API tools faq
paste
Advertisement
Guest User

OTL rej

a guest
May 25th, 2017
714
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 79.50 KB | None | 0 0
raw download clone embed print report
  1. OTL logfile created on: 2017-05-25 12:23:29 - Run 1
  2. OTL by OldTimer - Version 3.2.69.0 Folder = G:\
  3. 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
  4. Internet Explorer (Version = 9.11.9600.18665)
  5. Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
  6.  
  7. 31,96 Gb Total Physical Memory | 28,71 Gb Available Physical Memory | 89,86% Memory free
  8. 32,73 Gb Paging File | 29,72 Gb Available in Paging File | 90,80% Paging File free
  9. Paging file location(s): c:\pagefile.sys 800 1000 [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
  12. Drive C: | 119,23 Gb Total Space | 34,95 Gb Free Space | 29,31% Space Free | Partition Type: NTFS
  13. Drive G: | 7,45 Gb Total Space | 6,15 Gb Free Space | 82,49% Space Free | Partition Type: FAT32
  14. Drive X: | 931,50 Gb Total Space | 85,45 Gb Free Space | 9,17% Space Free | Partition Type: NTFS
  15.  
  16. Computer Name: PIWNICAMONTAZ | User Name: TOMEK | Logged in as Administrator.
  17. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
  18. Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
  19.  
  20. [color=#E56717]========== Processes (SafeList) ==========[/color]
  21.  
  22. PRC - [2017-05-25 12:18:10 | 000,602,112 | ---- | M] (OldTimer Tools) -- G:\OTL.exe
  23. PRC - [2017-05-23 10:37:59 | 003,780,096 | ---- | M] () -- C:\ProgramData\Logic Cramble\set.exe
  24. PRC - [2017-05-11 06:09:36 | 000,599,440 | ---- | M] () -- C:\Program Files (x86)\UCBrowser\Application\UCService.exe
  25. PRC - [2017-05-09 17:42:26 | 003,146,704 | ---- | M] (Malwarebytes) -- C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  26. PRC - [2017-02-16 14:51:08 | 000,130,072 | ---- | M] (深圳市猫哈网络科技发展有限公司) -- C:\Program Files (x86)\Maoha\JiSuZip\JszipSvc.exe
  27. PRC - [2017-02-07 10:22:46 | 000,555,120 | ---- | M] (Microleaves LTD) -- C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe
  28. PRC - [2015-12-22 20:00:12 | 000,925,744 | ---- | M] (Oracle Corporation) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
  29. PRC - [2014-02-08 18:18:26 | 000,411,936 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
  30. PRC - [2014-02-05 11:32:47 | 002,234,144 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
  31. PRC - [2014-02-05 11:32:34 | 001,593,632 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
  32. PRC - [2012-03-29 13:38:25 | 000,363,800 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
  33. PRC - [2012-03-29 13:38:22 | 000,277,784 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
  34. PRC - [2012-03-29 13:38:06 | 000,165,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
  35. PRC - [2012-03-27 01:14:26 | 000,291,608 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
  36. PRC - [2012-02-21 16:04:11 | 000,296,232 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
  37. PRC - [2012-02-21 16:04:09 | 000,075,048 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
  38. PRC - [2012-02-21 16:04:07 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
  39. PRC - [2012-02-21 15:19:12 | 000,371,256 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
  40. PRC - [2012-01-03 13:34:20 | 000,138,768 | ---- | M] (MSI) -- C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe
  41. PRC - [2012-01-03 13:34:16 | 000,502,288 | ---- | M] (MSI) -- C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe
  42. PRC - [2011-09-23 18:37:42 | 000,641,832 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
  43. PRC - [2010-04-01 18:00:16 | 000,603,472 | ---- | M] (ACD Systems International Inc.) -- C:\Program Files (x86)\Common Files\ACD Systems\EN\DevDetect.exe
  44.  
  45.  
  46. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  47.  
  48. MOD - [2012-02-21 15:15:34 | 000,075,048 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD12\subsys\DLNA\DMS\_PyDMSCtrl.pyd
  49. MOD - [2011-08-24 04:39:11 | 000,655,360 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD12\Common\Koan\_ssl.pyd
  50. MOD - [2011-08-24 04:39:11 | 000,081,920 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD12\Common\koan\_ctypes.pyd
  51. MOD - [2011-08-24 04:39:11 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD12\Common\Koan\_socket.pyd
  52.  
  53.  
  54. [color=#E56717]========== Services (SafeList) ==========[/color]
  55.  
