API tools faq
paste
Advertisement
Guest User

otl

a guest
May 27th, 2017
614
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 71.71 KB | None | 0 0
raw download clone embed print report
  1. OTL logfile created on: 2017-05-27 15:10:39 - Run 2
  2. OTL by OldTimer - Version 3.2.69.0 Folder = G:\
  3. 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
  4. Internet Explorer (Version = 9.11.9600.18665)
  5. Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
  6.  
  7. 31,96 Gb Total Physical Memory | 30,16 Gb Available Physical Memory | 94,38% Memory free
  8. 32,73 Gb Paging File | 30,96 Gb Available in Paging File | 94,59% Paging File free
  9. Paging file location(s): c:\pagefile.sys 800 1000 [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
  12. Drive C: | 119,23 Gb Total Space | 35,08 Gb Free Space | 29,42% Space Free | Partition Type: NTFS
  13. Drive G: | 7,45 Gb Total Space | 6,14 Gb Free Space | 82,43% Space Free | Partition Type: FAT32
  14. Drive X: | 931,50 Gb Total Space | 85,45 Gb Free Space | 9,17% Space Free | Partition Type: NTFS
  15.  
  16. Computer Name: PIWNICAMONTAZ | User Name: TOMEK | Logged in as Administrator.
  17. Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
  18. Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
  19.  
  20. [color=#E56717]========== Processes (SafeList) ==========[/color]
  21.  
  22. PRC - [2017-05-25 12:18:10 | 000,602,112 | ---- | M] (OldTimer Tools) -- G:\OTL.exe
  23.  
  24.  
  25. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  26.  
  27.  
  28. [color=#E56717]========== Services (SafeList) ==========[/color]
  29.  
  30. SRV:[b]64bit:[/b] - [2017-05-09 17:40:18 | 004,470,736 | ---- | M] (Malwarebytes) [Auto | Running] -- C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe -- (MBAMService)
  31. SRV:[b]64bit:[/b] - [2017-04-16 10:37:33 | 000,116,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
  32. SRV:[b]64bit:[/b] - [2016-08-22 18:19:43 | 001,386,496 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\diagtrack.dll -- (DiagTrack)
  33. SRV:[b]64bit:[/b] - [2014-02-05 11:32:24 | 016,941,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
  34. SRV:[b]64bit:[/b] - [2013-05-27 07:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
  35. SRV:[b]64bit:[/b] - [2012-03-07 02:00:46 | 000,629,984 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R)
  36. SRV:[b]64bit:[/b] - [2010-04-14 19:01:46 | 001,052,328 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\SysNative\lxeecoms.exe -- (lxee_device)
  37. SRV:[b]64bit:[/b] - [2009-07-14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
  38. SRV - [2017-05-24 12:09:14 | 000,173,512 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
  39. SRV - [2017-05-12 22:21:30 | 000,271,864 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
  40. SRV - [2017-05-11 06:09:36 | 000,599,440 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\UCBrowser\Application\UCService.exe -- (UCBrowserSvc)
  41. SRV - [2014-03-21 00:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
  42. SRV - [2014-02-08 18:18:26 | 000,411,936 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
  43. SRV - [2014-02-05 11:32:34 | 001,593,632 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)
  44. SRV - [2012-03-29 13:38:25 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
  45. SRV - [2012-03-29 13:38:22 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
  46. SRV - [2012-03-29 13:38:06 | 000,165,144 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe -- (jhi_service)
  47. SRV - [2012-02-21 16:04:11 | 000,296,232 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe -- (CyberLink PowerDVD 12 Media Server Service)
  48. SRV - [2012-02-21 16:04:09 | 000,075,048 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe -- (CyberLink PowerDVD 12 Media Server Monitor Service)
  49. SRV - [2012-02-21 16:04:07 | 000,087,336 | ---- | M] (CyberLink Corp.) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe -- (CLHNServiceForPowerDVD12)
  50. SRV - [2012-01-03 13:34:20 | 000,138,768 | ---- | M] (MSI) [Auto | Stopped] -- C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe -- (MSI_SuperCharger)
  51. SRV - [2011-09-23 18:37:42 | 000,641,832 | ---- | M] (Nero AG) [Auto | Stopped] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
  52. SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
  53. SRV - [2010-02-19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
  54.  
  55.  
  56. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  57.  
