Prosím o pomoc, na počítači mám hlášku o blokování policií, jde se ale dostat do nouzového režimu. Dle návodu přidávám log, děkuji moc.
Logfile of random's system information tool 1.09 (written by random/random)
Run by Aldair at 2013-05-04 09:23:23
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 95 GB (40%) free of 238 GB
Total RAM: 2046 MB (75% free)
HijackThis download failed
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\Explorer.EXE
ctfmon.exe
"C:\Users\Aldair\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\At1.job
C:\Windows\tasks\At2.job
C:\Windows\tasks\At3.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2903425235-1483294055-1189771601-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2903425235-1483294055-1189771601-1000UA.job
C:\Windows\tasks\Norton Security Scan for Aldair.job
=========Mozilla firefox=========
ProfilePath - C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default
prefs.js - "browser.search.useDBForOrder" - "false"
prefs.js - "browser.startup.homepage" - "https://www.google.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19, {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.74, wrc@avast.com:20110101, maps@ovi.com:5.2.7.0, {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.5, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.18"
prefs.js - "keyword.URL" - "http://search.conduit.com/ResultsExt.as ... 4996302&q="
"{336D0C35-8A85-403a-B9D2-65C292C39087}"=C:\Program Files\IB Updater\Firefox
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.169 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=
"Path"=
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nppl3260;version=12.0.1.666]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprjplug;version=12.0.1.666]
"Description"=RealJukebox Netscape Plugin
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.666]
"Description"=RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In
"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.666]
"Description"=RealPlayer(tm) HTML5VideoShim Plug-In
"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.666]
"Description"=12.0.1.666
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.169 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
C:\Program Files (x86)\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nppl3260.xpt
npwachk.xpt
nsILegitCheckPlugin.xpt
nsjsrealplayerplugin.xpt
C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
npLegitCheckPlugin.dll
NPOFF12.DLL
nppdf32.dll
nppl3260.dll
nprjplug.dll
nprpjplug.dll
npwachk.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt
C:\Program Files (x86)\Mozilla Firefox\searchplugins\
babylon.xml
Cetrumcz_igeared.xml
crawlersrch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
Search_Results.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml
C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\
ffxtlbr@incredibar.com
maps@ovi.com
{99079a25-328f-4bd4-be04-00955acaa0a7}
{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\
conduit.xml
MyStart Search.xml
Search_Results.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
IB Updater - C:\Program Files\IB Updater\Extension64.dll [2012-10-23 215896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18 77576]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2011-09-24 414416]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
IB Updater - C:\Program Files\IB Updater\Extension32.dll [2012-10-23 170840]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10 3834016]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{D5D47440-0750-463D-BAEF-A47D02414806}
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]
"Samsung Link"=C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe [2013-04-23 407384]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ICQ"=C:\Program Files (x86)\ICQ7.6\ICQ.exe [2011-10-10 127040]
"HydraVisionDesktopManager"=C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [2009-11-23 380928]
""=C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2013-02-13 844144]
"KiesPreload"=C:\Program Files (x86)\Samsung\Kies\Kies.exe [2013-02-13 1509232]
"KiesAirMessage"=C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup []
"Google Update"=C:\Users\Aldair\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-21 116648]
"AdobeBridge"= []
"Ythyicxip"=C:\Users\Aldair\AppData\Roaming\Obwu\uzepy.exe [2012-03-22 262656]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-12-19 41208]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe -launchedbylogin []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 5]
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe /Manual []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner.exe]
C:\Users\Aldair\AppData\Roaming\majHCfhOhnvkQZaYdBHPsG\majHCfhOhnvkQZaYdBHPsG\0.0.0.0\CCleaner.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-08-28 3671904]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Aldair\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-21 116648]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HTC Sync Loader]
C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe -startup []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesAirMessage]
C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2013-02-13 844144]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]
C:\Program Files (x86)\Samsung\Kies\Kies.exe [2013-02-13 1509232]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /starttray []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoTerm.exe]
C:\Program Files (x86)\Common Files\PCTV Systems\RemoTerm\RemoTerm.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-02-14 636032]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\program files (x86)\steam\steam.exe -silent []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [2011-09-24 273528]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Vyhledat aktualizace.lnk]
C:\PROGRA~2\COMMON~1\PCTVSY~1\WEBUPD~1\WEBUPD~1.EXE -s -c -f=UpdateTVC6.xml -p=TVCenter -language=CS -url=http://www.pctvsystems.com/Portals/pctv/WebUpdaterFiles []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Aldair^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Wild Media Server (UPnP, DLNA, HTTP).lnk]
C:\PROGRA~2\WILDME~1\wms.exe []
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"=C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"KiesTrayAgent"=C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [2013-02-13 310128]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-12-19 41208]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS6ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
AML Device Install.lnk - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe
C:\Users\Aldair\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
