  32. PRC - [2013-02-05 17:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
  33. PRC - [2013-01-26 18:12:09 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
  34. PRC - [2012-12-18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
  35. PRC - [2012-12-14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
  36. PRC - [2012-12-14 16:49:28 | 000,512,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
  37. PRC - [2012-12-14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
  38. PRC - [2012-12-11 04:52:44 | 003,147,384 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
  39. PRC - [2012-11-16 00:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
  40. PRC - [2012-10-22 14:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
  41. PRC - [2012-10-04 17:34:36 | 000,115,032 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
  42. PRC - [2012-03-27 10:14:27 | 000,291,608 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
  43. PRC - [2011-12-16 13:30:40 | 000,363,800 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
  44. PRC - [2011-12-16 13:30:38 | 000,277,784 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
  45. PRC - [2011-12-16 12:02:56 | 000,161,560 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
  46.  
  47.  
  48. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  49.  
  50. MOD - [2013-04-07 20:07:20 | 003,143,576 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
  51. MOD - [2013-03-29 21:53:56 | 001,114,024 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.DLL
  52. MOD - [2013-03-27 02:16:40 | 020,341,672 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dll
  53. MOD - [2013-03-26 00:23:34 | 000,651,776 | ---- | M] () -- C:\Program Files (x86)\Steam\SDL2.dll
  54. MOD - [2013-03-21 11:47:59 | 001,945,600 | ---- | M] () -- C:\Users\Admin\AppData\Local\GG\Application\xulrunner\mozjs.dll
  55. MOD - [2013-03-16 02:56:08 | 000,061,952 | ---- | M] () -- C:\Users\Admin\AppData\Local\Pokki\Engine\chrome.dll
  56. MOD - [2013-03-13 20:33:02 | 014,717,144 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll
  57. MOD - [2013-02-18 16:53:07 | 001,151,152 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe
  58. MOD - [2013-02-18 16:53:07 | 000,156,848 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\SiteSafety.dll
  59. MOD - [2013-01-29 15:20:14 | 009,816,192 | ---- | M] () -- C:\Users\Admin\AppData\Local\GG\Application\FMSBWChecker\Adobe AIR\Versions\1.0\Resources\NPSWF32.dll
  60. MOD - [2013-01-29 15:20:14 | 000,135,168 | ---- | M] () -- C:\Users\Admin\AppData\Local\GG\Application\ggdrive\zlib1.dll
  61. MOD - [2012-12-11 19:51:10 | 001,100,800 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-53.dll
  62. MOD - [2012-12-11 19:51:10 | 000,192,000 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-53.dll
  63. MOD - [2012-12-11 19:51:10 | 000,124,416 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-51.dll
  64. MOD - [2012-12-06 00:23:48 | 000,184,846 | ---- | M] () -- C:\Users\Admin\AppData\Local\Pokki\Engine\avformat-53.dll
  65. MOD - [2012-12-06 00:23:44 | 001,093,646 | ---- | M] () -- C:\Users\Admin\AppData\Local\Pokki\Engine\avcodec-53.dll
  66. MOD - [2012-12-06 00:23:44 | 000,117,262 | ---- | M] () -- C:\Users\Admin\AppData\Local\Pokki\Engine\avutil-51.dll
  67.  
  68.  
  69. [color=#E56717]========== Services (SafeList) ==========[/color]
  70.  
  71. SRV:[b]64bit:[/b] - [2012-05-04 13:33:20 | 000,027,760 | ---- | M] (VIA Technologies, Inc.) [Auto | Running] -- C:\Windows\SysNative\ViakaraokeSrv.exe -- (VIAKaraokeService)
  72. SRV:[b]64bit:[/b] - [2012-04-06 04:16:02 | 000,236,544 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
  73. SRV:[b]64bit:[/b] - [2011-12-08 17:38:24 | 000,607,456 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R)
  74. SRV:[b]64bit:[/b] - [2010-04-06 17:30:38 | 000,031,272 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysNative\AppleChargerSrv.exe -- (AppleChargerSrv)
  75. SRV:[b]64bit:[/b] - [2009-07-14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
  76. SRV - [2013-04-07 20:07:20 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
  77. SRV - [2013-03-29 21:53:56 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
  78. SRV - [2013-03-13 20:33:03 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
  79. SRV - [2013-02-18 16:53:07 | 000,968,880 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe -- (vToolbarUpdater14.2.0)
  80. SRV - [2013-02-05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
  81. SRV - [2013-01-26 18:12:09 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
  82. SRV - [2012-12-18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
  83. SRV - [2012-12-14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
  84. SRV - [2012-12-14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
  85. SRV - [2012-11-16 00:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
  86. SRV - [2012-10-22 14:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
  87. SRV - [2011-12-16 13:30:40 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
  88. SRV - [2011-12-16 13:30:38 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
  89. SRV - [2011-12-16 12:02:56 | 000,161,560 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe -- (jhi_service)
  90. SRV - [2009-06-10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
  91.  
