Prosim o preventivku

[marko70711]

Tu posielam log Ps: mam problem s antivirom - nechce sa aktualizovat

Logfile of random's system information tool 1.09 (written by random/random)
Run by mato at 2013-01-21 12:55:35
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 156 GB (54%) free of 288 GB
Total RAM: 2811 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:55:38, on 21. 1. 2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16438)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Software602\Print2PDF\Print2PDF.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe
C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\mato.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.zoznam.sk
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Program Windows Internet Explorer poskytuje: Zoznam.sk
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: DVDVideoSoftTB - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll
O2 - BHO: Pomocník pri prihlasovaní v konte Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: RewardsArcadeSuite - {B6EF6C45-5E8D-4c3b-B580-A5073261A381} - C:\Program Files (x86)\RewardsArcadeSuite\RewardsArcadeSuite.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
O3 - Toolbar: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Print2PDF Print Monitor] "C:\Program Files (x86)\Software602\Print2PDF\Print2PDF.exe" /server
O4 - HKLM\..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Sweetpacks Communicator] C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe
O4 - HKLM\..\Run: [LauncherM1400] "C:\Program Files (x86)\EPSON_P2B\Printer Software\Launcher\selaunch.exe" /S EPSON AL-M1400
O4 - HKLM\..\Run: [DocuPrint M1400 RUN] "C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmRun.exe"
O4 - HKLM\..\Run: [StatusAutoRunM1400] "C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmpl.exe" EPSON AL-M1400,hide,\S
O4 - HKLM\..\Run: [Bonus.SSR.FR11] "C:\Program Files (x86)\ABBYY FineReader 11\Bonus.ScreenshotReader.exe" /autorun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovať do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\mato\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O8 - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm
O9 - Extra 'Tools' menuitem: @C:\Program Files\Motorola\Bluetooth\btmshell.dll,-137 - {bd707fe6-39f6-4bda-9265-86a76719bdc5} - C:\Program Files\Motorola\Bluetooth\btmiesend.htm
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://195.28.70.134/kapor2/lib/mgaxctrl.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: ABBYY FineReader 11 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.11.0) - ABBYY - C:\Program Files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Bluetooth Device Manager - Motorola, Inc. - C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
O23 - Service: Bluetooth Media Service - Motorola, Inc. - C:\Program Files\Motorola\Bluetooth\audiosrv.exe
O23 - Service: Bluetooth OBEX Service - Motorola, Inc. - C:\Program Files\Motorola\Bluetooth\obexsrv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Easybits Services for Windows (ezSharedSvc) - EasyBits Software AS - C:\Windows\System32\ezSharedSvcHost.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Wireless Assistant Service - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HPWMISVC - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\SysWOW64\NLSSRV32.EXE
O23 - Service: PandoraService (PanService) - Pandora.TV - C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: RtVOsdService Installer (RtVOsdService) - Realtek Semiconductor Corp. - C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SEcnStatutsDatabase (SENADB) - Unknown owner - C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmdb.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 14708 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
atieclxx
C:\Windows\system32\atibtmon.exe Global\Ati_VariBrightMonitorEvent
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\Explorer.EXE
"C:\Windows\system32\Dwm.exe"
C:\Windows\System32\spoolsv.exe
taskeng.exe {4223CD33-E35A-4245-B0BC-5823DBB73BA9}
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"taskhost.exe"
"C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe"
taskeng.exe {3528757F-2533-4B98-8CCF-5699A8DDDF6B}
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe" -service
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe"
"C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe"
"C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
C:\Windows\SysWOW64\ezSharedSvcHost.exe
"C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe"
"C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
C:\Windows\SysWOW64\NLSSRV32.EXE
"C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp
C:\Windows\System32\svchost.exe -k HPZ12
"C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmdb.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files\Motorola\Bluetooth\obexsrv.exe"
WLIDSvcM.exe 2820
"C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"
"C:\Program Files (x86)\Software602\Print2PDF\Print2PDF.exe" /server
"C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe"
"C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe"
"C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmW.exe"
\??\C:\Windows\system32\conhost.exe "1978933209-441820970314030620-1438908911543824416-1831316097-771664142273680775
"C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmwj.exe"
\??\C:\Windows\system32\conhost.exe "36789909218296956293721089061706901739-2025893952-646738708-17105384761113672479
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe"
"C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe"
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\Motorola\Bluetooth\audiosrv.exe"
"C:\Program Files\Motorola\Bluetooth\btplayerctrl.exe" -Embedding
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe" /hidden
"C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe"
"C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe"
"C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe"
"C:\Program Files\Realtek\RtVOsd\RtVOsd.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="2012.1.734218697\1735523023" --supports-dual-gpus=false --skip-gpu-full-info-collection --reduce-gpu-sandbox --disable-image-transport-surface --gpu-vendor-id=0x1002 --gpu-device-id=0x9712 --gpu-driver-vendor="ATI Technologies Inc." --gpu-driver-version=8.712.1.3000 --ignored=" --type=renderer " /prefetch:12
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=sk --force-fieldtrials=EnableStage3D/enabled/ForceCompositingMode/enabled/GlobalSdch/global_enable_sdch/InfiniteCache/No/NewTabButton/default/OmniboxDisallowInlineHQP/Standard/OmniboxHUPCreateShorterMatch/Standard/OmniboxHUPCullRedirects/Standard/OmniboxSearchSuggestTrialStarted2012Q4/5/OneClickSignIn/Standard/Prerender/PrerenderEnabled/SBInterstitial/V2/SpdyCwnd/cwndMin16/SpeculativePrefetching/Disabled/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-1-Percent/group_50/UMA-Uniformity-Trial-10-Percent/default/UMA-Uniformity-Trial-20-Percent/group_02/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/default/WarmSocketImpact/warm_socket/ --extension-process --renderer-print-preview --channel="2012.2.433138075\1550746624" /prefetch:3
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\mato\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\np_dvs_plugin.dll" --lang=sk --channel="2012.3.1846513299\1925668546" /prefetch:4
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=sk --force-fieldtrials=CacheSensitivityAnalysis/No/EnableStage3D/enabled/ForceCompositingMode/enabled/GlobalSdch/global_enable_sdch/InfiniteCache/No/NewTabButton/default/OmniboxDisallowInlineHQP/Standard/OmniboxHUPCreateShorterMatch/Standard/OmniboxHUPCullRedirects/Standard/OmniboxSearchSuggestTrialStarted2012Q4/5/OneClickSignIn/Standard/Prerender/PrerenderEnabled/SBInterstitial/V2/SpdyCwnd/cwndMin16/SpeculativePrefetching/Disabled/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-1-Percent/group_50/UMA-Uniformity-Trial-10-Percent/default/UMA-Uniformity-Trial-20-Percent/group_02/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/default/WarmSocketImpact/warm_socket/ --renderer-print-preview --channel="2012.4.1802863886\155252181" /prefetch:3
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=ppapi --channel="2012.5.1181167368\1663559305" --lang=sk --ignored=" --type=renderer " /prefetch:13
"C:\Users\mato\Desktop\Rodinne dokumenty\Mato\Nastroje pre antivir\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\HPCeeScheduleFormato.job