msconfig.lnk - C:\Windows\System32\rundll32.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Users\Aldair\AppData\Roaming\datacore.exe"="C:\Users\Aldair\AppData\Roaming\datacore.exe:*:Enabled:Windows Messanger"
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"="C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"F:\MalwarebytesPortable\App\Malwarebytes\mbam.exe"="F:\MalwarebytesPortable\App\Malwarebytes\mbam.exe:*:Enabled:Malwarebytes"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.FFDS"=ff_vfw.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 month======
2013-05-04 09:23:24 ----D---- C:\Program Files\trend micro
2013-05-04 09:06:12 ----A---- C:\ProgramData\rundll32.exe
2013-05-03 23:00:44 ----A---- C:\Windows\ntbtlog.txt
2013-05-03 21:09:46 ----A---- C:\ProgramData\as98213.txt
2013-05-03 21:09:46 ----A---- C:\ProgramData\8gr4.js
2013-05-03 21:09:46 ----A---- C:\ProgramData\8gr4.bat
2013-05-03 21:09:02 ----A---- C:\ProgramData\4rg8.dat
2013-05-03 21:08:57 ----A---- C:\ProgramData\ofti.dat
2013-05-03 21:08:30 ----D---- C:\Users\Aldair\AppData\Roaming\Ontu
2013-05-03 21:08:30 ----D---- C:\Users\Aldair\AppData\Roaming\Obwu
2013-05-03 21:08:30 ----D---- C:\Users\Aldair\AppData\Roaming\Hokii
2013-04-25 19:03:38 ----A---- C:\Windows\system32\drivers\ntfs.sys
2013-04-17 22:10:06 ----D---- C:\Program Files\Samsung
2013-04-17 21:50:17 ----D---- C:\ProgramData\PMS
2013-04-17 21:50:05 ----D---- C:\Program Files (x86)\PS3 Media Server
2013-04-15 22:14:07 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-04-14 22:37:20 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2013-04-14 22:37:20 ----A---- C:\Windows\system32\mshtmled.dll
2013-04-14 22:37:19 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2013-04-14 22:37:19 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-04-14 22:37:18 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-04-14 22:37:18 ----A---- C:\Windows\SYSWOW64\url.dll
2013-04-14 22:37:18 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2013-04-14 22:37:18 ----A---- C:\Windows\system32\urlmon.dll
2013-04-14 22:37:18 ----A---- C:\Windows\system32\url.dll
2013-04-14 22:37:18 ----A---- C:\Windows\system32\ieUnatt.exe
2013-04-14 22:37:18 ----A---- C:\Windows\system32\ieui.dll
2013-04-14 22:37:17 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-04-14 22:37:17 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-04-14 22:37:17 ----A---- C:\Windows\system32\wininet.dll
2013-04-14 22:37:17 ----A---- C:\Windows\system32\msfeeds.dll
2013-04-14 22:37:17 ----A---- C:\Windows\system32\jscript9.dll
2013-04-14 22:37:16 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-04-14 22:37:16 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-04-14 22:37:16 ----A---- C:\Windows\system32\vbscript.dll
2013-04-14 22:37:16 ----A---- C:\Windows\system32\jsproxy.dll
2013-04-14 22:37:16 ----A---- C:\Windows\system32\jscript.dll
2013-04-14 22:37:15 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-04-14 22:37:15 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-04-14 22:37:15 ----A---- C:\Windows\system32\iertutil.dll
2013-04-14 22:37:13 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-04-14 22:37:12 ----A---- C:\Windows\system32\mshtml.dll
2013-04-14 22:37:11 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-04-14 22:37:11 ----A---- C:\Windows\system32\ieframe.dll
2013-04-14 18:10:24 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2013-04-14 18:10:24 ----A---- C:\Windows\system32\mstscax.dll
2013-04-14 18:10:23 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2013-04-14 18:10:23 ----A---- C:\Windows\SYSWOW64\aaclient.dll
2013-04-14 18:10:23 ----A---- C:\Windows\system32\tsgqec.dll
2013-04-14 18:10:23 ----A---- C:\Windows\system32\aaclient.dll
2013-04-14 18:10:19 ----A---- C:\Windows\system32\win32k.sys
2013-04-14 18:10:16 ----A---- C:\Windows\system32\drivers\fvevol.sys
2013-04-14 18:10:14 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2013-04-14 18:10:14 ----A---- C:\Windows\system32\ntoskrnl.exe
2013-04-14 18:10:13 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2013-04-14 18:10:13 ----A---- C:\Windows\system32\smss.exe
2013-04-14 18:10:12 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2013-04-14 18:10:12 ----A---- C:\Windows\system32\csrsrv.dll
2013-04-08 21:51:44 ----A---- C:\Windows\system32\drivers\rockusb.sys
2013-04-08 19:46:54 ----D---- C:\Program Files (x86)\7-Zip
======List of files/folders modified in the last 1 month======
2013-05-04 09:23:24 ----RD---- C:\Program Files
2013-05-04 09:08:19 ----HD---- C:\ProgramData
2013-05-04 09:08:14 ----D---- C:\Windows\Prefetch
2013-05-04 09:06:53 ----D---- C:\Samsung Link
2013-05-03 23:38:12 ----D---- C:\Windows\system32\drivers
2013-05-03 23:38:12 ----D---- C:\Users\Aldair\AppData\Roaming\Malwarebytes
2013-05-03 23:38:12 ----D---- C:\ProgramData\Malwarebytes
2013-05-03 23:34:48 ----D---- C:\Users\Aldair\AppData\Roaming\ICQ
2013-05-03 23:29:01 ----D---- C:\Windows\System32
2013-05-03 23:29:01 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-05-03 23:29:00 ----D---- C:\Windows\inf
2013-05-03 23:00:44 ----D---- C:\Windows
2013-05-03 22:53:58 ----D---- C:\Windows\system32\config
2013-05-03 21:39:09 ----D---- C:\Users\Aldair\AppData\Roaming\vlc
2013-05-03 19:22:32 ----D---- C:\Program Files (x86)\JDownloader
2013-04-30 23:04:37 ----D---- C:\Programs
2013-04-30 21:13:58 ----D---- C:\Windows\Temp
2013-04-30 06:43:19 ----SHD---- C:\Config.Msi
2013-04-29 23:21:02 ----SHD---- C:\System Volume Information
2013-04-27 21:42:02 ----D---- C:\Windows\winsxs
2013-04-27 21:32:00 ----SHD---- C:\Windows\Installer
2013-04-27 21:31:56 ----D---- C:\Windows\SysWOW64
2013-04-25 19:01:56 ----D---- C:\Windows\system32\catroot2
2013-04-25 19:01:56 ----D---- C:\Windows\system32\catroot
2013-04-17 21:50:05 ----RD---- C:\Program Files (x86)
2013-04-17 21:01:42 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2013-04-15 20:50:59 ----D---- C:\ProgramData\Adobe
2013-04-15 20:50:46 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-04-15 20:20:35 ----D---- C:\Windows\SYSWOW64\migration
2013-04-15 20:20:35 ----D---- C:\Program Files (x86)\Internet Explorer
2013-04-15 20:20:34 ----D---- C:\Windows\system32\migration
2013-04-15 20:20:34 ----D---- C:\Program Files\Internet Explorer
2013-04-14 22:39:02 ----A---- C:\Windows\system32\MRT.exe
2013-04-14 22:38:28 ----D---- C:\ProgramData\Microsoft Help
2013-04-08 22:22:44 ----D---- C:\Windows\system32\DriverStore
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 SmartDefragDriver;SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [2011-02-23 18232]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2012-09-09 560184]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R3 KMWDFILTER;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 30208]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\Windows\system32\DRIVERS\seehcri.sys [2010-11-02 34032]
S1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
