Magnipic.exe virus

Zpráva

valpet · #1 Příspěvek od **valpet** » 27 Dub 2013 16:50

Pred par dnami som si vsimol ze moj pocitac pomaly pracuje. Bohuzial zatial nemam poriadny antivirus, a tak som stiahol avast!, ktory mi bol doporuceny ako kvalitny free antivirus. Nic nenasiel a tak som este skusil Spybot S&D ale nenasiel nic spolocne s magnipicom.
Tak som sa rozhodol ze napisem sem a dufam ze mi niekdo poradi.

Za odpoved vopred dakujem

#2 Příspěvek od **vyosek** » 27 Dub 2013 16:59

Zdravim a pekny podvecer preji

Jelikoz nevime o Vasem PC nic a z kristalove koule se spatne vesti, navic pri zatazenem pocasi jake ted v okrese Zlin panuje, neni nic videt

Ale dosti legracek, kouknem na to

Dejte log z RSIT http://forum.viry.cz/viewtopic.php?f=24&t=81939 - navod Vas povede...

valpet · #3 Příspěvek od **valpet** » 27 Dub 2013 17:21

Logfile of random's system information tool 1.09 (written by random/random)
Run by USER at 2013-04-27 18:13:11
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 76 GB (30%) free of 250 GB
Total RAM: 8191 MB (85% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:13:50, on 27. 4. 2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16537)
Boot mode: Safe mode with network support

Running processes:
C:\Program Files (x86)\Skype\Phone\Skype.exe
D:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Safari\Safari.exe
C:\Program Files (x86)\Safari\Apple Application Support\WebKit2WebProcess.exe
C:\Program Files\trend micro\USER.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchou.com/?id=d4afb5f90000000 ... ff546267c7
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - (no file)
R3 - URLSearchHook: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: privitize Helper Object - {1ACB5ABE-4890-4747-952C-F13BDB93FB75} - C:\Program Files (x86)\Industriya\privitize\1.8.16.22\bh\privitize.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: uTorrentControl_v2 - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Pomocník pri prihlasovaní v konte Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: uTorrentControl_v2 Toolbar - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Google Update] "C:\Users\USER\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "D:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [EADM] "D:\Program Files (x86)\Origin\Origin.exe" -AutoStart
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files (x86)\BitTorrent\BitTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\USER\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [RGSC] D:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: LOLRecorder.lnk = C:\Program Files (x86)\LOLReplay\LOLRecorder.exe
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Desura Install Service - Desura Pty Ltd - C:\Program Files (x86)\Common Files\Desura\desura_service.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - Unknown owner - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - d:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
O23 - Service: IMF Service (IMFservice) - IObit - C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\Windows\system32\libusbd-nt.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TunngleService - Tunngle.net GmbH - C:\Program Files (x86)\Tunngle\TnglCtrl.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: vToolbarUpdater14.2.0 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12360 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
ctfmon.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
"C:\Program Files (x86)\Skype\Phone\Skype.exe"
"D:\Program Files (x86)\Steam\Steam.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Safari\Safari.exe"
"C:\Program Files (x86)\Safari\Apple Application Support\WebKit2WebProcess.exe" -type webprocess -clientIdentifier 816
"C:\Users\USER\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\avast! Emergency Update.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2510361886-763678838-3478513842-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2510361886-763678838-3478513842-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2013-03-07 1497560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-03-19 6305912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-04-10 79240]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ACB5ABE-4890-4747-952C-F13BDB93FB75}]
privitize Helper Object - C:\Program Files (x86)\Industriya\privitize\1.8.16.22\bh\privitize.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~2\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7473b6bd-4691-4744-a82b-7854eb3d70b6}]
uTorrentControl_v2 Toolbar - C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll [2011-05-09 176936]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-01-02 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-03-07 1224568]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pri prihlasovaní v konte Windows Live ID - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28 441216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Security Toolbar - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll [2013-02-18 1929392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-03-19 4529272]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-01-02 170416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2013-03-07 1497560]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{7473b6bd-4691-4744-a82b-7854eb3d70b6} - uTorrentControl_v2 Toolbar - C:\Program Files (x86)\uTorrentControl_v2\prxtbuTor.dll [2011-05-09 176936]
{95B7759C-8C7F-4BF1-B163-73684A933233} - AVG Security Toolbar - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll [2013-02-18 1929392]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-03-07 1224568]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"XboxStat"=C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [2009-09-30 825184]
"Launch LCore"=C:\Program Files\Logitech Gaming Software\LCore.exe [2012-11-29 7406392]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\USER\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-23 116648]
"Steam"=D:\Program Files (x86)\Steam\steam.exe [2013-04-19 1631144]
"EADM"=D:\Program Files (x86)\Origin\Origin.exe [2013-04-09 3497552]
"BitTorrent"=C:\Program Files (x86)\BitTorrent\BitTorrent.exe /MINIMIZED []
"Akamai NetSession Interface"=C:\Users\USER\AppData\Local\Akamai\netsession_win.exe [2013-01-26 4480768]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"RGSC"=D:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent []
"uTorrent"=C:\Program Files (x86)\uTorrent\uTorrent.exe [2012-09-23 896912]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2010-04-01 357696]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-02-28 18642024]
"SpybotSD TeaTimer"=C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-08-27 59280]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2012-09-09 421776]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2012-04-18 421888]
"vProt"=C:\Program Files (x86)\AVG Secure Search\vprot.exe [2013-02-18 1151152]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-12-19 642808]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2013-03-07 4767304]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
LOLRecorder.lnk - C:\Program Files (x86)\LOLReplay\LOLRecorder.exe