C:\Windows\tasks\ReclaimerUpdateFiles_mato.job
C:\Windows\tasks\ReclaimerUpdateXML_mato.job
C:\Windows\tasks\RNUpgradeHelperLogonPrompt_mato.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F}]
PDF-XChange Viewer IE-Plugin - C:\Program Files\Tracker Software\PDF-XChange Viewer\pdf-viewer\PDFXCviewIEPlugin.dll [2008-03-25 1296064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-08-14 43520]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18 66280]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2012-09-24 329712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
DVDVideoSoftTB Toolbar - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll [2011-05-09 176936]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pri prihlasovaní v konte Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 439168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B6EF6C45-5E8D-4c3b-B580-A5073261A381}]
RewardsArcadeSuite - C:\Program Files (x86)\RewardsArcadeSuite\RewardsArcadeSuite.dll [2011-11-03 528216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-09-24 59376]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E76FD755-C1BA-4DCB-9F13-99BD91223ADE}]
HP Network Check Helper - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2012-07-09 351136]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{872b5b88-9db5-4310-bdd0-ac189557e5f5} - DVDVideoSoftTB Toolbar - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll [2011-05-09 176936]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-10-14 2837288]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2010-05-26 6245408]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2012-09-12 1289704]
"HPWirelessAssistant"=C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe [2010-06-18 8192]
"BTMTrayAgent"=C:\Program Files\Motorola\Bluetooth\btmshell.dll [2010-06-10 24783624]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-04-17 3671872]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2010-06-17 98304]
"Print2PDF Print Monitor"=C:\Program Files (x86)\Software602\Print2PDF\Print2PDF.exe [2011-04-12 222776]
"HP Quick Launch"=C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [2010-07-02 602680]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
"TkBellExe"=C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [2012-08-29 296096]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-09-17 254896]
"Sweetpacks Communicator"=C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe [2012-08-15 231768]
"LauncherM1400"=C:\Program Files (x86)\EPSON_P2B\Printer Software\Launcher\selaunch.exe [2011-04-27 2438112]
"DocuPrint M1400 RUN"=C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmRun.exe [2011-04-27 361952]
"StatusAutoRunM1400"=C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmpl.exe [2011-07-19 4480984]
"Bonus.SSR.FR11"=C:\Program Files (x86)\ABBYY FineReader 11\Bonus.ScreenshotReader.exe [2011-08-18 925960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableLockWorkstation"=0
"DisableTaskMgr"=0
"DisableChangePassword"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"HideFastUserSwitching"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"EnableShellExecuteHooks"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-01-21 12:49:52 ----D---- C:\rsit
2013-01-20 19:53:16 ----D---- C:\ProgramData\SpecialBit Games
2013-01-20 13:22:22 ----D---- C:\ProgramData\JollyBear
2013-01-20 13:02:51 ----D---- C:\Windows\Big City Adventures-Sydney Australia
2013-01-20 13:02:51 ----D---- C:\Program Files (x86)\Big City Adventures-Sydney Australia
2013-01-17 18:09:33 ----D---- C:\Users\mato\AppData\Roaming\Software602
2013-01-17 09:58:03 ----D---- C:\Administrator's Guide
2013-01-17 09:54:51 ----D---- C:\Program Files (x86)\ABBYY FineReader 11
2013-01-16 21:02:57 ----D---- C:\Users\mato\AppData\Roaming\Gogii
2013-01-16 20:59:14 ----D---- C:\Windows\Infected - The Twin Vaccine CE
2013-01-16 20:59:14 ----D---- C:\Program Files (x86)\Infected - The Twin Vaccine CE
2013-01-15 14:03:55 ----D---- C:\Users\mato\AppData\Roaming\Rovio
2013-01-15 14:03:29 ----D---- C:\Program Files (x86)\Rovio
2013-01-13 20:20:51 ----D---- C:\Users\mato\AppData\Roaming\CasinoOnNet
2013-01-13 20:20:32 ----D---- C:\Program Files (x86)\CasinoOnNet
2013-01-11 14:29:43 ----D---- C:\Users\mato\AppData\Roaming\ABBYY
2013-01-11 14:04:04 ----D---- C:\ProgramData\ABBYY
2013-01-10 21:49:22 ----A---- C:\Windows\system32\Wpc.dll
2013-01-10 21:49:20 ----A---- C:\Windows\SYSWOW64\gameux.dll
2013-01-10 21:49:20 ----A---- C:\Windows\system32\gameux.dll
2013-01-10 21:49:19 ----A---- C:\Windows\SYSWOW64\Wpc.dll
2013-01-10 21:48:26 ----A---- C:\Windows\system32\KernelBase.dll
2013-01-10 21:48:25 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2013-01-10 21:48:25 ----A---- C:\Windows\system32\kernel32.dll
2013-01-10 21:48:24 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2013-01-10 21:48:24 ----A---- C:\Windows\system32\wow64win.dll
2013-01-10 21:48:24 ----A---- C:\Windows\system32\wow64cpu.dll
2013-01-10 21:48:24 ----A---- C:\Windows\system32\wow64.dll
2013-01-10 21:48:24 ----A---- C:\Windows\system32\winsrv.dll
2013-01-10 21:48:24 ----A---- C:\Windows\system32\conhost.exe
2013-01-10 21:48:23 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-01-10 21:48:23 ----A---- C:\Windows\SYSWOW64\wow32.dll
2013-01-10 21:48:23 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2013-01-10 21:48:23 ----A---- C:\Windows\system32\ntvdm64.dll
2013-01-10 21:48:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2013-01-10 21:48:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-01-10 21:48:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-01-10 21:48:22 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-01-10 21:48:22 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-01-10 21:48:21 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-01-10 21:48:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-01-10 21:48:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-01-10 21:48:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2013-01-10 21:48:19 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-01-10 21:48:19 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-01-10 21:48:19 ----A---- C:\Windows\SYSWOW64\setup16.exe
2013-01-10 21:48:19 ----A---- C:\Windows\SYSWOW64\instnm.exe
2013-01-10 21:48:18 ----A---- C:\Windows\SYSWOW64\user.exe
2013-01-10 21:47:26 ----A---- C:\Windows\system32\msxml6.dll
2013-01-10 21:47:25 ----A---- C:\Windows\system32\msxml3.dll
2013-01-10 21:47:24 ----A---- C:\Windows\SYSWOW64\msxml6.dll
2013-01-10 21:47:24 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2013-01-10 21:46:49 ----A---- C:\Windows\SYSWOW64\usp10.dll
2013-01-10 21:46:49 ----A---- C:\Windows\system32\usp10.dll
2013-01-10 21:46:47 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2013-01-10 21:46:47 ----A---- C:\Windows\system32\ncrypt.dll
2013-01-10 21:45:25 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2013-01-10 21:45:25 ----A---- C:\Windows\system32\win32spl.dll
2013-01-10 21:45:24 ----A---- C:\Windows\system32\taskhost.exe
2013-01-10 21:42:27 ----A---- C:\Windows\system32\win32k.sys
2013-01-05 11:07:54 ----D---- C:\Chcete být milionářem
2013-01-04 20:00:20 ----A---- C:\Windows\system32\d3dx10_41.dll
2013-01-04 20:00:20 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2013-01-04 20:00:19 ----A---- C:\Windows\SYSWOW64\D3DX9_41.dll
2013-01-04 20:00:19 ----A---- C:\Windows\system32\D3DX9_41.dll
2013-01-04 20:00:17 ----A---- C:\Windows\SYSWOW64\XAudio2_4.dll
2013-01-04 20:00:17 ----A---- C:\Windows\system32\XAudio2_4.dll
2013-01-04 20:00:17 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2013-01-04 20:00:16 ----A---- C:\Windows\SYSWOW64\xactengine3_4.dll
2013-01-04 20:00:16 ----A---- C:\Windows\SYSWOW64\X3DAudio1_6.dll
2013-01-04 20:00:16 ----A---- C:\Windows\system32\xactengine3_4.dll
2013-01-04 20:00:16 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2013-01-04 20:00:15 ----A---- C:\Windows\SYSWOW64\d3dx10_40.dll
2013-01-04 20:00:15 ----A---- C:\Windows\SYSWOW64\D3DCompiler_40.dll
2013-01-04 20:00:15 ----A---- C:\Windows\system32\d3dx10_40.dll
2013-01-04 20:00:15 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2013-01-04 20:00:13 ----A---- C:\Windows\SYSWOW64\D3DX9_40.dll
2013-01-04 20:00:13 ----A---- C:\Windows\system32\D3DX9_40.dll
2013-01-04 20:00:12 ----A---- C:\Windows\SYSWOW64\XAudio2_3.dll
2013-01-04 20:00:12 ----A---- C:\Windows\SYSWOW64\XAPOFX1_2.dll
2013-01-04 20:00:12 ----A---- C:\Windows\system32\XAudio2_3.dll
2013-01-04 20:00:12 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2013-01-04 20:00:11 ----A---- C:\Windows\SYSWOW64\xactengine3_3.dll
