Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

adware pricechop a browser!shopa

Návody, recenze, diskuze, řešení problémů

Moderátor: Moderátoři

Pravidla fóra
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
xaby
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 20 čer 2014 16:38

adware pricechop a browser!shopa

#1 Příspěvek od xaby »

Ahojte lidi :) Už delší dobu mám menší problém..Omylem jsem nainstaloval špatný program a vznikl trojský kůn 3x ale všechny jsem pomocí mého antiviru vymazal.Ale nějak se tomu podařilo přidat adware "pricechop" a "browser!shopa".Zkoušel jsem ho odinstalovat,no v nainstalovaných programech to není.Pricechop se mi teda nakonec podařilo odstranit ale byl úplně pod jiným jménem... Ale ten browser!shopa stále není pryč :(Jestli někdo ví,jak to odstranit,napište mi prosím :)


Jo a nehejtujte že jsem dal tento topic do špatné sekce,jsem nováček a nevím,kam ho dát ...
Jestli bude přesunut,napiště mi :)
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: adware pricechop a browser!shopa

#2 Příspěvek od vyosek »

Zdravim :)

:arrow: Ja na zaver tema presunu do spravne sekce

:arrow: Pro zacatek dejte log z RSIT http://forum.viry.cz/viewtopic.php?f=24&t=130784
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
xaby
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 20 čer 2014 16:38

Re: adware pricechop a browser!shopa

#3 Příspěvek od xaby »

Tady to je :
Logfile of random's system information tool 1.10 (written by random/random)
Run by vlastnik at 2014-08-18 17:11:46
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 385 GB (83%) free of 463 GB
Total RAM: 3948 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:11:54, on 18.8.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17239)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Launch Manager\LMworker.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\vlastnik.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://feed.helperbar.com/?p=mKO_AwFzXI ... earchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://feed.helperbar.com/?p=mKO_AwFzXI ... earchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.gboxapp.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.helperbar.com/?p=mKO_AwFzXI ... earchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.helperbar.com/?p=mKO_AwFzXI ... earchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Adblocker - {56916722-3657-ECBE-6DC5-668640C6519C} - C:\Program Files (x86)\Adblocker\s6um.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll
O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)
O4 - HKLM\..\Run: [msfbpvSrv] C:\Windows\inf\msfbpv.vbe
O4 - HKLM\..\Run: [msasumurSrv] C:\Windows\inf\msasumur.vbe
O4 - HKLM\..\Run: [msqhlabxSrv] C:\Windows\inf\msqhlabx.vbe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LiveSupport] "C:\Program Files (x86)\LiveSupport\LiveSupport.exe" /noshow /log
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid} (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [IsMyWinLockerReboot] msiexec.exe /qn /x{voidguid} (User 'Default user')
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs:
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Dritek WMI Service (DsiWMIService) - Dritek System Inc. - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EgisTec Ticket Service - Egis Technology Inc. - C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GREGService - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NTI IScheduleSvc - NTI Corporation - C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: Run software as Windows service (runaservice) - Unknown owner - C:\Users\vlastnik\AppData\Roaming\KAWin\runaservice.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11480 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\Explorer.EXE
"C:\Windows\system32\Dwm.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"taskhost.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe" /service
"C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe" /service
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Launch Manager\dsiwmis.exe"
"C:\Program Files (x86)\Acer\Registration\GREGsvc.exe"
"C:\Program Files (x86)\Launch Manager\LMworker.exe"
"C:\Program Files (x86)\Launch Manager\LMutilps32.exe" --system-level-mutex="Local\{B904A927-FE6B-48fd-8C83-6B807BED1F9C}"
"C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe"
C:\Users\vlastnik\AppData\Roaming\KAWin\runaservice.exe
C:\Users\vlastnik\AppData\Roaming\KAWin\Console.exe
taskeng.exe {65E47588-96AF-4732-A198-4B51124BB8B7}
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe"
"C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\igfxext.exe -Embedding
C:\Windows\system32\igfxsrvc.exe -Embedding
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Program Files\EgisTec IPS\PMMUpdate.exe"
"C:\Program Files\EgisTec IPS\EgisUpdate.exe"
C:\Windows\servicing\TrustedInstaller.exe
taskeng.exe {F44204B4-64B4-4B4C-AD51-7DBC201DF8C7}
taskeng.exe {03C047D9-EAA9-49FE-8978-95870322FED7}

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="3512.0.810935129\1080742476" --disable-d3d11 --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,5,16 --disable-accelerated-video-decode --gpu-vendor-id=0x8086 --gpu-device-id=0x0106 --gpu-driver-vendor="Intel Corporation" --gpu-driver-version=8.15.10.2342 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutoReloadExperiment/Disabled/BrowserBlacklist/Enabled/ChromeSuggestions/ML Kodachrome dev/EmbeddedSearch/Group5 dev:r1 prefetch_results:1 reuse_instant_search_base_page:1 prerender_instant_url_on_omnibox_focus:1 allow_prefetch_non_default_match:1/EnhancedBookmarks/Default/ExtensionInstallVerification/None/GoogleNow/Enable/HpackHuffmanAggregator/Disabled/Prerender/PrerenderMulti/PrerenderLocalPredictorSpec/cd=3:LocalPredictor=Disabled/SDCH/EnabledAll/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/group_01/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-1-Percent/group_94/UMA-Uniformity-Trial-10-Percent/default/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/WindowsLogoffRace/WindowsLogoffRace/" --extension-process --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --disable-accelerated-video-decode --channel="3512.2.1440882053\311111197" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutoReloadExperiment/Disabled/BrowserBlacklist/Enabled/ChromeSuggestions/ML Kodachrome dev/EmbeddedSearch/Group5 dev:r1 prefetch_results:1 reuse_instant_search_base_page:1 prerender_instant_url_on_omnibox_focus:1 allow_prefetch_non_default_match:1/EnhancedBookmarks/Default/ExtensionInstallVerification/None/GoogleNow/Enable/HpackHuffmanAggregator/Disabled/Prerender/PrerenderMulti/PrerenderLocalPredictorSpec/cd=3:LocalPredictor=Disabled/SDCH/EnabledAll/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/group_01/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-1-Percent/group_94/UMA-Uniformity-Trial-10-Percent/default/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/WindowsLogoffRace/WindowsLogoffRace/" --extension-process --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --disable-accelerated-video-decode --channel="3512.3.899978220\782778066" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutoReloadExperiment/Disabled/BrowserBlacklist/Enabled/ChromeSuggestions/ML Kodachrome dev/EmbeddedSearch/Group5 dev:r1 prefetch_results:1 reuse_instant_search_base_page:1 prerender_instant_url_on_omnibox_focus:1 allow_prefetch_non_default_match:1/EnhancedBookmarks/Default/ExtensionInstallVerification/None/GoogleNow/Enable/HpackHuffmanAggregator/Disabled/Prerender/PrerenderMulti/PrerenderLocalPredictorSpec/cd=3:LocalPredictor=Disabled/SDCH/EnabledAll/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/group_01/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-1-Percent/group_94/UMA-Uniformity-Trial-10-Percent/default/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/WindowsLogoffRace/WindowsLogoffRace/" --extension-process --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --disable-accelerated-video-decode --channel="3512.5.420106050\1103092569" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutoReloadExperiment/Disabled/BrowserBlacklist/Enabled/ChromeSuggestions/ML Kodachrome dev/EmbeddedSearch/Group5 dev:r1 prefetch_results:1 reuse_instant_search_base_page:1 prerender_instant_url_on_omnibox_focus:1 allow_prefetch_non_default_match:1/EnhancedBookmarks/Default/ExtensionInstallVerification/None/GoogleNow/Enable/HpackHuffmanAggregator/Disabled/Prerender/PrerenderMulti/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictorSpec/cd=3:LocalPredictor=Disabled/SDCH/EnabledAll/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/group_01/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-1-Percent/group_94/UMA-Uniformity-Trial-10-Percent/default/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/WindowsLogoffRace/WindowsLogoffRace/" --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --disable-accelerated-video-decode --channel="3512.6.769899292\1141769549" /prefetch:673131151
taskhost.exe $(Arg0)
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\sppsvc.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe49_ Global\UsGthrCtrlFltPipeMssGthrPipe49 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
"C:\Users\vlastnik\Downloads\RSITx64.exe"
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\AmiUpdXp.job - C:\Users\vlastnik\AppData\Local\SwvUpdater\Updater.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\update-S-1-5-21-3578969385-4246678597-2779815396-1000.job - C:\Program Files (x86)\Skillbrains\Updater\Updater.exe -runmode=checkupdate
C:\Windows\tasks\update-sys.job - C:\Program Files (x86)\Skillbrains\Updater\Updater.exe -runmode=checkupdate