C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 3.2.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-04-27 18:13:11 ----D---- C:\rsit
2013-04-27 18:13:11 ----D---- C:\Program Files\trend micro
2013-04-27 17:24:12 ----D---- C:\Program Files\CCleaner
2013-04-27 15:36:44 ----D---- C:\ProgramData\Spybot - Search & Destroy
2013-04-27 15:36:44 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2013-04-27 15:36:14 ----D---- C:\Program Files (x86)\Google
2013-04-27 15:36:11 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2013-04-27 15:36:10 ----A---- C:\Windows\system32\drivers\aswSP.sys
2013-04-27 15:36:02 ----A---- C:\Windows\system32\drivers\aswRdr2.sys
2013-04-27 15:36:00 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2013-04-27 15:35:59 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2013-04-27 15:35:58 ----A---- C:\Windows\system32\drivers\aswVmm.sys
2013-04-27 15:35:58 ----A---- C:\Windows\system32\drivers\aswRvrt.sys
2013-04-27 15:35:56 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2013-04-27 15:35:56 ----A---- C:\Windows\system32\aswBoot.exe
2013-04-27 15:35:49 ----A---- C:\Windows\avastSS.scr
2013-04-27 15:35:40 ----D---- C:\Program Files\AVAST Software
2013-04-27 15:35:23 ----D---- C:\ProgramData\AVAST Software
2013-04-27 14:22:32 ----AH---- C:\Windows\SYSWOW64\mlfcache.dat
2013-04-26 19:41:40 ----A---- C:\Windows\eReg.dat
2013-04-26 18:46:08 ----D---- C:\Program Files (x86)\Safari
2013-04-26 16:47:58 ----D---- C:\Users\USER\AppData\Roaming\ESET
2013-04-26 16:11:05 ----D---- C:\ProgramData\ESET
2013-04-26 16:11:04 ----D---- C:\Program Files\ESET
2013-04-24 18:14:12 ----A---- C:\Windows\system32\drivers\ntfs.sys
2013-04-16 15:20:18 ----D---- C:\Users\USER\AppData\Roaming\ftblauncher
2013-04-13 12:39:33 ----D---- C:\Games
2013-04-10 21:58:50 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-04-10 21:58:50 ----A---- C:\Windows\system32\ieui.dll
2013-04-10 21:58:50 ----A---- C:\Windows\system32\ie4uinit.exe
2013-04-10 21:58:49 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2013-04-10 21:58:49 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-04-10 21:58:49 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2013-04-10 21:58:49 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2013-04-10 21:58:49 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-04-10 21:58:49 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2013-04-10 21:58:49 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-04-10 21:58:49 ----A---- C:\Windows\system32\msfeeds.dll
2013-04-10 21:58:49 ----A---- C:\Windows\system32\iesysprep.dll
2013-04-10 21:58:49 ----A---- C:\Windows\system32\iesetup.dll
2013-04-10 21:58:49 ----A---- C:\Windows\system32\iertutil.dll
2013-04-10 21:58:49 ----A---- C:\Windows\system32\iernonce.dll
2013-04-10 21:58:48 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-04-10 21:58:48 ----A---- C:\Windows\system32\urlmon.dll
2013-04-10 21:58:47 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-04-10 21:58:47 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-04-10 21:58:47 ----A---- C:\Windows\system32\jscript9.dll
2013-04-10 21:58:47 ----A---- C:\Windows\system32\jscript.dll
2013-04-10 21:58:46 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-04-10 21:58:46 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-04-10 21:58:46 ----A---- C:\Windows\system32\wininet.dll
2013-04-10 21:58:46 ----A---- C:\Windows\system32\jsproxy.dll
2013-04-10 21:58:45 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-04-10 21:58:45 ----A---- C:\Windows\system32\ieframe.dll
2013-04-10 21:58:43 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-04-10 21:58:42 ----A---- C:\Windows\system32\mshtml.dll
2013-04-10 14:10:32 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2013-04-10 14:10:32 ----A---- C:\Windows\system32\mstscax.dll
2013-04-10 14:10:31 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2013-04-10 14:10:31 ----A---- C:\Windows\SYSWOW64\aaclient.dll
2013-04-10 14:10:31 ----A---- C:\Windows\system32\tsgqec.dll
2013-04-10 14:10:31 ----A---- C:\Windows\system32\aaclient.dll
2013-04-10 14:10:29 ----A---- C:\Windows\system32\win32k.sys
2013-04-10 14:10:24 ----A---- C:\Windows\system32\ntoskrnl.exe
2013-04-10 14:10:22 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2013-04-10 14:10:21 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2013-04-10 14:10:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2013-04-10 14:10:20 ----A---- C:\Windows\system32\smss.exe
2013-04-10 14:10:20 ----A---- C:\Windows\system32\csrsrv.dll
2013-04-07 19:54:16 ----D---- C:\ProgramData\CLSoft LTD
2013-04-07 19:54:11 ----D---- C:\ProgramData\Premium
2013-04-07 19:54:01 ----D---- C:\ProgramData\InstallMate
2013-04-07 19:53:51 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-04-07 19:53:50 ----D---- C:\Users\USER\AppData\Roaming\Industriya
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\wextract.exe
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\url.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\SetIEInstalledDate.exe
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\pngfilt.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\occache.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\msrating.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\msls31.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\mshtmler.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\mshta.exe
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\inseng.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\imgutil.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\iexpress.exe
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\ieapfltr.dat
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\IEAdvpack.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\icardie.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\elshyph.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2013-03-31 02:40:00 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\wextract.exe
2013-03-31 02:40:00 ----A---- C:\Windows\system32\webcheck.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\vbscript.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\url.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2013-03-31 02:40:00 ----A---- C:\Windows\system32\pngfilt.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\occache.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2013-03-31 02:40:00 ----A---- C:\Windows\system32\msrating.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\msls31.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\mshtmlmedia.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\mshtmler.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\mshtmled.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\mshta.exe
2013-03-31 02:40:00 ----A---- C:\Windows\system32\msfeedssync.exe
2013-03-31 02:40:00 ----A---- C:\Windows\system32\msfeedsbs.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\licmgr10.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\inseng.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\imgutil.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\iexpress.exe
2013-03-31 02:40:00 ----A---- C:\Windows\system32\ieUnatt.exe
2013-03-31 02:40:00 ----A---- C:\Windows\system32\iepeers.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\iedkcs32.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\ieapfltr.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\ieapfltr.dat
2013-03-31 02:40:00 ----A---- C:\Windows\system32\IEAdvpack.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\icardie.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\elshyph.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\dxtrans.dll
2013-03-31 02:40:00 ----A---- C:\Windows\system32\dxtmsft.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-03-31 02:38:46 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\XpsPrint.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\XpsGdiConverter.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\WMPhoto.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\WindowsCodecsExt.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\msmpeg2vdec.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\d3d11.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\d3d10core.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\d3d10_1core.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\d3d10_1.dll
2013-03-31 02:38:46 ----A---- C:\Windows\SYSWOW64\d3d10.dll
2013-03-31 02:38:46 ----A---- C:\Windows\system32\XpsPrint.dll
2013-03-31 02:38:46 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2013-03-31 02:38:46 ----A---- C:\Windows\system32\WMPhoto.dll
2013-03-31 02:38:46 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2013-03-31 02:38:46 ----A---- C:\Windows\system32\FntCache.dll
2013-03-31 02:38:46 ----A---- C:\Windows\system32\dxgi.dll
2013-03-31 02:38:46 ----A---- C:\Windows\system32\DWrite.dll
2013-03-31 02:38:46 ----A---- C:\Windows\system32\d3d10warp.dll
2013-03-31 02:38:46 ----A---- C:\Windows\system32\d2d1.dll
2013-03-31 02:38:45 ----A---- C:\Windows\SYSWOW64\UIAnimation.dll
2013-03-31 02:38:45 ----A---- C:\Windows\SYSWOW64\dxgi.dll
2013-03-31 02:38:45 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2013-03-31 02:38:45 ----A---- C:\Windows\SYSWOW64\d3d10level9.dll
2013-03-31 02:38:45 ----A---- C:\Windows\SYSWOW64\d2d1.dll
2013-03-31 02:38:45 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2013-03-31 02:38:45 ----A---- C:\Windows\system32\WindowsCodecs.dll
2013-03-31 02:38:45 ----A---- C:\Windows\system32\UIAnimation.dll
2013-03-31 02:38:45 ----A---- C:\Windows\system32\d3d11.dll
2013-03-31 02:38:45 ----A---- C:\Windows\system32\d3d10level9.dll
2013-03-31 02:38:45 ----A---- C:\Windows\system32\d3d10core.dll
2013-03-31 02:38:45 ----A---- C:\Windows\system32\d3d10_1core.dll
2013-03-31 02:38:45 ----A---- C:\Windows\system32\d3d10_1.dll
2013-03-31 02:38:45 ----A---- C:\Windows\system32\d3d10.dll

