OTL logfile created on: 2014-12-22 10:58:38 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\MG\Downloads
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
 
2,61 Gb Total Physical Memory | 1,06 Gb Available Physical Memory | 40,52% Memory free
5,21 Gb Paging File | 3,40 Gb Available in Paging File | 65,21% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297,99 Gb Total Space | 268,79 Gb Free Space | 90,20% Space Free | Partition Type: NTFS
 
Computer Name: X | User Name: MG | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2014-12-22 06:12:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MG\Downloads\OTL.exe
PRC - [2014-12-21 20:50:06 | 001,880,752 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
PRC - [2014-12-21 19:56:24 | 000,106,248 | ---- | M] (SurfRight B.V.) -- C:\Program Files\HitmanPro\hmpsched.exe
PRC - [2014-11-26 17:40:18 | 000,337,520 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2014-11-06 11:23:28 | 014,268,328 | ---- | M] (Zemana Ltd.) -- C:\Program Files\AntiLogger\AntiLogger.exe
PRC - [2014-11-03 08:31:56 | 000,064,616 | ---- | M] (CyberGhost S.R.L) -- C:\Program Files\CyberGhost 5\Service.exe
PRC - [2014-10-26 15:52:28 | 000,508,744 | ---- | M] (QFX Software Corporation) -- C:\Program Files\KeyScrambler\KeyScrambler.exe
PRC - [2014-10-01 14:40:28 | 001,349,576 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2014-10-01 14:40:14 | 005,088,456 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2014-07-26 19:34:29 | 001,876,816 | ---- | M] (SurfRight B.V.) -- C:\Program Files\HitmanPro.Alert\hmpalert.exe
PRC - [2014-04-11 19:17:18 | 000,650,816 | ---- | M] (MyCity) -- C:\Program Files\MCShield\MCShieldRTM.exe
PRC - [2011-11-02 03:57:46 | 000,397,312 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2011-11-02 03:57:18 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2011-11-01 22:10:10 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
PRC - [2011-10-14 07:47:00 | 001,571,432 | ---- | M] (Realtek Semiconductor) -- C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
PRC - [2011-04-07 14:23:34 | 002,672,600 | ---- | M] (PC Tools) -- C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
PRC - [2011-01-24 13:23:14 | 000,286,000 | ---- | M] (PC Tools) -- C:\Program Files\PC Tools Firewall Plus\FWService.exe
PRC - [2010-07-09 22:45:00 | 000,984,400 | ---- | M] (Virage Logic Corporation / Sonic Focus) -- C:\Program Files\ASUS\ASUS Sonic Focus\SonicFocusTray.exe
PRC - [2009-07-14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009-07-14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - [2014-12-21 23:08:00 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\de8525cc2e6327337e1c6917352bfe16\WindowsFormsIntegration.ni.dll
MOD - [2014-12-21 23:04:15 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\39f5a71b5185d267b0f55cd4cea26d6b\PresentationFramework.Aero.ni.dll
MOD - [2014-12-21 22:56:18 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\7ce9d463a5d343fe74d6f181f9226cab\UIAutomationProvider.ni.dll
MOD - [2014-12-21 22:56:14 | 014,318,592 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\68e5eeb3c6ef18ba2dc1ad70eb74aeee\PresentationFramework.ni.dll
MOD - [2014-12-21 22:55:40 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\7b459c5815af8123e4bf30d4e05bba65\PresentationCore.ni.dll
MOD - [2014-12-21 22:55:14 | 003,313,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\c2f9dd7db911053edcaaadf5fefc500a\WindowsBase.ni.dll
MOD - [2014-12-21 22:54:43 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\1762137638019a091020b3baf52f6de3\System.Core.ni.dll
MOD - [2014-12-21 22:49:51 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\fedf1ba58dced4f0b3f8c457648ceed9\System.Windows.Forms.ni.dll
MOD - [2014-12-21 22:49:03 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ead6be8b410d56b5576b10e56af2c180\System.Drawing.ni.dll
MOD - [2014-12-21 22:48:59 | 011,804,160 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\3871fc2b96345aa6f3be81d9e3c97160\System.Web.ni.dll
MOD - [2014-12-21 22:48:42 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\4bdeb88758dccd625f4703ed77aaf348\System.Runtime.Remoting.ni.dll
MOD - [2014-12-21 22:48:21 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5dd9f783008543df3e642ff1e99de4e8\System.Xml.ni.dll
MOD - [2014-12-21 22:48:12 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\4b1350e31ff09cc583b34854816d8036\System.Configuration.ni.dll
MOD - [2014-12-21 22:48:04 | 007,949,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5ba3bf5367fc012300c6566f20cb7f54\System.ni.dll
MOD - [2014-12-21 22:47:48 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\8c1770d45c63cf5c462eeb945ef9aa5d\mscorlib.ni.dll
MOD - [2014-12-21 20:50:04 | 016,843,952 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_16_0_0_235.dll
MOD - [2014-11-26 17:40:44 | 003,758,192 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2014-08-16 23:55:06 | 000,008,704 | ---- | M] () -- C:\Users\MG\AppData\Roaming\Mozilla\Firefox\Profiles\6vxpse13.default\extensions\mintrayr@tn123.ath.cx\lib\tray_x86-msvc.dll