2013-01-04 20:00:11 ----A---- C:\Windows\SYSWOW64\X3DAudio1_5.dll
2013-01-04 20:00:11 ----A---- C:\Windows\system32\xactengine3_3.dll
2013-01-04 20:00:11 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2013-01-04 20:00:09 ----A---- C:\Windows\SYSWOW64\XAudio2_2.dll
2013-01-04 20:00:09 ----A---- C:\Windows\SYSWOW64\XAPOFX1_1.dll
2013-01-04 20:00:09 ----A---- C:\Windows\SYSWOW64\xactengine3_2.dll
2013-01-04 20:00:09 ----A---- C:\Windows\system32\XAudio2_2.dll
2013-01-04 20:00:09 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2013-01-04 20:00:09 ----A---- C:\Windows\system32\xactengine3_2.dll
2013-01-04 20:00:08 ----A---- C:\Windows\SYSWOW64\d3dx10_39.dll
2013-01-04 20:00:08 ----A---- C:\Windows\SYSWOW64\D3DCompiler_39.dll
2013-01-04 20:00:08 ----A---- C:\Windows\system32\d3dx10_39.dll
2013-01-04 20:00:08 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2013-01-04 20:00:06 ----A---- C:\Windows\SYSWOW64\D3DX9_39.dll
2013-01-04 20:00:06 ----A---- C:\Windows\system32\D3DX9_39.dll
2013-01-04 20:00:05 ----A---- C:\Windows\SYSWOW64\XAudio2_1.dll
2013-01-04 20:00:05 ----A---- C:\Windows\SYSWOW64\XAPOFX1_0.dll
2013-01-04 20:00:05 ----A---- C:\Windows\system32\XAudio2_1.dll
2013-01-04 20:00:05 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2013-01-04 20:00:03 ----A---- C:\Windows\SYSWOW64\xactengine3_1.dll
2013-01-04 20:00:03 ----A---- C:\Windows\SYSWOW64\X3DAudio1_4.dll
2013-01-04 20:00:03 ----A---- C:\Windows\system32\xactengine3_1.dll
2013-01-04 20:00:03 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2013-01-04 20:00:02 ----A---- C:\Windows\SYSWOW64\d3dx10_38.dll
2013-01-04 20:00:02 ----A---- C:\Windows\SYSWOW64\D3DCompiler_38.dll
2013-01-04 20:00:02 ----A---- C:\Windows\system32\d3dx10_38.dll
2013-01-04 20:00:02 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2013-01-04 20:00:01 ----A---- C:\Windows\SYSWOW64\D3DX9_38.dll
2013-01-04 20:00:01 ----A---- C:\Windows\system32\D3DX9_38.dll
2013-01-04 19:59:59 ----A---- C:\Windows\SYSWOW64\XAudio2_0.dll
2013-01-04 19:59:59 ----A---- C:\Windows\system32\XAudio2_0.dll
2013-01-04 19:59:58 ----A---- C:\Windows\SYSWOW64\xactengine3_0.dll
2013-01-04 19:59:58 ----A---- C:\Windows\SYSWOW64\X3DAudio1_3.dll
2013-01-04 19:59:58 ----A---- C:\Windows\system32\xactengine3_0.dll
2013-01-04 19:59:58 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2013-01-04 19:59:57 ----A---- C:\Windows\SYSWOW64\d3dx10_37.dll
2013-01-04 19:59:57 ----A---- C:\Windows\SYSWOW64\D3DCompiler_37.dll
2013-01-04 19:59:57 ----A---- C:\Windows\system32\d3dx10_37.dll
2013-01-04 19:59:57 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2013-01-04 19:59:56 ----A---- C:\Windows\SYSWOW64\D3DX9_37.dll
2013-01-04 19:59:56 ----A---- C:\Windows\system32\D3DX9_37.dll
2013-01-04 19:59:55 ----A---- C:\Windows\SYSWOW64\xactengine2_10.dll
2013-01-04 19:59:55 ----A---- C:\Windows\system32\xactengine2_10.dll
2013-01-04 19:59:53 ----A---- C:\Windows\SYSWOW64\d3dx10_36.dll
2013-01-04 19:59:53 ----A---- C:\Windows\system32\d3dx10_36.dll
2013-01-04 19:59:52 ----A---- C:\Windows\SYSWOW64\d3dx9_36.dll
2013-01-04 19:59:52 ----A---- C:\Windows\SYSWOW64\D3DCompiler_36.dll
2013-01-04 19:59:52 ----A---- C:\Windows\system32\d3dx9_36.dll
2013-01-04 19:59:52 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2013-01-04 19:59:50 ----A---- C:\Windows\SYSWOW64\xactengine2_9.dll
2013-01-04 19:59:50 ----A---- C:\Windows\SYSWOW64\d3dx10_35.dll
2013-01-04 19:59:50 ----A---- C:\Windows\SYSWOW64\D3DCompiler_35.dll
2013-01-04 19:59:50 ----A---- C:\Windows\system32\xactengine2_9.dll
2013-01-04 19:59:50 ----A---- C:\Windows\system32\d3dx10_35.dll
2013-01-04 19:59:50 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2013-01-04 19:59:49 ----A---- C:\Windows\SYSWOW64\d3dx9_35.dll
2013-01-04 19:59:49 ----A---- C:\Windows\system32\d3dx9_35.dll
2013-01-04 19:59:48 ----A---- C:\Windows\SYSWOW64\xactengine2_8.dll
2013-01-04 19:59:48 ----A---- C:\Windows\SYSWOW64\X3DAudio1_2.dll
2013-01-04 19:59:48 ----A---- C:\Windows\system32\xactengine2_8.dll
2013-01-04 19:59:48 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2013-01-04 19:59:47 ----A---- C:\Windows\SYSWOW64\d3dx10_34.dll
2013-01-04 19:59:47 ----A---- C:\Windows\system32\d3dx10_34.dll
2013-01-04 19:59:46 ----A---- C:\Windows\SYSWOW64\d3dx9_34.dll
2013-01-04 19:59:46 ----A---- C:\Windows\SYSWOW64\D3DCompiler_34.dll
2013-01-04 19:59:46 ----A---- C:\Windows\system32\d3dx9_34.dll
2013-01-04 19:59:46 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2013-01-04 19:59:44 ----A---- C:\Windows\SYSWOW64\xinput1_3.dll
2013-01-04 19:59:44 ----A---- C:\Windows\system32\xinput1_3.dll
2013-01-04 19:59:43 ----A---- C:\Windows\SYSWOW64\xactengine2_7.dll
2013-01-04 19:59:43 ----A---- C:\Windows\system32\xactengine2_7.dll
2013-01-04 19:59:42 ----A---- C:\Windows\SYSWOW64\d3dx10_33.dll
2013-01-04 19:59:42 ----A---- C:\Windows\SYSWOW64\D3DCompiler_33.dll
2013-01-04 19:59:42 ----A---- C:\Windows\system32\d3dx10_33.dll
2013-01-04 19:59:42 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2013-01-04 19:59:41 ----A---- C:\Windows\SYSWOW64\d3dx9_33.dll
2013-01-04 19:59:41 ----A---- C:\Windows\system32\d3dx9_33.dll
2013-01-04 19:59:40 ----A---- C:\Windows\SYSWOW64\xactengine2_6.dll
2013-01-04 19:59:40 ----A---- C:\Windows\system32\xactengine2_6.dll
2013-01-04 19:59:39 ----A---- C:\Windows\SYSWOW64\xactengine2_5.dll
2013-01-04 19:59:39 ----A---- C:\Windows\system32\xactengine2_5.dll
2013-01-04 19:59:38 ----A---- C:\Windows\SYSWOW64\d3dx10.dll
2013-01-04 19:59:38 ----A---- C:\Windows\system32\d3dx10.dll
2013-01-04 19:59:35 ----A---- C:\Windows\SYSWOW64\xactengine2_4.dll
2013-01-04 19:59:35 ----A---- C:\Windows\SYSWOW64\x3daudio1_1.dll
2013-01-04 19:59:35 ----A---- C:\Windows\system32\xactengine2_4.dll
2013-01-04 19:59:35 ----A---- C:\Windows\system32\x3daudio1_1.dll
2013-01-04 19:59:34 ----A---- C:\Windows\SYSWOW64\d3dx9_31.dll
2013-01-04 19:59:34 ----A---- C:\Windows\system32\d3dx9_31.dll
2013-01-04 19:59:33 ----A---- C:\Windows\SYSWOW64\xinput1_2.dll
2013-01-04 19:59:33 ----A---- C:\Windows\SYSWOW64\xactengine2_3.dll
2013-01-04 19:59:33 ----A---- C:\Windows\system32\xinput1_2.dll
2013-01-04 19:59:33 ----A---- C:\Windows\system32\xactengine2_3.dll
2013-01-04 19:59:32 ----A---- C:\Windows\SYSWOW64\xactengine2_2.dll
2013-01-04 19:59:32 ----A---- C:\Windows\system32\xactengine2_2.dll
2013-01-04 19:59:30 ----A---- C:\Windows\SYSWOW64\xinput1_1.dll
2013-01-04 19:59:30 ----A---- C:\Windows\system32\xinput1_1.dll
2013-01-04 19:59:29 ----A---- C:\Windows\SYSWOW64\xactengine2_1.dll
2013-01-04 19:59:29 ----A---- C:\Windows\system32\xactengine2_1.dll
2013-01-04 19:59:15 ----A---- C:\Windows\SYSWOW64\d3dx9_30.dll
2013-01-04 19:59:15 ----A---- C:\Windows\system32\d3dx9_30.dll
2013-01-04 19:59:13 ----A---- C:\Windows\SYSWOW64\xactengine2_0.dll
2013-01-04 19:59:13 ----A---- C:\Windows\system32\xactengine2_0.dll
2013-01-04 19:59:12 ----A---- C:\Windows\SYSWOW64\x3daudio1_0.dll
2013-01-04 19:59:12 ----A---- C:\Windows\system32\x3daudio1_0.dll
2013-01-04 19:59:11 ----A---- C:\Windows\SYSWOW64\d3dx9_29.dll
2013-01-04 19:59:11 ----A---- C:\Windows\system32\d3dx9_29.dll
2013-01-04 19:59:09 ----A---- C:\Windows\SYSWOW64\d3dx9_28.dll
2013-01-04 19:59:09 ----A---- C:\Windows\system32\d3dx9_28.dll
2013-01-04 19:59:08 ----A---- C:\Windows\SYSWOW64\d3dx9_27.dll
2013-01-04 19:59:08 ----A---- C:\Windows\system32\d3dx9_27.dll
2013-01-04 19:59:06 ----A---- C:\Windows\SYSWOW64\d3dx9_26.dll
2013-01-04 19:59:06 ----A---- C:\Windows\system32\d3dx9_26.dll
2013-01-04 19:59:02 ----A---- C:\Windows\SYSWOW64\d3dx9_25.dll
2013-01-04 19:59:02 ----A---- C:\Windows\system32\d3dx9_25.dll
2013-01-04 19:58:57 ----A---- C:\Windows\SYSWOW64\d3dx9_24.dll
2013-01-04 19:58:57 ----A---- C:\Windows\system32\d3dx9_24.dll
2013-01-01 18:42:37 ----D---- C:\Program Files (x86)\Conduit
2013-01-01 18:42:33 ----D---- C:\Program Files (x86)\DVDVideoSoftTB
2013-01-01 18:41:40 ----D---- C:\Users\mato\AppData\Roaming\DVDVideoSoftIEHelpers
2013-01-01 18:41:09 ----D---- C:\Users\mato\AppData\Roaming\OpenCandy
2013-01-01 18:41:09 ----D---- C:\Program Files (x86)\DVDVideoSoft
2012-12-31 11:34:45 ----D---- C:\Users\mato\AppData\Roaming\XnView
2012-12-31 11:34:36 ----D---- C:\Program Files (x86)\XnView
2012-12-31 10:09:23 ----D---- C:\Program Files (x86)\Imager Enhancer
2012-12-27 11:10:38 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2012-12-27 11:10:38 ----A---- C:\Windows\system32\atmlib.dll
2012-12-27 11:10:37 ----A---- C:\Windows\system32\atmfd.dll
2012-12-27 11:10:36 ----A---- C:\Windows\SYSWOW64\atmfd.dll