  58. DRV:[b]64bit:[/b] - [2017-05-25 11:54:36 | 000,251,832 | ---- | M] (Malwarebytes) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
  59. DRV:[b]64bit:[/b] - [2017-05-25 11:49:55 | 000,187,320 | ---- | M] (Malwarebytes) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\MBAMChameleon.sys -- (MBAMChameleon)
  60. DRV:[b]64bit:[/b] - [2017-05-25 11:49:48 | 000,113,592 | ---- | M] (Malwarebytes) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\farflt.sys -- (MBAMFarflt)
  61. DRV:[b]64bit:[/b] - [2017-05-25 11:49:48 | 000,084,256 | ---- | M] (Malwarebytes) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebProtection)
  62. DRV:[b]64bit:[/b] - [2017-05-25 11:49:45 | 000,043,968 | ---- | M] (Malwarebytes) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtection)
  63. DRV:[b]64bit:[/b] - [2017-05-09 16:37:58 | 000,077,440 | ---- | M] () [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\mbae64.sys -- (ESProtectionDriver)
  64. DRV:[b]64bit:[/b] - [2015-06-11 19:15:53 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
  65. DRV:[b]64bit:[/b] - [2013-12-27 20:42:26 | 000,039,200 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
  66. DRV:[b]64bit:[/b] - [2013-11-28 15:38:18 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
  67. DRV:[b]64bit:[/b] - [2012-03-27 01:13:20 | 000,789,272 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc)
  68. DRV:[b]64bit:[/b] - [2012-03-27 01:13:20 | 000,356,632 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub)
  69. DRV:[b]64bit:[/b] - [2012-03-27 01:13:18 | 000,019,224 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iusb3hcs.sys -- (iusb3hcs)
  70. DRV:[b]64bit:[/b] - [2012-03-01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
  71. DRV:[b]64bit:[/b] - [2012-02-16 13:42:00 | 000,676,968 | ---- | M] (Realtek ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
  72. DRV:[b]64bit:[/b] - [2011-11-09 19:04:14 | 000,060,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
  73. DRV:[b]64bit:[/b] - [2011-07-13 13:59:54 | 000,072,240 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NBVol.sys -- (NBVol)
  74. DRV:[b]64bit:[/b] - [2011-07-13 13:59:54 | 000,015,920 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NBVolUp.sys -- (NBVolUp)
  75. DRV:[b]64bit:[/b] - [2010-11-20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
  76. DRV:[b]64bit:[/b] - [2010-11-20 15:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
  77. DRV:[b]64bit:[/b] - [2010-11-20 15:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
  78. DRV:[b]64bit:[/b] - [2010-11-20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
  79. DRV:[b]64bit:[/b] - [2009-11-18 01:12:00 | 000,032,344 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MBfilt64.sys -- (MBfilt)
  80. DRV:[b]64bit:[/b] - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
  81. DRV:[b]64bit:[/b] - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
  82. DRV:[b]64bit:[/b] - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
  83. DRV:[b]64bit:[/b] - [2009-07-14 02:06:43 | 000,060,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\61883.sys -- (61883)
  84. DRV:[b]64bit:[/b] - [2009-07-14 02:06:43 | 000,048,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avc.sys -- (Avc)
  85. DRV:[b]64bit:[/b] - [2009-07-14 02:06:42 | 000,061,440 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msdv.sys -- (MSDV)
  86. DRV:[b]64bit:[/b] - [2009-07-14 02:06:40 | 000,017,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avcstrm.sys -- (AVCSTRM)
  87. DRV:[b]64bit:[/b] - [2009-07-14 02:06:39 | 000,056,448 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mstape.sys -- (MSTAPE)
  88. DRV:[b]64bit:[/b] - [2009-07-09 03:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
  89. DRV:[b]64bit:[/b] - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
  90. DRV:[b]64bit:[/b] - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
  91. DRV:[b]64bit:[/b] - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
  92. DRV:[b]64bit:[/b] - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
  93. DRV - [2012-04-17 19:22:52 | 000,146,928 | ---- | M] (CyberLink Corp.) [2012/09/25 22:36:15] [Kernel | Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl -- ({73526619-C24F-470B-9BED-53D455FBB5C6})
  94. DRV - [2011-10-27 08:18:45 | 000,082,928 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys -- (ntk_PowerDVD12)
  95. DRV - [2010-10-22 11:37:36 | 000,014,136 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys -- (NTIOLib_1_0_4)
  96. DRV - [2010-01-18 10:36:44 | 000,014,136 | ---- | M] (MSI) [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys -- (NTIOLib_1_0_3)
  97. DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
  98.  
  99.  
  100. [color=#E56717]========== Standard Registry (SafeList) ==========[/color]
  101.  
  102.  
  103. [color=#E56717]========== Internet Explorer ==========[/color]
  104.  
  105. IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  106. IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  107. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
  108. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
  109.  
  110.  
  111. IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  112.  
  113. IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  114.  
  115.  
  116.  
  117. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = https://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYuvWipTBr6zac1SDQtXPK7KggGIqh_hOuJOSlQPI_hd41kLO7u-UyN9VHQb0GLMnfdGQ8JtUy2pnl7zMqctrDTKojTKfNjdmS4QchKZb9xd0Qa5gt58yq9vg_V8PNscdKfK88rhrbLPgh3UtH_x83iZUYdGg,,&q={searchTerms}
  118. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYuvWipTBr6zac1SDQtXPK7KggGIqh_hOuJOSlQPI_hd41kLO7u-UyN9VHQb0GLMnfdGQ8JtUy2pnl7zMqctrDTKojTKfNjdmS4QchKZb9xd0Qa5gt58yq9vg_V8PNscdKfK88rhrbLPgh3UtH_x83iZUYdGg,,&q={searchTerms}
  119. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
  120. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = https://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYuvWipTBr6zac1SDQtXPK7KggGIqh_hOuJOSlQPI_hd41kLO7u-UyN9VHQb0GLMnfdGQ8JtUy2pnl7zMqctrDTKojTKfNjdmS4QchKZb9xd0Qa5gt58yq9vg_V8PNscdKfK88rhrbLPgh3UtH_x83iZUYdGg,,&q={searchTerms}
  121. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
  122. IE - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  123.  
  124. [color=#E56717]========== FireFox ==========[/color]
  125.  