MOD - [2011-11-01 23:07:00 | 000,369,152 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2011-11-01 22:10:18 | 000,095,232 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
MOD - [2009-07-14 09:07:28 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_pl_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009-07-14 09:07:21 | 000,425,984 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_pl_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009-07-14 09:07:18 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_pl_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009-07-14 09:07:18 | 000,204,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_pl_b77a5c561934e089\System.resources.dll
 
 
[color=#E56717]========== Services (SafeList) ==========[/color]
 
SRV - [2014-12-21 19:56:24 | 000,106,248 | ---- | M] (SurfRight B.V.) [Auto | Running] -- C:\Program Files\HitmanPro\hmpsched.exe -- (HitmanProScheduler)
SRV - [2014-11-26 17:40:36 | 000,114,800 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014-11-03 08:31:56 | 000,064,616 | ---- | M] (CyberGhost S.R.L) [Auto | Running] -- C:\Program Files\CyberGhost 5\Service.exe -- (CGVPNCliService)
SRV - [2014-10-01 14:40:28 | 001,349,576 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2014-07-26 19:34:29 | 001,876,816 | ---- | M] (SurfRight B.V.) [Auto | Running] -- C:\Program Files\HitmanPro.Alert\hmpalert.exe -- (hmpalertsvc)
SRV - [2011-11-02 03:57:18 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2011-11-01 22:10:10 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV - [2011-01-24 13:23:14 | 000,286,000 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\PC Tools Firewall Plus\FWService.exe -- (PCToolsFirewallPlus)
SRV - [2009-07-14 02:16:19 | 000,348,672 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - [2009-07-14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009-07-14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - [2014-12-21 19:57:39 | 000,075,640 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hmpalert.sys -- (hmpalert)
DRV - [2014-12-21 17:51:03 | 000,080,104 | ---- | M] (Zemana Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\AntiLog32.sys -- (AntiLog32)
DRV - [2014-11-18 14:39:06 | 000,015,968 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\epmntdrv.sys -- (epmntdrv)
DRV - [2014-11-18 14:39:06 | 000,010,208 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2014-10-10 08:59:12 | 000,191,928 | ---- | M] (ESET) [File_System | System | Running] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm)
DRV - [2014-10-10 08:59:12 | 000,190,368 | ---- | M] (ESET) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\edevmon.sys -- (edevmon)
DRV - [2014-10-10 08:59:12 | 000,135,296 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2014-10-10 08:59:12 | 000,123,424 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV - [2014-09-10 00:18:30 | 000,050,200 | ---- | M] (Emsisoft GmbH) [File_System | On_Demand | Stopped] -- C:\EEK\bin\cleanhlp32.sys -- (cleanhlp)
DRV - [2013-08-22 13:40:22 | 000,035,288 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)
DRV - [2013-05-31 15:53:18 | 000,209,016 | ---- | M] (QFX Software Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\keyscrambler.sys -- (KeyScrambler)
DRV - [2011-11-02 05:43:50 | 008,599,040 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2011-11-02 03:18:22 | 000,257,024 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2011-10-17 18:40:44 | 000,085,520 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2011-10-14 18:04:40 | 000,014,720 | ---- | M] (ASUSTek Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AiCharger.sys -- (AiCharger)
DRV - [2011-06-27 01:37:12 | 002,191,872 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2011-03-02 12:40:54 | 000,160,576 | ---- | M] (PC Tools) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\PCTAppEvent.sys -- (PCTAppEvent)
DRV - [2011-01-17 09:10:26 | 000,251,560 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\pctgntdi.sys -- (pctgntdi)
DRV - [2011-01-17 08:11:12 | 000,125,248 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctplfw.sys -- (pctplfw)
DRV - [2011-01-12 10:36:22 | 000,089,472 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctNdis-PacketFilter.sys -- (PCTFW-PacketFilter)
DRV - [2010-11-29 09:50:40 | 000,035,968 | R--- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbfilter.sys -- (usbfilter)
DRV - [2010-07-08 08:49:10 | 000,057,536 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctNdis.sys -- (pctNdisMP)
DRV - [2010-07-08 08:49:10 | 000,057,536 | ---- | M] (PC Tools) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctNdis.sys -- (pctNdis)
DRV - [2010-02-18 09:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
 
 
 
 