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56916722-3657-ECBE-6DC5-668640C6519C}]
Adblocker - C:\Program Files (x86)\Adblocker\s6um.x64.dll [2014-08-15 398336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14 2117216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFCB3198-32F3-4E8B-9539-4324694ED664}]
Adblock Plus for IE Browser Helper Object - C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2013-10-08 515848]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56916722-3657-ECBE-6DC5-668640C6519C}]
Adblocker - C:\Program Files (x86)\Adblocker\s6um.dll [2014-08-15 332800]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-08-07 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14 1709152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-08-07 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFCB3198-32F3-4E8B-9539-4324694ED664}]
Adblock Plus for IE Browser Helper Object - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2013-10-08 448776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{ae07101b-46d4-4a98-af68-0333ea26e113}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{ae07101b-46d4-4a98-af68-0333ea26e113}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-05-09 168216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-05-09 391960]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-05-09 419096]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2010-10-08 2392360]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-06-09 11860072]
"Power Management"=C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [2011-08-02 1831016]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2014-03-11 1271072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"LiveSupport"=C:\Program Files (x86)\LiveSupport\LiveSupport.exe /noshow /log []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Uninstall C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64"=C:\Windows\system32\cmd.exe [2010-11-21 345088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AmIcoSinglun64]
C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [2011-01-26 368728]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcadeMovieService]
C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupManagerTray]
C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [2011-04-24 297280]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlueStacks Agent]
C:\Program Files (x86)\BlueStacks\HD-Agent.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.autoupdate]
C:\Users\vlastnik\AppData\Roaming\Seznam.cz\szninstall.exe [2013-05-16 1062472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.szndesktop]
C:\Users\vlastnik\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [2013-04-12 92664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dxtory Update Checker 2.0]
C:\Program Files (x86)\Dxtory Software\Dxtory2.0\UpdateChecker.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightShot]
C:\Users\vlastnik\AppData\Local\Skillbrains\lightshot\Lightshot.exe [2014-07-01 226560]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
C:\Program Files (x86)\Launch Manager\LManager.exe [2011-03-14 1081424]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe --auto-start []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\seznam-listicka-distribuce]
C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [2013-05-16 1062472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuiteTray]
C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [2011-09-20 341360]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"msfbpvSrv"=C:\Windows\inf\msfbpv.vbe [2013-08-27 1558]
"msasumurSrv"=C:\Windows\inf\msasumur.vbe [2013-08-27 1558]
"msqhlabxSrv"=C:\Windows\inf\msqhlabx.vbe [2013-08-27 1558]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-07-25 256896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-03-25 385024]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-08-18 17:11:46 ----D---- C:\rsit
2014-08-18 17:11:46 ----D---- C:\Program Files\trend micro
2014-08-16 20:35:22 ----D---- C:\ProgramData\NeextCoup
2014-08-16 20:35:20 ----D---- C:\Program Files (x86)\NeextCoup
2014-08-16 20:35:04 ----A---- C:\Windows\SYSWOW64\setup.exe
2014-08-15 16:09:55 ----A---- C:\Users\vlastnik\AppData\Roaming\LiveSupport.exe_log.txt
2014-08-15 16:09:54 ----A---- C:\Users\vlastnik\AppData\Roaming\regsvr32.exe_log.txt
2014-08-15 16:09:03 ----D---- C:\ProgramData\Trusted Publisher
2014-08-15 16:07:53 ----D---- C:\ProgramData\Adblocker
2014-08-15 16:07:52 ----D---- C:\Program Files (x86)\Adblocker
2014-08-15 16:07:39 ----D---- C:\ProgramData\prIcechOPP
2014-08-15 16:07:37 ----D---- C:\Program Files (x86)\prIcechOPP
2014-08-15 16:07:23 ----D---- C:\ProgramData\11e31c2b03c17f3b
2014-08-14 00:21:23 ----A---- C:\Windows\SYSWOW64\infocardapi.dll
2014-08-14 00:21:22 ----A---- C:\Windows\SYSWOW64\icardagt.exe
2014-08-14 00:21:22 ----A---- C:\Windows\system32\infocardapi.dll
2014-08-14 00:21:22 ----A---- C:\Windows\system32\icardagt.exe
2014-08-14 00:21:20 ----A---- C:\Windows\SYSWOW64\icardres.dll
2014-08-14 00:21:20 ----A---- C:\Windows\system32\icardres.dll
2014-08-14 00:20:56 ----A---- C:\Windows\SYSWOW64\TsWpfWrp.exe
2014-08-14 00:20:56 ----A---- C:\Windows\system32\TsWpfWrp.exe
2014-08-13 17:40:51 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2014-08-13 17:40:51 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2014-08-13 17:40:51 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2014-08-13 17:40:50 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2014-08-13 17:40:50 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2014-08-13 17:40:50 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2014-08-13 17:40:50 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-08-13 17:40:49 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2014-08-13 17:40:49 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2014-08-13 17:40:49 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2014-08-13 17:40:49 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 17:40:46 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2014-08-13 17:40:46 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2014-08-13 17:40:46 ----A---- C:\Windows\system32\urlmon.dll
2014-08-13 17:40:46 ----A---- C:\Windows\system32\iernonce.dll
2014-08-13 17:40:46 ----A---- C:\Windows\system32\ie4uinit.exe
2014-08-13 17:40:45 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2014-08-13 17:40:45 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2014-08-13 17:40:45 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 17:40:45 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-08-13 17:40:44 ----A---- C:\Windows\SYSWOW64\ieui.dll
2014-08-13 17:40:44 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2014-08-13 17:40:44 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2014-08-13 17:40:44 ----A---- C:\Windows\system32\msfeeds.dll
2014-08-13 17:40:44 ----A---- C:\Windows\system32\dxtmsft.dll
2014-08-13 17:40:43 ----A---- C:\Windows\system32\iesetup.dll
2014-08-13 17:40:42 ----A---- C:\Windows\system32\iedkcs32.dll
2014-08-13 17:40:40 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2014-08-13 17:40:40 ----A---- C:\Windows\system32\iertutil.dll
2014-08-13 17:40:39 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2014-08-13 17:40:39 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2014-08-13 17:40:38 ----A---- C:\Windows\SYSWOW64\wininet.dll
2014-08-13 17:40:38 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2014-08-13 17:40:38 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2014-08-13 17:40:38 ----A---- C:\Windows\system32\jsproxy.dll
2014-08-13 17:40:37 ----A---- C:\Windows\SYSWOW64\msrating.dll
2014-08-13 17:40:37 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2014-08-13 17:40:36 ----A---- C:\Windows\system32\dxtrans.dll
2014-08-13 17:40:35 ----A---- C:\Windows\system32\ieui.dll
2014-08-13 17:40:35 ----A---- C:\Windows\system32\ieframe.dll
2014-08-13 17:40:34 ----A---- C:\Windows\system32\mshtmled.dll
2014-08-13 17:40:33 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-08-13 17:40:33 ----A---- C:\Windows\system32\ieUnatt.exe
2014-08-13 17:40:32 ----A---- C:\Windows\system32\jscript9diag.dll
2014-08-13 17:40:31 ----A---- C:\Windows\system32\vbscript.dll
2014-08-13 17:40:31 ----A---- C:\Windows\system32\jscript9.dll
2014-08-13 17:40:30 ----A---- C:\Windows\system32\ieapfltr.dll
2014-08-13 17:40:29 ----A---- C:\Windows\system32\wininet.dll
2014-08-13 17:40:27 ----A---- C:\Windows\system32\msrating.dll
2014-08-13 17:40:27 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-08-13 17:40:25 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 17:40:24 ----A---- C:\Windows\system32\mshtml.dll
2014-08-13 17:39:57 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2014-08-13 17:39:57 ----A---- C:\Windows\system32\rpcrt4.dll
2014-08-13 17:39:55 ----A---- C:\Windows\system32\aepdu.dll
2014-08-13 17:39:53 ----A---- C:\Windows\system32\aeinv.dll
2014-08-13 17:39:19 ----A---- C:\Windows\SYSWOW64\KBDYAK.DLL
2014-08-13 17:39:19 ----A---- C:\Windows\SYSWOW64\KBDTAT.DLL
2014-08-13 17:39:19 ----A---- C:\Windows\SYSWOW64\KBDRU1.DLL
2014-08-13 17:39:19 ----A---- C:\Windows\SYSWOW64\KBDRU.DLL
2014-08-13 17:39:19 ----A---- C:\Windows\SYSWOW64\KBDBASH.DLL
2014-08-13 17:39:19 ----A---- C:\Windows\system32\KBDYAK.DLL
2014-08-13 17:39:19 ----A---- C:\Windows\system32\KBDTAT.DLL
2014-08-13 17:39:19 ----A---- C:\Windows\system32\KBDRU1.DLL
2014-08-13 17:39:19 ----A---- C:\Windows\system32\KBDRU.DLL
2014-08-13 17:39:19 ----A---- C:\Windows\system32\KBDBASH.DLL
2014-08-13 17:38:00 ----A---- C:\Windows\SYSWOW64\tzres.dll
2014-08-13 17:38:00 ----A---- C:\Windows\system32\tzres.dll
2014-08-13 17:37:45 ----A---- C:\Windows\SYSWOW64\msi.dll
2014-08-13 17:37:45 ----A---- C:\Windows\system32\msi.dll
2014-08-13 17:37:44 ----A---- C:\Windows\SYSWOW64\authui.dll
2014-08-13 17:37:44 ----A---- C:\Windows\system32\authui.dll
2014-08-13 17:37:43 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2014-08-13 17:37:43 ----A---- C:\Windows\system32\msihnd.dll
2014-08-13 17:37:43 ----A---- C:\Windows\system32\consent.exe
2014-08-13 17:37:34 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2014-08-13 17:37:33 ----A---- C:\Windows\system32\win32k.sys
2014-08-13 17:37:32 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2014-08-13 17:37:32 ----A---- C:\Windows\system32\gdi32.dll
2014-08-13 17:37:29 ----A---- C:\Windows\SYSWOW64\shell32.dll
2014-08-13 17:37:29 ----A---- C:\Windows\system32\shell32.dll
2014-08-12 11:53:49 ----D---- C:\Program Files (x86)\MTA San Andreas 1.3
2014-08-12 11:49:37 ----D---- C:\Program Files (x86)\MTA San Andreas 1.4
2014-08-12 11:49:37 ----AD---- C:\ProgramData\MTA San Andreas All
2014-08-08 18:58:16 ----D---- C:\Program Files (x86)\Microsoft OneDrive
2014-08-08 18:57:57 ----D---- C:\ProgramData\Microsoft OneDrive
2014-08-07 11:42:43 ----A---- C:\Windows\SYSWOW64\javaws.exe
2014-08-07 11:42:34 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2014-08-07 11:42:33 ----A---- C:\Windows\SYSWOW64\javaw.exe
2014-08-07 11:42:33 ----A---- C:\Windows\SYSWOW64\java.exe
2014-08-01 13:41:56 ----D---- C:\Program Files\Adblock Plus for IE
2014-08-01 13:41:47 ----D---- C:\ProgramData\Package Cache
2014-07-31 20:43:42 ----D---- C:\Program Files (x86)\ExKode
2014-07-31 10:40:20 ----A---- C:\Windows\system32\wups2.dll
2014-07-31 10:40:20 ----A---- C:\Windows\system32\wucltux.dll
2014-07-31 10:40:20 ----A---- C:\Windows\system32\wuauclt.exe
2014-07-31 10:40:19 ----A---- C:\Windows\system32\wuaueng.dll
2014-07-31 10:40:01 ----A---- C:\Windows\SYSWOW64\wups.dll
2014-07-31 10:40:01 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2014-07-31 10:40:01 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2014-07-31 10:40:01 ----A---- C:\Windows\system32\wups.dll
2014-07-31 10:40:01 ----A---- C:\Windows\system32\wudriver.dll
2014-07-31 10:40:01 ----A---- C:\Windows\system32\wuapi.dll
2014-07-31 10:39:47 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2014-07-31 10:39:47 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2014-07-31 10:39:46 ----A---- C:\Windows\system32\wuwebv.dll
2014-07-31 10:39:46 ----A---- C:\Windows\system32\wuapp.exe

