Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash

[MD5.6DD7175EE1C04C805941D96E9A64926E] [APT] [AutoKMS] (.CODYQX4.) -- C:\Windows\AutoKMS\AutoKMS.exe   [5046784]  =>HackTool.AutoKMS
[MD5.00000000000000000000000000000000] [APT] [Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA)] (...) -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe (.not file.)
O39 - APT: AutoKMS - (.CODYQX4.) -- C:\WINDOWS\System32\Tasks\AutoKMS  [2796]   =>HackTool.AutoKMS
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} Orphean =>.Microsoft Internet Explorer
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{12a26821-dc97-4acb-9aa5-8d23dbdbbe24}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1FBE80CF-13DA-496A-B15A-8ED49CFF80F2}: NameServer = 62.251.230.241 212.217.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{b8bc26e1-116a-44e9-826d-44c1ad98f0b0}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{243d1eec-afbb-4ea1-a6d9-545055d0a7cb}: DhcpDomain = hi.link
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{998bd34e-3e53-4edb-a5c9-7d98d2d72b8b}: DhcpDomain = hi.link
HKCU\SOFTWARE\ESET
O43 - CFD: 24/11/2015 - [] D -- C:\ProgramData\Microsoft Toolkit  =>HackTool.AutoKMS
O43 - CFD: 29/10/2015 - [] D -- C:\Users\pc\AppData\Local\ESET
O43 - CFD: 29/01/2016 - [] D -- C:\Users\pc\AppData\Local\Temp
O43 - CFD: 29/11/2015 - [0] SHD -- C:\Users\pc\AppData\Local\Temporary Internet Files
O43 - CFD: 10/11/2015 - [] D -- C:\Users\pc\AppData\Local\_
C:\Windows\AutoKMS\AutoKMS.exe  =>HackTool.AutoKMS
C:\WINDOWS\System32\Tasks\AutoKMS  =>HackTool.AutoKMS
C:\ProgramData\Microsoft Toolkit  =>HackTool.AutoKMS