======List of files/folders modified in the last 1 month======

2013-01-21 12:55:38 ----D---- C:\Program Files\trend micro
2013-01-21 12:47:10 ----D---- C:\Windows\Temp
2013-01-21 12:31:17 ----D---- C:\Windows\system32\config
2013-01-21 12:10:46 ----D---- C:\Windows\inf
2013-01-21 12:10:42 ----D---- C:\Windows\Logs
2013-01-21 12:10:42 ----D---- C:\Windows\debug
2013-01-21 12:10:42 ----AD---- C:\Windows
2013-01-21 12:04:42 ----D---- C:\Users\mato\AppData\Roaming\602Installer
2013-01-21 12:02:46 ----D---- C:\Windows\Prefetch
2013-01-21 12:01:52 ----D---- C:\Windows\system32\Tasks
2013-01-20 23:43:13 ----SHD---- C:\System Volume Information
2013-01-20 19:53:16 ----HD---- C:\ProgramData
2013-01-20 19:39:21 ----D---- C:\Users\mato\AppData\Roaming\OpenOffice.org2
2013-01-20 13:02:51 ----D---- C:\Program Files (x86)
2013-01-20 13:02:11 ----SHD---- C:\Windows\Installer
2013-01-20 13:01:44 ----D---- C:\Program Files (x86)\LeeGTs Games
2013-01-20 12:16:06 ----D---- C:\ProgramData\Oberon Games
2013-01-19 11:25:36 ----A---- C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-01-18 10:52:00 ----D---- C:\Windows\System32
2013-01-18 10:52:00 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-01-15 14:03:39 ----D---- C:\Windows\SysWOW64
2013-01-13 18:48:15 ----D---- C:\Windows\system32\catroot
2013-01-13 16:25:54 ----D---- C:\Program Files (x86)\SweetIM
2013-01-13 16:22:10 ----D---- C:\Program Files (x86)\Games
2013-01-13 16:21:10 ----D---- C:\Program Files (x86)\fliptoast
2013-01-13 16:19:47 ----D---- C:\Program Files (x86)\iWin.com Games
2013-01-13 16:19:23 ----D---- C:\Program Files (x86)\Operation Mania
2013-01-13 16:19:03 ----D---- C:\Program Files (x86)\Nokia
2013-01-13 16:19:00 ----D---- C:\Windows\system32\drivers
2013-01-13 16:18:59 ----D---- C:\Windows\system32\DriverStore
2013-01-13 16:18:51 ----D---- C:\Windows\system32\catroot2
2013-01-13 16:18:07 ----D---- C:\Program Files (x86)\Common Files
2013-01-13 16:17:38 ----D---- C:\Program Files\Common Files
2013-01-13 16:15:51 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2013-01-13 16:15:45 ----D---- C:\Program Files (x86)\CyberLink
2013-01-13 16:14:33 ----D---- C:\Program Files (x86)\Photo Mania
2013-01-11 20:18:32 ----D---- C:\Windows\rescache
2013-01-11 13:53:30 ----D---- C:\Temp
2013-01-11 13:30:39 ----D---- C:\Windows\Microsoft.NET
2013-01-11 13:30:36 ----RSD---- C:\Windows\assembly
2013-01-11 09:15:25 ----D---- C:\Windows\winsxs
2013-01-10 22:06:06 ----D---- C:\Windows\SYSWOW64\sk-SK
2013-01-10 22:06:06 ----D---- C:\Windows\system32\sk-SK
2013-01-10 22:06:04 ----D---- C:\Windows\AppPatch
2013-01-10 22:05:13 ----D---- C:\ProgramData\Microsoft Help
2013-01-10 21:53:53 ----A---- C:\Windows\system32\MRT.exe
2013-01-09 17:47:15 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-01-07 11:24:41 ----D---- C:\Users\mato\AppData\Roaming\Nitro
2013-01-05 11:12:12 ----D---- C:\Windows\Tasks
2013-01-01 18:47:21 ----D---- C:\ProgramData\Nitro
2013-01-01 18:41:53 ----D---- C:\Users\mato\AppData\Roaming\DVDVideoSoft
2013-01-01 01:26:13 ----D---- C:\Users\mato\AppData\Roaming\Skype

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-08-24 16440]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2012-08-30 228768]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-22 283200]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atipmdag.sys [2010-06-17 6403072]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2010-06-17 188928]
R3 clwvd;CyberLink WebCam Virtual Driver; C:\Windows\system32\DRIVERS\clwvd.sys [2010-08-02 32880]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-05-26 2374560]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver; C:\Windows\system32\DRIVERS\netr28x.sys [2010-06-23 931168]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-10-14 396848]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]
S3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 BTMCOM;Bluetooth Serial Port; C:\Windows\System32\Drivers\btmcom.sys [2010-04-09 52736]
S3 BTMUSB;Motorola Bluetooth Radio Service; C:\Windows\System32\Drivers\btmusb.sys [2010-06-29 3232768]
S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader; C:\Windows\system32\DRIVERS\ewdcsc.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys []
S3 hwusbdev;Huawei DataCard USB PNP Device; C:\Windows\system32\DRIVERS\ewusbdev.sys []
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-06-10 6108416]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit; C:\Windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 sdbus;sdbus; C:\Windows\system32\drivers\sdbus.sys [2010-11-20 109056]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 32768]
S3 WinUsb;WinUSB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2010-04-14 73728]
R2 ABBYY.Licensing.FineReader.Professional.11.0;ABBYY FineReader 11 PE Licensing Service; C:\Program Files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe [2011-08-18 819976]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-12-18 65192]
R2 AERTFilters;Andrea RT Filters Service; C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2010-06-17 202752]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files\Motorola\Bluetooth\obexsrv.exe [2010-05-20 677128]
R2 ezSharedSvc;Easybits Services for Windows; C:\Windows\syswow64\ezSharedSvcHost.exe [2010-04-23 514232]
R2 HP Support Assistant Service;HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 86528]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service; C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-06-18 103992]
R2 HPWMISVC;HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-07-02 27192]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [2011-04-16 73728]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2012-09-12 22072]
R2 nlsX86cc;Nalpeiron Licensing Service; C:\Windows\SysWOW64\NLSSRV32.EXE [2012-04-03 69640]
R2 PanService;PandoraService; C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [2012-06-22 625816]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 RtVOsdService;RtVOsdService Installer; C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [2010-04-19 315392]
R2 SENADB;SEcnStatutsDatabase; C:\Program Files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmdb.exe [2011-07-19 101336]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 Bluetooth Device Manager;Bluetooth Device Manager; C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe [2010-06-29 4181256]
R3 Bluetooth Media Service;Bluetooth Media Service; C:\Program Files\Motorola\Bluetooth\audiosrv.exe [2010-05-20 1096968]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-08-29 1028096]
R3 hpqwmiex;HP Software Framework Service; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [2012-08-10 1001376]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-11 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-09 251400]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-08-29 647680]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-11 116648]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2010-12-08 628736]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-03-04 1255736]

-----------------EOF-----------------

[marko70711]

Este pripajam k tomu jpg obrazok z toho antiviru http://imageshack.us/photo/my-images/7/testyzj.jpg/ zatial dikes.

[Roli]

Zdravím, tohle fixni v HJT :

O3 - Toolbar: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

HJT najdeš zde :

C:\Program Files\trend micro\mato.exe

Fix znamená že spustíš HJT jako admin

v okně které se ti otevře klikneš na Do a system scan only

v dalším okně najdeš řádky které jsem ti vypsal,

vedle nich je čtvereček do kterého uděláš zatržítko,

pak klikneš na Fix checked které je vlevo dole,

program se ti zeptá zda opravdu ANO s tím samozřejmě souhlasíš a je hotovo.


Přes Start >> Všechny programy >> Příslušenství >> Spustit >> napiš - services.msc >> Enter. Najdi službu :

Služba Google Update (gupdate)

Služba Google Update (gupdatem)

PandoraService (PanService)

klikni na ni pravým myšítkem, zvol vlastnosti, na další kartě nejprve službu zastav tlačítkem Zastavit a u položky Typ spouštění zvol Zakázáno.


Smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

čištění registru je třeba několikrát zopakovat !

Nástroje - tady lze odinstalovat programy, upravit co se spustí po Startu systému a obnovit systém


Pak použij Mbam z mého podpisu a dej mi sem z něj log, předem nic nemazat !!!

[marko70711]

LOG Mbam
Malwarebytes Anti-Malware (Skúšobná verzia) 1.70.0.1100
www.malwarebytes.org

Verzia databázy: v2013.01.23.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16439
mato :: MATO-HP [administrátor]

Ochrana: Zapnuté

23. 1. 2013 15:23:03
MBAM-log-2013-01-23 (20-16-34).txt

Typ kontroly: Úplná kontrola (C:\|D:\|)
Možnosti kontroly zapnuté: Pamäť | Po spustení | Registre | Systémové súbory | Heuristika/Extra | Heuristika/Shuriken | PUP | PUM
Možnosti kontroly vypnuté: P2P
Objektov kontrolovaných: 430706
Uplynutý čas: 1 hod, 44 min, 40 sek

Detegované služby pamäte: 0
(Škodlivé položky neboli zistené)

Detegované moduly pamäte: 0
(Škodlivé položky neboli zistené)

Detegované registračné kľúče: 0
(Škodlivé položky neboli zistené)

Detegované registračné hodnoty: 0
(Škodlivé položky neboli zistené)

Detegované položky registračných dát: 0
(Škodlivé položky neboli zistené)

Detegované priečinky: 0
(Škodlivé položky neboli zistené)

Detegované súbory: 8
C:\Program Files (x86)\Gardenscapes\Uninstall.exe (Malware.Packer.Krunchy) -> Žiadna úloha nevykonaná.
C:\Program Files (x86)\Vanilla & Chocolate\Uninstall.exe (Malware.Packer.Krunchy) -> Žiadna úloha nevykonaná.
C:\Users\mato\Desktop\Rodinne dokumenty\Janka\hry\Farm-Frenzy-3-FULL-GAMES-CZ\Farm Frenzy 3 FULL GAMES CZ\Farm Frenzy 3 Ancient Rome CZ\Trainer\Trainer.exe (HackTool.GamesCheat.Gen) -> Žiadna úloha nevykonaná.
C:\Users\mato\Desktop\Rodinne dokumenty\Janka\hry\Farm-Frenzy-3-FULL-GAMES-CZ\Farm Frenzy 3 FULL GAMES CZ\Farm Frenzy 3 CZ\Trainer\brewers.exe (Backdoor.Small) -> Žiadna úloha nevykonaná.
C:\Users\mato\Desktop\Rodinne dokumenty\Janka\hry\Farm-Frenzy-3-FULL-GAMES-CZ\Farm Frenzy 3 FULL GAMES CZ\Farm Frenzy 3 Gone Fishing\Farm frenzy gone fishing trainer +2\FFGF Trainer +2.exe (HackTool.GamesCheat.Gen) -> Žiadna úloha nevykonaná.
C:\Users\mato\Desktop\Rodinne dokumenty\Janka\hry\Farm-Frenzy-3-FULL-GAMES-CZ\Farm Frenzy 3 FULL GAMES CZ\Farm Frenzy 3 Madagascar CZ\Trainer\Farm_Frenzy_3_Madagascar_+9_by_Freiza\Farm Frenzy 3 Madagascar +9 by Freiza.exe (HackTool.GamesCheat.Gen) -> Žiadna úloha nevykonaná.
C:\Users\mato\Desktop\Rodinne dokumenty\Janka\hry\Farm-Frenzy-3-FULL-GAMES-CZ\Farm Frenzy 3 FULL GAMES CZ\Farm Frenzy 3 Russian Roulette CZ\Trainer\FarmFrenzyRussianRoulette8Trainer.exe (HackTool.GamesCheat.Gen) -> Žiadna úloha nevykonaná.
C:\Windows\System32\winword.exe (Trojan.Agent) -> Žiadna úloha nevykonaná.