======List of files/folders modified in the last 1 month======

2013-04-27 18:13:11 ----RD---- C:\Program Files
2013-04-27 18:13:11 ----D---- C:\Windows\Temp
2013-04-27 18:03:18 ----D---- C:\Users\USER\AppData\Roaming\Skype
2013-04-27 17:02:40 ----A---- C:\Windows\ntbtlog.txt
2013-04-27 16:57:12 ----SHD---- C:\Windows\Installer
2013-04-27 16:56:14 ----D---- C:\Users\USER\AppData\Roaming\uTorrent
2013-04-27 16:04:19 ----HD---- C:\ProgramData
2013-04-27 15:36:44 ----RD---- C:\Program Files (x86)
2013-04-27 15:36:18 ----D---- C:\Windows\Tasks
2013-04-27 15:36:11 ----D---- C:\Windows\system32\drivers
2013-04-27 15:35:56 ----D---- C:\Windows\SysWOW64
2013-04-27 15:35:56 ----D---- C:\Windows\System32
2013-04-27 15:35:49 ----D---- C:\Windows
2013-04-27 14:46:00 ----D---- C:\Windows\Prefetch
2013-04-26 23:37:29 ----D---- C:\Windows\system32\config
2013-04-26 23:37:06 ----D---- C:\Users\USER\AppData\Roaming\Apple Computer
2013-04-26 20:10:12 ----SHD---- C:\System Volume Information
2013-04-26 20:06:25 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2013-04-26 19:31:13 ----RSD---- C:\Windows\Fonts
2013-04-26 18:14:42 ----D---- C:\Windows\system32\DriverStore
2013-04-26 18:14:42 ----D---- C:\Windows\system32\catroot
2013-04-26 18:14:41 ----D---- C:\Windows\inf
2013-04-26 17:56:05 ----D---- C:\ProgramData\Ubisoft
2013-04-26 17:54:03 ----D---- C:\Windows\system32\Tasks
2013-04-26 17:52:14 ----D---- C:\Program Files (x86)\IObit
2013-04-26 17:49:06 ----D---- C:\Program Files\Bonjour
2013-04-26 17:48:29 ----D---- C:\game
2013-04-26 13:37:58 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2013-04-25 15:48:31 ----D---- C:\Windows\winsxs
2013-04-24 18:05:46 ----A---- C:\Windows\system32\HRUPPROG.TXT
2013-04-19 13:32:50 ----D---- C:\Windows\system32\catroot2
2013-04-16 15:15:31 ----D---- C:\Users\USER\AppData\Roaming\.techniclauncher
2013-04-15 14:29:50 ----D---- C:\Windows\SYSWOW64\directx
2013-04-14 18:43:46 ----D---- C:\Users\USER\AppData\Roaming\.minecraft
2013-04-11 13:31:16 ----D---- C:\Program Files\Internet Explorer
2013-04-11 13:31:16 ----D---- C:\Program Files (x86)\Internet Explorer
2013-04-10 21:43:53 ----D---- C:\ProgramData\Skype
2013-04-10 14:07:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-04-08 20:26:02 ----D---- C:\Program Files (x86)\LOLReplay
2013-04-08 16:16:46 ----RD---- C:\Program Files (x86)\Skype
2013-04-08 16:16:46 ----D---- C:\Program Files (x86)\Common Files
2013-04-06 19:30:45 ----D---- C:\Users\USER\AppData\Roaming\Tunngle
2013-04-06 19:30:45 ----D---- C:\ProgramData\Tunngle
2013-03-31 10:24:00 ----D---- C:\Windows\rescache
2013-03-31 09:48:44 ----D---- C:\Windows\SYSWOW64\sk-SK
2013-03-31 09:48:43 ----D---- C:\Windows\system32\sk-SK
2013-03-31 09:48:41 ----D---- C:\Windows\SYSWOW64\migration
2013-03-31 09:48:40 ----D---- C:\Windows\SYSWOW64\en-US
2013-03-31 09:48:34 ----D---- C:\Windows\system32\migration
2013-03-31 09:48:34 ----D---- C:\Windows\PolicyDefinitions
2013-03-31 09:48:33 ----D---- C:\Windows\system32\en-US
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\zh-TW
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\zh-HK
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\tr-TR
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\sv-SE
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\pt-PT
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\pt-BR
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\pl-PL
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\nl-NL
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\ko-KR
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\it-IT
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\hu-HU
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\fr-FR
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\fi-FI
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\es-ES
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\el-GR
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\de-DE
2013-03-31 09:48:29 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-03-31 09:48:28 ----D---- C:\Windows\SYSWOW64\zh-CN
2013-03-31 09:48:28 ----D---- C:\Windows\SYSWOW64\ru-RU
2013-03-31 09:48:28 ----D---- C:\Windows\SYSWOW64\nb-NO
2013-03-31 09:48:28 ----D---- C:\Windows\SYSWOW64\ja-JP
2013-03-31 09:48:28 ----D---- C:\Windows\SYSWOW64\da-DK
2013-03-31 09:48:26 ----D---- C:\Windows\system32\pt-PT
2013-03-31 09:48:26 ----D---- C:\Windows\system32\pt-BR
2013-03-31 09:48:26 ----D---- C:\Windows\system32\pl-PL
2013-03-31 09:48:26 ----D---- C:\Windows\system32\ko-KR
2013-03-31 09:48:26 ----D---- C:\Windows\system32\it-IT
2013-03-31 09:48:26 ----D---- C:\Windows\system32\hu-HU
2013-03-31 09:48:25 ----D---- C:\Windows\system32\zh-HK
2013-03-31 09:48:25 ----D---- C:\Windows\system32\tr-TR
2013-03-31 09:48:25 ----D---- C:\Windows\system32\sv-SE
2013-03-31 09:48:25 ----D---- C:\Windows\system32\nl-NL
2013-03-31 09:48:25 ----D---- C:\Windows\system32\fr-FR
2013-03-31 09:48:25 ----D---- C:\Windows\system32\fi-FI
2013-03-31 09:48:25 ----D---- C:\Windows\system32\es-ES
2013-03-31 09:48:25 ----D---- C:\Windows\system32\el-GR
2013-03-31 09:48:24 ----D---- C:\Windows\system32\zh-TW
2013-03-31 09:48:24 ----D---- C:\Windows\system32\zh-CN
2013-03-31 09:48:24 ----D---- C:\Windows\system32\ru-RU
2013-03-31 09:48:24 ----D---- C:\Windows\system32\nb-NO
2013-03-31 09:48:24 ----D---- C:\Windows\system32\ja-JP
2013-03-31 09:48:24 ----D---- C:\Windows\system32\de-DE
2013-03-31 09:48:24 ----D---- C:\Windows\system32\cs-CZ
2013-03-31 09:48:23 ----D---- C:\Windows\system32\da-DK
2013-03-31 02:42:22 ----D---- C:\Windows\Logs
2013-03-31 00:46:43 ----RSD---- C:\Windows\assembly

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [2013-03-07 65336]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 SmartDefragDriver;SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [2010-11-26 17720]
R1 aswRdr;aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [2013-03-07 70992]
R1 avgtp;avgtp; \??\C:\Windows\system32\drivers\avgtpx64.sys [2013-02-18 39768]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 33240]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20); C:\Windows\system32\DRIVERS\L1C62x64.sys [2009-06-10 57344]
R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\LGBusEnum.sys [2009-11-24 22408]
R3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LGSHidFilt.Sys [2012-10-03 66360]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2009-07-16 15416]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle); C:\Windows\system32\DRIVERS\tap0901t.sys [2009-09-16 31232]
S0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2012-11-23 834544]
S1 AsIO;AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [2009-04-06 13368]
S1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2013-03-07 1025808]
S1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2013-03-07 377920]
S1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2013-03-07 68920]
S2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2013-03-07 33400]
S2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2013-03-07 80816]
S3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-12-19 11278336]
S3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2012-12-19 552960]
S3 aswVmm;aswVmm; C:\Windows\system32\drivers\aswVmm.sys [2013-03-07 178624]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2012-11-06 96256]
S3 ATP;Comodo Unite Miniport Driver; C:\Windows\system32\DRIVERS\cmdatp.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 GPU-Z;GPU-Z; \??\C:\Users\USER\AppData\Local\Temp\GPU-Z.sys [2012-03-27 27008]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2012-09-23 33344]
S3 LbAdapter;LAN Bridger Virtual Miniport Driver; C:\Windows\system32\DRIVERS\lb.sys [2010-06-07 21656]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver; C:\Windows\system32\drivers\LGVirHid.sys [2009-11-24 16008]
S3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1; C:\Windows\system32\drivers\libusb0.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RegFilter;RegFilter; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys []
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 UrlFilter;UrlFilter; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys []
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2012-07-09 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]
S3 X6va007;X6va007; \??\C:\Users\USER\AppData\Local\Temp\0075984.tmp []
S3 xnacc;XBOX 360 Controller For Windows Driver Service; C:\Windows\system32\DRIVERS\xnacc.sys [2009-07-14 679936]
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys [2009-08-21 79976]
S4 FileMonitor;FileMonitor; \??\C:\Program Files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