======List of files/folders modified in the last 1 month======

2014-08-18 17:11:46 ----RD---- C:\Program Files
2014-08-18 17:11:41 ----D---- C:\Windows\Temp
2014-08-18 17:11:33 ----HD---- C:\ProgramData\ConsoleLogs
2014-08-18 15:29:19 ----D---- C:\Windows\system32\config
2014-08-18 12:34:18 ----RD---- C:\Program Files (x86)
2014-08-18 12:32:20 ----A---- C:\Windows\SYSWOW64\log.txt
2014-08-18 12:28:27 ----D---- C:\ProgramData\clear.fi
2014-08-18 12:10:59 ----D---- C:\Users\vlastnik\AppData\Roaming\Skype
2014-08-18 11:26:14 ----D---- C:\Windows\System32
2014-08-18 11:26:14 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-08-18 11:26:13 ----D---- C:\Windows\inf
2014-08-17 16:58:16 ----SHD---- C:\System Volume Information
2014-08-17 16:47:34 ----D---- C:\Windows\system32\catroot2
2014-08-16 20:35:22 ----AHD---- C:\ProgramData
2014-08-16 20:35:04 ----D---- C:\Windows\SysWOW64
2014-08-16 19:42:46 ----D---- C:\Windows\system32\Tasks
2014-08-16 19:42:45 ----D---- C:\Windows\Tasks
2014-08-16 11:23:08 ----D---- C:\Windows\Microsoft.NET
2014-08-15 20:13:53 ----D---- C:\Windows
2014-08-15 16:12:38 ----SHD---- C:\Windows\Installer
2014-08-15 16:12:38 ----SD---- C:\Users\vlastnik\AppData\Roaming\Microsoft
2014-08-15 16:07:22 ----D---- C:\Program Files (x86)\Google
2014-08-15 16:07:21 ----RD---- C:\Users
2014-08-15 16:05:38 ----RSD---- C:\Windows\assembly
2014-08-15 14:32:43 ----D---- C:\Users\vlastnik\AppData\Roaming\uTorrent
2014-08-15 12:35:47 ----D---- C:\ProgramData\BlueStacksSetup
2014-08-14 19:39:31 ----D---- C:\Windows\rescache
2014-08-14 00:43:46 ----D---- C:\Windows\winsxs
2014-08-14 00:39:07 ----D---- C:\Windows\ehome
2014-08-14 00:39:06 ----RSD---- C:\Windows\Fonts
2014-08-14 00:38:47 ----D---- C:\Windows\SYSWOW64\cs-CZ
2014-08-14 00:38:47 ----D---- C:\Windows\system32\cs-CZ
2014-08-14 00:38:45 ----D---- C:\Windows\system32\drivers
2014-08-14 00:38:42 ----D---- C:\Windows\SYSWOW64\en-US
2014-08-14 00:38:42 ----D---- C:\Program Files\Internet Explorer
2014-08-14 00:38:38 ----D---- C:\Windows\system32\en-US
2014-08-14 00:38:38 ----D---- C:\Windows\PolicyDefinitions
2014-08-14 00:38:31 ----D---- C:\Program Files (x86)\Internet Explorer
2014-08-14 00:35:42 ----D---- C:\Windows\system32\catroot
2014-08-14 00:30:14 ----D---- C:\Windows\system32\MRT
2014-08-14 00:27:00 ----D---- C:\Windows\debug
2014-08-14 00:26:57 ----A---- C:\Windows\system32\MRT.exe
2014-08-14 00:20:22 ----SD---- C:\Windows\system32\CompatTel
2014-08-13 10:37:14 ----D---- C:\Windows\Prefetch
2014-08-12 09:52:51 ----D---- C:\Users\vlastnik\AppData\Roaming\.minecraft
2014-08-11 13:41:04 ----D---- C:\Windows\system32\DriverStore
2014-08-10 09:18:47 ----D---- C:\Users\vlastnik\AppData\Roaming\Seznam.cz
2014-08-07 11:45:42 ----D---- C:\Program Files (x86)\Common Files
2014-08-07 11:45:39 ----D---- C:\ProgramData\Skype
2014-08-07 11:42:59 ----D---- C:\ProgramData\Oracle
2014-08-06 17:13:25 ----RD---- C:\Program Files (x86)\Skype
2014-08-01 12:44:19 ----D---- C:\Windows\Minidump
2014-07-23 21:34:51 ----D---- C:\Program Files\Microsoft Silverlight
2014-07-23 21:34:49 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2014-07-22 13:25:44 ----D---- C:\ProgramData\Adobe
2014-07-22 10:18:23 ----D---- C:\Program Files (x86)\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\drivers\iaStor.sys [2010-09-14 437272]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2014-01-25 268512]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 mwlPSDFilter;mwlPSDFilter; C:\Windows\system32\DRIVERS\mwlPSDFilter.sys [2012-01-17 22648]
R1 mwlPSDNServ;mwlPSDNServ; C:\Windows\system32\DRIVERS\mwlPSDNServ.sys [2012-01-17 20520]
R1 mwlPSDVDisk;mwlPSDVDisk; C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys [2012-01-17 62776]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R1 wStLibG64;wStLibG64; C:\Windows\system32\drivers\wStLibG64.sys [2014-04-17 61112]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-03-17 2712064]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2011-03-25 12262336]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-06-14 2899176]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 NTIDrvr;NTIDrvr; \??\C:\Windows\system32\drivers\NTIDrvr.sys [2011-09-20 18432]
R3 Sftfs;Sftfs; C:\Windows\system32\DRIVERS\Sftfslh.sys [2009-12-03 721768]
R3 Sftplay;Sftplay; C:\Windows\system32\DRIVERS\Sftplaylh.sys [2009-12-03 269672]
R3 Sftredir;Sftredir; C:\Windows\system32\DRIVERS\Sftredirlh.sys [2009-12-03 25960]
R3 Sftvol;Sftvol; C:\Windows\system32\DRIVERS\Sftvollh.sys [2009-12-03 22376]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2010-10-08 1395248]
R3 UBHelper;UBHelper; \??\C:\Windows\system32\drivers\UBHelper.sys [2011-09-20 17408]
S3 AmUStor;AM USB Stroage Driver; C:\Windows\system32\drivers\AmUStor.SYS [2011-01-14 74840]
S3 androidusb;ADB Interface Driver; C:\Windows\System32\Drivers\androidusb.sys [2010-04-29 32768]
S3 FairplayKD;FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1C62x64.sys []
S3 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2014-03-11 133928]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 ScreamBAudioSvc;ScreamBee Audio; C:\Windows\system32\drivers\ScreamingBAudio64.sys [2014-02-07 38992]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WinUsb;Ovladač WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-10 65640]
R2 c2cautoupdatesvc;Skype Click to Call Updater; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
R2 c2cpnrsvc;Skype Click to Call PNR Service; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
R2 DsiWMIService;Dritek WMI Service; C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-03-14 352336]
R2 GREGService;GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [2011-05-30 36456]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-14 13336]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2011-02-01 326168]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2014-03-11 23808]
R2 NTI IScheduleSvc;NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [2011-04-24 256832]
R2 runaservice;Run software as Windows service; C:\Users\vlastnik\AppData\Roaming\KAWin\runaservice.exe [2013-10-08 98304]
R2 sftlist;Application Virtualization Client; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-02-01 2656280]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S2 cvhsvc;Client Virtualization Handler; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09 262320]
S3 EgisTec Ticket Service;EgisTec Ticket Service; C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [2011-06-21 173424]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-01-17 655624]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-07-25 111616]
S3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2014-03-11 347872]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-11-19 4925184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-10-31 1255736]
S3 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-29 2292096]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S4 ePowerSvc;ePower Service; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [2011-08-02 872552]
S4 GamesAppIntegrationService;GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [2014-04-24 227904]
S4 GamesAppService;GamesAppService; C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2014-05-03 203344]
S4 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc []
S4 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /medsvc []
S4 Live Updater Service;Live Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [2011-04-22 244624]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 SecureUpdateSvc;SecureUpdate; C:\Program Files (x86)\Secure Speed Dial\IE\SecureUpdate.exe [2014-03-04 2503504]
S4 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
S4 ssinstall;SInstalátor; C:\Windows\SysWOW64\ssins.exe [2013-10-26 2324216]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: adware pricechop a browser!shopa

#4 Příspěvek od vyosek »

:arrow: Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe
  • Ulozte nejlepe na plochu
  • Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
  • Probehne vytvoreni zalohy a nasledne prohledavani
  • Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte
:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Kliknete na Scan a nasledne Clean
  • Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
xaby
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 20 čer 2014 16:38

Re: adware pricechop a browser!shopa

#5 Příspěvek od xaby »

Cleaner :
# AdwCleaner v3.307 - Report created 18/08/2014 at 19:18:18
# Updated 17/08/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : vlastnik - VLASTNIK-PC
# Running from : C:\Users\vlastnik\Desktop\adwcleaner_3.307.exe
# Option : Clean

***** [ Services ] *****

[#] Service Deleted : SecureUpdateSvc
Service Deleted : wStLibG64

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Adblocker
Folder Deleted : C:\ProgramData\Trusted Publisher
Folder Deleted : C:\ProgramData\NeextCoup
Folder Deleted : C:\ProgramData\prIcechOPP
Folder Deleted : C:\Program Files (x86)\Adblocker
Folder Deleted : C:\Program Files (x86)\mystarttb
Folder Deleted : C:\Program Files (x86)\Skillbrains
Folder Deleted : C:\Program Files (x86)\NeextCoup
Folder Deleted : C:\Program Files (x86)\prIcechOPP
Folder Deleted : C:\Users\Administrator\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Administrator\AppData\Local\torch
Folder Deleted : C:\Users\Guest\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\Guest\AppData\Local\torch
Folder Deleted : C:\Users\vlastnik\AppData\Local\apn
Folder Deleted : C:\Users\vlastnik\AppData\Local\Chromatic Browser
Folder Deleted : C:\Users\vlastnik\AppData\Local\iLivid
Folder Deleted : C:\Users\vlastnik\AppData\Local\Skillbrains
Folder Deleted : C:\Users\vlastnik\AppData\Local\SwvUpdater
Folder Deleted : C:\Users\vlastnik\AppData\Local\torch
Folder Deleted : C:\Users\vlastnik\AppData\Roaming\Oxy
Folder Deleted : C:\Users\vlastnik\AppData\Local\Software
File Deleted : C:\Windows\SysWOW64\installd.exe
File Deleted : C:\Windows\System32\drivers\wStLibG64.sys
File Deleted : C:\Windows\System32\GroupPolicy\Machine\Registry.pol
File Deleted : C:\Windows\System32\roboot64.exe
File Deleted : C:\Users\vlastnik\AppData\Roaming\LiveSupport.exe_log.txt
File Deleted : C:\Users\vlastnik\AppData\Roaming\regsvr32.exe_log.txt

***** [ Scheduled Tasks ] *****

Task Deleted : update-sys
Task Deleted : update-S-1-5-21-3578969385-4246678597-2779815396-1000