  126. FF - prefs.js..browser.search.countryCode: "PL"
  127. FF - prefs.js..browser.search.region: "PL"
  128. FF - prefs.js..browser.search.useDBForOrder: true
  129. FF - prefs.js..browser.startup.homepage: "google.pl/"
  130. FF - prefs.js..extensions.enabledAddons: dlwrzuta%40helpstudent.pl:0.2.8.1-signed.1-signed
  131. FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:53.0.3
  132. FF - prefs.js..network.proxy.type: 0
  133.  
  134.  
  135. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll File not found
  136. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  137. FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll ( Microsoft Corporation)
  138. FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll ()
  139. FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
  140. FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
  141. FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.71.2: C:\Program Files (x86)\Java\jre1.8.0_71\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
  142. FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.71.2: C:\Program Files (x86)\Java\jre1.8.0_71\bin\plugin2\npjp2.dll (Oracle Corporation)
  143. FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
  144. FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll ( Microsoft Corporation)
  145. FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
  146. FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
  147. FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
  148. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll (Google Inc.)
  149. FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll (Google Inc.)
  150.  
  151. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2012-06-23 23:03:06 | 000,000,000 | ---D | M]
  152. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 53.0.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2016-11-19 20:38:47 | 000,000,000 | ---D | M]
  153. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 53.0.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
  154.  
  155. [2012-06-24 10:55:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\Extensions
  156. [2017-05-25 11:46:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\Firefox\Profiles\lgoivmq9.default\browser-extension-data
  157. [2017-05-25 11:46:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\Firefox\Profiles\lgoivmq9.default\browser-extension-data\669206@extcorp.com
  158. [2017-05-27 15:06:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\Firefox\Profiles\lgoivmq9.default\extension-data
  159. [2017-05-27 14:56:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\Firefox\Profiles\lgoivmq9.default\extensions
  160. [2016-04-27 12:17:43 | 000,137,562 | ---- | M] () (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\firefox\profiles\lgoivmq9.default\extensions\dlwrzuta@helpstudent.pl.xpi
  161. [2017-05-27 14:56:11 | 001,681,248 | ---- | M] () (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\firefox\profiles\lgoivmq9.default\extensions\uBlock0@raymondhill.net.xpi
  162. [2017-05-24 12:15:50 | 000,044,954 | ---- | M] () (No name found) -- C:\Users\TOMEK\AppData\Roaming\mozilla\firefox\profiles\lgoivmq9.default\features\{5161adbd-0b12-4e39-8373-f8d141529abe}\shield-recipe-client@mozilla.org.xpi
  163. [2017-05-24 12:09:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
  164.  
  165. [color=#E56717]========== Chrome ==========[/color]
  166.  
  167. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\
  168. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\
  169. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.1_0\
  170. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\
  171. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.60_0\
  172. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\
  173. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\
  174. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.4_0\
  175. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdgfidddcehboihddlggjiiakhbpanpf\1.0.6.2_0\
  176. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.2_0\
  177. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\
  178. CHR - Extension: No name found = C:\Users\TOMEK\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5817.313.0.5_0\
  179.  
  180. O1 HOSTS File: ([2012-06-24 19:03:10 | 000,000,799 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
  181. O1 - Hosts: 127.0.0.1 activate.adobe.com
  182. O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
  183. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_71\bin\ssv.dll (Oracle Corporation)
  184. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_71\bin\jp2ssv.dll (Oracle Corporation)
  185. O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
  186. O4:[b]64bit:[/b] - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
  187. O4:[b]64bit:[/b] - HKLM..\Run: [Malwarebytes TrayApp] C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe (Malwarebytes)