  92.  
  93. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  94.  
  95. DRV:[b]64bit:[/b] - [2013-02-18 16:53:07 | 000,039,768 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
  96. DRV:[b]64bit:[/b] - [2012-12-14 16:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
  97. DRV:[b]64bit:[/b] - [2012-11-16 00:33:24 | 000,111,968 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
  98. DRV:[b]64bit:[/b] - [2012-10-22 14:02:44 | 000,154,464 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
  99. DRV:[b]64bit:[/b] - [2012-10-15 04:48:50 | 000,063,328 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
  100. DRV:[b]64bit:[/b] - [2012-10-02 04:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
  101. DRV:[b]64bit:[/b] - [2012-09-21 04:46:04 | 000,200,032 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
  102. DRV:[b]64bit:[/b] - [2012-09-21 04:46:00 | 000,225,120 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
  103. DRV:[b]64bit:[/b] - [2012-09-14 04:05:18 | 000,040,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
  104. DRV:[b]64bit:[/b] - [2012-05-04 13:33:12 | 002,196,592 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)
  105. DRV:[b]64bit:[/b] - [2012-04-06 07:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
  106. DRV:[b]64bit:[/b] - [2012-04-06 03:10:44 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
  107. DRV:[b]64bit:[/b] - [2012-03-27 10:13:18 | 000,789,272 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc)
  108. DRV:[b]64bit:[/b] - [2012-03-27 10:13:18 | 000,356,632 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub)
  109. DRV:[b]64bit:[/b] - [2012-03-27 10:13:17 | 000,019,224 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs)
  110. DRV:[b]64bit:[/b] - [2012-03-01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
  111. DRV:[b]64bit:[/b] - [2012-02-23 14:32:04 | 000,095,760 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
  112. DRV:[b]64bit:[/b] - [2011-11-10 02:04:14 | 000,060,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
  113. DRV:[b]64bit:[/b] - [2011-11-02 11:48:26 | 000,021,616 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\AppleCharger.sys -- (AppleCharger)
  114. DRV:[b]64bit:[/b] - [2011-08-12 00:54:16 | 000,104,560 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
  115. DRV:[b]64bit:[/b] - [2010-11-21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
  116. DRV:[b]64bit:[/b] - [2010-11-21 05:23:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
  117. DRV:[b]64bit:[/b] - [2010-11-21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
  118. DRV:[b]64bit:[/b] - [2010-11-21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
  119. DRV:[b]64bit:[/b] - [2010-11-21 05:23:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
  120. DRV:[b]64bit:[/b] - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
  121. DRV:[b]64bit:[/b] - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
  122. DRV:[b]64bit:[/b] - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
  123. DRV:[b]64bit:[/b] - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
  124. DRV:[b]64bit:[/b] - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
  125. DRV:[b]64bit:[/b] - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
  126. DRV:[b]64bit:[/b] - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
  127. DRV:[b]64bit:[/b] - [2006-12-22 21:05:52 | 000,559,104 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrxusb.sys -- (athrusb)
  128. DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
  129.  
  130.  
  131. [color=#E56717]========== Standard Registry (SafeList) ==========[/color]
  132.  
  133.  
  134. [color=#E56717]========== Internet Explorer ==========[/color]
  135.  