S1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2009-12-04 314016]
S2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2009-12-04 43680]
S2 npf;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-01-27 47632]
S3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-02-15 10856960]
S3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2012-02-15 327680]
S3 AODDriver;AODDriver; \??\C:\Program Files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys []
S3 athr;Atheros – ovladač pro zařízení pro rozšiřitelnou bezdrátovou síť LAN; C:\Windows\system32\DRIVERS\athrx.sys [2009-06-20 1394688]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]
S3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-05-06 125456]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-02-15 10856960]
S3 azvusb;Virtual USB Hub; C:\Windows\system32\DRIVERS\azvusb.sys [2009-08-24 54784]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2012-09-20 102368]
S3 etdrv;etdrv; \??\C:\Windows\etdrv.sys [2011-02-09 25640]
S3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\SysWOW64\FsUsbExDisk.SYS [2013-02-05 37344]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2011-02-10 25640]
S3 GVTDrv64;GVTDrv64; \??\C:\Windows\GVTDrv64.sys [2011-02-10 30528]
S3 HTCAND64;HTC Device Driver; C:\Windows\System32\Drivers\ANDROIDUSB.sys [2009-11-02 33736]
S3 mod7700;DiBcom DIB7700 based TV tuner device; C:\Windows\system32\DRIVERS\mod7700.sys [2010-11-19 1077840]
S3 MODRC;PCTV Dib Infrared Receiver; C:\Windows\system32\DRIVERS\modrc.sys [2010-11-19 24272]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2009-12-08 82816]
S3 PRODIGY;PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [2006-08-29 32377]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 20992]
S3 Rockusb;Driver for Rockusb Device; C:\Windows\system32\DRIVERS\rockusb.sys [2012-08-20 65648]
S3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver; C:\Windows\system32\DRIVERS\Rtnic64.sys [2009-06-10 51712]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2012-09-20 203104]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 32768]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]
S3 xnacc;Služba ovladače pro řadič XBOX 360 pro systém Windows; C:\Windows\system32\DRIVERS\xnacc.sys [2009-07-14 679936]
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys [2009-04-08 68992]
S3 zebrbus;Sony Ericsson Composite Device driver; C:\Windows\system32\DRIVERS\zebrbus.sys [2010-11-02 108544]
S3 zebrmdm;Sony Ericsson Port (WDM); C:\Windows\system32\DRIVERS\zebrmdm.sys [2010-11-02 145408]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
S2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2012-02-15 235520]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-12-08 76888]
S2 Samsung Link Service;Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe [2013-04-23 605768]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
S2 StarWindServiceAE;StarWind AE Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-15 256904]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-04-15 115608]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2011-06-08 633856]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-09 1255736]
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
-----------------EOF-----------------
Blokování policií
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Re: Blokování policií
vše provedeno a příloha
- Přílohy
-
- virusinfo_syscheck.zip
- (23.12 KiB) Staženo 52 x
Re: Blokování policií
Počítač naběhl v pořádku, tady je log a příloha
Logfile of random's system information tool 1.09 (written by random/random)
Run by Aldair at 2013-05-04 11:39:17
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 95 GB (40%) free of 238 GB
Total RAM: 2046 MB (43% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:39:26, on 4.5.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16476)
Boot mode: Normal
Running processes:
C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe
C:\Program Files (x86)\ICQ7.6\ICQ.exe
C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files (x86)\Samsung\Kies\Kies.exe
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
C:\Program Files\trend micro\Aldair.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2481032
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {124d001a-bdcb-472f-aa59-bbe7e4bc3204} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: IB Updater Helper - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\IB Updater\Extension32.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - (no file)
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.6\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"
O4 - HKCU\..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
O4 - HKCU\..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
O4 - HKCU\..\Run: [Google Update] "C:\Users\Aldair\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Ythyicxip] C:\Users\Aldair\AppData\Roaming\Obwu\uzepy.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: AML Device Install.lnk = C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: bwinCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Users\Aldair\Desktop\bwin Download Casino.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: bwinCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Users\Aldair\Desktop\bwin Download Casino.lnk (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Samsung Link Service - Copyright 2013 SAMSUNG - C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 10820 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\PnkBstrA.exe
"taskhost.exe"
taskeng.exe {911DEA7E-F9AD-4807-BBB5-9CDF4599CDCA}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe"
"C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe" "Samsung Link Service" __i4j_restart
C:\Windows\system32\sppsvc.exe
"C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 1576
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe"
"C:\Program Files (x86)\ICQ7.6\ICQ.exe" silent loginmode=4
"C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"
"C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe"
"C:\Program Files (x86)\Samsung\Kies\Kies.exe" /preload
HydraDM64.exe -h:65848 "Maximalizovat na celou plochu" "Maximalizovat k rohům okna" "Obnovit pracovní plochu"
taskeng.exe {535221F7-C303-48B2-89B3-78D09BB9D401}
"C:\Program Files\Samsung\Samsung Link\Samsung Link.exe"
"C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe"
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=3436.5ab6800.437597499 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox" E7CF176E110C211B 3436 "\\.\pipe\gecko-crash-server-pipe.3436" plugin
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe" --proxy-stub-channel=Flash2536.6B111D90.4150 --host-broker-channel=Flash2536.6B111D90.8855 --host-pid=2536 --host-npapi-version=27 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll"