  56. SRV:[b]64bit:[/b] - [2017-05-09 17:40:18 | 004,470,736 | ---- | M] (Malwarebytes) [Auto | Running] -- C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe -- (MBAMService)
  57. SRV:[b]64bit:[/b] - [2017-04-16 10:37:33 | 000,116,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
  58. SRV:[b]64bit:[/b] - [2016-08-22 18:19:43 | 001,386,496 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\diagtrack.dll -- (DiagTrack)
  59. SRV:[b]64bit:[/b] - [2014-02-05 11:32:24 | 016,941,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
  60. SRV:[b]64bit:[/b] - [2013-05-27 07:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
  61. SRV:[b]64bit:[/b] - [2012-03-07 02:00:46 | 000,629,984 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R)
  62. SRV:[b]64bit:[/b] - [2010-04-14 19:01:46 | 001,052,328 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxeecoms.exe -- (lxee_device)
  63. SRV:[b]64bit:[/b] - [2009-07-14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
  64. SRV - [2017-05-24 12:09:14 | 000,173,512 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
  65. SRV - [2017-05-23 10:37:59 | 003,780,096 | ---- | M] () [Auto | Running] -- C:\ProgramData\Logic Cramble\set.exe -- (backlh)
  66. SRV - [2017-05-12 22:21:30 | 000,271,864 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
  67. SRV - [2017-05-11 06:09:36 | 000,599,440 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\UCBrowser\Application\UCService.exe -- (UCBrowserSvc)
  68. SRV - [2017-02-16 14:51:08 | 000,130,072 | ---- | M] (深圳市猫哈网络科技发展有限公司) [Auto | Running] -- C:\Program Files (x86)\Maoha\JiSuZip\JszipSvc.exe -- (JszipService)
  69. SRV - [2014-03-21 00:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
  70. SRV - [2014-02-08 18:18:26 | 000,411,936 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
  71. SRV - [2014-02-05 11:32:34 | 001,593,632 | ---- | M] (NVIDIA Corporation) [Auto | Start_Pending] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)
  72. SRV - [2012-03-29 13:38:25 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
  73. SRV - [2012-03-29 13:38:22 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
  74. SRV - [2012-03-29 13:38:06 | 000,165,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe -- (jhi_service)
  75. SRV - [2012-02-21 16:04:11 | 000,296,232 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe -- (CyberLink PowerDVD 12 Media Server Service)
  76. SRV - [2012-02-21 16:04:09 | 000,075,048 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe -- (CyberLink PowerDVD 12 Media Server Monitor Service)
  77. SRV - [2012-02-21 16:04:07 | 000,087,336 | ---- | M] (CyberLink Corp.) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe -- (CLHNServiceForPowerDVD12)
  78. SRV - [2012-01-03 13:34:20 | 000,138,768 | ---- | M] (MSI) [Auto | Running] -- C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe -- (MSI_SuperCharger)
  79. SRV - [2011-09-23 18:37:42 | 000,641,832 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
  80. SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
  81. SRV - [2010-02-19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
  82.  
  83.  
  84. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  85.  
  86. DRV:[b]64bit:[/b] - [2017-05-25 11:54:36 | 000,251,832 | ---- | M] (Malwarebytes) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
  87. DRV:[b]64bit:[/b] - [2017-05-25 11:49:55 | 000,187,320 | ---- | M] (Malwarebytes) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\MBAMChameleon.sys -- (MBAMChameleon)
  88. DRV:[b]64bit:[/b] - [2017-05-25 11:49:48 | 000,113,592 | ---- | M] (Malwarebytes) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\farflt.sys -- (MBAMFarflt)
  89. DRV:[b]64bit:[/b] - [2017-05-25 11:49:48 | 000,084,256 | ---- | M] (Malwarebytes) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebProtection)
  90. DRV:[b]64bit:[/b] - [2017-05-25 11:49:45 | 000,043,968 | ---- | M] (Malwarebytes) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtection)
  91. DRV:[b]64bit:[/b] - [2017-05-09 16:37:58 | 000,077,440 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mbae64.sys -- (ESProtectionDriver)
  92. DRV:[b]64bit:[/b] - [2016-12-27 04:34:45 | 000,025,432 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vcdrom.sys -- (WiserIso)
  93. DRV:[b]64bit:[/b] - [2015-06-11 19:15:53 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
  94. DRV:[b]64bit:[/b] - [2013-12-27 20:42:26 | 000,039,200 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
  95. DRV:[b]64bit:[/b] - [2013-11-28 15:38:18 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
  96. DRV:[b]64bit:[/b] - [2012-03-27 01:13:20 | 000,789,272 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc)
  97. DRV:[b]64bit:[/b] - [2012-03-27 01:13:20 | 000,356,632 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub)
  98. DRV:[b]64bit:[/b] - [2012-03-27 01:13:18 | 000,019,224 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs)
  99. DRV:[b]64bit:[/b] - [2012-03-01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
  100. DRV:[b]64bit:[/b] - [2012-02-16 13:42:00 | 000,676,968 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
  101. DRV:[b]64bit:[/b] - [2011-11-09 19:04:14 | 000,060,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
  102. DRV:[b]64bit:[/b] - [2011-07-13 13:59:54 | 000,072,240 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NBVol.sys -- (NBVol)
  103. DRV:[b]64bit:[/b] - [2011-07-13 13:59:54 | 000,015,920 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NBVolUp.sys -- (NBVolUp)
  104. DRV:[b]64bit:[/b] - [2010-11-20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
  105. DRV:[b]64bit:[/b] - [2010-11-20 15:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
  106. DRV:[b]64bit:[/b] - [2010-11-20 15:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
  107. DRV:[b]64bit:[/b] - [2010-11-20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
  108. DRV:[b]64bit:[/b] - [2009-11-18 01:12:00 | 000,032,344 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\MBfilt64.sys -- (MBfilt)
  109. DRV:[b]64bit:[/b] - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
  110. DRV:[b]64bit:[/b] - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
  111. DRV:[b]64bit:[/b] - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
  112. DRV:[b]64bit:[/b] - [2009-07-14 02:06:43 | 000,060,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\61883.sys -- (61883)
  113. DRV:[b]64bit:[/b] - [2009-07-14 02:06:43 | 000,048,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avc.sys -- (Avc)
  114. DRV:[b]64bit:[/b] - [2009-07-14 02:06:42 | 000,061,440 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msdv.sys -- (MSDV)
  115. DRV:[b]64bit:[/b] - [2009-07-14 02:06:40 | 000,017,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avcstrm.sys -- (AVCSTRM)
  116. DRV:[b]64bit:[/b] - [2009-07-14 02:06:39 | 000,056,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mstape.sys -- (MSTAPE)
  117. DRV:[b]64bit:[/b] - [2009-07-09 03:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
  118. DRV:[b]64bit:[/b] - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
  119. DRV:[b]64bit:[/b] - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
  120. DRV:[b]64bit:[/b] - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
  121. DRV:[b]64bit:[/b] - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
  122. DRV - File not found [Kernel | System | Running] -- C:\Program Files (x86)\UCBrowser\Security:ucdrv-x64.sys -- (ucdrv)
  123. DRV - [2012-04-17 19:22:52 | 000,146,928 | ---- | M] (CyberLink Corp.) [2012/09/25 22:36:15] [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl -- ({73526619-C24F-470B-9BED-53D455FBB5C6})
  124. DRV - [2011-10-27 08:18:45 | 000,082,928 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys -- (ntk_PowerDVD12)
  125. DRV - [2010-10-22 11:37:36 | 000,014,136 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys -- (NTIOLib_1_0_4)
  126. DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
  127.  