***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [12x3q@3244516.com]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [xz123@ya456.com]
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\poheodfamflhhhdcmjfeggbgigeefaco
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\S-792098896
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{462862BE-9A5C-49A5-9CBD-A649EAC63645}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{0113A098-06EA-4776-A011-D75590778F1E}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{BEAA0C04-ED15-4C17-800B-28716025A4E4}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{462862BE-9A5C-49A5-9CBD-A649EAC63645}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Key Deleted : HKCU\Software\RegisteredApplicationsEx
Key Deleted : HKCU\Software\SkillBrains
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Key Deleted : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Deleted : HKLM\SOFTWARE\aartemisSoftware
Key Deleted : HKLM\SOFTWARE\awesomehpSoftware
Key Deleted : HKLM\SOFTWARE\BetterSurf
Key Deleted : HKLM\SOFTWARE\Email Notifier
Key Deleted : HKLM\SOFTWARE\MediaPlayerV1
Key Deleted : HKLM\SOFTWARE\MediaViewerV1
Key Deleted : HKLM\SOFTWARE\MediaViewV1
Key Deleted : HKLM\SOFTWARE\MediaWatchV1
Key Deleted : HKLM\SOFTWARE\mystarttb
Key Deleted : HKLM\SOFTWARE\omiga-plusSoftware
Key Deleted : HKLM\SOFTWARE\qone8Software
Key Deleted : HKLM\SOFTWARE\SkillBrains
Key Deleted : HKLM\SOFTWARE\sweet-pageSoftware
Key Deleted : HKLM\SOFTWARE\Uniblue
Key Deleted : HKLM\SOFTWARE\webssearchesSoftware
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
Key Deleted : [x64] HKLM\SOFTWARE\aartemisSoftware
Key Deleted : [x64] HKLM\SOFTWARE\awesomehpSoftware
Key Deleted : [x64] HKLM\SOFTWARE\omiga-plusSoftware
Key Deleted : [x64] HKLM\SOFTWARE\qone8Software
Key Deleted : [x64] HKLM\SOFTWARE\sweet-pageSoftware
Key Deleted : [x64] HKLM\SOFTWARE\webssearchesSoftware
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17239

Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Setting Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\\ Google Chrome v36.0.1985.143

[ File : C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Startup_urls] : hxxp://search.gboxapp.com/
Deleted [Homepage] : hxxp://search.gboxapp.com/

*************************
AdwCleaner[R0].txt - [9975 octets] - [18/08/2014 19:17:25]
AdwCleaner[S0].txt - [8484 octets] - [18/08/2014 19:18:18]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8544 octets] ##########

Junk remove :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by vlastnik on po 18.08.2014 at 19:10:40,11
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\livesupport
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113}
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\bi
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\smartbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\systweak
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\search settings
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\speedupmypc
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\updater.amiupd
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\updater.amiupd.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\quickshare_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\quickshare_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{99c91fc5-db5b-4aa0-bb70-5d89c5a4df96}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}



~~~ Files

Successfully deleted: [File] C:\Windows\Tasks\amiupdxp.job
Successfully deleted: [File] C:\Windows\syswow64\sho10A6.tmp



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\ProgramData\babylon"
Successfully deleted: [Folder] "C:\Users\vlastnik\AppData\Roaming\babylon"
Successfully deleted: [Folder] "C:\Users\vlastnik\AppData\Roaming\systweak"
Successfully deleted: [Folder] "C:\Users\vlastnik\appdata\locallow\minibar"
Successfully deleted: [Folder] "C:\Program Files (x86)\secure speed dial"
Successfully deleted: [Folder] "C:\Program Files (x86)\Common Files\spigot"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\vlastnik\appdata\local\{004908D1-49F1-4194-9F63-0448C281FB5F}
Successfully deleted: [Empty Folder] C:\Users\vlastnik\appdata\local\{2BA225AB-3B01-4601-BC22-4E9ECA4FFCF6}
Successfully deleted: [Empty Folder] C:\Users\vlastnik\appdata\local\{2EE84E8E-7DE3-40EB-9EE0-E7B1A6232A8D}
Successfully deleted: [Empty Folder] C:\Users\vlastnik\appdata\local\{45218324-688D-49D1-97F0-0ED8B15799E9}
Successfully deleted: [Empty Folder] C:\Users\vlastnik\appdata\local\{7D65EFAE-2B7C-4CA5-9E96-27AF0AB3A147}
Successfully deleted: [Empty Folder] C:\Users\vlastnik\appdata\local\{9BE734C8-9715-4E02-9613-56DE663E96AE}
Successfully deleted: [Folder] "C:\ProgramData\ask"



~~~ Chrome

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\dedmngkbaffkenlfdcbganndoghblmap
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\hbcennhacfaagdopikcegfcobcadeocj
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\pfndaklgolladniicklehhancnlgocpp



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on po 18.08.2014 at 19:16:42,34
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Ale jestli to ten adware mělo odstranit,tak neodstranilo :/
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: adware pricechop a browser!shopa

#6 Příspěvek od vyosek »

:arrow: Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu
  • Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
  • Do okna vlozte skript nize

  • Kód: Vybrat vše

    autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;
  • Nasledne kliknete na Run Script
  • PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
xaby
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 20 čer 2014 16:38

Re: adware pricechop a browser!shopa

#7 Příspěvek od xaby »

Zoek.exe v5.0.0.0 Updated 19-08-2014
Tool run by vlastnik on Łt 19.08.2014 at 12:50:23,56.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\vlastnik\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

19.8.2014 12:51:47 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3578969385-4246678597-2779815396-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{56916722-3657-ECBE-6DC5-668640C6519C} deleted successfully
HKEY_USERS\S-1-5-21-3578969385-4246678597-2779815396-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{56916722-3657-ECBE-6DC5-668640C6519C} deleted successfully
HKEY_USERS\S-1-5-21-3578969385-4246678597-2779815396-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{56916722-3657-ECBE-6DC5-668640C6519C} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{56916722-3657-ECBE-6DC5-668640C6519C} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{56916722-3657-ECBE-6DC5-668640C6519C} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{56916722-3657-ECBE-6DC5-668640C6519C} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56916722-3657-ECBE-6DC5-668640C6519C} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{56916722-3657-ECBE-6DC5-668640C6519C} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\ext@WebexpEnhancedV1alpha9938.net deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\ext@VideoPlayerV3beta897.net deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\ext@MediaPlayerV1alpha382.net deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\ext@MediaViewerV1alpha1854.net deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\ext@MediaViewV1alpha2823.net deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\ext@MediaWatchV1home727.net deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\ext@RichMediaViewV1release1678.net deleted successfully

==== Deleting Services ======================


==== Deleting Files \ Folders ======================

C:\Users\vlastnik\AppData\LocalLow\{56916722-3657-ECBE-6DC5-668640C6519C} deleted
C:\Users\vlastnik\AppData\Local\Packages\windows_ie_ac_001\AC\{56916722-3657-ECBE-6DC5-668640C6519C} deleted
C:\PROGRA~3\EmailNotifier deleted
C:\PROGRA~2\COMMON~1\Config\uninstinethnfd.exe deleted
C:\PROGRA~2\COMMON~1\Config deleted
C:\extensions.sqlite deleted
C:\extensions.ini deleted
C:\awh29AE.tmp deleted
C:\awh3D3E.tmp deleted
C:\awh67E6.tmp deleted
C:\awhAD5E.tmp deleted
C:\search.sqlite deleted
C:\prefs.js deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\vlastnik\Searches deleted
C:\Users\vlastnik\Downloads\SoftonicDownloader_for_morphvox-voice-changer.exe deleted
C:\Windows\wininit.ini deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{3D0F43D9-C1D7-733C-01F8-4A3001BF8CC3}.20140816203523" deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{3D0F43D9-C1D7-733C-01F8-4A3001BF8CC3}.20140818122707" deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{3D0F43D9-C1D7-733C-01F8-4A3001BF8CC3}.20140818122708" deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{4820778D-AB0D-6D18-C316-52A6A0E1D507}.20140815160754" deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}.20140815160807" deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{FDB962F0-B5B8-9460-D12F-7966E97BAA43}.20140815160723" deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{FDB962F0-B5B8-9460-D12F-7966E97BAA43}.20140815160740" deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{FDB962F0-B5B8-9460-D12F-7966E97BAA43}.20140816203454" deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{FDB962F0-B5B8-9460-D12F-7966E97BAA43}.20140816203455" deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{FDB962F0-B5B8-9460-D12F-7966E97BAA43}.20140816203523" deleted
"C:\PROGRA~3\11e31c2b03c17f3b\{FDB962F0-B5B8-9460-D12F-7966E97BAA43}.20140816203524" deleted
"C:\PROGRA~3\11e31c2b03c17f3b" deleted
"C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\Application Updater" deleted

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
bdghbiafpdllflnfffambkpdbjhbhdbg - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1854\ch\MediaViewerV1alpha1854.crx[]
ejfmfchobbohdmknbojhclcfegomcjbh - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home727\ch\MediaWatchV1home727.crx[]
ggecgigjedjfeaihhmbcilhplaipbfdj - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha9938\ch\WebexpEnhancedV1alpha9938.crx[]
ijbadapmpceifljbmpfpbcklnlimgjkj - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha2823\ch\MediaViewV1alpha2823.crx[]
jkcdkfjnonhccllfhgcfkfgfgjmckgge - C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release1678\ch\RichMediaViewV1release1678.crx[]
kglkdfoogibonacbjlmamnpckgjpfole - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta897\ch\VideoPlayerV3beta897.crx[]
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[14.07.2014 18:22]

NeextCoup - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn
Zhongwen A Chinese English Popup Dictionary - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde
praicechop - Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh
NeextCoup - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn
Zhongwen A Chinese English Popup Dictionary - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde
praicechop - Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh
NeextCoup - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn
Zhongwen A Chinese English Popup Dictionary - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde
praicechop - Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh
AccelerateTab - Default\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgjafhkemfjfgdmjcmhofijphjmaanak
AccelerateTab - Default User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgjafhkemfjfgdmjcmhofijphjmaanak
NeextCoup - Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn
Zhongwen A Chinese English Popup Dictionary - Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde
praicechop - Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh
NeextCoup - Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn
Zhongwen A Chinese English Popup Dictionary - Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde
praicechop - Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh
NeextCoup - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn
Zhongwen A Chinese English Popup Dictionary - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde
praicechop - Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh
NeextCoup - vlastnik\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn
Zhongwen A Chinese English Popup Dictionary - vlastnik\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde
praicechop - vlastnik\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh
NeextCoup - vlastnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn
Zhongwen A Chinese English Popup Dictionary - vlastnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde
praicechop - vlastnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh
NeextCoup - vlastnik\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn
praicechop - vlastnik\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\oifcemlemfikciheiclfmgihlbgogllh
NeextCoup - vlastnik\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn
Zhongwen A Chinese English Popup Dictionary - vlastnik\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde
praicechop - vlastnik\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh

==== Chromium Startpages ======================

C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "http://www.google.com/"

C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences
"startup_urls": [ "https://www.google.cz/" ],


==== Chrome Fix ======================

C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\http_www.superfish.com_0.localstorage deleted successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Profile 1\Local Storage\http_www.superfish.com_0.localstorage-journal deleted successfully
C:\Users\Default\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgjafhkemfjfgdmjcmhofijphjmaanak deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn deleted successfully
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn deleted successfully
C:\Users\vlastnik\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn deleted successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn deleted successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn deleted successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\hmaikpgmagkmpnpdonbaffldmehebamn deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde deleted successfully
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde deleted successfully
C:\Users\vlastnik\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde deleted successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde deleted successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde deleted successfully
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh deleted successfully
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh deleted successfully
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh deleted successfully
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh deleted successfully
C:\Users\vlastnik\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh deleted successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh deleted successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\oifcemlemfikciheiclfmgihlbgogllh deleted successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\oifcemlemfikciheiclfmgihlbgogllh deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://seznam.cz/"
"Search Page"="http://www.google.com"
"Search Bar"="http://www.google.com"
"Use Search Asst"="yes"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"Default"="http://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="http://www.google.com"
"SearchAssistant"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://seznam.cz/"
"Use Search Asst"="no"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/ ... chasst.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"

==== Reset Google Chrome ======================

C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences was reset successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google\Chrome\ExtensionInstallForcelist deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\bdghbiafpdllflnfffambkpdbjhbhdbg deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\ejfmfchobbohdmknbojhclcfegomcjbh deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\ggecgigjedjfeaihhmbcilhplaipbfdj deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\ijbadapmpceifljbmpfpbcklnlimgjkj deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\jkcdkfjnonhccllfhgcfkfgfgjmckgge deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\kglkdfoogibonacbjlmamnpckgjpfole deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcadeMovieService deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlueStacks Agent deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dxtory Update Checker 2.0 deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightShot deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\vlastnik\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\vlastnik\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\vlastnik\AppData\Local\Google\Chrome\User Data\Profile 1\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=407 folders=193 15987203 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\vlastnik\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\vlastnik\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted

==== EOF on Łt 19.08.2014 at 13:18:31,80 ======================
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: adware pricechop a browser!shopa

#8 Příspěvek od vyosek »

Poprosim o FRST http://forum.viry.cz/viewtopic.php?f=24&t=132509
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
xaby
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 20 čer 2014 16:38

Re: adware pricechop a browser!shopa

#9 Příspěvek od xaby »