(koniec)
Havet som odstranil az neskôr pretoze som bol v praci.

[Roli]

Vše co Mbam našel nech smazat.


Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.


V případě nejasností je ZDE obrázkový návod.

[marko70711]

LOG ComboFix

ComboFix 13-01-24.02 - mato . 01. 2013 10:06:13.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.2811.1789 [GMT 1:00]
Running from: c:\users\mato\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Hospital Hustle.exe
c:\program files (x86)\Hospital Hustle.exe\Hospital Hustle.exe
c:\program files (x86)\Hospital Hustle.exe\Thinstall (noportable.blogspot.com)\Hospital Hustle\40000026300002i\Hospital Hustle.exe
c:\program files (x86)\Hospital Hustle.exe\Thinstall (noportable.blogspot.com)\Hospital Hustle\Registry.rw.lck
c:\program files (x86)\Hospital Hustle.exe\Thinstall (noportable.blogspot.com)\Hospital Hustle\Registry.rw.tvr
c:\program files (x86)\Hospital Hustle.exe\Thinstall (noportable.blogspot.com)\Hospital Hustle\Registry.tvr.backup
c:\users\mato\AppData\Roaming\.#
c:\users\mato\AppData\Roaming\Microsoft\Windows\Recent\img9.jpg.url
.
.
((((((((((((((((((((((((( Files Created from 2012-12-25 to 2013-01-25 )))))))))))))))))))))))))))))))
.
.
2013-01-25 09:16 . 2013-01-25 09:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-01-25 08:44 . 2013-01-25 08:44 76232 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B9877F00-D475-4C4B-BF48-F3C6C4C53C08}\offreg.dll
2013-01-24 15:14 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B9877F00-D475-4C4B-BF48-F3C6C4C53C08}\mpengine.dll
2013-01-23 14:20 . 2013-01-23 14:20 -------- d-----w- c:\users\mato\AppData\Roaming\Malwarebytes
2013-01-23 14:19 . 2013-01-23 14:19 -------- d-----w- c:\programdata\Malwarebytes
2013-01-23 14:19 . 2013-01-23 14:20 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-01-23 14:19 . 2012-12-14 15:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-01-23 14:19 . 2013-01-23 14:19 -------- d-----w- c:\users\mato\AppData\Local\Programs
2013-01-23 12:38 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-01-21 17:30 . 2009-12-08 05:47 4194304 ----a-w- c:\windows\SysWow64\cdintf400.dll
2013-01-21 17:29 . 2013-01-21 17:29 7680 ----a-w- c:\windows\system32\Ry4CoInst.dll
2013-01-21 17:29 . 2013-01-21 17:29 36904 ----a-w- c:\windows\system32\drivers\Rockey4.sys
2013-01-21 17:29 . 2013-01-21 17:29 23592 ----a-w- c:\windows\system32\drivers\Rockey4USB.sys
2013-01-21 17:26 . 2013-01-21 17:26 -------- d-----w- c:\windows\SysWow64\Binaries
2013-01-21 17:25 . 2013-01-21 19:50 -------- d-----w- C:\CENKROSplusData
2013-01-21 17:25 . 2013-01-21 17:29 -------- d-----w- c:\program files (x86)\CENKROSplus
2013-01-21 17:22 . 2013-01-21 17:22 -------- d-----w- c:\windows\Downloaded Installations
2013-01-21 11:49 . 2013-01-21 11:50 -------- d-----w- C:\rsit
2013-01-20 18:53 . 2013-01-20 18:53 -------- d-----w- c:\programdata\SpecialBit Games
2013-01-20 12:22 . 2013-01-20 12:22 -------- d-----w- c:\users\mato\AppData\Local\JollyBear
2013-01-20 12:22 . 2013-01-20 12:22 -------- d-----w- c:\programdata\JollyBear
2013-01-20 12:02 . 2013-01-20 12:02 -------- d-----w- c:\program files (x86)\Big City Adventures-Sydney Australia
2013-01-20 12:02 . 2013-01-20 12:02 -------- d-----w- c:\windows\Big City Adventures-Sydney Australia
2013-01-17 17:09 . 2013-01-17 17:09 -------- d-----w- c:\users\mato\AppData\Roaming\Software602
2013-01-17 08:58 . 2013-01-17 08:58 -------- d-----w- C:\Administrator's Guide
2013-01-17 08:54 . 2013-01-17 09:08 -------- d-----w- c:\program files (x86)\ABBYY FineReader 11
2013-01-16 20:02 . 2013-01-16 20:02 -------- d-----w- c:\users\mato\AppData\Roaming\Gogii
2013-01-16 19:59 . 2013-01-16 19:59 -------- d-----w- c:\program files (x86)\Infected - The Twin Vaccine CE
2013-01-16 19:59 . 2013-01-16 19:59 -------- d-----w- c:\windows\Infected - The Twin Vaccine CE
2013-01-15 13:03 . 2013-01-16 22:28 -------- d-----w- c:\users\mato\AppData\Roaming\Rovio
2013-01-15 13:03 . 2013-01-16 22:27 -------- d-----w- c:\program files (x86)\Rovio
2013-01-13 19:20 . 2013-01-13 19:23 -------- d-----w- c:\users\mato\AppData\Roaming\CasinoOnNet
2013-01-13 19:20 . 2013-01-13 19:23 -------- d-----w- c:\program files (x86)\CasinoOnNet
2013-01-11 13:29 . 2013-01-11 13:29 -------- d-----w- c:\users\mato\AppData\Roaming\ABBYY
2013-01-11 13:04 . 2013-01-17 08:54 -------- d-----w- c:\users\mato\AppData\Local\ABBYY
2013-01-11 13:04 . 2013-01-17 08:54 -------- d-----w- c:\programdata\ABBYY
2013-01-10 20:48 . 2012-11-30 05:41 424448 ----a-w- c:\windows\system32\KernelBase.dll
2013-01-10 20:47 . 2012-11-01 05:43 2002432 ----a-w- c:\windows\system32\msxml6.dll
2013-01-10 20:47 . 2012-11-01 05:43 1882624 ----a-w- c:\windows\system32\msxml3.dll
2013-01-10 20:47 . 2012-11-01 04:47 1389568 ----a-w- c:\windows\SysWow64\msxml6.dll
2013-01-10 20:47 . 2012-11-01 04:47 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll
2013-01-10 20:46 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll
2013-01-10 20:46 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2013-01-10 20:46 . 2012-11-20 05:48 307200 ----a-w- c:\windows\system32\ncrypt.dll
2013-01-10 20:46 . 2012-11-20 04:51 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll
2013-01-10 20:45 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll
2013-01-10 20:45 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-01-10 20:45 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe
2013-01-10 20:42 . 2012-11-23 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys
2013-01-05 10:07 . 2013-01-05 10:07 -------- d-----w- C:\Chcete být milionářem
2013-01-04 18:59 . 2008-03-05 15:04 489480 ----a-w- c:\windows\system32\XAudio2_0.dll
2013-01-04 18:58 . 2005-02-05 18:45 3544272 ----a-w- c:\windows\system32\d3dx9_24.dll
2013-01-01 17:42 . 2013-01-01 17:42 -------- d-----w- c:\program files (x86)\Conduit
2013-01-01 17:42 . 2013-01-01 17:42 -------- d-----w- c:\users\mato\AppData\Local\Conduit
2013-01-01 17:41 . 2013-01-01 17:41 -------- d-----w- c:\users\mato\AppData\Roaming\DVDVideoSoftIEHelpers
2013-01-01 17:41 . 2013-01-01 17:41 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2013-01-01 17:41 . 2013-01-01 17:41 -------- d-----w- c:\users\mato\AppData\Roaming\OpenCandy
2013-01-01 17:41 . 2013-01-01 17:41 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2012-12-31 10:34 . 2012-12-31 10:55 -------- d-----w- c:\users\mato\AppData\Roaming\XnView
2012-12-31 10:34 . 2012-12-31 10:34 -------- d-----w- c:\program files (x86)\XnView
2012-12-31 09:09 . 2012-12-31 09:09 -------- d-----w- c:\program files (x86)\Imager Enhancer
2012-12-27 10:10 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-27 10:10 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-27 10:10 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-27 10:10 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-10 20:53 . 2011-03-04 11:07 67599240 ----a-w- c:\windows\system32\MRT.exe
2013-01-09 16:47 . 2012-03-31 19:25 697864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-01-09 16:47 . 2011-06-14 19:52 74248 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-11-30 04:45 . 2013-01-10 20:48 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-11-28 10:00 . 2012-11-28 10:05 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3CC9929F-42B9-4024-B009-43E2F67D9C05}\gapaengine.dll
2012-11-21 19:34 . 2012-11-21 19:34 7680 ----a-r- c:\users\mato\AppData\Roaming\Microsoft\Installer\{B530C7EE-9C40-11D4-8583-004F4E03F091}\IconB530C7EE2.exe
2012-11-21 19:34 . 2012-11-21 19:34 22016 ----a-r- c:\users\mato\AppData\Roaming\Microsoft\Installer\{B530C7EE-9C40-11D4-8583-004F4E03F091}\IconB530C7EE3.exe
2012-11-21 19:34 . 2012-11-21 19:34 13312 ----a-r- c:\users\mato\AppData\Roaming\Microsoft\Installer\{B530C7EE-9C40-11D4-8583-004F4E03F091}\IconB530C7EE1.exe
2012-11-14 20:38 . 2012-11-14 20:38 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2012-11-14 20:38 . 2012-11-14 20:38 718336 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2012-11-14 20:38 . 2012-11-14 20:38 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-11-14 20:38 . 2012-11-14 20:38 226304 ----a-w- c:\windows\system32\elshyph.dll
2012-11-14 20:38 . 2012-11-14 20:38 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2012-11-14 20:38 . 2012-11-14 20:38 1772032 ----a-w- c:\windows\SysWow64\wininet.dll
2012-11-14 20:38 . 2012-11-14 20:38 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2012-11-14 20:38 . 2012-11-14 20:38 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-11-14 20:38 . 2012-11-14 20:38 135680 ----a-w- c:\windows\SysWow64\wextract.exe
2012-11-14 20:38 . 2012-11-14 20:38 525312 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-11-14 20:38 . 2012-11-14 20:38 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-11-14 20:38 . 2012-11-14 20:38 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-11-14 20:38 . 2012-11-14 20:38 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2012-11-14 20:38 . 2012-11-14 20:38 111104 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-11-14 20:38 . 2012-11-14 20:38 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-11-14 20:38 . 2012-11-14 20:38 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-11-14 20:38 . 2012-11-14 20:38 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-11-14 20:38 . 2012-11-14 20:38 361984 ----a-w- c:\windows\SysWow64\html.iec
2012-11-14 20:38 . 2012-11-14 20:38 2882048 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-11-14 20:38 . 2012-11-14 20:38 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2012-11-14 20:38 . 2012-11-14 20:38 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-11-14 20:38 . 2012-11-14 20:38 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-11-14 20:38 . 2012-11-14 20:38 89600 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-11-14 20:38 . 2012-11-14 20:38 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-11-14 20:38 . 2012-11-14 20:38 53760 ----a-w- c:\windows\system32\jsproxy.dll