IE - HKU\S-1-5-21-2226444264-1822766488-2759232319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pl-pl/?ocid=iehp
IE - HKU\S-1-5-21-2226444264-1822766488-2759232319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = pl
IE - HKU\S-1-5-21-2226444264-1822766488-2759232319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 40 CB 4E B0 38 1D D0 01  [binary data]
IE - HKU\S-1-5-21-2226444264-1822766488-2759232319-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2226444264-1822766488-2759232319-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2226444264-1822766488-2759232319-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.search.isUS: false
FF - prefs.js..browser.search.openintab: true
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledAddons: %7B4176DFF4-4698-11DE-BEEB-45DA55D89593%7D:0.8.40
FF - prefs.js..extensions.enabledAddons: trafficlight%40bitdefender.com:0.2.17
FF - prefs.js..extensions.enabledAddons: movableAppButton%40Merci.chao:1.4
FF - prefs.js..extensions.enabledAddons: %7B5F590AA2-1221-4113-A6F4-A4BB62414FAC%7D:0.45.8.20130519.3
FF - prefs.js..extensions.enabledAddons: mintrayr%40tn123.ath.cx:1.1.2
FF - prefs.js..extensions.enabledAddons: %7BDDC359D1-844A-42a7-9AA1-88A850A938A8%7D:2.0.17
FF - prefs.js..extensions.enabledAddons: %7B3d7eb24f-2740-49df-8937-200b1cc08f8a%7D:1.5.18
FF - prefs.js..extensions.enabledAddons: info%40djzig.com:2.3.1
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.type: 0
 
FF - user.js..browser.search.openintab: true
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 34.0.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 34.0.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2014-12-21 20:35:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\Extensions
[2014-12-21 20:48:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\Firefox\Profiles\6vxpse13.default\extensions
[2014-12-21 20:37:59 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\MG\AppData\Roaming\mozilla\Firefox\Profiles\6vxpse13.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2014-12-21 20:37:02 | 000,000,000 | ---D | M] (LavaFox V2) -- C:\Users\MG\AppData\Roaming\mozilla\Firefox\Profiles\6vxpse13.default\extensions\info@djzig.com
[2014-12-21 20:37:04 | 000,000,000 | ---D | M] (MinimizeToTray revived (MinTrayR)) -- C:\Users\MG\AppData\Roaming\mozilla\Firefox\Profiles\6vxpse13.default\extensions\mintrayr@tn123.ath.cx
[2014-12-21 20:48:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\Firefox\Profiles\6vxpse13.default\extensions\staged
[2014-08-16 23:59:14 | 000,114,352 | ---- | M] () (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\firefox\profiles\6vxpse13.default\extensions\compatibility@addons.mozilla.org.xpi
[2014-10-16 17:58:00 | 001,443,602 | ---- | M] () (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\firefox\profiles\6vxpse13.default\extensions\firefox@ghostery.com.xpi
[2014-09-21 18:10:58 | 000,082,295 | ---- | M] () (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\firefox\profiles\6vxpse13.default\extensions\jid0-9XfBwUWnvPx4wWsfBWMCm4Jj69E@jetpack.xpi
[2014-08-17 00:03:42 | 000,003,323 | ---- | M] () (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\firefox\profiles\6vxpse13.default\extensions\movableAppButton@Merci.chao.xpi
[2014-08-17 00:03:42 | 000,897,750 | ---- | M] () (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\firefox\profiles\6vxpse13.default\extensions\trafficlight@bitdefender.com.xpi
[2014-08-17 00:03:42 | 000,222,800 | ---- | M] () (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\firefox\profiles\6vxpse13.default\extensions\{4176DFF4-4698-11DE-BEEB-45DA55D89593}.xpi
[2014-08-17 00:54:38 | 000,043,024 | ---- | M] () (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\firefox\profiles\6vxpse13.default\extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}.xpi
[2014-12-21 20:48:22 | 000,194,991 | ---- | M] () (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\firefox\profiles\6vxpse13.default\extensions\{c4d362ec-1cff-4ca0-9031-99a8fad7995a}.xpi
[2014-11-16 16:39:02 | 000,979,699 | ---- | M] () (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\firefox\profiles\6vxpse13.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014-09-14 14:05:00 | 000,731,942 | ---- | M] () (No name found) -- C:\Users\MG\AppData\Roaming\mozilla\firefox\profiles\6vxpse13.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2014-12-21 20:34:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2014-12-21 20:34:07 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
O1 HOSTS File: ([2009-06-10 22:39:37 | 000,000,824 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O4 - HKLM..\Run: [00PCTFW] C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
O4 - HKLM..\Run: [AntiLogger] C:\Program Files\AntiLogger\AntiLogger.exe (Zemana Ltd.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [KeyScrambler] C:\Program Files\KeyScrambler\keyscrambler.exe (QFX Software Corporation)