  128.  
  129. [color=#E56717]========== Standard Registry (SafeList) ==========[/color]
  130.  
  131.  
  132. [color=#E56717]========== Internet Explorer ==========[/color]
  133.  
  134. IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  135. IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  136. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
  137. IE - HKLM\..\SearchScopes,DefaultScope = {ielnksrch}
  138. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  139. IE - HKLM\..\SearchScopes\ielnksrch: "URL" = https://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYuvWipTBr6zac1SDQtXPK7KggGIqh_hOuJOSlQPI_hd41kLO7u-UyN9VHQb0GLMnfdGQ8JtUy2pnl7zMqctrDTKojTKfNjdmS4QchKZb9xd0Qa5gt58yq9vg_V8PNscdKfK88rhrbLPgh3UtH_x83iZUYdGg,,&q={searchTerms}
  140.  
  141.  
  142. IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  143.  
  144. IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  145.  
  146.  
  147.  
  148. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = https://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYuvWipTBr6zac1SDQtXPK7KggGIqh_hOuJOSlQPI_hd41kLO7u-UyN9VHQb0GLMnfdGQ8JtUy2pnl7zMqctrDTKojTKfNjdmS4QchKZb9xd0Qa5gt58yq9vg_V8PNscdKfK88rhrbLPgh3UtH_x83iZUYdGg,,&q={searchTerms}
  149. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYuvWipTBr6zac1SDQtXPK7KggGIqh_hOuJOSlQPI_hd41kLO7u-UyN9VHQb0GLMnfdGQ8JtUy2pnl7zMqctrDTKojTKfNjdmS4QchKZb9xd0Qa5gt58yq9vg_V8PNscdKfK88rhrbLPgh3UtH_x83iZUYdGg,,&q={searchTerms}
  150. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYuvWipTBr6zac1SDQtXPK7KggGIqh_hOuJOSlQPI_hd41kLO7u-UyN9VHQb0GLMnfRXw8Huq6H_H60v3G3SJ8jI4yPBPnZjdbdaSXo9jgRPBdZCJvnLm2ltv7Ho2ChJ1AQNklnHyWpGsUwHCbFcY9yT6hgLw,,
  151. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = https://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYuvWipTBr6zac1SDQtXPK7KggGIqh_hOuJOSlQPI_hd41kLO7u-UyN9VHQb0GLMnfdGQ8JtUy2pnl7zMqctrDTKojTKfNjdmS4QchKZb9xd0Qa5gt58yq9vg_V8PNscdKfK88rhrbLPgh3UtH_x83iZUYdGg,,&q={searchTerms}
  152. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\..\SearchScopes,DefaultScope = {ielnksrch}
  153. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
  154. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\..\SearchScopes\{ielnksrch}: "URL" = https://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYuvWipTBr6zac1SDQtXPK7KggGIqh_hOuJOSlQPI_hd41kLO7u-UyN9VHQb0GLMnfdGQ8JtUy2pnl7zMqctrDTKojTKfNjdmS4QchKZb9xd0Qa5gt58yq9vg_V8PNscdKfK88rhrbLPgh3UtH_x83iZUYdGg,,&q={searchTerms}
  155. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  156.  
  157. [color=#E56717]========== FireFox ==========[/color]
  158.  
  159. FF - prefs.js..browser.search.countryCode: "PL"
  160. FF - prefs.js..browser.search.region: "PL"
  161. FF - prefs.js..browser.startup.homepage: "C:\\ProgramData\\Hotfreshs\\ff.HP"
  162. FF - prefs.js..extensions.enabledAddons: dlwrzuta%40helpstudent.pl:0.2.8.1-signed.1-signed
  163. FF - prefs.js..extensions.enabledAddons: anttoolbar%40ant.com:2.4.7.50
  164. FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:53.0.3
  165. FF - prefs.js..network.proxy.type: 0
  166.  
  167.  
  168. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll File not found
  169. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  170. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll ( Microsoft Corporation)
  171. FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll ()
  172. FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
  173. FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
  174. FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.71.2: C:\Program Files (x86)\Java\jre1.8.0_71\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
  175. FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.71.2: C:\Program Files (x86)\Java\jre1.8.0_71\bin\plugin2\npjp2.dll (Oracle Corporation)
  176. FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  177. FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll ( Microsoft Corporation)
  178. FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
  179. FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
  180. FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
  181. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll (Google Inc.)
  182. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll (Google Inc.)
  183.  
  184. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2012-06-23 23:03:06 | 000,000,000 | ---D | M]
  185. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 53.0.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2016-11-19 20:38:47 | 000,000,000 | ---D | M]
  186. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 53.0.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
  187.  
  188. [2012-06-24 10:55:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\Extensions
  189. [2017-05-25 11:46:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\Firefox\Profiles\lgoivmq9.default\browser-extension-data
  190. [2017-05-25 11:46:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\Firefox\Profiles\lgoivmq9.default\browser-extension-data\669206@extcorp.com
  191. [2017-05-25 11:22:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\Firefox\Profiles\lgoivmq9.default\extensions
  192. [2017-05-16 10:12:36 | 000,000,000 | ---D | M] (Ant Video Downloader) -- C:\Users\TOMEK\AppData\Roaming\mozilla\Firefox\Profiles\lgoivmq9.default\extensions\anttoolbar@ant.com
  193. [2017-04-12 11:16:52 | 000,009,961 | ---- | M] () (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\firefox\profiles\lgoivmq9.default\extensions\669206@extcorp.com.xpi
  194. [2016-04-27 12:17:43 | 000,137,562 | ---- | M] () (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\firefox\profiles\lgoivmq9.default\extensions\dlwrzuta@helpstudent.pl.xpi
  195. [2013-08-02 21:40:45 | 000,224,035 | ---- | M] () (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\firefox\profiles\lgoivmq9.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
  196. [2017-05-24 12:15:50 | 000,044,954 | ---- | M] () (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\firefox\profiles\lgoivmq9.default\features\{5161adbd-0b12-4e39-8373-f8d141529abe}\shield-recipe-client@mozilla.org.xpi
  197. [2017-05-16 10:19:11 | 000,044,954 | ---- | M] () (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\firefox\profiles\lgoivmq9.default\features\{83e1e912-f61a-426b-8774-ef8e7497e468}\shield-recipe-client@mozilla.org.xpi
  198. [2017-05-24 12:09:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
  199.  