2012-11-14 20:38 . 2012-11-14 20:38 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2012-11-14 20:38 . 2012-11-14 20:38 441856 ----a-w- c:\windows\system32\html.iec
2012-11-14 20:38 . 2012-11-14 20:38 281600 ----a-w- c:\windows\system32\dxtrans.dll
2012-11-14 20:38 . 2012-11-14 20:38 2670080 ----a-w- c:\windows\system32\iertutil.dll
2012-11-14 20:38 . 2012-11-14 20:38 2245120 ----a-w- c:\windows\system32\wininet.dll
2012-11-14 20:38 . 2012-11-14 20:38 216576 ----a-w- c:\windows\system32\msls31.dll
2012-11-14 20:38 . 2012-11-14 20:38 197120 ----a-w- c:\windows\system32\msrating.dll
2012-11-14 20:38 . 2012-11-14 20:38 1352192 ----a-w- c:\windows\system32\urlmon.dll
2012-11-14 20:38 . 2012-11-14 20:38 97280 ----a-w- c:\windows\system32\mshtmled.dll
2012-11-14 20:38 . 2012-11-14 20:38 905216 ----a-w- c:\windows\system32\mshtmlmedia.dll
2012-11-14 20:38 . 2012-11-14 20:38 81408 ----a-w- c:\windows\system32\icardie.dll
2012-11-14 20:38 . 2012-11-14 20:38 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2012-11-14 20:38 . 2012-11-14 20:38 67072 ----a-w- c:\windows\system32\iesetup.dll
2012-11-14 20:38 . 2012-11-14 20:38 603136 ----a-w- c:\windows\system32\msfeeds.dll
2012-11-14 20:38 . 2012-11-14 20:38 593408 ----a-w- c:\windows\system32\vbscript.dll
2012-11-14 20:38 . 2012-11-14 20:38 50688 ----a-w- c:\windows\system32\ie4uinit.exe
2012-11-14 20:38 . 2012-11-14 20:38 39936 ----a-w- c:\windows\system32\iernonce.dll
2012-11-14 20:38 . 2012-11-14 20:38 27648 ----a-w- c:\windows\system32\licmgr10.dll
2012-11-14 20:38 . 2012-11-14 20:38 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2012-11-14 20:38 . 2012-11-14 20:38 247296 ----a-w- c:\windows\system32\webcheck.dll
2012-11-14 20:38 . 2012-11-14 20:38 235008 ----a-w- c:\windows\system32\url.dll
2012-11-14 20:38 . 2012-11-14 20:38 167424 ----a-w- c:\windows\system32\iexpress.exe
2012-11-14 20:38 . 2012-11-14 20:38 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2012-11-14 20:38 . 2012-11-14 20:38 142848 ----a-w- c:\windows\system32\wextract.exe
2012-11-14 20:38 . 2012-11-14 20:38 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2012-11-14 20:38 . 2012-11-14 20:38 102912 ----a-w- c:\windows\system32\inseng.dll
2012-11-14 20:37 . 2012-11-14 20:37 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-11-14 20:37 . 2012-11-14 20:37 854528 ----a-w- c:\windows\system32\jscript.dll
2012-11-14 20:37 . 2012-11-14 20:37 77312 ----a-w- c:\windows\system32\tdc.ocx
2012-11-14 20:37 . 2012-11-14 20:37 62976 ----a-w- c:\windows\system32\pngfilt.dll
2012-11-14 20:37 . 2012-11-14 20:37 531456 ----a-w- c:\windows\system32\ieui.dll
2012-11-14 20:37 . 2012-11-14 20:37 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2012-11-14 20:37 . 2012-11-14 20:37 51200 ----a-w- c:\windows\system32\imgutil.dll
2012-11-14 20:37 . 2012-11-14 20:37 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-11-14 20:37 . 2012-11-14 20:37 3966976 ----a-w- c:\windows\system32\jscript9.dll
2012-11-14 20:37 . 2012-11-14 20:37 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2012-11-14 20:37 . 2012-11-14 20:37 15418368 ----a-w- c:\windows\system32\ieframe.dll
2012-11-14 20:37 . 2012-11-14 20:37 149504 ----a-w- c:\windows\system32\occache.dll
2012-11-14 20:37 . 2012-11-14 20:37 13824 ----a-w- c:\windows\system32\mshta.exe
2012-11-14 20:37 . 2012-11-14 20:37 136704 ----a-w- c:\windows\system32\iesysprep.dll
2012-11-14 20:37 . 2012-11-14 20:37 136192 ----a-w- c:\windows\system32\iepeers.dll
2012-11-14 20:37 . 2012-11-14 20:37 136192 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-11-14 20:37 . 2012-11-14 20:37 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2012-11-14 20:34 . 2012-11-14 20:34 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-11-14 20:34 . 2012-11-14 20:34 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2012-11-14 20:34 . 2012-11-14 20:34 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 364544 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2012-11-14 20:34 . 2012-11-14 20:34 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 2776576 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2012-11-14 20:34 . 2012-11-14 20:34 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 2284544 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2012-11-14 20:34 . 2012-11-14 20:34 1682432 ----a-w- c:\windows\system32\XpsPrint.dll
2012-11-14 20:34 . 2012-11-14 20:34 1158144 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2012-11-14 20:34 . 2012-11-14 20:34 10752 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\prxtbDVDV.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\DVDVideoSoftTB\prxtbDVDV.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{B6EF6C45-5E8D-4c3b-B580-A5073261A381}]
2011-11-03 17:43 528216 ----a-w- c:\program files (x86)\RewardsArcadeSuite\RewardsArcadeSuite.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-06-17 98304]
"Print2PDF Print Monitor"="c:\program files (x86)\Software602\Print2PDF\Print2PDF.exe" [2011-04-12 222776]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-07-02 602680]
"Sweetpacks Communicator"="c:\program files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe" [2012-08-15 231768]
"LauncherM1400"="c:\program files (x86)\EPSON_P2B\Printer Software\Launcher\selaunch.exe" [2011-04-27 2438112]
"DocuPrint M1400 RUN"="c:\program files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmRun.exe" [2011-04-27 361952]
"StatusAutoRunM1400"="c:\program files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmpl.exe" [2011-07-19 4480984]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]
R3 BTMCOM;Bluetooth Serial Port;c:\windows\system32\Drivers\btmcom.sys [2010-04-09 52736]
R3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys [2010-06-29 3232768]
R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-04 1255736]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]
R4 PanService;PandoraService;c:\program files (x86)\PANDORA.TV\PanService\PandoraService.exe [2012-06-22 625816]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-22 283200]
S2 602XML Updater;602Updater;c:\program files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2010-04-14 73728]
S2 ABBYY.Licensing.FineReader.Professional.11.0;ABBYY FineReader 11 PE Licensing Service;c:\program files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe [2011-08-18 819976]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-06-17 202752]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe [2010-05-20 677128]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 86528]
S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-06-18 103992]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-07-02 27192]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE [2012-04-03 69640]
S2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [2010-04-19 315392]
S2 SENADB;SEcnStatutsDatabase;c:\program files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmdb.exe [2011-07-19 101336]
S3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [2010-06-29 4181256]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe [2010-05-20 1096968]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-08-02 32880]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-08-28 1028096]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2010-06-23 931168]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-04-16 10:07 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-01-24 15:06 1607120 ----a-w- c:\program files (x86)\Google\Chrome\Application\24.0.1312.56\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-01-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 16:47]
.
2013-01-05 c:\windows\Tasks\HPCeeScheduleFormato.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 21:15]
.
2012-12-22 c:\windows\Tasks\ReclaimerUpdateFiles_mato.job
- c:\users\mato\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-21 18:01]
.
2012-12-23 c:\windows\Tasks\ReclaimerUpdateXML_mato.job
- c:\users\mato\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-21 18:01]
.
2013-01-25 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_mato.job
- c:\users\mato\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-21 18:01]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-05-26 6245408]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-06-18 8192]
"BTMTrayAgent"="c:\program files\Motorola\Bluetooth\btmshell.dll" [2010-06-10 24783624]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uStart Page = https://www.google.sk/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: E&xportovať do programu Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\mato\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Search the Web - c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
IE: {{bd707fe6-39f6-4bda-9265-86a76719bdc5} - c:\program files\Motorola\Bluetooth\btmiesend.htm
TCP: DhcpNameServer = 188.120.1.2 188.120.0.122
.
- - - - ORPHANS REMOVED - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-01-25 10:20:16
ComboFix-quarantined-files.txt 2013-01-25 09:20
.
Pre-Run: 157 850 042 368 bytes free
Post-Run: 157 665 902 592 bytes free
.
- - End Of File - - 21EF565F52D4A6E6309EB13014DEC1B1

[Roli]

Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:

Kód: Vybrat vše

Folder::
c:\program files (x86)\Conduit
c:\users\mato\AppData\Local\Conduit

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

[marko70711]