O4 - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SonicMasterTray] C:\Program Files\ASUS\ASUS Sonic Focus\SonicFocusTray.exe (Virage Logic Corporation / Sonic Focus)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-2226444264-1822766488-2759232319-1000..\Run: [MCShield Monitor] C:\Program Files\MCShield\MCShieldRTM.exe (MyCity)
O4 - HKU\.DEFAULT..\RunOnce: [SPReview] C:\Windows\System32\SPReview\SPReview.exe (Microsoft Corporation)
O4 - HKU\S-1-5-18..\RunOnce: [SPReview] C:\Windows\System32\SPReview\SPReview.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPropertiesMyComputer = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFileAssociate = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 0
O7 - HKU\S-1-5-21-2226444264-1822766488-2759232319-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{95F532BC-79F1-46EF-AF29-A17FFAA293B7}: DhcpNameServer = 192.168.0.254
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-06-10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2014-12-22 11:00:10 | 000,000,000 | ---D | C] -- C:\FRST
[2014-12-22 10:26:41 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2014-12-22 10:18:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2014-12-22 09:36:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2014-12-22 09:29:40 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2014-12-22 06:45:25 | 000,000,000 | ---D | C] -- C:\Windows\CheckSur
[2014-12-22 06:21:26 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\ElevatedDiagnostics
[2014-12-22 05:37:32 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Geckofx
[2014-12-22 01:48:57 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\CyberGhost
[2014-12-21 22:22:37 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\Macromedia
[2014-12-21 22:22:37 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Macromedia
[2014-12-21 22:22:37 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\Adobe
[2014-12-21 22:15:43 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\Ashampoo Photo Commander 11
[2014-12-21 22:09:40 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Microsoft Games
[2014-12-21 22:08:33 | 000,000,000 | RHSD | C] -- C:\grubfiles
[2014-12-21 22:08:33 | 000,000,000 | RHSD | C] -- C:\BOOT
[2014-12-21 22:08:31 | 000,000,000 | RHSD | C] -- C:\sources
[2014-12-21 22:07:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Keriver 1-Click Restore Free
[2014-12-21 22:06:43 | 000,000,000 | ---D | C] -- C:\Program Files\Keriver 1-Click Restore Free
[2014-12-21 22:02:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Partition Master 10.2
[2014-12-21 22:01:17 | 000,000,000 | ---D | C] -- C:\Program Files\EaseUS
[2014-12-21 22:00:59 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\ESET
[2014-12-21 21:18:44 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\Ashampoo
[2014-12-21 21:18:43 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\CrashRpt
[2014-12-21 21:17:13 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\ashampoo
[2014-12-21 21:01:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
[2014-12-21 21:00:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Ashampoo
[2014-12-21 21:00:10 | 000,028,160 | ---- | C] (mst software GmbH, Germany) -- C:\Windows\System32\DfSdkBt.exe
[2014-12-21 20:59:19 | 000,000,000 | ---D | C] -- C:\Program Files\Ashampoo
[2014-12-21 20:49:00 | 000,701,616 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2014-12-21 20:48:59 | 000,071,344 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2014-12-21 20:48:52 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed
[2014-12-21 20:42:32 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2014-12-21 20:37:50 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\PCToolsFirewallPlus
[2014-12-21 20:34:52 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\Mozilla
[2014-12-21 20:34:52 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Mozilla
[2014-12-21 20:34:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2014-12-21 20:34:26 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2014-12-21 20:34:00 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2014-12-21 20:28:10 | 000,000,000 | ---D | C] -- C:\Program Files\TAP-Windows
[2014-12-21 20:26:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberGhost 5
[2014-12-21 20:25:46 | 000,000,000 | ---D | C] -- C:\Program Files\CyberGhost 5
[2014-12-21 20:24:58 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Programs
[2014-12-21 20:23:34 | 000,218,592 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTCore.sys
[2014-12-21 20:23:34 | 000,160,576 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTAppEvent.sys
[2014-12-21 20:22:55 | 000,251,560 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctgntdi.sys
[2014-12-21 20:22:55 | 000,105,280 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctwfpfilter.sys
[2014-12-21 20:21:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
[2014-12-21 20:21:50 | 000,000,000 | ---D | C] -- C:\Program Files\Elaborate Bytes