  200. [color=#E56717]========== Chrome ==========[/color]
  201.  
  202. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\
  203. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\
  204. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\
  205. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\
  206. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.60_0\
  207. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\
  208. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\
  209. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\
  210. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdgfidddcehboihddlggjiiakhbpanpf\1.0.6.2_0\
  211. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\
  212. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\
  213. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5817.313.0.5_0\
  214.  
  215. O1 HOSTS File: ([2012-06-24 19:03:10 | 000,000,799 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
  216. O1 - Hosts: 127.0.0.1 activate.adobe.com
  217. O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
  218. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_71\bin\ssv.dll (Oracle Corporation)
  219. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_71\bin\jp2ssv.dll (Oracle Corporation)
  220. O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
  221. O4:[b]64bit:[/b] - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
  222. O4:[b]64bit:[/b] - HKLM..\Run: [gplyra] C:\Users\TOMEK\AppData\Roaming\gplyra\gplyra\start.cmd ()
  223. O4:[b]64bit:[/b] - HKLM..\Run: [Malwarebytes TrayApp] C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe (Malwarebytes)
  224. O4:[b]64bit:[/b] - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
  225. O4:[b]64bit:[/b] - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
  226. O4:[b]64bit:[/b] - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
  227. O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
  228. O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe (Nero AG)
  229. O4 - HKLM..\Run: [PowerDVD12Agent] C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe (CyberLink Corp.)
  230. O4 - HKLM..\Run: [PowerDVD12DMREngine] C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe (CyberLink)
  231. O4 - HKLM..\Run: [Super-Charger] C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe (MSI)
  232. O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
  233. O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
  234. O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  235. O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  236. O4 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000..\Run: [AdobeBridge] File not found
  237. O4 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000..\Run: [Device Detector] DevDetect.exe -autorun File not found
  238. O4 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000..\Run: [YeaDesktop] C:\Program Files (x86)\YeaDesktop\YeaDesktop.exe /autostart File not found
  239. O4:[b]64bit:[/b] - HKLM..\RunOnce: [c721950] "C:\Windows\System32\cmd.exe" /C START /MIN RD /S /Q "C:\ProgramData\Microsoft\Windows\Pending"^&EXIT File not found
  240. O4:[b]64bit:[/b] - HKLM..\RunOnce: [PIWNICAMONTAZ] C:\Windows\Temp\g6DBF.tmp.exe ()
  241. O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
  242. O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
  243. O4 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000..\RunOnce: [Application Restart #1] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
  244. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  245. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
  246. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
  247. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
  248. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
  249. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
  250. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
  251. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
  252. O7 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  253. O7 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
  254. O13[b]64bit:[/b] - gopher Prefix: missing
  255. O13 - gopher Prefix: missing
  256. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 5.63.188.2 8.8.8.8
  257. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C0B44350-6949-422D-92A3-18856B463330}: DhcpNameServer = 5.63.188.2 8.8.8.8
  258. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C0B44350-6949-422D-92A3-18856B463330}: NameServer = 82.163.142.8,95.211.158.136
  259. O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
  260. O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
  261. O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
  262. O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
  263. O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  264. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  265. O32 - HKLM CDRom: AutoRun - 1
  266. O33 - MountPoints2\{80eba25c-bd68-11e1-84f9-9b08d8768243}\Shell - "" = AutoRun
  267. O33 - MountPoints2\{80eba25c-bd68-11e1-84f9-9b08d8768243}\Shell\AutoRun\command - "" = "G:\Adobe CS5\Set-up.exe"
  268. O34 - HKLM BootExecute: (autocheck autochk *)
  269. O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
  270. O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
  271. O35 - HKLM\..comfile [open] -- "%1" %*
  272. O35 - HKLM\..exefile [open] -- "%1" %*
  273. O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
  274. O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
  275. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  276. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  277. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  278. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  279. O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
  280.  
  281. [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
  282.  