  188. O4:[b]64bit:[/b] - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
  189. O4:[b]64bit:[/b] - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
  190. O4:[b]64bit:[/b] - HKLM..\Run: [ShadowPlay] C:\Windows\SysNative\nvspcap64.dll (NVIDIA Corporation)
  191. O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
  192. O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe (Nero AG)
  193. O4 - HKLM..\Run: [PowerDVD12Agent] C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe (CyberLink Corp.)
  194. O4 - HKLM..\Run: [PowerDVD12DMREngine] C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe (CyberLink)
  195. O4 - HKLM..\Run: [Super-Charger] C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe (MSI)
  196. O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
  197. O4 - HKLM..\Run: [USB3MON] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
  198. O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  199. O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
  200. O4 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000..\Run: [AdobeBridge] File not found
  201. O4 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000..\Run: [Device Detector] DevDetect.exe -autorun File not found
  202. O4:[b]64bit:[/b] - HKLM..\RunOnce: [c79331] "C:\Windows\System32\cmd.exe" /C START /MIN RD /S /Q "C:\ProgramData\Microsoft\Windows\Pending"^&EXIT File not found
  203. O4 - HKLM..\RunOnce: [DeleteOnReboot] C:\Users\TOMEK\AppData\Local\Temp\DeleteOnReboot.bat ()
  204. O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
  205. O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
  206. O4 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000..\RunOnce: [Report] C:\AdwCleaner\AdwCleaner[C2].txt ()
  207. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
  208. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
  209. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
  210. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
  211. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
  212. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
  213. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
  214. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
  215. O7 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  216. O7 - HKU\S-1-5-21-3247616249-3673664874-1107524508-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
  217. O13[b]64bit:[/b] - gopher Prefix: missing
  218. O13 - gopher Prefix: missing
  219. O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 5.63.188.2 8.8.8.8
  220. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C0B44350-6949-422D-92A3-18856B463330}: DhcpNameServer = 5.63.188.2 8.8.8.8
  221. O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
  222. O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
  223. O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
  224. O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
  225. O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  226. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
  227. O32 - HKLM CDRom: AutoRun - 1
  228. O33 - MountPoints2\{80eba25c-bd68-11e1-84f9-9b08d8768243}\Shell - "" = AutoRun
  229. O33 - MountPoints2\{80eba25c-bd68-11e1-84f9-9b08d8768243}\Shell\AutoRun\command - "" = "G:\Adobe CS5\Set-up.exe"
  230. O34 - HKLM BootExecute: (autocheck autochk *)
  231. O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
  232. O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
  233. O35 - HKLM\..comfile [open] -- "%1" %*
  234. O35 - HKLM\..exefile [open] -- "%1" %*
  235. O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
  236. O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
  237. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  238. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  239. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  240. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  241. O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
  242.  
  243. [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
  244.  
  245. [2017-05-27 14:49:58 | 000,000,000 | ---D | C] -- C:\AdwCleaner
  246. [2017-05-25 11:58:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab Setup Files
  247. [2017-05-25 11:49:55 | 000,187,320 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMChameleon.sys
  248. [2017-05-25 11:49:48 | 000,113,592 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\farflt.sys
  249. [2017-05-25 11:49:48 | 000,084,256 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mwac.sys
  250. [2017-05-25 11:49:45 | 000,043,968 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbam.sys
  251. [2017-05-25 11:49:41 | 000,251,832 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
  252. [2017-05-25 11:49:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
  253. [2017-05-25 11:49:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
  254. [2017-05-25 11:49:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes
  255. [2017-05-25 11:23:09 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Local\UCBrowser
  256. [2017-05-25 11:22:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UCBrowser
  257. [2017-05-25 11:22:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iwSKLpNEtm2y
  258. [2017-05-25 11:22:30 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Local\Programs
  259. [2017-05-25 11:22:26 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Roaming\ServerTest
  260. [2017-05-25 11:22:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Greenhome
  261. [2017-05-25 11:22:01 | 003,448,832 | ---- | C] (TODO: <Company name>) -- C:\Users\TOMEK\AppData\Local\Joyin.exe
  262. [2017-05-25 11:22:00 | 003,448,832 | ---- | C] (TODO: <Company name>) -- C:\Users\TOMEK\AppData\Local\Yearbam.exe
  263. [2017-05-25 11:13:29 | 000,000,000 | -HSD | C] -- C:\Config.Msi
  264. [2017-05-25 11:01:02 | 000,000,000 | ---D | C] -- C:\Users\TOMEK\AppData\Roaming\Google
  265. [2017-05-12 21:27:47 | 005,977,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
  266. [2017-05-12 21:27:46 | 005,547,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
  267. [2017-05-12 21:27:46 | 004,000,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
  268. [2017-05-12 21:27:46 | 002,065,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ole32.dll
  269. [2017-05-12 21:27:46 | 001,483,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
  270. [2017-05-12 21:27:46 | 000,880,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll
  271. [2017-05-12 21:27:45 | 003,945,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
  272. [2017-05-12 21:27:45 | 002,132,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
  273. [2017-05-12 21:27:45 | 002,057,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
  274. [2017-05-12 21:27:45 | 001,732,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
  275. [2017-05-12 21:27:45 | 001,460,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
  276. [2017-05-12 21:27:45 | 001,359,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
  277. [2017-05-12 21:27:45 | 001,212,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll
  278. [2017-05-12 21:27:45 | 001,155,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
  279. [2017-05-12 21:27:45 | 000,968,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
  280. [2017-05-12 21:27:45 | 000,876,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
  281. [2017-05-12 21:27:45 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
  282. [2017-05-12 21:27:45 | 000,806,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
  283. [2017-05-12 21:27:45 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
  284. [2017-05-12 21:27:45 | 000,725,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
  285. [2017-05-12 21:27:45 | 000,706,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi
  286. [2017-05-12 21:27:45 | 000,663,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
  287. [2017-05-12 21:27:45 | 000,631,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi
  288. [2017-05-12 21:27:45 | 000,615,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
  289. [2017-05-12 21:27:45 | 000,576,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
  290. [2017-05-12 21:27:45 | 000,463,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certcli.dll
  291. [2017-05-12 21:27:45 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
  292. [2017-05-12 21:27:45 | 000,405,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll
  293. [2017-05-12 21:27:45 | 000,377,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
  294. [2017-05-12 21:27:45 | 000,342,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certcli.dll
  295. [2017-05-12 21:27:45 | 000,315,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
  296. [2017-05-12 21:27:45 | 000,300,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pdh.dll
  297. [2017-05-12 21:27:45 | 000,287,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
  298. [2017-05-12 21:27:45 | 000,265,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
  299. [2017-05-12 21:27:45 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pdh.dll
  300. [2017-05-12 21:27:45 | 000,116,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
  301. [2017-05-12 21:27:45 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
  302. [2017-05-12 21:27:45 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
  303. [2017-05-12 21:27:45 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
  304. [2017-05-12 21:27:45 | 000,087,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
  305. [2017-05-12 21:27:45 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
  306. [2017-05-12 21:27:45 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
  307. [2017-05-12 21:27:45 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
  308. [2017-05-12 21:27:45 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\oleres.dll