[2014-12-21 20:13:33 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2014-12-21 20:12:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Tools Firewall Plus
[2014-12-21 20:12:52 | 000,089,472 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctNdis-PacketFilter.sys
[2014-12-21 20:12:52 | 000,057,536 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctNdis.sys
[2014-12-21 20:12:52 | 000,032,808 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctNdis-DNS.sys
[2014-12-21 20:12:52 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2014-12-21 20:12:48 | 000,125,248 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\pctplfw.sys
[2014-12-21 20:12:36 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools Firewall Plus
[2014-12-21 20:10:55 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\QFX Software
[2014-12-21 20:10:55 | 000,000,000 | ---D | C] -- C:\ProgramData\QFX Software
[2014-12-21 20:10:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeyScrambler
[2014-12-21 20:09:58 | 000,209,016 | ---- | C] (QFX Software Corporation) -- C:\Windows\System32\drivers\keyscrambler.sys
[2014-12-21 20:09:46 | 000,000,000 | ---D | C] -- C:\Program Files\KeyScrambler
[2014-12-21 20:01:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
[2014-12-21 20:01:19 | 000,000,000 | ---D | C] -- C:\Program Files\MozBackup
[2014-12-21 19:59:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield
[2014-12-21 19:58:53 | 000,000,000 | ---D | C] -- C:\ProgramData\MCShield
[2014-12-21 19:58:53 | 000,000,000 | ---D | C] -- C:\Program Files\MCShield
[2014-12-21 19:57:43 | 000,000,000 | ---D | C] -- C:\Windows\CryptoGuard
[2014-12-21 19:57:39 | 000,477,008 | ---- | C] (SurfRight) -- C:\Windows\System32\hmpalert.dll
[2014-12-21 19:57:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro.Alert
[2014-12-21 19:57:36 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro.Alert
[2014-12-21 19:56:23 | 000,000,000 | ---D | C] -- C:\Program Files\HitmanPro
[2014-12-21 19:55:04 | 000,155,400 | ---- | C] (SurfRight B.V.) -- C:\Windows\System32\LnkProtect.dll
[2014-12-21 19:54:56 | 000,000,000 | ---D | C] -- C:\EEK
[2014-12-21 19:54:52 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2014-12-21 19:53:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2014-12-21 19:53:47 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2014-12-21 17:51:03 | 000,080,104 | ---- | C] (Zemana Ltd.) -- C:\Windows\System32\drivers\AntiLog32.sys
[2014-12-21 17:51:03 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Zemana
[2014-12-21 17:50:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiLogger
[2014-12-21 17:50:56 | 000,000,000 | ---D | C] -- C:\Program Files\AntiLogger
[2014-12-21 17:48:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eset
[2014-12-21 17:48:39 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET
[2014-12-21 17:48:39 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2014-12-21 17:46:14 | 000,000,000 | ---D | C] -- C:\Windows\System32\catroot2
[2014-12-21 17:17:31 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2014-12-21 03:55:56 | 000,000,000 | R--D | C] -- C:\Users\MG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2014-12-21 03:55:56 | 000,000,000 | R--D | C] -- C:\Users\MG\Searches
[2014-12-21 03:55:56 | 000,000,000 | R--D | C] -- C:\Users\MG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2014-12-21 03:55:46 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\Identities
[2014-12-21 03:55:43 | 000,000,000 | R--D | C] -- C:\Users\MG\Contacts
[2014-12-21 03:55:34 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\VirtualStore
[2014-12-21 03:55:32 | 000,000,000 | --SD | C] -- C:\Users\MG\AppData\Roaming\Microsoft
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\Videos
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\Saved Games
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\Pictures
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\Music
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\Links
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\Favorites
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\Downloads
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\Documents
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\Desktop
[2014-12-21 03:55:32 | 000,000,000 | R--D | C] -- C:\Users\MG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\Ustawienia lokalne
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\AppData\Local\Temporary Internet Files
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\Szablony
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\SendTo
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\Recent
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\PrintHood
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\NetHood
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\Documents\Moje wideo