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-08-2014 01
Ran by vlastnik (administrator) on VLASTNIK-PC on 19-08-2014 18:49:29
Running from C:\Users\vlastnik\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
() C:\Users\vlastnik\AppData\Roaming\KAWin\runaservice.exe
() C:\Users\vlastnik\AppData\Roaming\KAWin\Console.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\DMREngine.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2392360 2010-10-08] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11860072 2011-06-09] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831016 2011-08-02] (Acer Incorporated)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM-x32\...\Run: [msfbpvSrv] => C:\Windows\inf\msfbpv.vbe [1558 2013-08-27] ()
HKLM-x32\...\Run: [msasumurSrv] => C:\Windows\inf\msasumur.vbe [1558 2013-08-27] ()
HKLM-x32\...\Run: [msqhlabxSrv] => C:\Windows\inf\msqhlabx.vbe [1558 2013-08-27] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\...\RunOnce: [Uninstall C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64"
HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\...\MountPoints2: {dc7ac989-0504-11e4-9e8a-8f26e34bd287} - E:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\...\MountPoints2: {f3f0c334-c7ef-11e3-a09f-047d7b24fa9b} - E:\Startme.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://seznam.cz/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer.msn.com
SearchScopes: HKCU - DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.100.1 192.168.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\vlastnik\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S4 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 runaservice; C:\Users\vlastnik\AppData\Roaming\KAWin\runaservice.exe [98304 2013-10-08] () [File not signed]
S4 ssinstall; C:\Windows\SysWOW64\ssins.exe [2324216 2013-10-26] (PS Media s.r.o.)
S4 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S4 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-29] (Google Inc)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]
S3 L1C; system32\DRIVERS\L1C62x64.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-19 18:49 - 2014-08-19 18:50 - 00012843 _____ () C:\Users\vlastnik\Desktop\FRST.txt
2014-08-19 18:49 - 2014-08-19 18:42 - 02101760 _____ (Farbar) C:\Users\vlastnik\Desktop\FRST64.exe
2014-08-19 18:48 - 2014-08-19 18:49 - 00000000 ____D () C:\FRST
2014-08-19 18:41 - 2014-08-19 18:42 - 02101760 _____ (Farbar) C:\Users\vlastnik\Downloads\FRST64.exe
2014-08-19 13:07 - 2014-08-19 12:50 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-19 12:51 - 2014-08-19 13:18 - 00021387 _____ () C:\zoek-results.log
2014-08-19 12:50 - 2014-08-19 13:15 - 00000000 ____D () C:\zoek_backup
2014-08-19 12:49 - 2014-08-19 12:49 - 01288704 _____ () C:\Users\vlastnik\Downloads\zoek.exe
2014-08-18 21:00 - 2014-08-18 21:00 - 00005819 _____ () C:\Users\vlastnik\Downloads\smime.p7s
2014-08-18 19:17 - 2014-08-18 19:18 - 00000000 ____D () C:\AdwCleaner
2014-08-18 19:10 - 2014-08-18 19:10 - 00000000 ____D () C:\Windows\ERUNT
2014-08-18 19:09 - 2014-08-18 19:10 - 01361671 _____ () C:\Users\vlastnik\Downloads\adwcleaner_3.307.exe
2014-08-18 19:09 - 2014-08-18 19:09 - 01016261 _____ (Thisisu) C:\Users\vlastnik\Downloads\JRT.exe
2014-08-18 17:11 - 2014-08-18 17:11 - 01222144 _____ () C:\Users\vlastnik\Downloads\RSITx64.exe
2014-08-18 17:11 - 2014-08-18 17:11 - 00000000 ____D () C:\rsit
2014-08-18 17:11 - 2014-08-18 17:11 - 00000000 ____D () C:\Program Files\trend micro
2014-08-16 20:35 - 2014-08-16 20:35 - 01558016 _____ (they) C:\Windows\SysWOW64\setup.exe
2014-08-15 20:13 - 2014-08-19 13:15 - 00001852 _____ () C:\Windows\PFRO.log
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\vlastnik\AppData\Local\Packages
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\vlastnik\AppData\Local\Comodo
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Guest
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Administrator
2014-08-15 16:04 - 2014-08-15 16:04 - 00661540 _____ () C:\Users\vlastnik\Downloads\BlueStacks by Sipsob.com.zip.exe
2014-08-15 14:23 - 2014-08-15 14:24 - 00017726 _____ () C:\Users\vlastnik\Downloads\[kickass.to]bluestacks.hd.appplayer.torrent
2014-08-15 12:34 - 2014-08-15 12:35 - 12835056 _____ (BlueStack Systems Inc.) C:\Users\vlastnik\Downloads\BlueStacks-SplitInstaller_native_c.exe
2014-08-14 00:21 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-14 00:21 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-14 00:21 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-14 00:21 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-14 00:21 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-14 00:21 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-14 00:20 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-14 00:20 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 17:40 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 17:40 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 17:40 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 17:40 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 17:40 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 17:40 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 17:40 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 17:40 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 17:40 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 17:40 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 17:40 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 17:40 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 17:40 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 17:40 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 17:40 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 17:40 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 17:40 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 17:40 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 17:40 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 17:40 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 17:40 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 17:40 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 17:40 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 17:40 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 17:40 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 17:40 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 17:40 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 17:40 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 17:40 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 17:40 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 17:40 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 17:40 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 17:40 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 17:40 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 17:40 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 17:40 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 17:40 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 17:40 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 17:40 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 17:40 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 17:40 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 17:40 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 17:40 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 17:40 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 17:40 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 17:40 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 17:40 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 17:40 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 17:40 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 17:40 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 17:40 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 17:40 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 17:40 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 17:40 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 17:40 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 17:40 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 17:39 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 17:39 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 17:39 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 17:39 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-13 17:39 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 17:39 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 17:39 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 17:39 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 17:39 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 17:39 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 17:39 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 17:39 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 17:39 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 17:39 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 17:39 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 17:39 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 17:38 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 17:38 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 17:37 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-13 17:37 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-13 17:37 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-13 17:37 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 17:37 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 17:37 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 17:37 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 17:37 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 17:37 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 17:37 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 17:37 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 17:37 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 17:37 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-12 21:07 - 2014-08-12 21:10 - 12835056 _____ (BlueStack Systems Inc.) C:\Users\vlastnik\Downloads\BlueStacks-SplitInstaller_native (2).exe
2014-08-12 11:54 - 2014-08-12 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3
2014-08-12 11:53 - 2014-08-12 11:54 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.3
2014-08-12 11:49 - 2014-08-12 11:53 - 00000000 ____D () C:\ProgramData\MTA San Andreas All
2014-08-12 11:49 - 2014-08-12 11:50 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.4
2014-08-12 11:49 - 2014-08-12 11:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.4
2014-08-12 11:46 - 2014-08-12 11:47 - 21858800 _____ (Multi Theft Auto) C:\Users\vlastnik\Downloads\mtasa-1.4.exe
2014-08-11 20:50 - 2014-08-12 14:38 - 00000000 ____D () C:\Users\vlastnik\Desktop\Counter-Strike Source
2014-08-11 18:52 - 2014-08-11 18:54 - 12814576 _____ (BlueStack Systems Inc.) C:\Users\vlastnik\Downloads\BlueStacks-SplitInstaller_native (1).exe
2014-08-11 17:34 - 2014-08-11 20:48 - 1500467439 _____ () C:\Users\vlastnik\Downloads\Counter-Strike--Source---(Full-game,-no-install).rar
2014-08-11 13:41 - 2014-08-11 13:41 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_androidusb_01009.Wdf
2014-08-11 12:53 - 2014-08-11 12:55 - 12814576 _____ (BlueStack Systems Inc.) C:\Users\vlastnik\Downloads\BlueStacks-SplitInstaller_native.exe
2014-08-10 23:46 - 2014-08-10 23:47 - 11990847 _____ () C:\Users\vlastnik\Downloads\sa-mp-0.3z-R1-install.exe
2014-08-10 20:58 - 2014-08-10 20:59 - 13057568 _____ (BlueStack Systems Inc.) C:\Users\vlastnik\Downloads\BlueStacks-SplitInstaller_native_b.exe
2014-08-10 18:38 - 2014-08-12 12:33 - 00000000 ____D () C:\Users\vlastnik\Desktop\GTA San Andreas
2014-08-10 16:09 - 2014-08-10 17:41 - 754051051 _____ () C:\Users\vlastnik\Downloads\GTA-San-Andreas (1).rar
2014-08-10 09:16 - 2014-08-10 10:40 - 716621977 _____ () C:\Users\vlastnik\Downloads\GTA-SAN-ANDREAS.rar
2014-08-09 22:28 - 2014-08-09 22:30 - 28062081 _____ () C:\Users\vlastnik\Downloads\Sphax PureBDcraft 128x MC17.zip
2014-08-09 22:22 - 2014-08-09 22:22 - 00818111 _____ () C:\Users\vlastnik\Downloads\OptiFine_1.7.10_HD_U_A4.jar
2014-08-09 22:16 - 2014-08-09 22:17 - 13423227 _____ () C:\Users\vlastnik\Downloads\Sphax PureBDcraft 64x MC17.zip
2014-08-08 18:58 - 2014-08-08 19:04 - 00000000 ___RD () C:\Users\vlastnik\OneDrive
2014-08-08 18:58 - 2014-08-08 18:58 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive
2014-08-08 18:58 - 2014-08-08 18:57 - 06089928 _____ (Microsoft Corporation) C:\Users\vlastnik\Downloads\OneDriveSetup.exe
2014-08-08 18:57 - 2014-08-08 18:57 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2014-08-08 13:41 - 2014-08-08 13:41 - 00814735 _____ () C:\Users\vlastnik\Downloads\OptiFine_1.7.9_HD_U_D2 (1).jar
2014-08-07 20:57 - 2014-08-07 20:57 - 00121190 _____ () C:\Users\vlastnik\Downloads\Sphax-PureBDcraftGrass.icns
2014-08-07 11:42 - 2014-08-07 11:42 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-07 11:42 - 2014-08-07 11:42 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-07 11:42 - 2014-08-07 11:42 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-07 11:42 - 2014-08-07 11:42 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-07 11:42 - 2014-08-07 11:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-06 21:04 - 2014-08-06 21:04 - 00675988 _____ () C:\Users\vlastnik\Downloads\Minecraft.exe
2014-08-05 19:58 - 2014-08-05 19:58 - 00266809 _____ () C:\Users\vlastnik\Downloads\Reis-Minimap-Mod-1.7.9.zip
2014-08-01 14:57 - 2014-08-01 14:58 - 05244768 _____ () C:\Users\vlastnik\Downloads\MorphVOXPro4_Install-1.exe
2014-08-01 14:55 - 2014-08-01 14:55 - 04009096 _____ () C:\Users\vlastnik\Downloads\MorphVOX_Install-157.exe
2014-08-01 13:41 - 2014-08-01 13:41 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-01 13:40 - 2014-08-01 13:41 - 04741136 _____ () C:\Users\vlastnik\Downloads\adblockplusie-1.1.exe
2014-08-01 13:36 - 2014-08-19 18:05 - 00005285 _____ () C:\Windows\setupact.log
2014-08-01 13:36 - 2014-08-01 13:36 - 00000000 _____ () C:\Windows\setuperr.log
2014-07-31 20:43 - 2014-07-31 20:43 - 00000000 ____D () C:\Program Files (x86)\ExKode
2014-07-31 20:42 - 2014-07-31 20:43 - 03381528 _____ (ExKode Co. Ltd. ) C:\Users\vlastnik\Downloads\DxtorySetup2.0.127.exe
2014-07-31 16:53 - 2014-07-31 16:53 - 00000181 _____ () C:\Users\vlastnik\Downloads\eula.txt
2014-07-31 16:08 - 2014-07-31 16:08 - 00014290 _____ () C:\Users\vlastnik\Downloads\EasyPrefix.jar
2014-07-31 15:17 - 2014-07-31 15:17 - 01110604 _____ (TeamExtreme) C:\Users\vlastnik\Downloads\Minecraft Launcher.exe
2014-07-31 15:13 - 2014-08-07 12:32 - 715232360 _____ () C:\Users\vlastnik\Downloads\Minecraft.dmg
2014-07-31 10:40 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-07-31 10:40 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-07-31 10:40 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-07-31 10:40 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-07-31 10:40 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-07-31 10:40 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-07-31 10:40 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-07-31 10:40 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-07-31 10:40 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-07-31 10:40 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-07-31 10:39 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-07-31 10:39 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-07-31 10:39 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 10:39 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-29 19:32 - 2014-07-29 19:32 - 00001255 _____ () C:\Users\vlastnik\Downloads\config.yml
2014-07-29 19:24 - 2014-07-29 19:24 - 00000448 _____ () C:\Users\vlastnik\Downloads\permissions (2).yml
2014-07-29 19:19 - 2014-07-29 19:19 - 00000448 _____ () C:\Users\vlastnik\Downloads\permissions (1).yml
2014-07-29 19:00 - 2014-07-29 19:01 - 00000000 _____ () C:\Users\vlastnik\Downloads\permissions.yml
2014-07-29 18:14 - 2014-07-29 18:14 - 00007183 _____ () C:\Users\vlastnik\Downloads\Enchanter.jar
2014-07-29 18:13 - 2014-07-29 18:13 - 00950751 _____ () C:\Users\vlastnik\Downloads\Citizens.jar
2014-07-29 18:08 - 2014-07-29 18:08 - 00354166 _____ () C:\Users\vlastnik\Downloads\GriefPrevention-282.jar
2014-07-23 21:53 - 2014-07-23 21:53 - 02786954 _____ () C:\Users\vlastnik\Downloads\forge-1.7.2-10.12.2.1121-installer.jar