S2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2012-12-19 240640]
S2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2012-08-11 55184]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-03-07 45248]
S2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe []
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-27 116648]
S2 HiPatchService;Hi-Rez Studios Authenticate and Update Service; d:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [2013-04-23 9216]
S2 IMFservice;IMF Service; C:\Program Files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2012-01-09 821592]
S2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1; C:\Windows\syswow64\libusbd-nt.exe [2005-03-09 18944]
S2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2013-01-23 76888]
S2 SBSDWSCService;SBSD Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]
S2 vToolbarUpdater14.2.0;vToolbarUpdater14.2.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [2013-02-18 968880]
S2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2011-03-28 2292096]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-13 253656]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 Desura Install Service;Desura Install Service; C:\Program Files (x86)\Common Files\Desura\desura_service.exe [2012-05-13 131912]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-27 116648]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2012-09-09 936848]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-04-19 543656]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 TunngleService;TunngleService; C:\Program Files (x86)\Tunngle\TnglCtrl.exe [2013-03-20 746392]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-03-26 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

#4 Příspěvek od **vyosek** » 27 Dub 2013 17:24

Odinstalujte AVG Secure Search a Akamai

Odinstalujte Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

Ulozte nejlepe na plochu
Ukoncete vsechny programy
Kliknete na Prohledat
Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte

valpet · #5 Příspěvek od **valpet** » 27 Dub 2013 17:29

# AdwCleaner v2.202 - Log vytvorený 27/04/2013 o 18:28:45
# Aktualizované 23/04/2013 Xplode
# Operaený systém : Windows 7 Professional Service Pack 1 (64 bits)
# Uživateľ : USER - USER-PC
# Spustený systém : Núdzový režim s prácou v sieti
# Spustené z : C:\Users\USER\Downloads\adwcleaner.exe
# Voľba [Prehľada?]

***** [Služby] *****

***** [Súbory / Adresáre] *****

Adresár Nájdené : C:\Program Files (x86)\uTorrentControl_v2
Adresár Nájdené : C:\ProgramData\clsoft ltd
Adresár Nájdené : C:\ProgramData\InstallMate
Adresár Nájdené : C:\ProgramData\Premium
Adresár Nájdené : C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Adresár Nájdené : C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda

***** [Registre] *****

Hodnota Nájdené : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Hodnota Nájdené : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Hodnota Nájdené : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Hodnota Nájdené : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Kľúe Nájdené : HKCU\Software\AppDataLow\Software\Conduit
Kľúe Nájdené : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Kľúe Nájdené : HKCU\Software\AppDataLow\Software\PriceGong
Kľúe Nájdené : HKCU\Software\AppDataLow\Software\SmartBar
Kľúe Nájdené : HKCU\Software\AppDataLow\Software\uTorrentControl_v2
Kľúe Nájdené : HKCU\Software\AppDataLow\SProtector
Kľúe Nájdené : HKCU\Software\AppDataLow\Toolbar
Kľúe Nájdené : HKCU\Software\Conduit
Kľúe Nájdené : HKCU\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Kľúe Nájdené : HKCU\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Kľúe Nájdené : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Kľúe Nájdené : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Kľúe Nájdené : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{537F4F0B-3542-4C7D-A3E5-CF121482696C}
Kľúe Nájdené : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Kľúe Nájdené : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Kľúe Nájdené : HKCU\Software\StartSearch
Kľúe Nájdené : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Kľúe Nájdené : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Kľúe Nájdené : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Kľúe Nájdené : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Kľúe Nájdené : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Kľúe Nájdené : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Kľúe Nájdené : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Kľúe Nájdené : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Kľúe Nájdené : HKLM\SOFTWARE\Classes\escort.escortIEPane
Kľúe Nájdené : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Kľúe Nájdené : HKLM\SOFTWARE\Classes\Toolbar.CT2790392
Kľúe Nájdené : HKLM\SOFTWARE\Classes\Toolbar.CT3220468
Kľúe Nájdené : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Kľúe Nájdené : HKLM\SOFTWARE\Classes\TypeLib\{AC329328-7EC4-4C34-B672-0A2B90CB9B00}
Kľúe Nájdené : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Kľúe Nájdené : HKLM\Software\Conduit
Kľúe Nájdené : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{537F4F0B-3542-4C7D-A3E5-CF121482696C}
Kľúe Nájdené : HKLM\Software\SP Global
Kľúe Nájdené : HKLM\Software\SProtector
Kľúe Nájdené : HKLM\Software\uTorrentControl_v2
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{14F35FFC-522A-4DD1-A07E-6B8B65C6891E}
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{537F4F0B-3542-4C7D-A3E5-CF121482696C}
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEA42E78-8C47-4D97-AAC5-663F3E8A609F}
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E9EDE453-13E9-44B7-91B4-5BC46F5D945A}
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Kľúe Nájdené : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl_v2 Toolbar
Kľúe Nájdené : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Kľúe Nájdené : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Kľúe Nájdené : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Kľúe Nájdené : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Kľúe Nájdené : HKU\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

***** [Internetové prehliadaee] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registre sú eisté.

-\\ Google Chrome v26.0.1410.64

*************************

AdwCleaner[R1].txt - [6015 octets] - [27/04/2013 18:28:45]

########## EOF - C:\AdwCleaner[R1].txt - [6075 octets] ##########

#6 Příspěvek od **vyosek** » 27 Dub 2013 17:30

Spustte znovu AdwCleaner

Pokud pouzivate Win Vista ci W7, kliknete na AdwCleaner pravym a dejte Run As Administrator ci Spustit jako spravce
Kliknete na Smazat
PC provede opravu, restartuje se a da Vam log (C:\AdwCleaner [S1].txt) , jeho obsah vlozte sem

valpet · #7 Příspěvek od **valpet** » 27 Dub 2013 17:42

# AdwCleaner v2.202 - Log vytvorený 27/04/2013 o 18:33:34
# Aktualizované 23/04/2013 Xplode
# Operaený systém : Windows 7 Professional Service Pack 1 (64 bits)
# Uživateľ : USER - USER-PC
# Spustený systém : Núdzový režim s prácou v sieti
# Spustené z : C:\Users\USER\Downloads\adwcleaner.exe
# Voľba [Vymaza?]