ComboFix 13-01-26.02 - mato . 01. 2013 21:29:23.3.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.2811.1162 [GMT 1:00]
Running from: c:\users\mato\Desktop\ComboFix.exe
Command switches used :: c:\users\mato\Desktop\CFScript.txt.txt
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Conduit
c:\program files (x86)\Conduit\Community Alerts\Alert.dll
c:\users\mato\AppData\Local\Conduit
c:\users\mato\AppData\Local\Conduit\CT2269050\DVDVideoSoftTBAutoUpdateHelper.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-12-26 to 2013-01-26 )))))))))))))))))))))))))))))))
.
.
2013-01-26 21:23 . 2013-01-26 21:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-01-26 21:23 . 2013-01-26 21:23 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2013-01-26 20:00 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8CE0D5E9-4D2A-457B-B2F8-F8FA027DE93B}\mpengine.dll
2013-01-26 16:24 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-01-23 14:20 . 2013-01-23 14:20 -------- d-----w- c:\users\mato\AppData\Roaming\Malwarebytes
2013-01-23 14:19 . 2013-01-23 14:19 -------- d-----w- c:\programdata\Malwarebytes
2013-01-23 14:19 . 2013-01-23 14:20 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-01-23 14:19 . 2012-12-14 15:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-01-23 14:19 . 2013-01-23 14:19 -------- d-----w- c:\users\mato\AppData\Local\Programs
2013-01-21 17:30 . 2009-12-08 05:47 4194304 ----a-w- c:\windows\SysWow64\cdintf400.dll
2013-01-21 17:29 . 2013-01-21 17:29 7680 ----a-w- c:\windows\system32\Ry4CoInst.dll
2013-01-21 17:29 . 2013-01-21 17:29 36904 ----a-w- c:\windows\system32\drivers\Rockey4.sys
2013-01-21 17:29 . 2013-01-21 17:29 23592 ----a-w- c:\windows\system32\drivers\Rockey4USB.sys
2013-01-21 17:26 . 2013-01-21 17:26 -------- d-----w- c:\windows\SysWow64\Binaries
2013-01-21 17:25 . 2013-01-21 19:50 -------- d-----w- C:\CENKROSplusData
2013-01-21 17:25 . 2013-01-21 17:29 -------- d-----w- c:\program files (x86)\CENKROSplus
2013-01-21 17:22 . 2013-01-21 17:22 -------- d-----w- c:\windows\Downloaded Installations
2013-01-21 11:49 . 2013-01-21 11:50 -------- d-----w- C:\rsit
2013-01-20 18:53 . 2013-01-20 18:53 -------- d-----w- c:\programdata\SpecialBit Games
2013-01-20 12:22 . 2013-01-20 12:22 -------- d-----w- c:\users\mato\AppData\Local\JollyBear
2013-01-20 12:22 . 2013-01-20 12:22 -------- d-----w- c:\programdata\JollyBear
2013-01-20 12:02 . 2013-01-20 12:02 -------- d-----w- c:\program files (x86)\Big City Adventures-Sydney Australia
2013-01-20 12:02 . 2013-01-20 12:02 -------- d-----w- c:\windows\Big City Adventures-Sydney Australia
2013-01-17 17:09 . 2013-01-17 17:09 -------- d-----w- c:\users\mato\AppData\Roaming\Software602
2013-01-17 08:58 . 2013-01-17 08:58 -------- d-----w- C:\Administrator's Guide
2013-01-17 08:54 . 2013-01-17 09:08 -------- d-----w- c:\program files (x86)\ABBYY FineReader 11
2013-01-16 20:02 . 2013-01-16 20:02 -------- d-----w- c:\users\mato\AppData\Roaming\Gogii
2013-01-16 19:59 . 2013-01-16 19:59 -------- d-----w- c:\program files (x86)\Infected - The Twin Vaccine CE
2013-01-16 19:59 . 2013-01-16 19:59 -------- d-----w- c:\windows\Infected - The Twin Vaccine CE
2013-01-15 13:03 . 2013-01-16 22:28 -------- d-----w- c:\users\mato\AppData\Roaming\Rovio
2013-01-15 13:03 . 2013-01-16 22:27 -------- d-----w- c:\program files (x86)\Rovio
2013-01-13 19:20 . 2013-01-13 19:23 -------- d-----w- c:\users\mato\AppData\Roaming\CasinoOnNet
2013-01-13 19:20 . 2013-01-13 19:23 -------- d-----w- c:\program files (x86)\CasinoOnNet
2013-01-11 13:29 . 2013-01-11 13:29 -------- d-----w- c:\users\mato\AppData\Roaming\ABBYY
2013-01-11 13:04 . 2013-01-17 08:54 -------- d-----w- c:\users\mato\AppData\Local\ABBYY
2013-01-11 13:04 . 2013-01-17 08:54 -------- d-----w- c:\programdata\ABBYY
2013-01-10 20:48 . 2012-11-30 05:41 424448 ----a-w- c:\windows\system32\KernelBase.dll
2013-01-10 20:47 . 2012-11-01 05:43 2002432 ----a-w- c:\windows\system32\msxml6.dll
2013-01-10 20:47 . 2012-11-01 05:43 1882624 ----a-w- c:\windows\system32\msxml3.dll
2013-01-10 20:47 . 2012-11-01 04:47 1389568 ----a-w- c:\windows\SysWow64\msxml6.dll
2013-01-10 20:47 . 2012-11-01 04:47 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll
2013-01-10 20:46 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll
2013-01-10 20:46 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2013-01-10 20:46 . 2012-11-20 05:48 307200 ----a-w- c:\windows\system32\ncrypt.dll
2013-01-10 20:46 . 2012-11-20 04:51 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll
2013-01-10 20:45 . 2012-11-09 05:45 750592 ----a-w- c:\windows\system32\win32spl.dll
2013-01-10 20:45 . 2012-11-09 04:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2013-01-10 20:45 . 2012-11-23 03:13 68608 ----a-w- c:\windows\system32\taskhost.exe
2013-01-10 20:42 . 2012-11-23 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys
2013-01-05 10:07 . 2013-01-05 10:07 -------- d-----w- C:\Chcete být milionářem
2013-01-04 18:59 . 2008-03-05 15:04 489480 ----a-w- c:\windows\system32\XAudio2_0.dll
2013-01-04 18:58 . 2005-02-05 18:45 3544272 ----a-w- c:\windows\system32\d3dx9_24.dll
2013-01-01 17:41 . 2013-01-01 17:41 -------- d-----w- c:\users\mato\AppData\Roaming\DVDVideoSoftIEHelpers
2013-01-01 17:41 . 2013-01-01 17:41 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2013-01-01 17:41 . 2013-01-01 17:41 -------- d-----w- c:\users\mato\AppData\Roaming\OpenCandy
2013-01-01 17:41 . 2013-01-01 17:41 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2012-12-31 10:34 . 2012-12-31 10:55 -------- d-----w- c:\users\mato\AppData\Roaming\XnView
2012-12-31 10:34 . 2012-12-31 10:34 -------- d-----w- c:\program files (x86)\XnView
2012-12-31 09:09 . 2012-12-31 09:09 -------- d-----w- c:\program files (x86)\Imager Enhancer
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-10 20:53 . 2011-03-04 11:07 67599240 ----a-w- c:\windows\system32\MRT.exe
2013-01-09 16:47 . 2012-03-31 19:25 697864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-01-09 16:47 . 2011-06-14 19:52 74248 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-16 17:11 . 2012-12-27 10:10 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-16 14:45 . 2012-12-27 10:10 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-27 10:10 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-16 14:13 . 2012-12-27 10:10 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-11-30 04:45 . 2013-01-10 20:48 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-11-28 10:00 . 2012-11-28 10:05 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3CC9929F-42B9-4024-B009-43E2F67D9C05}\gapaengine.dll
2012-11-21 19:34 . 2012-11-21 19:34 7680 ----a-r- c:\users\mato\AppData\Roaming\Microsoft\Installer\{B530C7EE-9C40-11D4-8583-004F4E03F091}\IconB530C7EE2.exe
2012-11-21 19:34 . 2012-11-21 19:34 22016 ----a-r- c:\users\mato\AppData\Roaming\Microsoft\Installer\{B530C7EE-9C40-11D4-8583-004F4E03F091}\IconB530C7EE3.exe
2012-11-21 19:34 . 2012-11-21 19:34 13312 ----a-r- c:\users\mato\AppData\Roaming\Microsoft\Installer\{B530C7EE-9C40-11D4-8583-004F4E03F091}\IconB530C7EE1.exe
2012-11-14 20:38 . 2012-11-14 20:38 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2012-11-14 20:38 . 2012-11-14 20:38 718336 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2012-11-14 20:38 . 2012-11-14 20:38 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-11-14 20:38 . 2012-11-14 20:38 226304 ----a-w- c:\windows\system32\elshyph.dll
2012-11-14 20:38 . 2012-11-14 20:38 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2012-11-14 20:38 . 2012-11-14 20:38 1772032 ----a-w- c:\windows\SysWow64\wininet.dll
2012-11-14 20:38 . 2012-11-14 20:38 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2012-11-14 20:38 . 2012-11-14 20:38 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-11-14 20:38 . 2012-11-14 20:38 135680 ----a-w- c:\windows\SysWow64\wextract.exe
2012-11-14 20:38 . 2012-11-14 20:38 525312 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-11-14 20:38 . 2012-11-14 20:38 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-11-14 20:38 . 2012-11-14 20:38 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-11-14 20:38 . 2012-11-14 20:38 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2012-11-14 20:38 . 2012-11-14 20:38 111104 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-11-14 20:38 . 2012-11-14 20:38 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-11-14 20:38 . 2012-11-14 20:38 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-11-14 20:38 . 2012-11-14 20:38 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-11-14 20:38 . 2012-11-14 20:38 361984 ----a-w- c:\windows\SysWow64\html.iec
2012-11-14 20:38 . 2012-11-14 20:38 2882048 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-11-14 20:38 . 2012-11-14 20:38 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2012-11-14 20:38 . 2012-11-14 20:38 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-11-14 20:38 . 2012-11-14 20:38 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-11-14 20:38 . 2012-11-14 20:38 89600 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-11-14 20:38 . 2012-11-14 20:38 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-11-14 20:38 . 2012-11-14 20:38 53760 ----a-w- c:\windows\system32\jsproxy.dll
2012-11-14 20:38 . 2012-11-14 20:38 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2012-11-14 20:38 . 2012-11-14 20:38 441856 ----a-w- c:\windows\system32\html.iec
2012-11-14 20:38 . 2012-11-14 20:38 281600 ----a-w- c:\windows\system32\dxtrans.dll