  136. IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  137. IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  138. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
  139. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/"acala3gp"/{B2004D1B-AF62-4DCA-834C-DF3E200F3194}
  140. IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
  141. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  142. IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.good-results.info/?l=1&q={searchTerms}&pid=703&r=2013/02/18&hid=3208912777&lg=EN&cc=PL
  143. IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10002&barid={B97FA903-4ED5-11E2-BCC5-902B3494A546}
  144.  
  145.  
  146. IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  147.  
  148. IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  149.  
  150.  
  151.  
  152. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
  153. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
  154. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
  155. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/"acala3gp"/{B2004D1B-AF62-4DCA-834C-DF3E200F3194}
  156. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
  157. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
  158. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\SearchScopes,DefaultScope = {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
  159. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
  160. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://mixidj.delta-search.com/?q={searchTerms}&affID=121124&tt=0413_7&babsrc=SP_ss&mntrId=0c4d02fc0000000000000060b34f4715
  161. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\SearchScopes\{5852A8C7-FEA4-464E-9B9C-EDC3E6B8E043}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
  162. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\SearchScopes\{650B6A85-CB86-4579-BB43-03C158487AC8}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^PL&apn_uid=24193E86-D8E9-4DD6-A4F6-D173970A8B37&apn_sauid=BF7FBA97-4F13-4CD3-BA83-53C8FBF0430D
  163. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={sear
  164. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={840EEB12-33C2-46A0-A7DA-859CCCB354B1}&mid=db192b22400247d0ab26416272704cb5-2aff2e3828c976488bb01ce5c6738f25b85659f3&lang=pl&ds=AVG&pr=fr&d=2012-12-24 20:28:59&v=14.0.2.14&pid=avg&sg=&sap=dsp&q={searchTerms}
  165. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = http://www.bigseekpro.com/search/browser/"acala3gp"/{B2004D1B-AF62-4DCA-834C-DF3E200F3194}?q={searchTerms}
  166. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.good-results.info/?l=1&q={searchTerms}&pid=703&r=2013/02/18&hid=3208912777&lg=EN&cc=PL
  167. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10002&barid={B97FA903-4ED5-11E2-BCC5-902B3494A546}
  168. IE - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  169.  
  170. [color=#E56717]========== FireFox ==========[/color]
  171.  
  172. FF - prefs.js..browser.search.defaultengine: "Google"
  173. FF - prefs.js..browser.search.defaultthis.engineName: ""
  174. FF - prefs.js..browser.search.defaulturl: "http://websearch.good-results.info/?pid=703&r=2013/02/18&hid=3208912777&lg=EN&cc=PL&l=1&q="
  175. FF - prefs.js..browser.search.selectedEngine: "Google"
  176. FF - prefs.js..browser.search.selectedEngine,S: S", "WebSearch"
  177. FF - prefs.js..browser.search.useDBForOrder: "false"
  178. FF - prefs.js..browser.startup.homepage: "https://www.google.pl/"
  179. FF - prefs.js..extensions.enabledAddons: %7BEEE6C361-6118-11DC-9C72-001320C79847%7D:1.9.0.0
  180. FF - prefs.js..extensions.enabledAddons: %7B9e09ac65-43c0-4b9d-970f-11e2e9616c55%7D:1.5
  181. FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0
  182. FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "WebSearch"
  183. FF - prefs.js..browser.startup.homepage: "http://websearch.good-results.info/?pid=703&r=2013/02/18&hid=3208912777&lg=EN&cc=PL"
  184. FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""
  185.  
  186.  
  187. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found
  188. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  189. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
  190. FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
  191. FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll ()
  192. FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
  193. FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
  194. FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
  195. FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
  196. FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
  197. FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
  198. FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  199. FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
  200. FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
  201. FF - HKCU\Software\MozillaPlugins\pokki.com/PokkiDownloadHelper: C:\Users\Admin\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll (Pokki)
  202. FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll File not found
  203.  
  204. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\FireFoxExt\14.2.0.1 [2013-02-18 16:53:17 | 000,000,000 | ---D | M]
  205. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-12-24 22:44:12 | 000,000,000 | ---D | M]
  206. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013-04-07 20:07:20 | 000,000,000 | ---D | M]
  207. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
  208. FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-12-24 22:44:12 | 000,000,000 | ---D | M]
  209. FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013-04-07 20:07:20 | 000,000,000 | ---D | M]
  210. FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
  211.  