***** [Služby] *****

***** [Súbory / Adresáre] *****

Adresár Vymazané : C:\Program Files (x86)\uTorrentControl_v2
Adresár Vymazané : C:\ProgramData\clsoft ltd
Adresár Vymazané : C:\ProgramData\InstallMate
Adresár Vymazané : C:\ProgramData\Premium
Adresár Vymazané : C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Vymazané pri reštarte : C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda

***** [Registre] *****

Hodnota Vymazané : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Hodnota Vymazané : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Hodnota Vymazané : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Hodnota Vymazané : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7473B6BD-4691-4744-A82B-7854EB3D70B6}]
Kľúe Vymazané : HKCU\Software\AppDataLow\Software\Conduit
Kľúe Vymazané : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Kľúe Vymazané : HKCU\Software\AppDataLow\Software\PriceGong
Kľúe Vymazané : HKCU\Software\AppDataLow\Software\SmartBar
Kľúe Vymazané : HKCU\Software\AppDataLow\Software\uTorrentControl_v2
Kľúe Vymazané : HKCU\Software\AppDataLow\SProtector
Kľúe Vymazané : HKCU\Software\AppDataLow\Toolbar
Kľúe Vymazané : HKCU\Software\Conduit
Kľúe Vymazané : HKCU\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Kľúe Vymazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Kľúe Vymazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Kľúe Vymazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{537F4F0B-3542-4C7D-A3E5-CF121482696C}
Kľúe Vymazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Kľúe Vymazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Kľúe Vymazané : HKCU\Software\StartSearch
Kľúe Vymazané : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Kľúe Vymazané : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Kľúe Vymazané : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Kľúe Vymazané : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Kľúe Vymazané : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Kľúe Vymazané : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Kľúe Vymazané : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Kľúe Vymazané : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Kľúe Vymazané : HKLM\SOFTWARE\Classes\escort.escortIEPane
Kľúe Vymazané : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Kľúe Vymazané : HKLM\SOFTWARE\Classes\Toolbar.CT2790392
Kľúe Vymazané : HKLM\SOFTWARE\Classes\Toolbar.CT3220468
Kľúe Vymazané : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Kľúe Vymazané : HKLM\SOFTWARE\Classes\TypeLib\{AC329328-7EC4-4C34-B672-0A2B90CB9B00}
Kľúe Vymazané : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Kľúe Vymazané : HKLM\Software\Conduit
Kľúe Vymazané : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{537F4F0B-3542-4C7D-A3E5-CF121482696C}
Kľúe Vymazané : HKLM\Software\SP Global
Kľúe Vymazané : HKLM\Software\SProtector
Kľúe Vymazané : HKLM\Software\uTorrentControl_v2
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{14F35FFC-522A-4DD1-A07E-6B8B65C6891E}
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{537F4F0B-3542-4C7D-A3E5-CF121482696C}
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BEA42E78-8C47-4D97-AAC5-663F3E8A609F}
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E9EDE453-13E9-44B7-91B4-5BC46F5D945A}
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Kľúe Vymazané : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl_v2 Toolbar
Kľúe Vymazané : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Kľúe Vymazané : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Kľúe Vymazané : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Kľúe Vymazané : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

***** [Internetové prehliadaee] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registre sú eisté.

-\\ Google Chrome v26.0.1410.64

*************************

AdwCleaner[R1].txt - [6134 octets] - [27/04/2013 18:28:45]
AdwCleaner[S1].txt - [5796 octets] - [27/04/2013 18:33:34]

########## EOF - C:\AdwCleaner[S1].txt - [5856 octets] ##########

#8 Příspěvek od **vyosek** » 27 Dub 2013 17:43

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe

Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe

Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe
Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
Na plose vznikne log Rkill.txt ten mi sem vlozte
Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

valpet · #9 Příspěvek od **valpet** » 27 Dub 2013 17:48

Rkill

Rkill 2.4.7 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 04/27/2013 06:46:08 PM in x64 mode.
Windows Version: Windows 7 Professional Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* COM+ Event System (EventSystem) is not Running.
Startup Type set to: Automatic

* Security Center (wscsvc) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Windows Update (wuauserv) is not Running.
Startup Type set to: Automatic (Delayed Start)

* FontCache => %SystemRoot%\system32\svchost.exe -k LocalService [Incorrect ImagePath]

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 04/27/2013 06:46:12 PM
Execution time: 0 hours(s), 0 minute(s), and 3 seconds(s)