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe" --channel=2372.002EF2A4.1934849410 --proxy-stub-channel=Flash2536.6B111D90.4150 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll" --host-npapi-version=27 --type=renderer
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Users\Aldair\Desktop\RSITx64.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2903425235-1483294055-1189771601-10003_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2903425235-1483294055-1189771601-10003 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\At1.job
C:\Windows\tasks\At2.job
C:\Windows\tasks\At3.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2903425235-1483294055-1189771601-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2903425235-1483294055-1189771601-1000UA.job
C:\Windows\tasks\Norton Security Scan for Aldair.job
=========Mozilla firefox=========
ProfilePath - C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default
prefs.js - "browser.search.useDBForOrder" - "false"
prefs.js - "browser.startup.homepage" - "https://www.google.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19, {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.74, wrc@avast.com:20110101, maps@ovi.com:5.2.7.0, {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.5, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.18"
prefs.js - "keyword.URL" - "http://search.conduit.com/ResultsExt.as ... 4996302&q="
"{336D0C35-8A85-403a-B9D2-65C292C39087}"=C:\Program Files\IB Updater\Firefox
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.169 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=
"Path"=
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nppl3260;version=12.0.1.666]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprjplug;version=12.0.1.666]
"Description"=RealJukebox Netscape Plugin
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.666]
"Description"=RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In
"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.666]
"Description"=RealPlayer(tm) HTML5VideoShim Plug-In
"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.666]
"Description"=12.0.1.666
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.169 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
C:\Program Files (x86)\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nppl3260.xpt
npwachk.xpt
nsILegitCheckPlugin.xpt
nsjsrealplayerplugin.xpt
C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
npLegitCheckPlugin.dll
NPOFF12.DLL
nppdf32.dll
nppl3260.dll
nprjplug.dll
nprpjplug.dll
npwachk.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt
C:\Program Files (x86)\Mozilla Firefox\searchplugins\
babylon.xml
Cetrumcz_igeared.xml
crawlersrch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
Search_Results.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml
C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\
ffxtlbr@incredibar.com
maps@ovi.com
{99079a25-328f-4bd4-be04-00955acaa0a7}
{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\
conduit.xml
MyStart Search.xml
Search_Results.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
IB Updater - C:\Program Files\IB Updater\Extension64.dll [2012-10-23 215896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18 77576]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2011-09-24 414416]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
IB Updater - C:\Program Files\IB Updater\Extension32.dll [2012-10-23 170840]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10 3834016]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{D5D47440-0750-463D-BAEF-A47D02414806}
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]
"Samsung Link"=C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe [2013-04-23 407384]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ICQ"=C:\Program Files (x86)\ICQ7.6\ICQ.exe [2011-10-10 127040]
"HydraVisionDesktopManager"=C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [2009-11-23 380928]
""=C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2013-02-13 844144]
"KiesPreload"=C:\Program Files (x86)\Samsung\Kies\Kies.exe [2013-02-13 1509232]
"KiesAirMessage"=C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup []
"Google Update"=C:\Users\Aldair\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-21 116648]
"AdobeBridge"= []
"Ythyicxip"=C:\Users\Aldair\AppData\Roaming\Obwu\uzepy.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-12-19 41208]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe -launchedbylogin []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 5]
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe /Manual []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner.exe]
C:\Users\Aldair\AppData\Roaming\majHCfhOhnvkQZaYdBHPsG\majHCfhOhnvkQZaYdBHPsG\0.0.0.0\CCleaner.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-08-28 3671904]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Aldair\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-21 116648]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HTC Sync Loader]
C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe -startup []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesAirMessage]
C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2013-02-13 844144]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]
C:\Program Files (x86)\Samsung\Kies\Kies.exe [2013-02-13 1509232]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /starttray []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoTerm.exe]
C:\Program Files (x86)\Common Files\PCTV Systems\RemoTerm\RemoTerm.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-02-14 636032]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\program files (x86)\steam\steam.exe -silent []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [2011-09-24 273528]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Vyhledat aktualizace.lnk]
C:\PROGRA~2\COMMON~1\PCTVSY~1\WEBUPD~1\WEBUPD~1.EXE -s -c -f=UpdateTVC6.xml -p=TVCenter -language=CS -url=http://www.pctvsystems.com/Portals/pctv/WebUpdaterFiles []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Aldair^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Wild Media Server (UPnP, DLNA, HTTP).lnk]
C:\PROGRA~2\WILDME~1\wms.exe []
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"=C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"KiesTrayAgent"=C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [2013-02-13 310128]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-12-19 41208]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS6ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
AML Device Install.lnk - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Users\Aldair\AppData\Roaming\datacore.exe"="C:\Users\Aldair\AppData\Roaming\datacore.exe:*:Enabled:Windows Messanger"