  212. [2012-12-24 21:21:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
  213. [2013-04-07 21:15:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\wumsbu41.default\extensions
  214. [2013-02-18 20:59:08 | 000,000,000 | ---D | M] (Search-NewTab) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\wumsbu41.default\extensions\51228091ac16e@51228091ac1a7.com
  215. [2012-11-06 18:19:24 | 000,214,034 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\extensions\putlockerdownloader@putlockerdownloader.com.xpi
  216. [2013-04-04 21:38:22 | 000,009,181 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\extensions\{9e09ac65-43c0-4b9d-970f-11e2e9616c55}.xpi
  217. [2013-03-23 16:10:12 | 000,221,336 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
  218. [2013-02-15 16:28:26 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
  219. [2013-01-07 07:58:54 | 000,190,000 | ---- | M] () (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
  220. [2012-12-25 22:59:34 | 000,002,308 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\searchplugins\askcom.xml
  221. [2013-01-22 15:33:15 | 000,002,432 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\searchplugins\babylon1.xml
  222. [2013-03-04 00:05:10 | 000,001,294 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\searchplugins\delta.xml
  223. [2013-03-10 22:03:57 | 000,001,296 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\searchplugins\mixidj.xml
  224. [2013-03-23 17:35:52 | 000,002,378 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\searchplugins\search.xml
  225. [2012-12-25 22:57:47 | 000,003,915 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\searchplugins\sweetim.xml
  226. [2013-02-18 20:59:05 | 000,000,627 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\wumsbu41.default\searchplugins\WebSearch.xml
  227. [2013-04-07 20:07:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
  228. [2013-04-07 20:07:20 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
  229. [2013-02-19 17:38:32 | 000,002,980 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\allegro-pl.xml
  230. [2013-02-18 16:53:18 | 000,003,714 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
  231. [2013-03-10 22:03:49 | 000,006,528 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
  232. [2013-02-19 17:38:32 | 000,001,619 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fbc-pl.xml
  233. [2013-02-19 17:38:32 | 000,001,130 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\merlin-pl.xml
  234. [2013-02-19 17:38:32 | 000,001,071 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\pwn-pl.xml
  235. [2013-02-19 17:38:32 | 000,001,396 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-pl.xml
  236. [2013-02-19 17:38:32 | 000,001,896 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wp-pl.xml
  237.  
  238. [color=#E56717]========== Chrome ==========[/color]
  239.  
  240. CHR - homepage: http://websearch.good-results.info/?pid=703&r=2013/02/18&hid=3208912777&lg=EN&cc=PL
  241. CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgjbhnopicifekfncpakjfnkppldjpde\1\
  242. CHR - Extension: No name found = C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mimpadopfgeagmdkefhmjablnfbfdbhd\1\
  243.  
  244. O1 HOSTS File: ([2013-04-07 15:51:30 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
  245. O1 - Hosts: 127.0.0.1 localhost
  246. O1 - Hosts: ::1 localhost
  247. O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
  248. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
  249. O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
  250. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
  251. O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
  252. O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
  253. O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
  254. O3 - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
  255. O3 - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
  256. O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
  257. O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
  258. O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
  259. O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
  260. O4 - HKLM..\Run: [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
  261. O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
  262. O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
  263. O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
  264. O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  265. O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  266. O4 - HKU\S-1-5-21-929212034-3805227821-1322915038-1000..\Run: [GG] C:\Users\Admin\AppData\Local\GG\Application\gghub.exe (GG Network S.A.)