#10 Příspěvek od **vyosek** » 27 Dub 2013 17:52

Fajn, pokracujte ComboFixem

valpet · #11 Příspěvek od **valpet** » 27 Dub 2013 17:59

CF

ComboFix 13-04-27.04 - USER . 04. 2013 18:52:21.1.2 - x64 NETWORK
Microsoft Windows 7 Professional 6.1.7601.1.1250.421.1051.18.8191.7181 [GMT 2:00]
Running from: c:\users\USER\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\USER\AppData\Roaming\Love
c:\users\USER\AppData\Roaming\Love\mari0\mappacks\smb\8-4.txt
c:\users\USER\AppData\Roaming\Love\mari0\options.txt
c:\users\USER\AppData\Roaming\Love\mari0\suspend.txt
D:\install.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-03-27 to 2013-04-27 )))))))))))))))))))))))))))))))
.
.
2013-04-27 16:33 . 2013-04-27 16:33 171 ----a-w- c:\windows\DeleteOnReboot.bat
2013-04-27 16:13 . 2013-04-27 16:13 -------- d-----w- C:\rsit
2013-04-27 16:13 . 2013-04-27 16:13 -------- d-----w- c:\program files\trend micro
2013-04-27 15:24 . 2013-04-27 15:24 -------- d-----w- c:\program files\CCleaner
2013-04-27 13:36 . 2013-04-27 16:27 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-04-27 13:36 . 2013-04-27 16:27 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2013-04-27 13:36 . 2013-04-27 13:36 -------- d-----w- c:\program files (x86)\Google
2013-04-27 13:36 . 2013-03-06 22:33 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-04-27 13:36 . 2013-03-06 22:33 377920 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-04-27 13:36 . 2013-03-06 22:33 70992 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-04-27 13:36 . 2013-03-06 22:33 68920 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-04-27 13:35 . 2013-03-06 22:33 1025808 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-04-27 13:35 . 2013-03-06 22:33 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-04-27 13:35 . 2013-03-06 22:33 178624 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-04-27 13:35 . 2013-03-06 22:33 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-04-27 13:35 . 2013-03-06 22:32 287840 ----a-w- c:\windows\system32\aswBoot.exe
2013-04-27 13:35 . 2013-03-06 22:32 41664 ----a-w- c:\windows\avastSS.scr
2013-04-27 13:35 . 2013-04-27 13:35 -------- d-----w- c:\program files\AVAST Software
2013-04-27 13:35 . 2013-04-27 13:35 -------- d-----w- c:\programdata\AVAST Software
2013-04-27 13:35 . 2013-04-27 13:35 -------- d-----w- c:\users\USER\AppData\Local\ElevatedDiagnostics
2013-04-26 16:46 . 2013-04-26 16:46 -------- d-----w- c:\program files (x86)\Safari
2013-04-26 14:47 . 2013-04-26 14:47 -------- d-----w- c:\users\USER\AppData\Local\ESET
2013-04-26 14:11 . 2013-04-26 14:11 -------- d-----w- c:\program files\ESET
2013-04-26 08:26 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9722E94F-70C2-421C-BDF3-96F2F9C3A38E}\mpengine.dll
2013-04-24 16:14 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-16 13:20 . 2013-04-17 12:54 -------- d-----w- c:\users\USER\AppData\Roaming\ftblauncher
2013-04-13 10:40 . 2013-04-13 10:40 -------- d-----w- c:\users\USER\AppData\Local\FLT
2013-04-13 10:39 . 2013-04-13 10:39 -------- d-----w- C:\Games
2013-04-10 12:10 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2013-04-10 12:10 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2013-04-10 12:10 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2013-04-10 12:10 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2013-04-10 12:10 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2013-04-10 12:10 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2013-04-10 12:10 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-04-10 12:10 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 12:10 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-04-10 12:10 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-04-10 12:10 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-04-10 12:10 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-04-10 12:10 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-04-08 14:16 . 2013-04-08 14:16 -------- d-----w- c:\program files (x86)\Common Files\Skype
2013-04-07 17:53 . 2013-04-07 17:53 -------- d-----w- c:\users\USER\AppData\Roaming\Industriya
2013-03-31 00:38 . 2013-03-31 00:38 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-04-26 11:37 . 2012-03-23 20:48 107832 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-03-25 21:36 . 2012-03-23 20:56 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-03-25 21:36 . 2012-03-23 20:48 281688 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-03-13 16:04 . 2012-04-12 12:35 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-13 16:04 . 2012-03-25 20:41 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-03-11 23:10 . 2010-11-21 03:27 282744 ------w- c:\windows\system32\MpSigStub.exe
2013-03-10 15:33 . 2013-03-10 15:33 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2013-02-18 17:16 . 2012-11-22 22:21 39768 ----a-w- c:\windows\system32\drivers\avgtpx64.sys
2013-02-12 04:12 . 2013-03-20 20:28 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="d:\program files (x86)\Steam\steam.exe" [2013-04-19 1631144]
"EADM"="d:\program files (x86)\Origin\Origin.exe" [2013-04-09 3497552]
"Akamai NetSession Interface"="c:\users\USER\AppData\Local\Akamai\netsession_win.exe" [2013-01-26 4480768]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2012-09-23 896912]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-28 18642024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-03-06 4767304]
.
c:\users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-6-7 1195520]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
LOLRecorder.lnk - c:\program files (x86)\LOLReplay\LOLRecorder.exe [2013-2-14 523264]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2012-11-23 834544]
R1 aswSnx;aswSnx; [x]
R1 aswSP;aswSP; [x]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-12-19 240640]