  283. [2017-05-25 11:58:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab Setup Files
  284. [2017-05-25 11:49:55 | 000,187,320 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMChameleon.sys
  285. [2017-05-25 11:49:48 | 000,113,592 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\farflt.sys
  286. [2017-05-25 11:49:48 | 000,084,256 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mwac.sys
  287. [2017-05-25 11:49:45 | 000,043,968 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbam.sys
  288. [2017-05-25 11:49:41 | 000,251,832 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
  289. [2017-05-25 11:49:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
  290. [2017-05-25 11:49:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
  291. [2017-05-25 11:49:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes
  292. [2017-05-25 11:25:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microleaves
  293. [2017-05-25 11:23:15 | 000,000,000 | ---D | C] -- C:\ProgramData\1b78df31-10a7-0
  294. [2017-05-25 11:23:14 | 000,000,000 | ---D | C] -- C:\ProgramData\1b78df31-7ce7-1
  295. [2017-05-25 11:23:09 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Local\UCBrowser
  296. [2017-05-25 11:22:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UCBrowser
  297. [2017-05-25 11:22:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iwSKLpNEtm2y
  298. [2017-05-25 11:22:37 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Roaming\gplyra
  299. [2017-05-25 11:22:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YeaDesktop
  300. [2017-05-25 11:22:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Maoha
  301. [2017-05-25 11:22:30 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Roaming\UCChannel
  302. [2017-05-25 11:22:30 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Local\Programs
  303. [2017-05-25 11:22:26 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Roaming\ServerTest
  304. [2017-05-25 11:22:25 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\XMUpdate
  305. [2017-05-25 11:22:25 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk
  306. [2017-05-25 11:22:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Hotfreshs
  307. [2017-05-25 11:22:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microleaves
  308. [2017-05-25 11:22:11 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Roaming\Microleaves
  309. [2017-05-25 11:22:11 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Local\AdvinstAnalytics
  310. [2017-05-25 11:22:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Greenhome
  311. [2017-05-25 11:22:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Logic Cramble
  312. [2017-05-25 11:22:01 | 003,448,832 | ---- | C] (TODO: <Company name>) -- C:\Users\TOMEK\AppData\Local\Joyin.exe
  313. [2017-05-25 11:22:00 | 003,448,832 | ---- | C] (TODO: <Company name>) -- C:\Users\TOMEK\AppData\Local\Yearbam.exe
  314. [2017-05-25 11:13:29 | 000,000,000 | -HSD | C] -- C:\Config.Msi
  315. [2017-05-25 11:01:02 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Roaming\Google
  316. [2017-05-12 21:27:47 | 005,977,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
  317. [2017-05-12 21:27:46 | 005,547,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
  318. [2017-05-12 21:27:46 | 004,000,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
  319. [2017-05-12 21:27:46 | 002,065,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ole32.dll
  320. [2017-05-12 21:27:46 | 001,483,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
  321. [2017-05-12 21:27:46 | 000,880,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll
  322. [2017-05-12 21:27:45 | 003,945,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
  323. [2017-05-12 21:27:45 | 002,132,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
  324. [2017-05-12 21:27:45 | 002,057,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
  325. [2017-05-12 21:27:45 | 001,732,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
  326. [2017-05-12 21:27:45 | 001,460,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
  327. [2017-05-12 21:27:45 | 001,359,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
  328. [2017-05-12 21:27:45 | 001,212,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll
  329. [2017-05-12 21:27:45 | 001,155,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
  330. [2017-05-12 21:27:45 | 000,968,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
  331. [2017-05-12 21:27:45 | 000,876,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
  332. [2017-05-12 21:27:45 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
  333. [2017-05-12 21:27:45 | 000,806,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
  334. [2017-05-12 21:27:45 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
  335. [2017-05-12 21:27:45 | 000,725,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
  336. [2017-05-12 21:27:45 | 000,706,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi
  337. [2017-05-12 21:27:45 | 000,663,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
  338. [2017-05-12 21:27:45 | 000,631,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi
  339. [2017-05-12 21:27:45 | 000,615,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
  340. [2017-05-12 21:27:45 | 000,576,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
  341. [2017-05-12 21:27:45 | 000,463,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certcli.dll
  342. [2017-05-12 21:27:45 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
  343. [2017-05-12 21:27:45 | 000,405,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll
  344. [2017-05-12 21:27:45 | 000,377,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
  345. [2017-05-12 21:27:45 | 000,342,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certcli.dll
  346. [2017-05-12 21:27:45 | 000,315,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
  347. [2017-05-12 21:27:45 | 000,300,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pdh.dll
  348. [2017-05-12 21:27:45 | 000,287,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
  349. [2017-05-12 21:27:45 | 000,265,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
  350. [2017-05-12 21:27:45 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pdh.dll
  351. [2017-05-12 21:27:45 | 000,116,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
  352. [2017-05-12 21:27:45 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
  353. [2017-05-12 21:27:45 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
  354. [2017-05-12 21:27:45 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
  355. [2017-05-12 21:27:45 | 000,087,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
  356. [2017-05-12 21:27:45 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
  357. [2017-05-12 21:27:45 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
  358. [2017-05-12 21:27:45 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
  359. [2017-05-12 21:27:45 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\oleres.dll
  360. [2017-05-12 21:27:45 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleres.dll
  361. [2017-05-12 21:27:45 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\plasrv.exe
  362. [2017-05-12 21:27:45 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comcat.dll
  363. [2017-05-12 21:27:45 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\comcat.dll
  364. [2017-05-12 21:27:44 | 001,163,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
  365. [2017-05-12 21:27:44 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
  366. [2017-05-12 21:27:44 | 000,814,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
  367. [2017-05-12 21:27:44 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
  368. [2017-05-12 21:27:44 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
  369. [2017-05-12 21:27:44 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\adtschema.dll
  370. [2017-05-12 21:27:44 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\adtschema.dll
  371. [2017-05-12 21:27:44 | 000,620,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
  372. [2017-05-12 21:27:44 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
  373. [2017-05-12 21:27:44 | 000,489,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
  374. [2017-05-12 21:27:44 | 000,476,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
  375. [2017-05-12 21:27:44 | 000,419,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
  376. [2017-05-12 21:27:44 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
  377. [2017-05-12 21:27:44 | 000,341,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
  378. [2017-05-12 21:27:44 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
  379. [2017-05-12 21:27:44 | 000,312,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
  380. [2017-05-12 21:27:44 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rstrui.exe
  381. [2017-05-12 21:27:44 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
  382. [2017-05-12 21:27:44 | 000,229,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
  383. [2017-05-12 21:27:44 | 000,215,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
  384. [2017-05-12 21:27:44 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
  385. [2017-05-12 21:27:44 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpchttp.dll
  386. [2017-05-12 21:27:44 | 000,168,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
  387. [2017-05-12 21:27:44 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
  388. [2017-05-12 21:27:44 | 000,148,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidpolicyconverter.exe
  389. [2017-05-12 21:27:44 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msaudite.dll
  390. [2017-05-12 21:27:44 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msaudite.dll
  391. [2017-05-12 21:27:44 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
  392. [2017-05-12 21:27:44 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
  393. [2017-05-12 21:27:44 | 000,141,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