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"="C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"F:\MalwarebytesPortable\App\Malwarebytes\mbam.exe"="F:\MalwarebytesPortable\App\Malwarebytes\mbam.exe:*:Enabled:Malwarebytes"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.FFDS"=ff_vfw.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 month======
2013-05-04 09:23:24 ----D---- C:\Program Files\trend micro
2013-04-25 19:03:38 ----A---- C:\Windows\system32\drivers\ntfs.sys
2013-04-17 22:10:06 ----D---- C:\Program Files\Samsung
2013-04-17 21:50:17 ----D---- C:\ProgramData\PMS
2013-04-17 21:50:05 ----D---- C:\Program Files (x86)\PS3 Media Server
2013-04-15 22:14:07 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-04-14 22:37:20 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2013-04-14 22:37:20 ----A---- C:\Windows\system32\mshtmled.dll
2013-04-14 22:37:19 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2013-04-14 22:37:19 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-04-14 22:37:18 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-04-14 22:37:18 ----A---- C:\Windows\SYSWOW64\url.dll
2013-04-14 22:37:18 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2013-04-14 22:37:18 ----A---- C:\Windows\system32\urlmon.dll
2013-04-14 22:37:18 ----A---- C:\Windows\system32\url.dll
2013-04-14 22:37:18 ----A---- C:\Windows\system32\ieUnatt.exe
2013-04-14 22:37:18 ----A---- C:\Windows\system32\ieui.dll
2013-04-14 22:37:17 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-04-14 22:37:17 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-04-14 22:37:17 ----A---- C:\Windows\system32\wininet.dll
2013-04-14 22:37:17 ----A---- C:\Windows\system32\msfeeds.dll
2013-04-14 22:37:17 ----A---- C:\Windows\system32\jscript9.dll
2013-04-14 22:37:16 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-04-14 22:37:16 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-04-14 22:37:16 ----A---- C:\Windows\system32\vbscript.dll
2013-04-14 22:37:16 ----A---- C:\Windows\system32\jsproxy.dll
2013-04-14 22:37:16 ----A---- C:\Windows\system32\jscript.dll
2013-04-14 22:37:15 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-04-14 22:37:15 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-04-14 22:37:15 ----A---- C:\Windows\system32\iertutil.dll
2013-04-14 22:37:13 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-04-14 22:37:12 ----A---- C:\Windows\system32\mshtml.dll
2013-04-14 22:37:11 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-04-14 22:37:11 ----A---- C:\Windows\system32\ieframe.dll
2013-04-14 18:10:24 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2013-04-14 18:10:24 ----A---- C:\Windows\system32\mstscax.dll
2013-04-14 18:10:23 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2013-04-14 18:10:23 ----A---- C:\Windows\SYSWOW64\aaclient.dll
2013-04-14 18:10:23 ----A---- C:\Windows\system32\tsgqec.dll
2013-04-14 18:10:23 ----A---- C:\Windows\system32\aaclient.dll
2013-04-14 18:10:19 ----A---- C:\Windows\system32\win32k.sys
2013-04-14 18:10:16 ----A---- C:\Windows\system32\drivers\fvevol.sys
2013-04-14 18:10:14 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2013-04-14 18:10:14 ----A---- C:\Windows\system32\ntoskrnl.exe
2013-04-14 18:10:13 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2013-04-14 18:10:13 ----A---- C:\Windows\system32\smss.exe
2013-04-14 18:10:12 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2013-04-14 18:10:12 ----A---- C:\Windows\system32\csrsrv.dll
2013-04-08 21:51:44 ----A---- C:\Windows\system32\drivers\rockusb.sys
2013-04-08 19:46:54 ----D---- C:\Program Files (x86)\7-Zip
======List of files/folders modified in the last 1 month======
2013-05-04 11:39:26 ----D---- C:\Windows\Prefetch
2013-05-04 11:38:48 ----D---- C:\Windows\System32
2013-05-04 11:38:48 ----D---- C:\Windows\inf
2013-05-04 11:38:48 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-05-04 11:36:17 ----D---- C:\Samsung Link
2013-05-04 11:32:33 ----HD---- C:\ProgramData
2013-05-04 11:32:32 ----D---- C:\Windows
2013-05-04 10:01:14 ----D---- C:\Windows\SYSWOW64\drivers
2013-05-04 09:56:13 ----SHD---- C:\$Recycle.Bin
2013-05-04 09:55:51 ----RD---- C:\Users
2013-05-04 09:23:24 ----RD---- C:\Program Files
2013-05-03 23:38:12 ----D---- C:\Windows\system32\drivers
2013-05-03 23:38:12 ----D---- C:\Users\Aldair\AppData\Roaming\Malwarebytes
2013-05-03 23:38:12 ----D---- C:\ProgramData\Malwarebytes
2013-05-03 23:34:48 ----D---- C:\Users\Aldair\AppData\Roaming\ICQ
2013-05-03 22:53:58 ----D---- C:\Windows\system32\config
2013-05-03 21:39:09 ----D---- C:\Users\Aldair\AppData\Roaming\vlc
2013-05-03 19:22:32 ----D---- C:\Program Files (x86)\JDownloader
2013-04-30 23:04:37 ----D---- C:\Programs
2013-04-30 21:13:58 ----D---- C:\Windows\Temp
2013-04-30 06:43:19 ----SHD---- C:\Config.Msi
2013-04-29 23:21:02 ----SHD---- C:\System Volume Information
2013-04-27 21:42:02 ----D---- C:\Windows\winsxs
2013-04-27 21:32:00 ----SHD---- C:\Windows\Installer
2013-04-27 21:31:56 ----D---- C:\Windows\SysWOW64
2013-04-25 19:01:56 ----D---- C:\Windows\system32\catroot2
2013-04-25 19:01:56 ----D---- C:\Windows\system32\catroot
2013-04-17 21:50:05 ----RD---- C:\Program Files (x86)
2013-04-17 21:01:42 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2013-04-15 20:50:59 ----D---- C:\ProgramData\Adobe
2013-04-15 20:50:46 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-04-15 20:20:35 ----D---- C:\Windows\SYSWOW64\migration
2013-04-15 20:20:35 ----D---- C:\Program Files (x86)\Internet Explorer
2013-04-15 20:20:34 ----D---- C:\Windows\system32\migration
2013-04-15 20:20:34 ----D---- C:\Program Files\Internet Explorer
2013-04-14 22:39:02 ----A---- C:\Windows\system32\MRT.exe
2013-04-14 22:38:28 ----D---- C:\ProgramData\Microsoft Help
2013-04-08 22:22:44 ----D---- C:\Windows\system32\DriverStore
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 SmartDefragDriver;SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [2011-02-23 18232]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2012-09-09 560184]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2009-12-04 314016]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2009-12-04 43680]
R2 npf;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-01-27 47632]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-02-15 10856960]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2012-02-15 327680]
R3 athr;Atheros – ovladač pro zařízení pro rozšiřitelnou bezdrátovou síť LAN; C:\Windows\system32\DRIVERS\athrx.sys [2009-06-20 1394688]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]
R3 KMWDFILTER;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 30208]
R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver; C:\Windows\system32\DRIVERS\Rtnic64.sys [2009-06-10 51712]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\Windows\system32\DRIVERS\seehcri.sys [2010-11-02 34032]