R2 aswFsBlk;aswFsBlk; [x]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-03-06 80816]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service;d:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [2013-04-23 9216]
R2 IMFservice;IMF Service;c:\program files (x86)\IObit\IObit Malware Fighter\IMFsrv.exe [2012-01-09 821592]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]
R3 aswVmm;aswVmm; [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-11-06 96256]
R3 ATP;Comodo Unite Miniport Driver;c:\windows\system32\DRIVERS\cmdatp.sys [x]
R3 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe [2012-05-13 131912]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 GPU-Z;GPU-Z;c:\users\USER\AppData\Local\Temp\GPU-Z.sys [x]
R3 LbAdapter;LAN Bridger Virtual Miniport Driver;c:\windows\system32\DRIVERS\lb.sys [2010-06-07 21656]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-24 16008]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [x]
R3 RegFilter;RegFilter;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\regfilter.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe [2013-03-20 746392]
R3 UrlFilter;UrlFilter;c:\program files (x86)\IObit\IObit Malware Fighter\drivers\win7_amd64\UrlFilter.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
R3 WatAdminSvc;Služba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-26 1255736]
R3 X6va007;X6va007;c:\users\USER\AppData\Local\Temp\0075984.tmp [x]
R4 FileMonitor;FileMonitor;c:\program files (x86)\IObit\IObit Malware Fighter\Drivers\win7_amd64\FileMonitor.sys [x]
S0 aswRvrt;aswRvrt; [x]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [2010-11-26 17720]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2013-02-18 39768]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [2009-06-10 57344]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 22408]
S3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;c:\windows\system32\DRIVERS\LGSHidFilt.Sys [2012-10-02 66360]
S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 31232]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-04-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 16:04]
.
2013-04-27 c:\windows\Tasks\avast! Emergency Update.job
- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2013-04-27 22:32]
.
2013-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-27 13:36]
.
2013-04-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2510361886-763678838-3478513842-1000Core.job
- c:\users\USER\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-23 18:36]
.
2013-04-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2510361886-763678838-3478513842-1000UA.job
- c:\users\USER\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-23 18:36]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-03-06 22:32 133840 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 825184]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2012-11-29 7406392]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://searchou.com/?id=d4afb5f900000000000000ff546267c7
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{88c7f2aa-f93f-432c-8f0e-b7d85967a527} - (no file)
BHO-{1ACB5ABE-4890-4747-952C-F13BDB93FB75} - c:\program files (x86)\Industriya\privitize\1.8.16.22\bh\privitize.dll
Wow6432Node-HKCU-Run-BitTorrent - c:\program files (x86)\BitTorrent\BitTorrent.exe
Wow6432Node-HKCU-Run-RGSC - d:\program files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-BattlEye for A2 - d:\program files (x86)\steam\steamapps\common\arma 2BattlEye\UnInstallBE.exe
AddRemove-BattlEye for OA - d:\program files (x86)\steam\steamapps\common\arma 2 operation arrowheadExpansion\BattlEye\UnInstallBE.exe
AddRemove-IObit Malware Fighter_is1 - c:\program files (x86)\IObit\IObit Malware Fighter\unins000.exe
AddRemove-privitize - c:\program files (x86)\Industriya\privitize\1.8.16.22\uninstall.exe
AddRemove-Smart Defrag 2_is1 - c:\program files (x86)\IObit\Smart Defrag 2\unins000.exe
AddRemove-SP_008a99b9 - c:\program files (x86)\MagniPic\uninstall.exe
AddRemove-Sumotori Full Version - c:\program files (x86)\gravitysensation.com\Sumotori_Full\Uninstall.exe
AddRemove-VLC media player - c:\program files (x86)\VideoLAN\VLC\uninstall.exe
AddRemove-{9D0F3E99-7B0D-E5A2-E523-042D7692EBC7} - c:\progra~3\INSTAL~1\{72D19~1\Setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va007]
"ImagePath"="\??\c:\users\USER\AppData\Local\Temp\0075984.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.download\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariDownload"
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2510361886-763678838-3478513842-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2510361886-763678838-3478513842-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.safariextz\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariExtension"
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2510361886-763678838-3478513842-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webarchive\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2510361886-763678838-3478513842-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2510361886-763678838-3478513842-1000)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="SafariHTML"
.
[HKEY_USERS\S-1-5-21-2510361886-763678838-3478513842-1000\Software\SecuROM\License information*]
"datasecu"=hex:b5,b9,71,90,30,be,7b,eb,46,27,f2,32,2b,8a,8c,f2,05,68,8b,60,af,
2c,77,b9,c1,d1,91,99,68,50,23,a9,cb,54,28,a9,12,a8,7c,1d,99,50,dc,15,c8,c7,\
"rkeysecu"=hex:f7,e9,80,25,ec,a4,c6,2e,7a,40,63,4b,8b,0e,31,78
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-04-27 18:59:31
ComboFix-quarantined-files.txt 2013-04-27 16:59
.
Pre-Run: 79 947 739 136 bytes free
Post-Run: 82 903 240 704 bytes free
.
- - End Of File - - 3E0AD3B874E740F9E00EF2BF29B81222