  309. [2017-05-12 21:27:45 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleres.dll
  310. [2017-05-12 21:27:45 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\plasrv.exe
  311. [2017-05-12 21:27:45 | 000,008,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comcat.dll
  312. [2017-05-12 21:27:45 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\comcat.dll
  313. [2017-05-12 21:27:44 | 001,163,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
  314. [2017-05-12 21:27:44 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
  315. [2017-05-12 21:27:44 | 000,814,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
  316. [2017-05-12 21:27:44 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
  317. [2017-05-12 21:27:44 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
  318. [2017-05-12 21:27:44 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\adtschema.dll
  319. [2017-05-12 21:27:44 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\adtschema.dll
  320. [2017-05-12 21:27:44 | 000,620,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
  321. [2017-05-12 21:27:44 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
  322. [2017-05-12 21:27:44 | 000,489,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
  323. [2017-05-12 21:27:44 | 000,476,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
  324. [2017-05-12 21:27:44 | 000,419,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
  325. [2017-05-12 21:27:44 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
  326. [2017-05-12 21:27:44 | 000,341,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
  327. [2017-05-12 21:27:44 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
  328. [2017-05-12 21:27:44 | 000,312,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
  329. [2017-05-12 21:27:44 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rstrui.exe
  330. [2017-05-12 21:27:44 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
  331. [2017-05-12 21:27:44 | 000,229,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
  332. [2017-05-12 21:27:44 | 000,215,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
  333. [2017-05-12 21:27:44 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
  334. [2017-05-12 21:27:44 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpchttp.dll
  335. [2017-05-12 21:27:44 | 000,168,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
  336. [2017-05-12 21:27:44 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
  337. [2017-05-12 21:27:44 | 000,148,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidpolicyconverter.exe
  338. [2017-05-12 21:27:44 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msaudite.dll
  339. [2017-05-12 21:27:44 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msaudite.dll
  340. [2017-05-12 21:27:44 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
  341. [2017-05-12 21:27:44 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
  342. [2017-05-12 21:27:44 | 000,141,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
  343. [2017-05-12 21:27:44 | 000,141,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rpchttp.dll
  344. [2017-05-12 21:27:44 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
  345. [2017-05-12 21:27:44 | 000,130,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
  346. [2017-05-12 21:27:44 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\bcrypt.dll
  347. [2017-05-12 21:27:44 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
  348. [2017-05-12 21:27:44 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
  349. [2017-05-12 21:27:44 | 000,091,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
  350. [2017-05-12 21:27:44 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
  351. [2017-05-12 21:27:44 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
  352. [2017-05-12 21:27:44 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\auditpol.exe
  353. [2017-05-12 21:27:44 | 000,063,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\setbcdlocale.dll
  354. [2017-05-12 21:27:44 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
  355. [2017-05-12 21:27:44 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msobjs.dll
  356. [2017-05-12 21:27:44 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msobjs.dll
  357. [2017-05-12 21:27:44 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
  358. [2017-05-12 21:27:44 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidapi.dll
  359. [2017-05-12 21:27:44 | 000,050,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\appidapi.dll
  360. [2017-05-12 21:27:44 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srclient.dll
  361. [2017-05-12 21:27:44 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\auditpol.exe
  362. [2017-05-12 21:27:44 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
  363. [2017-05-12 21:27:44 | 000,047,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
  364. [2017-05-12 21:27:44 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
  365. [2017-05-12 21:27:44 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptbase.dll
  366. [2017-05-12 21:27:44 | 000,034,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
  367. [2017-05-12 21:27:44 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
  368. [2017-05-12 21:27:44 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
  369. [2017-05-12 21:27:44 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
  370. [2017-05-12 21:27:44 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
  371. [2017-05-12 21:27:44 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appidcertstorecheck.exe
  372. [2017-05-12 21:27:44 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
  373. [2017-05-12 21:27:44 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
  374. [2017-05-12 21:27:44 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
  375. [2017-05-12 21:27:44 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
  376. [2017-05-12 21:27:44 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
  377. [2017-05-12 21:27:44 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\apisetschema.dll
  378. [2017-05-12 21:27:44 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
  379. [2017-05-12 21:27:44 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
  380. [2017-05-12 21:27:44 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
  381. [2017-05-12 21:27:44 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
  382. [2017-05-12 21:27:44 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
  383. [2017-05-12 21:27:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
  384. [2017-05-12 21:27:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
  385. [2017-05-12 21:27:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
  386. [2017-05-12 21:27:44 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
  387. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
  388. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
  389. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
  390. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
  391. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
  392. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
  393. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
  394. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
  395. [2017-05-12 21:27:44 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
  396. [2017-05-12 21:27:44 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
  397. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
  398. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
  399. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
  400. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
  401. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
  402. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
  403. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
  404. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
  405. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
  406. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
  407. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
  408. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
  409. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
  410. [2017-05-12 21:27:44 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
  411. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
  412. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
  413. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
  414. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
  415. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
  416. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
  417. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
  418. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
  419. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
  420. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
  421. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
  422. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
  423. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
  424. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
  425. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
  426. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
  427. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
  428. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
  429. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
  430. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
  431. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
  432. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
  433. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
  434. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
  435. [2017-05-12 21:27:44 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
  436. [2017-05-12 21:27:44 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
  437.  