  394. [2017-05-12 21:27:44 | 000,141,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rpchttp.dll
  395. [2017-05-12 21:27:44 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
  396. [2017-05-12 21:27:44 | 000,130,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
  397. [2017-05-12 21:27:44 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\bcrypt.dll
  398. [2017-05-12 21:27:44 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
  399. [2017-05-12 21:27:44 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
  400. [2017-05-12 21:27:44 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
  401. [2017-05-12 21:27:44 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
  402. [2017-05-12 21:27:44 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
  403. [2017-05-12 21:27:44 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\auditpol.exe
  404. [2017-05-12 21:27:44 | 000,063,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\setbcdlocale.dll
  405. [2017-05-12 21:27:44 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
  406. [2017-05-12 21:27:44 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msobjs.dll
  407. [2017-05-12 21:27:44 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msobjs.dll
  408. [2017-05-12 21:27:44 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
  409. [2017-05-12 21:27:44 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidapi.dll
  410. [2017-05-12 21:27:44 | 000,050,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\appidapi.dll
  411. [2017-05-12 21:27:44 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srclient.dll
  412. [2017-05-12 21:27:44 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\auditpol.exe
  413. [2017-05-12 21:27:44 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
  414. [2017-05-12 21:27:44 | 000,047,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
  415. [2017-05-12 21:27:44 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
  416. [2017-05-12 21:27:44 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptbase.dll
  417. [2017-05-12 21:27:44 | 000,034,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
  418. [2017-05-12 21:27:44 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
  419. [2017-05-12 21:27:44 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
  420. [2017-05-12 21:27:44 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
  421. [2017-05-12 21:27:44 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
  422. [2017-05-12 21:27:44 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidcertstorecheck.exe
  423. [2017-05-12 21:27:44 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
  424. [2017-05-12 21:27:44 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
  425. [2017-05-12 21:27:44 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
  426. [2017-05-12 21:27:44 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
  427. [2017-05-12 21:27:44 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
  428. [2017-05-12 21:27:44 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\apisetschema.dll
  429. [2017-05-12 21:27:44 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
  430. [2017-05-12 21:27:44 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
  431. [2017-05-12 21:27:44 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
  432. [2017-05-12 21:27:44 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
  433. [2017-05-12 21:27:44 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
  434. [2017-05-12 21:27:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
  435. [2017-05-12 21:27:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
  436. [2017-05-12 21:27:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
  437. [2017-05-12 21:27:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
  438. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
  439. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
  440. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
  441. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
  442. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
  443. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
  444. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
  445. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
  446. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
  447. [2017-05-12 21:27:44 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
  448. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
  449. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
  450. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
  451. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
  452. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
  453. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
  454. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
  455. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
  456. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
  457. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
  458. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
  459. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
  460. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
  461. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
  462. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
  463. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
  464. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
  465. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
  466. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
  467. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
  468. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
  469. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
  470. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
  471. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
  472. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
  473. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
  474. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
  475. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
  476. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
  477. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
  478. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
  479. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
  480. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
  481. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
  482. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
  483. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
  484. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
  485. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
  486. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
  487. [2017-05-12 21:27:44 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
  488.  
  489. [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
  490.  
  491. [2017-05-25 12:22:07 | 001,816,209 | ---- | M] () -- C:\Windows\SysNative\cwlog.dtl
  492. [2017-05-25 12:15:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\Online Application V2G3.job
  493. [2017-05-25 12:15:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\Online Application V2G2.job
  494. [2017-05-25 12:15:00 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\Online Application V2G1.job
  495. [2017-05-25 12:11:24 | 000,002,448 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
  496. [2017-05-25 11:59:48 | 025,454,906 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
  497. [2017-05-25 11:59:48 | 009,316,370 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
  498. [2017-05-25 11:59:48 | 008,697,418 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
  499. [2017-05-25 11:59:48 | 008,377,176 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
  500. [2017-05-25 11:59:48 | 000,006,316 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
  501. [2017-05-25 11:54:36 | 000,251,832 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
  502. [2017-05-25 11:54:33 | 000,000,292 | ---- | M] () -- C:\Windows\tasks\UCBrowserUpdaterCore.job
  503. [2017-05-25 11:54:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
  504. [2017-05-25 11:49:55 | 000,187,320 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMChameleon.sys
  505. [2017-05-25 11:49:48 | 000,113,592 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\farflt.sys
  506. [2017-05-25 11:49:48 | 000,084,256 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\mwac.sys
  507. [2017-05-25 11:49:45 | 000,043,968 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbam.sys
  508. [2017-05-25 11:49:39 | 000,001,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes.lnk
  509. [2017-05-25 11:29:34 | 000,019,776 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  510. [2017-05-25 11:29:34 | 000,019,776 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  511. [2017-05-25 11:25:17 | 000,000,456 | ---- | M] () -- C:\Windows\tasks\UCBrowserUpdater.job
  512. [2017-05-25 11:25:01 | 000,000,374 | ---- | M] () -- C:\Windows\tasks\Updater_Online_Application.job
  513. [2017-05-25 11:22:22 | 000,015,606 | ---- | M] () -- C:\Windows\SysWow64\findit.xml
  514. [2017-05-25 11:22:07 | 001,895,383 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\StimSailfresh.bin
  515. [2017-05-25 11:22:03 | 007,306,240 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\agent.dat
  516. [2017-05-25 11:22:03 | 000,126,464 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\noah.dat
  517. [2017-05-25 11:22:03 | 000,070,800 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\Config.xml
  518. [2017-05-25 11:22:03 | 000,018,432 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\Main.dat
  519. [2017-05-25 11:22:03 | 000,005,568 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\md.xml
  520. [2017-05-25 11:22:02 | 001,897,408 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\Joyin.tst
  521. [2017-05-25 11:22:01 | 000,278,509 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\Yearbam.tst