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\Documents\Moje obrazy
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\Moje dokumenty
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\Documents\Moja muzyka
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\Menu Start
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\AppData\Local\Historia
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\Dane aplikacji
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\AppData\Local\Dane aplikacji
[2014-12-21 03:55:32 | 000,000,000 | -HSD | C] -- C:\Users\MG\Cookies
[2014-12-21 03:55:32 | 000,000,000 | -H-D | C] -- C:\Users\MG\AppData
[2014-12-21 03:55:32 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Temp
[2014-12-21 03:55:32 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Microsoft
[2014-12-21 03:55:32 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\Media Center Programs
[2014-12-21 03:55:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Ulubione
[2014-12-21 03:55:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Szablony
[2014-12-21 03:55:16 | 000,000,000 | -HSD | C] -- C:\Recovery
[2014-12-21 03:55:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Pulpit
[2014-12-21 03:55:16 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moje wideo
[2014-12-21 03:55:16 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moje obrazy
[2014-12-21 03:55:16 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moja muzyka
[2014-12-21 03:55:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Menu Start
[2014-12-21 03:55:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumenty
[2014-12-21 03:55:16 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dane aplikacji
[2014-12-20 21:25:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2014-12-20 21:25:22 | 000,000,000 | ---D | C] -- C:\ProgramData\USBChargerPlus
[2014-12-20 21:24:15 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Works
[2014-12-20 21:23:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio
[2014-12-20 21:23:35 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2014-12-20 21:23:05 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Apps
[2014-12-20 21:21:23 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Microsoft Help
[2014-12-20 21:21:18 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2014-12-20 21:21:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2014-12-20 21:19:31 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2014-12-20 21:05:50 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2014-12-20 21:05:46 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\AMD
[2014-12-20 21:05:38 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Roaming\ATI
[2014-12-20 21:05:38 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\ATI
[2014-12-20 21:05:38 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2014-12-20 21:04:53 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
[2014-12-20 21:04:19 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHost.exe
[2014-12-20 21:04:19 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PresentationHostProxy.dll
[2014-12-20 21:04:19 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netfxperf.dll
[2014-12-20 21:02:18 | 000,000,000 | ---D | C] -- C:\Program Files\AMD APP
[2014-12-20 21:02:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2014-12-20 21:02:03 | 000,035,968 | R--- | C] (Advanced Micro Devices) -- C:\Windows\System32\drivers\usbfilter.sys
[2014-12-20 21:02:03 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2014-12-20 21:01:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2014-12-20 21:00:21 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2014-12-20 21:00:16 | 000,037,944 | ---- | C] (Advanced Micro Devices) -- C:\Windows\System32\drivers\amdiox86.sys
[2014-12-20 21:00:04 | 000,085,520 | ---- | C] (Advanced Micro Devices) -- C:\Windows\System32\drivers\AtihdW73.sys
[2014-12-20 20:59:51 | 000,466,944 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\System32\ATIDEMGX.dll
[2014-12-20 20:59:51 | 000,052,736 | ---- | C] (AMD) -- C:\Windows\System32\coinst.dll
[2014-12-20 20:58:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS Utility
[2014-12-20 20:58:23 | 000,000,000 | ---D | C] -- C:\Users\MG\AppData\Local\Downloaded Installations
[2014-12-20 20:58:21 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2014-12-20 20:58:19 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2014-12-20 20:58:13 | 000,000,000 | ---D | C] -- C:\ProgramData\SonicFocus
[2014-12-20 20:58:04 | 000,000,000 | ---D | C] -- C:\Windows\System32\RTCOM
[2014-12-20 20:57:34 | 001,783,056 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\WavesLib.dll
[2014-12-20 20:57:34 | 000,345,328 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSXT.dll
[2014-12-20 20:57:34 | 000,214,368 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFNHK.dll
[2014-12-20 20:57:34 | 000,214,352 | ---- | C] (Sonic Focus, Inc.) -- C:\Windows\System32\SFFXProc.dll