  438. [color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
  439.  
  440. [2017-05-27 15:09:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
  441. [2017-05-27 15:08:34 | 000,001,299 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
  442. [2017-05-27 15:01:08 | 000,011,097 | ---- | M] () -- C:\Windows\SysNative\cwlog.dtl
  443. [2017-05-27 14:57:51 | 025,517,736 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
  444. [2017-05-27 14:57:51 | 008,719,268 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
  445. [2017-05-27 14:57:50 | 009,338,470 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
  446. [2017-05-27 14:57:50 | 008,398,316 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
  447. [2017-05-27 14:57:50 | 000,006,316 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
  448. [2017-05-27 14:54:58 | 000,032,244 | ---- | M] () -- C:\Users\TOMEK\Desktop\bookmarks.html
  449. [2017-05-26 18:31:06 | 000,002,065 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes.lnk
  450. [2017-05-26 18:25:21 | 000,000,456 | ---- | M] () -- C:\Windows\tasks\UCBrowserUpdater.job
  451. [2017-05-25 13:57:58 | 000,019,776 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  452. [2017-05-25 13:57:58 | 000,019,776 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  453. [2017-05-25 11:54:36 | 000,251,832 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
  454. [2017-05-25 11:49:55 | 000,187,320 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMChameleon.sys
  455. [2017-05-25 11:49:48 | 000,113,592 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\farflt.sys
  456. [2017-05-25 11:49:48 | 000,084,256 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\mwac.sys
  457. [2017-05-25 11:49:45 | 000,043,968 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbam.sys
  458. [2017-05-25 11:22:03 | 007,306,240 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\agent.dat
  459. [2017-05-25 11:22:03 | 000,126,464 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\noah.dat
  460. [2017-05-25 11:22:03 | 000,070,800 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\Config.xml
  461. [2017-05-25 11:22:03 | 000,018,432 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\Main.dat
  462. [2017-05-25 11:22:03 | 000,005,568 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\md.xml
  463. [2017-05-25 11:22:02 | 001,897,408 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\Joyin.tst
  464. [2017-05-25 11:21:57 | 000,016,512 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\InstallationConfiguration.xml
  465. [2017-05-25 11:21:55 | 003,448,832 | ---- | M] (TODO: <Company name>) -- C:\Users\TOMEK\AppData\Local\Yearbam.exe
  466. [2017-05-25 11:21:55 | 003,448,832 | ---- | M] (TODO: <Company name>) -- C:\Users\TOMEK\AppData\Local\Joyin.exe
  467. [2017-05-25 11:21:55 | 000,140,800 | ---- | M] () -- C:\Users\TOMEK\AppData\Local\installer.dat
  468. [2017-05-24 21:41:18 | 000,000,021 | ---- | M] () -- C:\Windows\SurCode.INI
  469. [2017-05-21 16:44:04 | 000,381,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sppcommdlg.dll
  470. [2017-05-21 16:44:00 | 000,349,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\slui.exe
  471. [2017-05-16 15:56:17 | 003,387,296 | ---- | M] () -- C:\Users\TOMEK\Documents\antoni_9.prproj
  472. [2017-05-16 15:54:51 | 003,387,296 | ---- | M] () -- C:\Users\TOMEK\Documents\antoni_8.prproj
  473. [2017-05-15 19:24:32 | 011,204,432 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
  474. [2017-05-12 22:37:52 | 758,606,783 | ---- | M] () -- C:\Users\TOMEK\Desktop\DELFIN 50.mp4
  475. [2017-05-12 22:21:29 | 000,803,320 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
  476. [2017-05-12 22:21:29 | 000,144,888 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
  477. [2017-05-09 16:37:58 | 000,077,440 | ---- | M] () -- C:\Windows\SysNative\drivers\mbae64.sys
  478. [2017-04-28 03:14:59 | 000,631,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\winresume.efi
  479. [2017-04-28 03:14:09 | 000,706,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\winload.efi
  480. [2017-04-28 03:14:08 | 005,547,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
  481. [2017-04-28 03:11:49 | 001,732,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
  482. [2017-04-28 03:10:12 | 000,362,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
  483. [2017-04-28 03:10:12 | 000,243,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
  484. [2017-04-28 03:10:12 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
  485. [2017-04-28 03:10:11 | 000,215,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
  486. [2017-04-28 03:10:10 | 000,503,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
  487. [2017-04-28 03:10:10 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
  488. [2017-04-28 03:10:10 | 000,050,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\srclient.dll
  489. [2017-04-28 03:10:10 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
  490. [2017-04-28 03:10:09 | 000,063,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\setbcdlocale.dll
  491. [2017-04-28 03:10:08 | 001,212,928 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll
  492. [2017-04-28 03:10:08 | 000,190,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rpchttp.dll
  493. [2017-04-28 03:10:08 | 000,028,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
  494. [2017-04-28 03:10:07 | 000,016,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
  495. [2017-04-28 03:10:04 | 000,312,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
  496. [2017-04-28 03:10:04 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msobjs.dll
  497. [2017-04-28 03:10:03 | 000,146,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msaudite.dll
  498. [2017-04-28 03:10:02 | 001,460,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
  499. [2017-04-28 03:10:02 | 001,163,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
  500. [2017-04-28 03:10:02 | 000,419,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
  501. [2017-04-28 03:09:59 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
  502. [2017-04-28 03:09:59 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\cryptbase.dll
  503. [2017-04-28 03:09:58 | 000,880,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll
  504. [2017-04-28 03:09:58 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\adtschema.dll
  505. [2017-04-28 03:09:58 | 000,463,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\certcli.dll
  506. [2017-04-28 03:09:58 | 000,123,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\bcrypt.dll
  507. [2017-04-28 03:09:58 | 000,059,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appidapi.dll
  508. [2017-04-28 03:09:58 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\apisetschema.dll
  509. [2017-04-28 03:09:58 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
  510. [2017-04-28 03:09:58 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
  511. [2017-04-28 03:09:58 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
  512. [2017-04-28 03:09:58 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
  513. [2017-04-28 03:09:58 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
  514. [2017-04-28 03:09:58 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
  515. [2017-04-28 03:09:58 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
  516. [2017-04-28 03:09:58 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
  517. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
  518. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
  519. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
  520. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
  521. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
  522. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
  523. [2017-04-28 03:09:58 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
  524. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
  525. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
  526. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
  527. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
  528. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
  529. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
  530. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
  531. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
  532. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
  533. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
  534. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
  535. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
  536. [2017-04-28 03:09:58 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
  537. [2017-04-28 02:36:36 | 004,000,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
  538. [2017-04-28 02:36:36 | 003,945,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
  539. [2017-04-28 02:32:51 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
  540. [2017-04-28 02:32:45 | 000,141,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\rpchttp.dll
  541. [2017-04-28 02:32:40 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msobjs.dll
  542. [2017-04-28 02:32:39 | 000,146,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msaudite.dll
  543. [2017-04-28 02:32:33 | 000,342,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\certcli.dll
  544. [2017-04-28 02:32:32 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\adtschema.dll
  545. [2017-04-28 02:32:32 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\appidapi.dll
  546. [2017-04-28 02:32:32 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
  547. [2017-04-28 02:32:32 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
  548. [2017-04-28 02:32:32 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
  549. [2017-04-28 02:32:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
  550. [2017-04-28 02:32:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
  551. [2017-04-28 02:32:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
  552. [2017-04-28 02:32:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
  553. [2017-04-28 02:32:32 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
  554. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
  555. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
  556. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
  557. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
  558. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
  559. [2017-04-28 02:32:32 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
  560. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
  561. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
  562. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
  563. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
  564. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
  565. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
  566. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
  567. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
  568. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
  569. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
  570. [2017-04-28 02:32:32 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
  571. [2017-04-28 02:19:29 | 000,148,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appidpolicyconverter.exe
  572. [2017-04-28 02:19:26 | 000,017,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\appidcertstorecheck.exe
  573. [2017-04-28 02:18:44 | 000,064,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\auditpol.exe
  574. [2017-04-28 02:15:46 | 000,338,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
  575. [2017-04-28 02:14:54 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\rstrui.exe
  576. [2017-04-28 02:11:35 | 000,050,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\auditpol.exe
  577. [2017-04-28 02:10:53 | 000,112,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
  578. [2017-04-28 02:08:07 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
  579. [2017-04-28 02:08:06 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
  580. [2017-04-28 02:08:06 | 000,007,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
  581. [2017-04-28 02:08:05 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
  582. [2017-04-28 02:07:13 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
  583. [2017-04-28 02:07:13 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
  584. [2017-04-28 02:07:13 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
  585. [2017-04-28 02:07:13 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
  586.  
  587. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  588.  