2014-07-23 12:12 - 2014-07-23 12:12 - 00000000 ____D () C:\Users\vlastnik\Documents\Lightshot
2014-07-22 10:16 - 2014-07-22 10:18 - 00004114 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-19 18:50 - 2014-08-19 18:49 - 00012843 _____ () C:\Users\vlastnik\Desktop\FRST.txt
2014-08-19 18:49 - 2014-08-19 18:48 - 00000000 ____D () C:\FRST
2014-08-19 18:42 - 2014-08-19 18:49 - 02101760 _____ (Farbar) C:\Users\vlastnik\Desktop\FRST64.exe
2014-08-19 18:42 - 2014-08-19 18:41 - 02101760 _____ (Farbar) C:\Users\vlastnik\Downloads\FRST64.exe
2014-08-19 18:34 - 2012-11-02 17:38 - 00000956 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-19 18:25 - 2014-05-08 17:39 - 01577053 _____ () C:\Windows\WindowsUpdate.log
2014-08-19 18:18 - 2012-11-02 17:38 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-19 18:05 - 2014-08-01 13:36 - 00005285 _____ () C:\Windows\setupact.log
2014-08-19 17:54 - 2009-07-14 06:45 - 00024608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-19 17:54 - 2009-07-14 06:45 - 00024608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-19 17:45 - 2012-11-02 17:38 - 00000952 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-19 17:45 - 2012-10-31 09:12 - 00000000 ____D () C:\ProgramData\clear.fi
2014-08-19 17:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-19 15:02 - 2012-10-31 18:55 - 00000000 ____D () C:\Users\vlastnik\AppData\Roaming\Skype
2014-08-19 13:18 - 2014-08-19 12:51 - 00021387 _____ () C:\zoek-results.log
2014-08-19 13:16 - 2009-07-14 07:08 - 00032572 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-19 13:16 - 2009-07-14 06:45 - 00283376 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-19 13:15 - 2014-08-19 12:50 - 00000000 ____D () C:\zoek_backup
2014-08-19 13:15 - 2014-08-15 20:13 - 00001852 _____ () C:\Windows\PFRO.log
2014-08-19 13:02 - 2012-10-30 17:38 - 00000000 ____D () C:\Users\vlastnik
2014-08-19 12:50 - 2014-08-19 13:07 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-19 12:49 - 2014-08-19 12:49 - 01288704 _____ () C:\Users\vlastnik\Downloads\zoek.exe
2014-08-18 21:00 - 2014-08-18 21:00 - 00005819 _____ () C:\Users\vlastnik\Downloads\smime.p7s
2014-08-18 19:18 - 2014-08-18 19:17 - 00000000 ____D () C:\AdwCleaner
2014-08-18 19:10 - 2014-08-18 19:10 - 00000000 ____D () C:\Windows\ERUNT
2014-08-18 19:10 - 2014-08-18 19:09 - 01361671 _____ () C:\Users\vlastnik\Downloads\adwcleaner_3.307.exe
2014-08-18 19:09 - 2014-08-18 19:09 - 01016261 _____ (Thisisu) C:\Users\vlastnik\Downloads\JRT.exe
2014-08-18 17:11 - 2014-08-18 17:11 - 01222144 _____ () C:\Users\vlastnik\Downloads\RSITx64.exe
2014-08-18 17:11 - 2014-08-18 17:11 - 00000000 ____D () C:\rsit
2014-08-18 17:11 - 2014-08-18 17:11 - 00000000 ____D () C:\Program Files\trend micro
2014-08-18 11:26 - 2012-01-18 00:16 - 00672914 _____ () C:\Windows\system32\perfh005.dat
2014-08-18 11:26 - 2012-01-18 00:16 - 00143894 _____ () C:\Windows\system32\perfc005.dat
2014-08-18 11:26 - 2009-07-14 07:13 - 01596168 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-16 20:35 - 2014-08-16 20:35 - 01558016 _____ (they) C:\Windows\SysWOW64\setup.exe
2014-08-16 20:35 - 2014-01-29 22:28 - 00000270 __RSH () C:\ProgramData\ntuser.pol
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\vlastnik\AppData\Local\Packages
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\vlastnik\AppData\Local\Comodo
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Guest
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-08-15 16:07 - 2014-08-15 16:07 - 00000000 ____D () C:\Users\Administrator
2014-08-15 16:07 - 2012-11-02 17:38 - 00000000 ____D () C:\Users\vlastnik\AppData\Local\Google
2014-08-15 16:07 - 2012-11-02 17:38 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-15 16:05 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-08-15 16:04 - 2014-08-15 16:04 - 00661540 _____ () C:\Users\vlastnik\Downloads\BlueStacks by Sipsob.com.zip.exe
2014-08-15 14:32 - 2013-12-31 13:38 - 00000000 ____D () C:\Users\vlastnik\AppData\Roaming\uTorrent
2014-08-15 14:24 - 2014-08-15 14:23 - 00017726 _____ () C:\Users\vlastnik\Downloads\[kickass.to]bluestacks.hd.appplayer.torrent
2014-08-15 12:35 - 2014-08-15 12:34 - 12835056 _____ (BlueStack Systems Inc.) C:\Users\vlastnik\Downloads\BlueStacks-SplitInstaller_native_c.exe
2014-08-15 12:35 - 2014-01-18 22:48 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2014-08-14 19:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-14 13:00 - 2012-11-03 08:54 - 00002187 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-08-14 00:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 00:30 - 2013-08-15 00:29 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 00:26 - 2012-11-07 18:04 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-14 00:20 - 2014-05-06 17:40 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-12 21:10 - 2014-08-12 21:07 - 12835056 _____ (BlueStack Systems Inc.) C:\Users\vlastnik\Downloads\BlueStacks-SplitInstaller_native (2).exe
2014-08-12 14:38 - 2014-08-11 20:50 - 00000000 ____D () C:\Users\vlastnik\Desktop\Counter-Strike Source
2014-08-12 12:33 - 2014-08-10 18:38 - 00000000 ____D () C:\Users\vlastnik\Desktop\GTA San Andreas
2014-08-12 11:54 - 2014-08-12 11:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.3
2014-08-12 11:54 - 2014-08-12 11:53 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.3
2014-08-12 11:53 - 2014-08-12 11:49 - 00000000 ____D () C:\ProgramData\MTA San Andreas All
2014-08-12 11:50 - 2014-08-12 11:49 - 00000000 ____D () C:\Program Files (x86)\MTA San Andreas 1.4
2014-08-12 11:49 - 2014-08-12 11:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MTA San Andreas 1.4
2014-08-12 11:49 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-08-12 11:47 - 2014-08-12 11:46 - 21858800 _____ (Multi Theft Auto) C:\Users\vlastnik\Downloads\mtasa-1.4.exe
2014-08-12 09:52 - 2014-04-24 20:29 - 00000000 ____D () C:\Users\vlastnik\AppData\Roaming\.minecraft
2014-08-11 21:06 - 2013-08-22 18:32 - 00000000 ____D () C:\Users\vlastnik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-08-11 20:48 - 2014-08-11 17:34 - 1500467439 _____ () C:\Users\vlastnik\Downloads\Counter-Strike--Source---(Full-game,-no-install).rar
2014-08-11 18:54 - 2014-08-11 18:52 - 12814576 _____ (BlueStack Systems Inc.) C:\Users\vlastnik\Downloads\BlueStacks-SplitInstaller_native (1).exe
2014-08-11 13:41 - 2014-08-11 13:41 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_androidusb_01009.Wdf
2014-08-11 12:55 - 2014-08-11 12:53 - 12814576 _____ (BlueStack Systems Inc.) C:\Users\vlastnik\Downloads\BlueStacks-SplitInstaller_native.exe
2014-08-10 23:47 - 2014-08-10 23:46 - 11990847 _____ () C:\Users\vlastnik\Downloads\sa-mp-0.3z-R1-install.exe
2014-08-10 20:59 - 2014-08-10 20:58 - 13057568 _____ (BlueStack Systems Inc.) C:\Users\vlastnik\Downloads\BlueStacks-SplitInstaller_native_b.exe
2014-08-10 17:41 - 2014-08-10 16:09 - 754051051 _____ () C:\Users\vlastnik\Downloads\GTA-San-Andreas (1).rar
2014-08-10 10:40 - 2014-08-10 09:16 - 716621977 _____ () C:\Users\vlastnik\Downloads\GTA-SAN-ANDREAS.rar
2014-08-10 09:18 - 2013-08-20 18:38 - 00000000 ____D () C:\Users\vlastnik\AppData\Roaming\Seznam.cz
2014-08-10 09:13 - 2013-10-26 17:52 - 00000000 _____ () C:\Windows\SysWOW64\sinstall.log
2014-08-09 22:30 - 2014-08-09 22:28 - 28062081 _____ () C:\Users\vlastnik\Downloads\Sphax PureBDcraft 128x MC17.zip
2014-08-09 22:22 - 2014-08-09 22:22 - 00818111 _____ () C:\Users\vlastnik\Downloads\OptiFine_1.7.10_HD_U_A4.jar
2014-08-09 22:17 - 2014-08-09 22:16 - 13423227 _____ () C:\Users\vlastnik\Downloads\Sphax PureBDcraft 64x MC17.zip
2014-08-08 19:04 - 2014-08-08 18:58 - 00000000 ___RD () C:\Users\vlastnik\OneDrive
2014-08-08 18:58 - 2014-08-08 18:58 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive
2014-08-08 18:57 - 2014-08-08 18:58 - 06089928 _____ (Microsoft Corporation) C:\Users\vlastnik\Downloads\OneDriveSetup.exe
2014-08-08 18:57 - 2014-08-08 18:57 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2014-08-08 13:41 - 2014-08-08 13:41 - 00814735 _____ () C:\Users\vlastnik\Downloads\OptiFine_1.7.9_HD_U_D2 (1).jar
2014-08-07 20:58 - 2013-08-25 18:47 - 00000000 ___RD () C:\Users\vlastnik\Desktop\ 
2014-08-07 20:57 - 2014-08-07 20:57 - 00121190 _____ () C:\Users\vlastnik\Downloads\Sphax-PureBDcraftGrass.icns
2014-08-07 12:32 - 2014-07-31 15:13 - 715232360 _____ () C:\Users\vlastnik\Downloads\Minecraft.dmg
2014-08-07 11:45 - 2011-10-13 15:25 - 00000000 ____D () C:\ProgramData\Skype
2014-08-07 11:42 - 2014-08-07 11:42 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-07 11:42 - 2014-08-07 11:42 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-07 11:42 - 2014-08-07 11:42 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-07 11:42 - 2014-08-07 11:42 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-07 11:42 - 2014-08-07 11:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-07 11:42 - 2013-10-17 19:39 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-07 04:06 - 2014-08-13 17:39 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 17:39 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-06 21:04 - 2014-08-06 21:04 - 00675988 _____ () C:\Users\vlastnik\Downloads\Minecraft.exe
2014-08-06 17:13 - 2012-11-22 15:25 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-08-05 19:58 - 2014-08-05 19:58 - 00266809 _____ () C:\Users\vlastnik\Downloads\Reis-Minimap-Mod-1.7.9.zip
2014-08-01 14:58 - 2014-08-01 14:57 - 05244768 _____ () C:\Users\vlastnik\Downloads\MorphVOXPro4_Install-1.exe
2014-08-01 14:55 - 2014-08-01 14:55 - 04009096 _____ () C:\Users\vlastnik\Downloads\MorphVOX_Install-157.exe
2014-08-01 13:41 - 2014-08-01 13:41 - 00000000 ____D () C:\Program Files\Adblock Plus for IE
2014-08-01 13:41 - 2014-08-01 13:40 - 04741136 _____ () C:\Users\vlastnik\Downloads\adblockplusie-1.1.exe
2014-08-01 13:36 - 2014-08-01 13:36 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-01 12:44 - 2014-07-06 15:36 - 00000000 ____D () C:\Windows\Minidump
2014-08-01 01:41 - 2014-08-13 17:40 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-13 17:40 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-31 20:46 - 2014-02-11 17:18 - 00000000 ____D () C:\Users\vlastnik\AppData\Local\Dxtory Software
2014-07-31 20:43 - 2014-07-31 20:43 - 00000000 ____D () C:\Program Files (x86)\ExKode
2014-07-31 20:43 - 2014-07-31 20:42 - 03381528 _____ (ExKode Co. Ltd. ) C:\Users\vlastnik\Downloads\DxtorySetup2.0.127.exe
2014-07-31 16:53 - 2014-07-31 16:53 - 00000181 _____ () C:\Users\vlastnik\Downloads\eula.txt
2014-07-31 16:08 - 2014-07-31 16:08 - 00014290 _____ () C:\Users\vlastnik\Downloads\EasyPrefix.jar
2014-07-31 15:17 - 2014-07-31 15:17 - 01110604 _____ (TeamExtreme) C:\Users\vlastnik\Downloads\Minecraft Launcher.exe
2014-07-29 19:32 - 2014-07-29 19:32 - 00001255 _____ () C:\Users\vlastnik\Downloads\config.yml
2014-07-29 19:24 - 2014-07-29 19:24 - 00000448 _____ () C:\Users\vlastnik\Downloads\permissions (2).yml
2014-07-29 19:19 - 2014-07-29 19:19 - 00000448 _____ () C:\Users\vlastnik\Downloads\permissions (1).yml
2014-07-29 19:01 - 2014-07-29 19:00 - 00000000 _____ () C:\Users\vlastnik\Downloads\permissions.yml
2014-07-29 18:14 - 2014-07-29 18:14 - 00007183 _____ () C:\Users\vlastnik\Downloads\Enchanter.jar
2014-07-29 18:13 - 2014-07-29 18:13 - 00950751 _____ () C:\Users\vlastnik\Downloads\Citizens.jar
2014-07-29 18:08 - 2014-07-29 18:08 - 00354166 _____ () C:\Users\vlastnik\Downloads\GriefPrevention-282.jar
2014-07-25 16:52 - 2014-08-13 17:40 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-25 16:02 - 2014-08-13 17:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-25 16:01 - 2014-08-13 17:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-25 15:51 - 2014-08-13 17:40 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-25 15:30 - 2014-08-13 17:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-25 15:28 - 2014-08-13 17:40 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-25 15:28 - 2014-08-13 17:40 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-25 15:25 - 2014-08-13 17:40 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-25 15:25 - 2014-08-13 17:40 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-25 15:11 - 2014-08-13 17:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-25 15:10 - 2014-08-13 17:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-25 15:04 - 2014-08-13 17:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-25 15:03 - 2014-08-13 17:40 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-25 15:00 - 2014-08-13 17:40 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-25 15:00 - 2014-08-13 17:40 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-25 14:59 - 2014-08-13 17:40 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-25 14:47 - 2014-08-13 17:40 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-25 14:40 - 2014-08-13 17:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-25 14:34 - 2014-08-13 17:40 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-25 14:34 - 2014-08-13 17:40 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-25 14:33 - 2014-08-13 17:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-25 14:30 - 2014-08-13 17:40 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-25 14:28 - 2014-08-13 17:40 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-25 14:28 - 2014-08-13 17:40 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-25 14:21 - 2014-08-13 17:40 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-25 14:19 - 2014-08-13 17:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-25 14:18 - 2014-08-13 17:40 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-25 14:17 - 2014-08-13 17:40 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-25 14:17 - 2014-08-13 17:40 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-25 14:12 - 2014-08-13 17:40 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-25 14:10 - 2014-08-13 17:40 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-25 14:10 - 2014-08-13 17:40 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-25 14:08 - 2014-08-13 17:40 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-25 14:06 - 2014-08-13 17:40 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-25 13:52 - 2014-08-13 17:40 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-25 13:47 - 2014-08-13 17:40 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-25 13:43 - 2014-08-13 17:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-25 13:42 - 2014-08-13 17:40 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-25 13:39 - 2014-08-13 17:40 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-25 13:39 - 2014-08-13 17:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-25 13:36 - 2014-08-13 17:40 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-25 13:34 - 2014-08-13 17:40 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-25 13:29 - 2014-08-13 17:40 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-25 13:23 - 2014-08-13 17:40 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-25 13:13 - 2014-08-13 17:40 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-25 13:07 - 2014-08-13 17:40 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-25 13:07 - 2014-08-13 17:40 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-25 13:03 - 2014-08-13 17:40 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-25 12:52 - 2014-08-13 17:40 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-25 12:26 - 2014-08-13 17:40 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-25 12:17 - 2014-08-13 17:40 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-25 12:09 - 2014-08-13 17:40 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-25 12:05 - 2014-08-13 17:40 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-25 12:00 - 2014-08-13 17:40 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-23 21:53 - 2014-07-23 21:53 - 02786954 _____ () C:\Users\vlastnik\Downloads\forge-1.7.2-10.12.2.1121-installer.jar
2014-07-23 21:34 - 2013-03-14 10:39 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-23 21:34 - 2013-03-14 10:39 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-23 20:58 - 2013-03-14 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-23 12:12 - 2014-07-23 12:12 - 00000000 ____D () C:\Users\vlastnik\Documents\Lightshot
2014-07-22 13:25 - 2011-10-13 15:49 - 00000000 ____D () C:\ProgramData\Adobe
2014-07-22 10:18 - 2014-07-22 10:16 - 00004114 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log
2014-07-22 10:18 - 2013-02-25 19:43 - 00000000 ____D () C:\Program Files (x86)\Java