2012-11-14 20:38 . 2012-11-14 20:38 2670080 ----a-w- c:\windows\system32\iertutil.dll
2012-11-14 20:38 . 2012-11-14 20:38 2245120 ----a-w- c:\windows\system32\wininet.dll
2012-11-14 20:38 . 2012-11-14 20:38 216576 ----a-w- c:\windows\system32\msls31.dll
2012-11-14 20:38 . 2012-11-14 20:38 197120 ----a-w- c:\windows\system32\msrating.dll
2012-11-14 20:38 . 2012-11-14 20:38 1352192 ----a-w- c:\windows\system32\urlmon.dll
2012-11-14 20:38 . 2012-11-14 20:38 97280 ----a-w- c:\windows\system32\mshtmled.dll
2012-11-14 20:38 . 2012-11-14 20:38 905216 ----a-w- c:\windows\system32\mshtmlmedia.dll
2012-11-14 20:38 . 2012-11-14 20:38 81408 ----a-w- c:\windows\system32\icardie.dll
2012-11-14 20:38 . 2012-11-14 20:38 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2012-11-14 20:38 . 2012-11-14 20:38 67072 ----a-w- c:\windows\system32\iesetup.dll
2012-11-14 20:38 . 2012-11-14 20:38 603136 ----a-w- c:\windows\system32\msfeeds.dll
2012-11-14 20:38 . 2012-11-14 20:38 593408 ----a-w- c:\windows\system32\vbscript.dll
2012-11-14 20:38 . 2012-11-14 20:38 50688 ----a-w- c:\windows\system32\ie4uinit.exe
2012-11-14 20:38 . 2012-11-14 20:38 39936 ----a-w- c:\windows\system32\iernonce.dll
2012-11-14 20:38 . 2012-11-14 20:38 27648 ----a-w- c:\windows\system32\licmgr10.dll
2012-11-14 20:38 . 2012-11-14 20:38 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2012-11-14 20:38 . 2012-11-14 20:38 247296 ----a-w- c:\windows\system32\webcheck.dll
2012-11-14 20:38 . 2012-11-14 20:38 235008 ----a-w- c:\windows\system32\url.dll
2012-11-14 20:38 . 2012-11-14 20:38 167424 ----a-w- c:\windows\system32\iexpress.exe
2012-11-14 20:38 . 2012-11-14 20:38 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2012-11-14 20:38 . 2012-11-14 20:38 142848 ----a-w- c:\windows\system32\wextract.exe
2012-11-14 20:38 . 2012-11-14 20:38 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2012-11-14 20:38 . 2012-11-14 20:38 102912 ----a-w- c:\windows\system32\inseng.dll
2012-11-14 20:37 . 2012-11-14 20:37 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-11-14 20:37 . 2012-11-14 20:37 854528 ----a-w- c:\windows\system32\jscript.dll
2012-11-14 20:37 . 2012-11-14 20:37 77312 ----a-w- c:\windows\system32\tdc.ocx
2012-11-14 20:37 . 2012-11-14 20:37 62976 ----a-w- c:\windows\system32\pngfilt.dll
2012-11-14 20:37 . 2012-11-14 20:37 531456 ----a-w- c:\windows\system32\ieui.dll
2012-11-14 20:37 . 2012-11-14 20:37 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2012-11-14 20:37 . 2012-11-14 20:37 51200 ----a-w- c:\windows\system32\imgutil.dll
2012-11-14 20:37 . 2012-11-14 20:37 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-11-14 20:37 . 2012-11-14 20:37 3966976 ----a-w- c:\windows\system32\jscript9.dll
2012-11-14 20:37 . 2012-11-14 20:37 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2012-11-14 20:37 . 2012-11-14 20:37 15418368 ----a-w- c:\windows\system32\ieframe.dll
2012-11-14 20:37 . 2012-11-14 20:37 149504 ----a-w- c:\windows\system32\occache.dll
2012-11-14 20:37 . 2012-11-14 20:37 13824 ----a-w- c:\windows\system32\mshta.exe
2012-11-14 20:37 . 2012-11-14 20:37 136704 ----a-w- c:\windows\system32\iesysprep.dll
2012-11-14 20:37 . 2012-11-14 20:37 136192 ----a-w- c:\windows\system32\iepeers.dll
2012-11-14 20:37 . 2012-11-14 20:37 136192 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-11-14 20:37 . 2012-11-14 20:37 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2012-11-14 20:34 . 2012-11-14 20:34 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-11-14 20:34 . 2012-11-14 20:34 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2012-11-14 20:34 . 2012-11-14 20:34 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 364544 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2012-11-14 20:34 . 2012-11-14 20:34 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 2776576 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2012-11-14 20:34 . 2012-11-14 20:34 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2012-11-14 20:34 . 2012-11-14 20:34 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\prxtbDVDV.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\DVDVideoSoftTB\prxtbDVDV.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-06-17 98304]
"Print2PDF Print Monitor"="c:\program files (x86)\Software602\Print2PDF\Print2PDF.exe" [2011-04-12 222776]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-07-02 602680]
"Sweetpacks Communicator"="c:\program files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe" [2012-08-15 231768]
"LauncherM1400"="c:\program files (x86)\EPSON_P2B\Printer Software\Launcher\selaunch.exe" [2011-04-27 2438112]
"DocuPrint M1400 RUN"="c:\program files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmRun.exe" [2011-04-27 361952]
"StatusAutoRunM1400"="c:\program files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmpl.exe" [2011-07-19 4480984]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]
R3 BTMCOM;Bluetooth Serial Port;c:\windows\system32\Drivers\btmcom.sys [2010-04-09 52736]
R3 BTMUSB;Motorola Bluetooth Radio Service;c:\windows\system32\Drivers\btmusb.sys [2010-06-29 3232768]
R3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\DRIVERS\ewdcsc.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-04 1255736]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]
R4 PanService;PandoraService;c:\program files (x86)\PANDORA.TV\PanService\PandoraService.exe [2012-06-22 625816]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-04-22 283200]
S2 602XML Updater;602Updater;c:\program files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2010-04-14 73728]
S2 ABBYY.Licensing.FineReader.Professional.11.0;ABBYY FineReader 11 PE Licensing Service;c:\program files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe [2011-08-18 819976]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-06-17 202752]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files\Motorola\Bluetooth\obexsrv.exe [2010-05-20 677128]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 86528]
S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-06-18 103992]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-07-02 27192]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE [2012-04-03 69640]
S2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [2010-04-19 315392]
S2 SENADB;SEcnStatutsDatabase;c:\program files (x86)\EPSON_P2B\Printer Software\Status Monitor\seksmdb.exe [2011-07-19 101336]
S3 Bluetooth Device Manager;Bluetooth Device Manager;c:\program files\Motorola\Bluetooth\devmgrsrv.exe [2010-06-29 4181256]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files\Motorola\Bluetooth\audiosrv.exe [2010-05-20 1096968]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-08-02 32880]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2010-08-28 1028096]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys [2010-06-23 931168]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-04-16 10:07 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-01-24 15:06 1607120 ----a-w- c:\program files (x86)\Google\Chrome\Application\24.0.1312.56\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-01-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 16:47]
.
2013-01-05 c:\windows\Tasks\HPCeeScheduleFormato.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13 21:15]
.
2012-12-22 c:\windows\Tasks\ReclaimerUpdateFiles_mato.job
- c:\users\mato\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-21 18:01]
.
2012-12-23 c:\windows\Tasks\ReclaimerUpdateXML_mato.job
- c:\users\mato\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-21 18:01]
.
2013-01-26 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_mato.job
- c:\users\mato\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.30\agent\rnupgagent.exe [2012-12-21 18:01]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-05-26 6245408]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-06-18 8192]
"BTMTrayAgent"="c:\program files\Motorola\Bluetooth\btmshell.dll" [2010-06-10 24783624]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uStart Page = https://www.google.sk/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: E&xportovať do programu Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\mato\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Search the Web - c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
IE: {{bd707fe6-39f6-4bda-9265-86a76719bdc5} - c:\program files\Motorola\Bluetooth\btmiesend.htm
TCP: DhcpNameServer = 188.120.1.2 188.120.0.122
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2013-01-26 22:26:04
ComboFix-quarantined-files.txt 2013-01-26 21:26
ComboFix2.txt 2013-01-26 20:22
ComboFix3.txt 2013-01-25 09:20
.
Pre-Run: 161 214 103 552 bytes free
Post-Run: 161 143 091 200 bytes free
.
- - End Of File - - 558AA9CA76394E8000C029252E799FFC

[Roli]

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.


Pak dej vědět jaký je stav PC.

[marko70711]

Postupoval som podla instrukcii ale pc nevie najst ComboFix http://imageshack.us/photo/my-images/819/testljh.jpg/ mozno som ho odstranil ale nespominam si ze by som ho odstranoval.

[Roli]

Máš ten příkaz napsaný - zkopírovaný správně ?

ComboFixmezera/Uninstall

Jestliže ani tak to nepůjde T-Cleaner by ho měl odmazat.

Jinak stav PC je jaký ?

[marko70711]

Ten prikaz som skopiroval spravne ale neviem preco ho pc nevedel najst. Ale to uz je jedno, pouzil som T-Cleaner vymazal vsetko co bolo potrebne vymazat. PC sa sprava uplne normalne, nema ziadne znamky zavyrenia. Je super ze existuju taky ludia ako ste vy. Dikes

[Roli]

Není zač a