  522. [2017-05-25 11:21:57 | 000,016,512 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\InstallationConfiguration.xml
  523. [2017-05-25 11:21:55 | 003,448,832 | ---- | M] (TODO: <Company name>) -- C:\Users\TOMEK\AppData\Local\Yearbam.exe
  524. [2017-05-25 11:21:55 | 003,448,832 | ---- | M] (TODO: <Company name>) -- C:\Users\TOMEK\AppData\Local\Joyin.exe
  525. [2017-05-25 11:21:55 | 000,140,800 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\installer.dat
  526. [2017-05-24 21:41:18 | 000,000,021 | ---- | M] () -- C:\Windows\SurCode.INI
  527. [2017-05-21 16:44:04 | 000,381,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sppcommdlg.dll
  528. [2017-05-21 16:44:00 | 000,349,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\slui.exe
  529. [2017-05-16 15:56:17 | 003,387,296 | ---- | M] () -- C:\Users\TOMEK\Documents\antoni_9.prproj
  530. [2017-05-16 15:54:51 | 003,387,296 | ---- | M] () -- C:\Users\TOMEK\Documents\antoni_8.prproj
  531. [2017-05-15 19:24:32 | 011,204,432 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
  532. [2017-05-12 22:37:52 | 758,606,783 | ---- | M] () -- C:\Users\TOMEK\Desktop\DELFIN 50.mp4
  533. [2017-05-12 22:21:29 | 000,803,320 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
  534. [2017-05-12 22:21:29 | 000,144,888 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
  535. [2017-05-09 16:37:58 | 000,077,440 | ---- | M] () -- C:\Windows\SysNative\drivers\mbae64.sys
  536. [2017-04-28 03:14:59 | 000,631,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi
  537. [2017-04-28 03:14:09 | 000,706,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi
  538. [2017-04-28 03:14:08 | 005,547,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
  539. [2017-04-28 03:11:49 | 001,732,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
  540. [2017-04-28 03:10:12 | 000,362,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
  541. [2017-04-28 03:10:12 | 000,243,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
  542. [2017-04-28 03:10:12 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
  543. [2017-04-28 03:10:11 | 000,215,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
  544. [2017-04-28 03:10:10 | 000,503,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
  545. [2017-04-28 03:10:10 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
  546. [2017-04-28 03:10:10 | 000,050,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\srclient.dll
  547. [2017-04-28 03:10:10 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
  548. [2017-04-28 03:10:09 | 000,063,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\setbcdlocale.dll
  549. [2017-04-28 03:10:08 | 001,212,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll
  550. [2017-04-28 03:10:08 | 000,190,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rpchttp.dll
  551. [2017-04-28 03:10:08 | 000,028,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
  552. [2017-04-28 03:10:07 | 000,016,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
  553. [2017-04-28 03:10:04 | 000,312,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
  554. [2017-04-28 03:10:04 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msobjs.dll
  555. [2017-04-28 03:10:03 | 000,146,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msaudite.dll
  556. [2017-04-28 03:10:02 | 001,460,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
  557. [2017-04-28 03:10:02 | 001,163,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
  558. [2017-04-28 03:10:02 | 000,419,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
  559. [2017-04-28 03:09:59 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
  560. [2017-04-28 03:09:59 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptbase.dll
  561. [2017-04-28 03:09:58 | 000,880,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll
  562. [2017-04-28 03:09:58 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\adtschema.dll
  563. [2017-04-28 03:09:58 | 000,463,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\certcli.dll
  564. [2017-04-28 03:09:58 | 000,123,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\bcrypt.dll
  565. [2017-04-28 03:09:58 | 000,059,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appidapi.dll
  566. [2017-04-28 03:09:58 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\apisetschema.dll
  567. [2017-04-28 03:09:58 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
  568. [2017-04-28 03:09:58 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
  569. [2017-04-28 03:09:58 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
  570. [2017-04-28 03:09:58 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
  571. [2017-04-28 03:09:58 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
  572. [2017-04-28 03:09:58 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
  573. [2017-04-28 03:09:58 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
  574. [2017-04-28 03:09:58 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
  575. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
  576. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
  577. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
  578. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
  579. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
  580. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
  581. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
  582. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
  583. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
  584. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
  585. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
  586. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
  587. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
  588. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
  589. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
  590. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
  591. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
  592. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
  593. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
  594. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
  595. [2017-04-28 02:36:36 | 004,000,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
  596. [2017-04-28 02:36:36 | 003,945,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
  597. [2017-04-28 02:32:51 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
  598. [2017-04-28 02:32:45 | 000,141,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\rpchttp.dll
  599. [2017-04-28 02:32:40 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msobjs.dll
  600. [2017-04-28 02:32:39 | 000,146,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msaudite.dll
  601. [2017-04-28 02:32:33 | 000,342,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\certcli.dll
  602. [2017-04-28 02:32:32 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\adtschema.dll
  603. [2017-04-28 02:32:32 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\appidapi.dll
  604. [2017-04-28 02:32:32 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
  605. [2017-04-28 02:32:32 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
  606. [2017-04-28 02:32:32 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
  607. [2017-04-28 02:32:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
  608. [2017-04-28 02:32:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
  609. [2017-04-28 02:32:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
  610. [2017-04-28 02:32:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
  611. [2017-04-28 02:32:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
  612. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
  613. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
  614. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
  615. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
  616. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
  617. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
  618. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
  619. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
  620. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
  621. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
  622. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
  623. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
  624. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
  625. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
  626. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
  627. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
  628. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
  629. [2017-04-28 02:19:29 | 000,148,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appidpolicyconverter.exe
  630. [2017-04-28 02:19:26 | 000,017,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appidcertstorecheck.exe
  631. [2017-04-28 02:18:44 | 000,064,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\auditpol.exe
  632. [2017-04-28 02:15:46 | 000,338,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
  633. [2017-04-28 02:14:54 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rstrui.exe
  634. [2017-04-28 02:11:35 | 000,050,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\auditpol.exe
  635. [2017-04-28 02:10:53 | 000,112,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
  636. [2017-04-28 02:08:07 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
  637. [2017-04-28 02:08:06 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
  638. [2017-04-28 02:08:06 | 000,007,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
  639. [2017-04-28 02:08:05 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
  640. [2017-04-28 02:07:13 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
  641. [2017-04-28 02:07:13 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
  642. [2017-04-28 02:07:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
  643. [2017-04-28 02:07:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
  644.  