S3 AODDriver;AODDriver; \??\C:\Program Files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys []
S3 aoors6z8;aoors6z8; C:\Windows\system32\drivers\aoors6z8.sys []
S3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-05-06 125456]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-02-15 10856960]
S3 ayf15m13;ayf15m13; C:\Windows\system32\drivers\ayf15m13.sys []
S3 azvusb;Virtual USB Hub; C:\Windows\system32\DRIVERS\azvusb.sys [2009-08-24 54784]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2012-09-20 102368]
S3 etdrv;etdrv; \??\C:\Windows\etdrv.sys [2011-02-09 25640]
S3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\SysWOW64\FsUsbExDisk.SYS [2013-02-05 37344]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2011-02-10 25640]
S3 GVTDrv64;GVTDrv64; \??\C:\Windows\GVTDrv64.sys [2011-02-10 30528]
S3 HTCAND64;HTC Device Driver; C:\Windows\System32\Drivers\ANDROIDUSB.sys [2009-11-02 33736]
S3 mod7700;DiBcom DIB7700 based TV tuner device; C:\Windows\system32\DRIVERS\mod7700.sys [2010-11-19 1077840]
S3 MODRC;PCTV Dib Infrared Receiver; C:\Windows\system32\DRIVERS\modrc.sys [2010-11-19 24272]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2009-12-08 82816]
S3 PRODIGY;PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [2006-08-29 32377]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 20992]
S3 Rockusb;Driver for Rockusb Device; C:\Windows\system32\DRIVERS\rockusb.sys [2012-08-20 65648]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2012-09-20 203104]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 32768]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]
S3 xnacc;Služba ovladače pro řadič XBOX 360 pro systém Windows; C:\Windows\system32\DRIVERS\xnacc.sys [2009-07-14 679936]
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys [2009-04-08 68992]
S3 zebrbus;Sony Ericsson Composite Device driver; C:\Windows\system32\DRIVERS\zebrbus.sys [2010-11-02 108544]
S3 zebrmdm;Sony Ericsson Port (WDM); C:\Windows\system32\DRIVERS\zebrmdm.sys [2010-11-02 145408]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2012-02-15 235520]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-12-08 76888]
R2 Samsung Link Service;Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe [2013-04-23 605768]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-15 256904]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-04-15 115608]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2011-06-08 633856]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-09 1255736]
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
-----------------EOF-----------------
Logfile of random's system information tool 1.09 (written by random/random)
Run by Aldair at 2013-05-04 11:39:17
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 95 GB (40%) free of 238 GB
Total RAM: 2046 MB (43% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:39:26, on 4.5.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16476)
Boot mode: Normal
Running processes:
C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe
C:\Program Files (x86)\ICQ7.6\ICQ.exe
C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files (x86)\Samsung\Kies\Kies.exe
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
C:\Program Files\trend micro\Aldair.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= ... =CT2481032
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {124d001a-bdcb-472f-aa59-bbe7e4bc3204} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: IB Updater Helper - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\IB Updater\Extension32.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - (no file)
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.6\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"
O4 - HKCU\..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
O4 - HKCU\..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
O4 - HKCU\..\Run: [Google Update] "C:\Users\Aldair\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Ythyicxip] C:\Users\Aldair\AppData\Roaming\Obwu\uzepy.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: AML Device Install.lnk = C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: bwinCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Users\Aldair\Desktop\bwin Download Casino.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: bwinCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Users\Aldair\Desktop\bwin Download Casino.lnk (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Samsung Link Service - Copyright 2013 SAMSUNG - C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 10820 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\SysWOW64\PnkBstrA.exe
"taskhost.exe"
taskeng.exe {911DEA7E-F9AD-4807-BBB5-9CDF4599CDCA}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe"
"C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe" "Samsung Link Service" __i4j_restart
C:\Windows\system32\sppsvc.exe
"C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 1576
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe"
"C:\Program Files (x86)\ICQ7.6\ICQ.exe" silent loginmode=4
"C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"
"C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe"
"C:\Program Files (x86)\Samsung\Kies\Kies.exe" /preload
HydraDM64.exe -h:65848 "Maximalizovat na celou plochu" "Maximalizovat k rohům okna" "Obnovit pracovní plochu"
taskeng.exe {535221F7-C303-48B2-89B3-78D09BB9D401}
"C:\Program Files\Samsung\Samsung Link\Samsung Link.exe"
"C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe"
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=3436.5ab6800.437597499 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox" E7CF176E110C211B 3436 "\\.\pipe\gecko-crash-server-pipe.3436" plugin
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe" --proxy-stub-channel=Flash2536.6B111D90.4150 --host-broker-channel=Flash2536.6B111D90.8855 --host-pid=2536 --host-npapi-version=27 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll"
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe" --channel=2372.002EF2A4.1934849410 --proxy-stub-channel=Flash2536.6B111D90.4150 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll" --host-npapi-version=27 --type=renderer
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Users\Aldair\Desktop\RSITx64.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2903425235-1483294055-1189771601-10003_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2903425235-1483294055-1189771601-10003 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\At1.job
C:\Windows\tasks\At2.job
C:\Windows\tasks\At3.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2903425235-1483294055-1189771601-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2903425235-1483294055-1189771601-1000UA.job
C:\Windows\tasks\Norton Security Scan for Aldair.job
=========Mozilla firefox=========
ProfilePath - C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default