  589. [2017-05-27 14:54:58 | 000,032,244 | ---- | C] () -- C:\Users\TOMEK\Desktop\bookmarks.html
  590. [2017-05-25 11:49:39 | 000,002,065 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes.lnk
  591. [2017-05-25 11:49:37 | 000,077,440 | ---- | C] () -- C:\Windows\SysNative\drivers\mbae64.sys
  592. [2017-05-25 11:23:16 | 000,000,456 | ---- | C] () -- C:\Windows\tasks\UCBrowserUpdater.job
  593. [2017-05-25 11:22:33 | 000,025,432 | ---- | C] () -- C:\Windows\SysNative\drivers\vcdrom.sys
  594. [2017-05-25 11:22:03 | 000,126,464 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\noah.dat
  595. [2017-05-25 11:22:03 | 000,070,800 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\Config.xml
  596. [2017-05-25 11:22:03 | 000,018,432 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\Main.dat
  597. [2017-05-25 11:22:03 | 000,005,568 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\md.xml
  598. [2017-05-25 11:22:02 | 007,306,240 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\agent.dat
  599. [2017-05-25 11:22:02 | 001,897,408 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\Joyin.tst
  600. [2017-05-25 11:21:55 | 000,140,800 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\installer.dat
  601. [2017-05-25 11:21:55 | 000,016,512 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\InstallationConfiguration.xml
  602. [2017-05-16 15:55:11 | 003,387,296 | ---- | C] () -- C:\Users\TOMEK\Documents\antoni_9.prproj
  603. [2017-05-16 14:26:09 | 003,387,296 | ---- | C] () -- C:\Users\TOMEK\Documents\antoni_8.prproj
  604. [2017-05-16 13:30:36 | 758,606,783 | ---- | C] () -- C:\Users\TOMEK\Desktop\DELFIN 50.mp4
  605. [2017-05-16 12:57:35 | 491,931,462 | ---- | C] () -- C:\Users\TOMEK\Desktop\kosciól dąbrówka.avi
  606. [2016-01-02 23:55:59 | 000,000,132 | ---- | C] () -- C:\Users\TOMEK\AppData\Roaming\Preferencje Adobe CS5 dla formatu AIFF
  607. [2015-12-14 12:55:47 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
  608. [2012-12-06 13:46:36 | 000,000,017 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\resmon.resmoncfg
  609. [2012-10-05 12:22:48 | 000,022,528 | ---- | C] () -- C:\Users\TOMEK\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
  610. [2012-09-25 16:38:02 | 000,000,132 | ---- | C] () -- C:\Users\TOMEK\AppData\Roaming\Preferencje Adobe CS5 dla formatu PNG
  611.  
  612. [color=#E56717]========== ZeroAccess Check ==========[/color]
  613.  
  614. [2009-07-14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
  615.  
  616. [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  617.  
  618. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  619.  
  620. [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
  621.  
  622. [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  623.  
  624. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
  625. "" = C:\Windows\SysNative\shell32.dll -- [2015-08-06 20:04:07 | 014,176,768 | ---- | M] (Microsoft Corporation)
  626. "ThreadingModel" = Apartment
  627.  
  628. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  629. "" = %SystemRoot%\system32\shell32.dll -- [2015-08-06 19:44:51 | 012,875,776 | ---- | M] (Microsoft Corporation)
  630. "ThreadingModel" = Apartment
  631.  
  632. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
  633. "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
  634. "ThreadingModel" = Free
  635.  
  636. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  637. "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
  638. "ThreadingModel" = Free
  639.  
  640. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
  641. "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
  642. "ThreadingModel" = Both
  643.  
  644. [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  645.  
  646. [color=#E56717]========== LOP Check ==========[/color]
  647.  
  648. [2012-09-26 15:55:11 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\ACD Systems
  649. [2012-10-04 14:24:31 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
  650. [2013-06-10 21:39:20 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\GHISLER
  651. [2012-06-26 13:37:40 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\PACE Anti-Piracy
  652. [2012-06-25 21:21:21 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\proDAD
  653. [2015-05-02 13:32:16 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\Red Giant Link
  654. [2012-06-24 00:58:22 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
  655. [2017-05-25 11:22:27 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\ServerTest
  656. [2012-06-23 23:09:13 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
  657. [2012-09-21 22:21:16 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\TeamViewer
  658. [2012-09-26 16:00:32 | 000,000,000 | ---D | M] -- C:\Users\TOMEK\AppData\Roaming\Thinstall
  659.  
  660. [color=#E56717]========== Purity Check ==========[/color]
  661.  
  662.  
  663.  
  664. [color=#E56717]========== Alternate Data Streams ==========[/color]
  665.  
  666. @Alternate Data Stream - 915 bytes -> C:\Users\TOMEK\AppData\Local\Temp:IaJlWQfvGLYZKGtlghbDZdYbw
  667. @Alternate Data Stream - 914 bytes -> C:\ProgramData\Microsoft:oEBV43lHqnig4PSPUqBUtcoR
  668. @Alternate Data Stream - 1091 bytes -> C:\ProgramData\Microsoft:3vUr4NxsdPPDdUIZYzBjo
  669. @Alternate Data Stream - 1009 bytes -> C:\ProgramData\Microsoft:Pb4MthYV2TtpxW8HML0YlMLBmXgC
  670.  
  671. < End of report >
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!