  267. O4 - HKU\S-1-5-21-929212034-3805227821-1322915038-1000..\Run: [Pokki] "%LOCALAPPDATA%\Pokki\Engine\pokki.exe" File not found
  268. O4 - HKU\S-1-5-21-929212034-3805227821-1322915038-1000..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
  269. O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
  270. O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
  271. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  272. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
  273. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
  274. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
  275. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
  276. O7 - HKU\S-1-5-21-929212034-3805227821-1322915038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
  277. O8:[b]64bit:[/b] - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
  278. O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
  279. O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
  280. O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
  281. O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
  282. O13[b]64bit:[/b] - gopher Prefix: missing
  283. O13 - gopher Prefix: missing
  284. O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
  285. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 0.0.0.0
  286. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F500F30-C5E9-4F48-A204-B1ED698158A0}: DhcpNameServer = 192.168.1.1 0.0.0.0
  287. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1557667D-4BC3-41D6-B810-0273512C9EBE}: DhcpNameServer = 192.168.1.1 0.0.0.0
  288. O18:[b]64bit:[/b] - Protocol\Handler\grooveLocalGWS - No CLSID value found
  289. O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found
  290. O18:[b]64bit:[/b] - Protocol\Handler\viprotocol - No CLSID value found
  291. O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll ()
  292. O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
  293. O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
  294. O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
  295. O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
  296. O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
  297. O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  298. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  299. O32 - HKLM CDRom: AutoRun - 1
  300. O34 - HKLM BootExecute: (autocheck autochk *)
  301. O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
  302. O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
  303. O35 - HKLM\..comfile [open] -- "%1" %*
  304. O35 - HKLM\..exefile [open] -- "%1" %*
  305. O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
  306. O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
  307. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  308. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  309. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  310. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  311. O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
  312.  
  313. [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
  314.  
  315. [2013-04-08 20:40:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
  316. [2013-04-08 20:39:49 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
  317. [2013-04-08 20:39:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
  318. [2013-04-07 20:07:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
  319. [2013-04-07 16:25:20 | 000,000,000 | ---D | C] -- C:\Users\Admin\Doctor Web
  320. [2013-04-07 16:00:40 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
  321. [2013-04-07 15:56:02 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
  322. [2013-04-07 15:55:56 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
  323. [2013-04-07 15:55:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
  324. [2013-04-07 15:55:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
  325. [2013-04-07 15:55:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
  326. [2013-04-07 15:50:33 | 000,000,000 | ---D | C] -- C:\_OTL
  327. [2013-04-07 15:46:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\Qtrax
  328. [2013-04-07 15:46:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\QTRAX
  329. [2013-04-07 15:46:48 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Downloaded Installations
  330. [2013-03-25 22:39:46 | 004,546,560 | ---- | C] (Google Inc.) -- C:\Windows\SysWow64\GPhotos.scr
  331. [2013-03-24 12:49:51 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
  332. [2013-03-24 12:24:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
  333. [2013-03-24 12:24:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam
  334. [2013-03-23 17:30:39 | 000,000,000 | ---D | C] -- C:\AcalaSoft
  335. [2013-03-20 22:23:47 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usb8023.sys
  336. [2013-03-15 14:38:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rockstar Games
  337. [2013-03-14 21:59:38 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\FlvtoYoutubeDownloader
  338. [2013-03-14 21:59:06 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\FlvtoConverter
  339. [2013-03-14 21:58:47 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flvto Youtube Downloader
  340. [2013-03-14 21:58:20 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Flvto Youtube Downloader
  341. [2013-03-13 21:30:14 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
  342. [2013-03-13 21:30:14 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
  343. [2013-03-13 21:30:14 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
  344. [2013-03-13 21:30:14 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
  345. [2013-03-13 21:30:14 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
  346. [2013-03-13 21:30:14 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
  347. [2013-03-13 21:30:14 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
  348. [2013-03-13 21:30:13 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
  349. [2013-03-13 21:30:13 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
  350. [2013-03-13 21:30:13 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
  351. [2013-03-13 21:30:13 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
  352. [2013-03-13 21:30:13 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
  353. [2013-03-13 21:30:12 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
  354. [2013-03-13 21:30:12 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
  355. [2013-03-13 21:30:12 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
  356.  
  357. [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
  358.  