  645. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  646.  
  647. [2017-05-25 11:49:39 | 000,001,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes.lnk
  648. [2017-05-25 11:49:37 | 000,077,440 | ---- | C] () -- C:\Windows\SysNative\drivers\mbae64.sys
  649. [2017-05-25 11:23:18 | 000,000,292 | ---- | C] () -- C:\Windows\tasks\UCBrowserUpdaterCore.job
  650. [2017-05-25 11:23:16 | 000,000,456 | ---- | C] () -- C:\Windows\tasks\UCBrowserUpdater.job
  651. [2017-05-25 11:22:33 | 000,025,432 | ---- | C] () -- C:\Windows\SysNative\drivers\vcdrom.sys
  652. [2017-05-25 11:22:19 | 000,015,606 | ---- | C] () -- C:\Windows\SysWow64\findit.xml
  653. [2017-05-25 11:22:15 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\Online Application V2G3.job
  654. [2017-05-25 11:22:14 | 000,000,374 | ---- | C] () -- C:\Windows\tasks\Updater_Online_Application.job
  655. [2017-05-25 11:22:14 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\Online Application V2G2.job
  656. [2017-05-25 11:22:14 | 000,000,342 | ---- | C] () -- C:\Windows\tasks\Online Application V2G1.job
  657. [2017-05-25 11:22:07 | 001,895,383 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\StimSailfresh.bin
  658. [2017-05-25 11:22:03 | 000,126,464 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\noah.dat
  659. [2017-05-25 11:22:03 | 000,070,800 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\Config.xml
  660. [2017-05-25 11:22:03 | 000,018,432 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\Main.dat
  661. [2017-05-25 11:22:03 | 000,005,568 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\md.xml
  662. [2017-05-25 11:22:02 | 007,306,240 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\agent.dat
  663. [2017-05-25 11:22:02 | 001,897,408 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\Joyin.tst
  664. [2017-05-25 11:22:01 | 000,278,509 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\Yearbam.tst
  665. [2017-05-25 11:21:55 | 000,140,800 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\installer.dat
  666. [2017-05-25 11:21:55 | 000,016,512 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\InstallationConfiguration.xml
  667. [2017-05-16 15:55:11 | 003,387,296 | ---- | C] () -- C:\Users\TOMEK\Documents\antoni_9.prproj
  668. [2017-05-16 14:26:09 | 003,387,296 | ---- | C] () -- C:\Users\TOMEK\Documents\antoni_8.prproj
  669. [2017-05-16 13:30:36 | 758,606,783 | ---- | C] () -- C:\Users\TOMEK\Desktop\DELFIN 50.mp4
  670. [2017-05-16 12:57:35 | 491,931,462 | ---- | C] () -- C:\Users\TOMEK\Desktop\kosciól dąbrówka.avi
  671. [2016-01-02 23:55:59 | 000,000,132 | ---- | C] () -- C:\Users\TOMEK\AppData\Roaming\Preferencje Adobe CS5 dla formatu AIFF
  672. [2015-12-14 12:55:47 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
  673. [2012-12-06 13:46:36 | 000,000,017 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\resmon.resmoncfg
  674. [2012-10-05 12:22:48 | 000,022,528 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  675. [2012-09-25 16:38:02 | 000,000,132 | ---- | C] () -- C:\Users\TOMEK\AppData\Roaming\Preferencje Adobe CS5 dla formatu PNG
  676.  
  677. [color=#E56717]========== ZeroAccess Check ==========[/color]
  678.  
  679. [2009-07-14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
  680.  
  681. [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  682.  
  683. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  684.  
  685. [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
  686.  
  687. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  688.  
  689. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  690. "" = C:\Windows\SysNative\shell32.dll -- [2015-08-06 20:04:07 | 014,176,768 | ---- | M] (Microsoft Corporation)
  691. "ThreadingModel" = Apartment
  692.  
  693. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  694. "" = %SystemRoot%\system32\shell32.dll -- [2015-08-06 19:44:51 | 012,875,776 | ---- | M] (Microsoft Corporation)
  695. "ThreadingModel" = Apartment
  696.  
  697. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
  698. "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
  699. "ThreadingModel" = Free
  700.  
  701. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  702. "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
  703. "ThreadingModel" = Free
  704.  
  705. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
  706. "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
  707. "ThreadingModel" = Both
  708.  
  709. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  710.  
  711. [color=#E56717]========== Files - Unicode (All) ==========[/color]
  712. [2017-05-25 11:23:20 | 000,001,547 | ---- | C] ()(C:\Users\TOMEK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC???.lnk) -- C:\Users\TOMEK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
  713. [2017-05-25 11:23:20 | 000,000,000 | ---D | C](C:\Users\TOMEK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC???) -- C:\Users\TOMEK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器
  714. [2017-05-25 11:22:33 | 000,000,000 | ---D | C](C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\极速压缩
  715.  
  716. [color=#E56717]========== Alternate Data Streams ==========[/color]
  717.  
  718. @Alternate Data Stream - 915 bytes -> C:\Users\TOMEK\AppData\Local\Temp:IaJlWQfvGLYZKGtlghbDZdYbw
  719. @Alternate Data Stream - 914 bytes -> C:\ProgramData\Microsoft:oEBV43lHqnig4PSPUqBUtcoR
  720. @Alternate Data Stream - 1091 bytes -> C:\ProgramData\Microsoft:3vUr4NxsdPPDdUIZYzBjo
  721. @Alternate Data Stream - 1009 bytes -> C:\ProgramData\Microsoft:Pb4MthYV2TtpxW8HML0YlMLBmXgC
  722.  
  723. < End of report >
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!