[2014-12-20 20:57:34 | 000,185,584 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSHD.dll
[2014-12-20 20:57:34 | 000,173,296 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSHP360.dll
[2014-12-20 20:57:34 | 000,140,528 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSWOW.dll
[2014-12-20 20:57:34 | 000,078,672 | ---- | C] (Sonic Focus, Inc.) -- C:\Windows\System32\SFFXComm.dll
[2014-12-20 20:57:34 | 000,074,080 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFCOM.dll
[2014-12-20 20:57:34 | 000,074,064 | ---- | C] (Sonic Focus, Inc.) -- C:\Windows\System32\SFFXSAPO.dll
[2014-12-20 20:57:34 | 000,074,064 | ---- | C] (Sonic Focus, Inc.) -- C:\Windows\System32\SFFXHAPO.dll
[2014-12-20 20:57:34 | 000,074,064 | ---- | C] (Sonic Focus, Inc.) -- C:\Windows\System32\SFFXDAPO.dll
[2014-12-20 20:57:33 | 002,276,968 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkPgExt.dll
[2014-12-20 20:57:33 | 000,068,960 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFAPO.dll
[2014-12-20 20:57:28 | 000,083,048 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkCoInst.dll
[2014-12-20 20:57:27 | 001,329,768 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkApoApi.dll
[2014-12-20 20:57:26 | 004,238,440 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkAPO.dll
[2014-12-20 20:57:24 | 001,497,704 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RTSndMgr.cpl
[2014-12-20 20:57:24 | 000,359,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEP32A.dll
[2014-12-20 20:57:24 | 000,170,840 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEED32A.dll
[2014-12-20 20:57:24 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEL32A.dll
[2014-12-20 20:57:24 | 000,064,856 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEG32A.dll
[2014-12-20 20:57:23 | 001,873,920 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RCoRes.dat
[2014-12-20 20:57:23 | 000,295,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DHT32.dll
[2014-12-20 20:57:23 | 000,295,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DAA32.dll
[2014-12-20 20:57:22 | 001,836,376 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioEQ.dll
[2014-12-20 20:57:22 | 000,232,792 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO20.dll
[2014-12-20 20:57:22 | 000,132,368 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO.dll
[2014-12-20 20:57:18 | 001,740,352 | ---- | C] (Fortemedia Corporation) -- C:\Windows\System32\FMAPO.dll
[2014-12-20 20:57:17 | 001,509,480 | ---- | C] (DTS) -- C:\Windows\System32\DTSS2SpeakerDLL.dll
[2014-12-20 20:57:17 | 001,292,904 | ---- | C] (DTS) -- C:\Windows\System32\DTSS2HeadphoneDLL.dll
[2014-12-20 20:57:17 | 000,601,704 | ---- | C] (DTS) -- C:\Windows\System32\DTSVoiceClarityDLL.dll
[2014-12-20 20:57:17 | 000,458,344 | ---- | C] (DTS) -- C:\Windows\System32\DTSNeoPCDLL.dll
[2014-12-20 20:57:17 | 000,375,400 | ---- | C] (DTS) -- C:\Windows\System32\DTSLimiterDLL.dll
[2014-12-20 20:57:17 | 000,218,216 | ---- | C] (DTS) -- C:\Windows\System32\DTSLFXAPO.dll
[2014-12-20 20:57:16 | 001,220,200 | ---- | C] (DTS) -- C:\Windows\System32\DTSBoostDLL.dll
[2014-12-20 20:57:16 | 000,654,952 | ---- | C] (DTS) -- C:\Windows\System32\DTSBassEnhancementDLL.dll
[2014-12-20 20:57:16 | 000,389,736 | ---- | C] (DTS) -- C:\Windows\System32\DTSGainCompensatorDLL.dll
[2014-12-20 20:57:16 | 000,218,728 | ---- | C] (DTS) -- C:\Windows\System32\DTSGFXAPO.dll
[2014-12-20 20:57:15 | 000,175,200 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\System32\AERTACap.dll
[2014-12-20 20:57:15 | 000,096,160 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\System32\AERTARen.dll
[2014-12-20 20:57:15 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2014-12-20 20:57:14 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2014-12-20 20:57:09 | 000,000,000 | -H-D | C] -- C:\Program Files\Temp
[2014-12-20 20:57:08 | 001,698,408 | R--- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll
[2014-12-20 20:57:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2014-12-20 20:56:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Asus
[2014-12-20 20:56:16 | 000,000,000 | ---D | C] -- C:\Program Files\ASUS
[2014-12-20 20:55:47 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2014-12-20 20:40:46 | 000,000,000 | ---D | C] -- C:\Windows\System32\MRT
[2014-12-20 20:38:26 | 000,123,904 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\poqexec.exe
[2014-12-20 20:38:25 | 002,377,216 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2014-12-20 20:38:22 | 003,957,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2014-12-20 20:38:22 | 003,901,824 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2014-12-20 20:28:06 | 000,229,000 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2014-12-20 20:25:19 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2014-12-20 20:25:19 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2014-12-20 20:25:10 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2014-12-20 20:25:10 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2014-12-20 20:25:10 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2014-12-20 20:25:01 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2014-12-20 20:25:01 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2014-12-20 18:45:26 | 000,000,000 | -H-D | C] -- C:\Windows\Prefetch