prefs.js - "browser.search.useDBForOrder" - "false"
prefs.js - "browser.startup.homepage" - "https://www.google.cz/"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17, {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19, {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20, {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.74, wrc@avast.com:20110101, maps@ovi.com:5.2.7.0, {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.5, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.18"
prefs.js - "keyword.URL" - "http://search.conduit.com/ResultsExt.as ... 4996302&q="
"{336D0C35-8A85-403a-B9D2-65C292C39087}"=C:\Program Files\IB Updater\Firefox
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.169 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=
"Path"=
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nppl3260;version=12.0.1.666]
"Description"=RealPlayer(tm) LiveConnect-Enabled Plug-In
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprjplug;version=12.0.1.666]
"Description"=RealJukebox Netscape Plugin
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.666]
"Description"=RealNetworks(tm) RealPlayer Chrome Background Extension Plug-In
"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.666]
"Description"=RealPlayer(tm) HTML5VideoShim Plug-In
"Path"=C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.666]
"Description"=12.0.1.666
"Path"=C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=]
"Description"=
"Path"=
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.169 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled
[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll
C:\Program Files (x86)\Mozilla Firefox\extensions\
{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
{972ce4c6-7e08-4474-a285-3208198ce6fd}
C:\Program Files (x86)\Mozilla Firefox\components\
binary.manifest
browsercomps.dll
nppl3260.xpt
npwachk.xpt
nsILegitCheckPlugin.xpt
nsjsrealplayerplugin.xpt
C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
npdeployJava1.dll
npLegitCheckPlugin.dll
NPOFF12.DLL
nppdf32.dll
nppl3260.dll
nprjplug.dll
nprpjplug.dll
npwachk.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt
C:\Program Files (x86)\Mozilla Firefox\searchplugins\
babylon.xml
Cetrumcz_igeared.xml
crawlersrch.xml
google.xml
heureka-cz.xml
jyxo-cz.xml
Search_Results.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml
yahoo.xml
C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\
ffxtlbr@incredibar.com
maps@ovi.com
{99079a25-328f-4bd4-be04-00955acaa0a7}
{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\
conduit.xml
MyStart Search.xml
Search_Results.xml
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
IB Updater - C:\Program Files\IB Updater\Extension64.dll [2012-10-23 215896]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-12-18 77576]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2011-09-24 414416]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
IB Updater - C:\Program Files\IB Updater\Extension32.dll [2012-10-23 170840]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2011-10-10 3834016]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-04-12 41760]
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{D5D47440-0750-463D-BAEF-A47D02414806}
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]
"Samsung Link"=C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe [2013-04-23 407384]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ICQ"=C:\Program Files (x86)\ICQ7.6\ICQ.exe [2011-10-10 127040]
"HydraVisionDesktopManager"=C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [2009-11-23 380928]
""=C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2013-02-13 844144]
"KiesPreload"=C:\Program Files (x86)\Samsung\Kies\Kies.exe [2013-02-13 1509232]
"KiesAirMessage"=C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup []
"Google Update"=C:\Users\Aldair\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-21 116648]
"AdobeBridge"= []
"Ythyicxip"=C:\Users\Aldair\AppData\Roaming\Obwu\uzepy.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-12-19 41208]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe -launchedbylogin []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced SystemCare 5]
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe /Manual []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner.exe]
C:\Users\Aldair\AppData\Roaming\majHCfhOhnvkQZaYdBHPsG\majHCfhOhnvkQZaYdBHPsG\0.0.0.0\CCleaner.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-08-28 3671904]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Aldair\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-21 116648]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HTC Sync Loader]
C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe -startup []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesAirMessage]
C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2013-02-13 844144]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]
C:\Program Files (x86)\Samsung\Kies\Kies.exe [2013-02-13 1509232]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /starttray []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoTerm.exe]
C:\Program Files (x86)\Common Files\PCTV Systems\RemoTerm\RemoTerm.exe []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-02-14 636032]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
c:\program files (x86)\steam\steam.exe -silent []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [2011-09-24 273528]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Vyhledat aktualizace.lnk]
C:\PROGRA~2\COMMON~1\PCTVSY~1\WEBUPD~1\WEBUPD~1.EXE -s -c -f=UpdateTVC6.xml -p=TVCenter -language=CS -url=http://www.pctvsystems.com/Portals/pctv/WebUpdaterFiles []
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Aldair^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Wild Media Server (UPnP, DLNA, HTTP).lnk]
C:\PROGRA~2\WILDME~1\wms.exe []
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"=C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [2008-07-22 77824]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"KiesTrayAgent"=C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [2013-02-13 310128]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2012-12-19 41208]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03 946352]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS6ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
AML Device Install.lnk - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Users\Aldair\AppData\Roaming\datacore.exe"="C:\Users\Aldair\AppData\Roaming\datacore.exe:*:Enabled:Windows Messanger"
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"="C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"F:\MalwarebytesPortable\App\Malwarebytes\mbam.exe"="F:\MalwarebytesPortable\App\Malwarebytes\mbam.exe:*:Enabled:Malwarebytes"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.FFDS"=ff_vfw.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