valpet · #12 Příspěvek od **valpet** » 27 Dub 2013 19:04

uz sa mi konecne podarilo spustit vsetky programy bez problemov az na to ze su este trocha spomalene... co sa s tym da robit?

#13 Příspěvek od **vyosek** » 27 Dub 2013 19:08

Stahnete SecurityCheck http://screen317.spywareinfoforum.org/SecurityCheck.exe

Ulozte nejlepe na Plochu
Spustte tradicne dvouklikem a postupujte dle pokynu utility
Po dokonceni skenu se vytvori a otevre log, ten mi sem vlozte

Stahnete SytemLook http://jpshortstuff.247fixes.com/SystemLook.exe a ulozte jej na plochu

Do okna vlozte skript nize

Kód: Vybrat vše

:filefind
Magnipic.exe

:regfind
Magnipic.exe

Kliknete na Look
Tlacitko Look se zmeni na Scanning a zsedne
Pockejte pokud se tlacitko Scanning opet nezmeni na Look - tak poznate ze SystemLook dokoncil svou praci
Vyskoci na Vas log s nazvem SystemLook (pripadne bude ulozen na plose), jeho obsah mi sem vlozte

valpet · #14 Příspěvek od **valpet** » 27 Dub 2013 20:25

Results of screen317's Security Check version 0.99.63
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 25
Java(TM) 6 Update 31
Java 7 Update 10
Java version out of Date!
Adobe Flash Player 11.6.602.180
Google Chrome 26.0.1410.43
Google Chrome 26.0.1410.64
````````Process Check: objlist.exe by Laurent````````
IObit IObit Malware Fighter IMFsrv.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````

systemlook nic nenasiel

#15 Příspěvek od **vyosek** » 28 Dub 2013 08:54

Odinstalujte IObit Malware Fighter

Stahnete Farbar Service Scanner http://download.bleepingcomputer.com/farbar/FSS.exe

Ulozte nejlepe na Plochu
U vsech polozek udelejte zatrzitko (tim je oznacite pro skenovani)
Kliknete na Scan
Po dokonceni skenu se objevi log FSS.txt ten sem vlozte

VIRY.CZ

Magnipic.exe virus

Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus

Re: Magnipic.exe virus