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-18 15:20

==================== End Of Log ============================
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: adware pricechop a browser!shopa

#10 Příspěvek od vyosek »

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
HKLM-x32\...\Run: [msfbpvSrv] => C:\Windows\inf\msfbpv.vbe [1558 2013-08-27] ()
HKLM-x32\...\Run: [msasumurSrv] => C:\Windows\inf\msasumur.vbe [1558 2013-08-27] ()
HKLM-x32\...\Run: [msqhlabxSrv] => C:\Windows\inf\msqhlabx.vbe [1558 2013-08-27] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
C:\Windows\inf\msfbpv.vbe
C:\Windows\inf\msasumur.vbe
C:\Windows\inf\msqhlabx.vbe
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\...\RunOnce: [Uninstall C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64"
HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\...\MountPoints2: {dc7ac989-0504-11e4-9e8a-8f26e34bd287} - E:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\...\MountPoints2: {f3f0c334-c7ef-11e3-a09f-047d7b24fa9b} - E:\Startme.exe

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 L1C; system32\DRIVERS\L1C62x64.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
C:\Program Files (x86)\Skype\Toolbars

2014-08-19 13:07 - 2014-08-19 12:50 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-19 12:51 - 2014-08-19 13:18 - 00021387 _____ () C:\zoek-results.log
2014-08-19 12:50 - 2014-08-19 13:15 - 00000000 ____D () C:\zoek_backup
2014-08-19 12:49 - 2014-08-19 12:49 - 01288704 _____ () C:\Users\vlastnik\Downloads\zoek.exe
2014-08-18 19:17 - 2014-08-18 19:18 - 00000000 ____D () C:\AdwCleaner
2014-08-18 19:10 - 2014-08-18 19:10 - 00000000 ____D () C:\Windows\ERUNT
2014-08-18 19:09 - 2014-08-18 19:10 - 01361671 _____ () C:\Users\vlastnik\Downloads\adwcleaner_3.307.exe
2014-08-18 19:09 - 2014-08-18 19:09 - 01016261 _____ (Thisisu) C:\Users\vlastnik\Downloads\JRT.exe
2014-08-18 17:11 - 2014-08-18 17:11 - 01222144 _____ () C:\Users\vlastnik\Downloads\RSITx64.exe
2014-08-18 17:11 - 2014-08-18 17:11 - 00000000 ____D () C:\rsit
2014-08-18 17:11 - 2014-08-18 17:11 - 00000000 ____D () C:\Program Files\trend micro

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.autoupdate" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.szndesktop" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dxtory Update Checker 2.0" /f

Hosts:
Reboot:
End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
xaby
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 20 čer 2014 16:38

Re: adware pricechop a browser!shopa

#11 Příspěvek od xaby »

Neví jak,ale zmizelo to :)
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: adware pricechop a browser!shopa

#12 Příspěvek od vyosek »

Poprosim o fixlog.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
xaby
Návštěvník
Návštěvník
Příspěvky: 7
Registrován: 20 čer 2014 16:38

Re: adware pricechop a browser!shopa

#13 Příspěvek od xaby »

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-08-2014 01
Ran by vlastnik at 2014-08-21 18:18:18 Run:1
Running from C:\Users\vlastnik\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKLM-x32\...\Run: [msfbpvSrv] => C:\Windows\inf\msfbpv.vbe [1558 2013-08-27] ()
HKLM-x32\...\Run: [msasumurSrv] => C:\Windows\inf\msasumur.vbe [1558 2013-08-27] ()
HKLM-x32\...\Run: [msqhlabxSrv] => C:\Windows\inf\msqhlabx.vbe [1558 2013-08-27] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
C:\Windows\inf\msfbpv.vbe
C:\Windows\inf\msasumur.vbe
C:\Windows\inf\msqhlabx.vbe
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\...\RunOnce: [Uninstall C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64"
HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\...\MountPoints2: {dc7ac989-0504-11e4-9e8a-8f26e34bd287} - E:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\...\MountPoints2: {f3f0c334-c7ef-11e3-a09f-047d7b24fa9b} - E:\Startme.exe

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 L1C; system32\DRIVERS\L1C62x64.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
C:\Program Files (x86)\Skype\Toolbars

2014-08-19 13:07 - 2014-08-19 12:50 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-19 12:51 - 2014-08-19 13:18 - 00021387 _____ () C:\zoek-results.log
2014-08-19 12:50 - 2014-08-19 13:15 - 00000000 ____D () C:\zoek_backup
2014-08-19 12:49 - 2014-08-19 12:49 - 01288704 _____ () C:\Users\vlastnik\Downloads\zoek.exe
2014-08-18 19:17 - 2014-08-18 19:18 - 00000000 ____D () C:\AdwCleaner
2014-08-18 19:10 - 2014-08-18 19:10 - 00000000 ____D () C:\Windows\ERUNT
2014-08-18 19:09 - 2014-08-18 19:10 - 01361671 _____ () C:\Users\vlastnik\Downloads\adwcleaner_3.307.exe
2014-08-18 19:09 - 2014-08-18 19:09 - 01016261 _____ (Thisisu) C:\Users\vlastnik\Downloads\JRT.exe
2014-08-18 17:11 - 2014-08-18 17:11 - 01222144 _____ () C:\Users\vlastnik\Downloads\RSITx64.exe
2014-08-18 17:11 - 2014-08-18 17:11 - 00000000 ____D () C:\rsit
2014-08-18 17:11 - 2014-08-18 17:11 - 00000000 ____D () C:\Program Files\trend micro

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.autoupdate" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.szndesktop" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dxtory Update Checker 2.0" /f

Hosts:
Reboot:
End
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\msfbpvSrv => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\msasumurSrv => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\msqhlabxSrv => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value deleted successfully.
C:\Windows\inf\msfbpv.vbe => Moved successfully.
C:\Windows\inf\msasumur.vbe => Moved successfully.
C:\Windows\inf\msqhlabx.vbe => Moved successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} => Value not found.
HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} => Value not found.
HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} => Value not found.
HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\...\RunOnce: [Uninstall C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\vlastnik\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64" => Value not found.
"HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc7ac989-0504-11e4-9e8a-8f26e34bd287}" => Key deleted successfully.
"HKCR\CLSID\{dc7ac989-0504-11e4-9e8a-8f26e34bd287}" => Key not found.
"HKU\S-1-5-21-3578969385-4246678597-2779815396-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f3f0c334-c7ef-11e3-a09f-047d7b24fa9b}" => Key deleted successfully.
"HKCR\CLSID\{f3f0c334-c7ef-11e3-a09f-047d7b24fa9b}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}" => Key deleted successfully.
"HKCR\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl" => Key deleted successfully.
C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
c2cautoupdatesvc => Service stopped successfully.
c2cautoupdatesvc => Service deleted successfully.
c2cpnrsvc => Service stopped successfully.
c2cpnrsvc => Service deleted successfully.
L1C => Service deleted successfully.
pccsmcfd => Service deleted successfully.
C:\Program Files (x86)\Skype\Toolbars => Moved successfully.
C:\Windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\vlastnik\Downloads\zoek.exe => Moved successfully.
C:\AdwCleaner => Moved successfully.
C:\Windows\ERUNT => Moved successfully.
C:\Users\vlastnik\Downloads\adwcleaner_3.307.exe => Moved successfully.
C:\Users\vlastnik\Downloads\JRT.exe => Moved successfully.
C:\Users\vlastnik\Downloads\RSITx64.exe => Moved successfully.
C:\rsit => Moved successfully.
C:\Program Files\trend micro => Moved successfully.

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.autoupdate" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cz.seznam.software.szndesktop" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dxtory Update Checker 2.0" /f =========

Chyba: Syst‚m nenalezl zadaně klˇź registru nebo po§adovanou hodnotu.


========= End of Reg: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.


The system needed a reboot.

==== End of Fixlog ====
Nahoru
Uživatelský avatar
vyosek
VIP
VIP
Příspěvky: 56373
Registrován: 07 lis 2006 15:24
Bydliště: Šalingrad - Brno

Re: adware pricechop a browser!shopa

#14 Příspěvek od vyosek »

Tak jeste uklidime :James008:

:arrow: T-Cleaner http://vyosek.tym.cz/pro_usery/T-Cleaner.exe
  • Stahnete a spustte
  • Pro potvrzeni volby mackejte A, Enter
  • Po pouziti utilitu smazte
  • Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
:arrow: OTC http://oldtimer.geekstogo.com/OTC.exe
  • Stahnete a spustte
  • Kliknete na CleanUp a potvrdte YES
  • Program uklidi a restartuje PC

:arrow: TFC http://oldtimer.geekstogo.com/TFC.exe
  • Stahnete a spustte
  • Kliknete na Start a potvrdte OK
  • Program uklidi a restartuje pc
  • Po pouziti utilitu smazte
:arrow: Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: A pokud nejsou problemy ci dotazy, je to z me strany vse :|
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Odpovědět

Zpět na „Prohlížeče, antispamy a poštovní klienti“