  359. [2013-04-09 22:37:20 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  360. [2013-04-09 22:37:20 | 000,022,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  361. [2013-04-09 22:30:05 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\schedule!3036567561.job
  362. [2013-04-09 22:29:58 | 000,000,308 | ---- | M] () -- C:\Windows\tasks\Ayxnre.job
  363. [2013-04-09 22:29:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
  364. [2013-04-09 22:29:53 | 2117,840,895 | -HS- | M] () -- C:\hiberfil.sys
  365. [2013-04-09 20:24:00 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
  366. [2013-04-08 22:49:31 | 001,523,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
  367. [2013-04-08 22:49:31 | 000,687,590 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
  368. [2013-04-08 22:49:31 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
  369. [2013-04-08 22:49:31 | 000,131,176 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
  370. [2013-04-08 22:49:31 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
  371. [2013-04-07 16:00:41 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
  372. [2013-04-07 15:55:57 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  373. [2013-04-07 15:51:30 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
  374. [2013-03-25 22:39:46 | 004,546,560 | ---- | M] (Google Inc.) -- C:\Windows\SysWow64\GPhotos.scr
  375. [2013-03-24 12:49:51 | 000,000,219 | ---- | M] () -- C:\Users\Admin\Desktop\Team Fortress 2.url
  376. [2013-03-24 12:24:31 | 000,000,917 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk
  377. [2013-03-14 21:58:47 | 000,002,178 | ---- | M] () -- C:\Users\Admin\Desktop\Flvto Youtube Downloader.lnk
  378. [2013-03-13 20:33:03 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
  379. [2013-03-13 20:33:02 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
  380.  
  381. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  382.  
  383. [2013-04-07 16:00:41 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
  384. [2013-04-07 15:55:57 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  385. [2013-03-24 12:49:51 | 000,000,219 | ---- | C] () -- C:\Users\Admin\Desktop\Team Fortress 2.url
  386. [2013-03-24 12:24:31 | 000,000,917 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk
  387. [2013-03-14 21:58:47 | 000,002,178 | ---- | C] () -- C:\Users\Admin\Desktop\Flvto Youtube Downloader.lnk
  388. [2013-01-26 18:12:10 | 000,280,976 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
  389. [2013-01-26 18:12:09 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
  390. [2012-12-24 22:40:49 | 000,174,797 | ---- | C] () -- C:\Windows\hpoins45.dat
  391. [2012-12-06 18:35:17 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
  392. [2012-12-06 18:32:40 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
  393. [2012-12-06 18:32:40 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
  394. [2012-12-06 18:32:40 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
  395. [2012-12-06 18:20:04 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
  396. [2012-03-09 15:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
  397. [2011-12-08 17:14:58 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll
  398.  
  399. [color=#E56717]========== ZeroAccess Check ==========[/color]
  400.  
  401. [2009-07-14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
  402.  
  403. [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  404.  
  405. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  406.  
  407. [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
  408.  
  409. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  410.  
  411. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  412. "" = C:\Windows\SysNative\shell32.dll -- [2012-06-09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
  413. "ThreadingModel" = Apartment
  414.  
  415. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  416. "" = %SystemRoot%\system32\shell32.dll -- [2012-06-09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
  417. "ThreadingModel" = Apartment
  418.  
  419. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
  420. "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
  421. "ThreadingModel" = Free
  422.  
  423. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  424. "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
  425. "ThreadingModel" = Free
  426.  
  427. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
  428. "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
  429. "ThreadingModel" = Both
  430.  
  431. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  432.  
  433. [color=#E56717]========== LOP Check ==========[/color]
  434.  
  435. [2013-02-17 14:23:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\.minecraft
  436. [2013-02-08 23:02:53 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AVG
  437. [2012-12-24 21:30:19 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AVG2013
  438. [2012-12-26 22:05:49 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Babylon
  439. [2013-03-14 22:54:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FlvtoConverter
  440. [2013-04-09 22:30:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\GG
  441. [2013-01-26 18:12:07 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PunkBuster
  442. [2013-03-04 00:06:40 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Rovio
  443. [2013-02-16 19:41:33 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\systweak
  444. [2012-12-24 21:29:08 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TuneUp Software
  445. [2013-01-11 16:47:33 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software
  446. [2013-01-11 16:47:33 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software
  447.  
  448. [color=#E56717]========== Purity Check ==========[/color]
  449.  
  450.  
  451.  
  452. [color=#E56717]========== Alternate Data Streams ==========[/color]
  453.  
  454. @Alternate Data Stream - 169 bytes -> C:\ProgramData\TEMP:0B4227B4
  455. @Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:373E1720
  456.  
  457. < End of report >
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!