[2014-12-20 18:45:02 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2014-12-20 18:44:01 | 000,000,000 | -H-D | C] -- C:\Windows\Panther
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2014-12-22 10:53:12 | 000,015,280 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014-12-22 10:53:12 | 000,015,280 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014-12-22 10:45:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014-12-22 10:45:01 | 2097,979,392 | -HS- | M] () -- C:\hiberfil.sys
[2014-12-22 05:51:51 | 000,336,888 | -H-- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2014-12-21 22:38:27 | 000,155,400 | ---- | M] (SurfRight B.V.) -- C:\Windows\System32\LnkProtect.dll
[2014-12-21 22:08:33 | 000,383,562 | RHS- | M] () -- C:\ZHNTLDR
[2014-12-21 22:08:33 | 000,217,769 | RHS- | M] () -- C:\zhgrldr
[2014-12-21 22:08:33 | 000,000,000 | RHS- | M] () -- C:\Windows\System32\mszhsdmf.srg
[2014-12-21 22:08:31 | 000,000,449 | RHS- | M] () -- C:\menu.lst
[2014-12-21 20:50:06 | 000,701,616 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2014-12-21 20:50:06 | 000,071,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2014-12-21 19:57:39 | 000,477,008 | ---- | M] (SurfRight) -- C:\Windows\System32\hmpalert.dll
[2014-12-21 19:57:39 | 000,075,640 | ---- | M] () -- C:\Windows\System32\drivers\hmpalert.sys
[2014-12-21 17:51:03 | 000,080,104 | ---- | M] (Zemana Ltd.) -- C:\Windows\System32\drivers\AntiLog32.sys
[2014-12-20 21:08:25 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2014-12-20 20:47:06 | 000,000,057 | -H-- | M] () -- C:\Windows\System32\mapisvc.inf
[2014-12-20 19:58:28 | 000,687,828 | -H-- | M] () -- C:\Windows\System32\perfh015.dat
[2014-12-20 19:58:28 | 000,607,190 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2014-12-20 19:58:28 | 000,131,382 | -H-- | M] () -- C:\Windows\System32\perfc015.dat
[2014-12-20 19:58:28 | 000,103,568 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2014-12-20 18:49:35 | 000,067,517 | -H-- | M] () -- C:\Windows\System32\license.rtf
[2014-12-20 18:47:25 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2014-11-24 14:04:58 | 000,229,000 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2014-12-21 22:08:33 | 000,383,562 | RHS- | C] () -- C:\ZHNTLDR
[2014-12-21 22:08:33 | 000,217,769 | RHS- | C] () -- C:\zhgrldr
[2014-12-21 22:08:33 | 000,000,000 | RHS- | C] () -- C:\Windows\System32\mszhsdmf.srg
[2014-12-21 22:08:31 | 000,000,449 | RHS- | C] () -- C:\menu.lst
[2014-12-21 22:01:48 | 000,021,088 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll
[2014-12-21 22:01:47 | 002,502,240 | ---- | C] () -- C:\Windows\System32\BootMan.exe
[2014-12-21 22:01:47 | 000,088,160 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe
[2014-12-21 22:01:47 | 000,015,968 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys
[2014-12-21 22:01:47 | 000,010,208 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys
[2014-12-21 20:34:41 | 000,001,121 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2014-12-21 19:57:39 | 000,075,640 | ---- | C] () -- C:\Windows\System32\drivers\hmpalert.sys
[2014-12-21 03:56:07 | 000,001,425 | ---- | C] () -- C:\Users\MG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2014-12-20 21:08:25 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2014-12-20 20:59:51 | 000,198,664 | ---- | C] () -- C:\Windows\System32\atiapfxx.blb
[2014-12-20 20:59:51 | 000,003,929 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2014-12-20 20:59:40 | 000,035,707 | ---- | C] () -- C:\Windows\atiogl.xml
[2014-12-20 20:57:23 | 000,150,996 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2014-12-20 18:47:25 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2014-12-20 18:45:02 | 2097,979,392 | -HS- | C] () -- C:\hiberfil.sys
 
[color=#E56717]========== ZeroAccess Check ==========[/color]
 
[2009-07-14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2009-07-14 02:16:14 | 012,866,560 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009-07-14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009-07-14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2014-12-21 21:55:33 | 000,000,000 | ---D | M] -- C:\Users\MG\AppData\Roaming\Ashampoo
[2014-12-21 22:15:43 | 000,000,000 | ---D | M] -- C:\Users\MG\AppData\Roaming\Ashampoo Photo Commander 11
[2014-12-21 20:39:05 | 000,000,000 | ---D | M] -- C:\Users\MG\AppData\Roaming\PCToolsFirewallPlus
[2014-12-21 20:10:55 | 000,000,000 | ---D | M] -- C:\Users\MG\AppData\Roaming\QFX Software
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:C31F31E6

< End of report >