======File associations======
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 month======
2013-05-04 09:23:24 ----D---- C:\Program Files\trend micro
2013-04-25 19:03:38 ----A---- C:\Windows\system32\drivers\ntfs.sys
2013-04-17 22:10:06 ----D---- C:\Program Files\Samsung
2013-04-17 21:50:17 ----D---- C:\ProgramData\PMS
2013-04-17 21:50:05 ----D---- C:\Program Files (x86)\PS3 Media Server
2013-04-15 22:14:07 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-04-14 22:37:20 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2013-04-14 22:37:20 ----A---- C:\Windows\system32\mshtmled.dll
2013-04-14 22:37:19 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2013-04-14 22:37:19 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-04-14 22:37:18 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-04-14 22:37:18 ----A---- C:\Windows\SYSWOW64\url.dll
2013-04-14 22:37:18 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2013-04-14 22:37:18 ----A---- C:\Windows\system32\urlmon.dll
2013-04-14 22:37:18 ----A---- C:\Windows\system32\url.dll
2013-04-14 22:37:18 ----A---- C:\Windows\system32\ieUnatt.exe
2013-04-14 22:37:18 ----A---- C:\Windows\system32\ieui.dll
2013-04-14 22:37:17 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-04-14 22:37:17 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-04-14 22:37:17 ----A---- C:\Windows\system32\wininet.dll
2013-04-14 22:37:17 ----A---- C:\Windows\system32\msfeeds.dll
2013-04-14 22:37:17 ----A---- C:\Windows\system32\jscript9.dll
2013-04-14 22:37:16 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-04-14 22:37:16 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-04-14 22:37:16 ----A---- C:\Windows\system32\vbscript.dll
2013-04-14 22:37:16 ----A---- C:\Windows\system32\jsproxy.dll
2013-04-14 22:37:16 ----A---- C:\Windows\system32\jscript.dll
2013-04-14 22:37:15 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-04-14 22:37:15 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-04-14 22:37:15 ----A---- C:\Windows\system32\iertutil.dll
2013-04-14 22:37:13 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-04-14 22:37:12 ----A---- C:\Windows\system32\mshtml.dll
2013-04-14 22:37:11 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-04-14 22:37:11 ----A---- C:\Windows\system32\ieframe.dll
2013-04-14 18:10:24 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2013-04-14 18:10:24 ----A---- C:\Windows\system32\mstscax.dll
2013-04-14 18:10:23 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2013-04-14 18:10:23 ----A---- C:\Windows\SYSWOW64\aaclient.dll
2013-04-14 18:10:23 ----A---- C:\Windows\system32\tsgqec.dll
2013-04-14 18:10:23 ----A---- C:\Windows\system32\aaclient.dll
2013-04-14 18:10:19 ----A---- C:\Windows\system32\win32k.sys
2013-04-14 18:10:16 ----A---- C:\Windows\system32\drivers\fvevol.sys
2013-04-14 18:10:14 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2013-04-14 18:10:14 ----A---- C:\Windows\system32\ntoskrnl.exe
2013-04-14 18:10:13 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2013-04-14 18:10:13 ----A---- C:\Windows\system32\smss.exe
2013-04-14 18:10:12 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2013-04-14 18:10:12 ----A---- C:\Windows\system32\csrsrv.dll
2013-04-08 21:51:44 ----A---- C:\Windows\system32\drivers\rockusb.sys
2013-04-08 19:46:54 ----D---- C:\Program Files (x86)\7-Zip
======List of files/folders modified in the last 1 month======
2013-05-04 11:39:26 ----D---- C:\Windows\Prefetch
2013-05-04 11:38:48 ----D---- C:\Windows\System32
2013-05-04 11:38:48 ----D---- C:\Windows\inf
2013-05-04 11:38:48 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-05-04 11:36:17 ----D---- C:\Samsung Link
2013-05-04 11:32:33 ----HD---- C:\ProgramData
2013-05-04 11:32:32 ----D---- C:\Windows
2013-05-04 10:01:14 ----D---- C:\Windows\SYSWOW64\drivers
2013-05-04 09:56:13 ----SHD---- C:\$Recycle.Bin
2013-05-04 09:55:51 ----RD---- C:\Users
2013-05-04 09:23:24 ----RD---- C:\Program Files
2013-05-03 23:38:12 ----D---- C:\Windows\system32\drivers
2013-05-03 23:38:12 ----D---- C:\Users\Aldair\AppData\Roaming\Malwarebytes
2013-05-03 23:38:12 ----D---- C:\ProgramData\Malwarebytes
2013-05-03 23:34:48 ----D---- C:\Users\Aldair\AppData\Roaming\ICQ
2013-05-03 22:53:58 ----D---- C:\Windows\system32\config
2013-05-03 21:39:09 ----D---- C:\Users\Aldair\AppData\Roaming\vlc
2013-05-03 19:22:32 ----D---- C:\Program Files (x86)\JDownloader
2013-04-30 23:04:37 ----D---- C:\Programs
2013-04-30 21:13:58 ----D---- C:\Windows\Temp
2013-04-30 06:43:19 ----SHD---- C:\Config.Msi
2013-04-29 23:21:02 ----SHD---- C:\System Volume Information
2013-04-27 21:42:02 ----D---- C:\Windows\winsxs
2013-04-27 21:32:00 ----SHD---- C:\Windows\Installer
2013-04-27 21:31:56 ----D---- C:\Windows\SysWOW64
2013-04-25 19:01:56 ----D---- C:\Windows\system32\catroot2
2013-04-25 19:01:56 ----D---- C:\Windows\system32\catroot
2013-04-17 21:50:05 ----RD---- C:\Program Files (x86)
2013-04-17 21:01:42 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2013-04-15 20:50:59 ----D---- C:\ProgramData\Adobe
2013-04-15 20:50:46 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-04-15 20:20:35 ----D---- C:\Windows\SYSWOW64\migration
2013-04-15 20:20:35 ----D---- C:\Program Files (x86)\Internet Explorer
2013-04-15 20:20:34 ----D---- C:\Windows\system32\migration
2013-04-15 20:20:34 ----D---- C:\Program Files\Internet Explorer
2013-04-14 22:39:02 ----A---- C:\Windows\system32\MRT.exe
2013-04-14 22:38:28 ----D---- C:\ProgramData\Microsoft Help
2013-04-08 22:22:44 ----D---- C:\Windows\system32\DriverStore
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 SmartDefragDriver;SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [2011-02-23 18232]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2012-09-09 560184]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2009-12-04 314016]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2009-12-04 43680]
R2 npf;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys [2010-01-27 47632]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-02-15 10856960]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2012-02-15 327680]
R3 athr;Atheros – ovladač pro zařízení pro rozšiřitelnou bezdrátovou síť LAN; C:\Windows\system32\DRIVERS\athrx.sys [2009-06-20 1394688]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]
R3 KMWDFILTER;HIDServiceDesc; C:\Windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 30208]
R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver; C:\Windows\system32\DRIVERS\Rtnic64.sys [2009-06-10 51712]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\Windows\system32\DRIVERS\seehcri.sys [2010-11-02 34032]
S3 AODDriver;AODDriver; \??\C:\Program Files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys []
S3 aoors6z8;aoors6z8; C:\Windows\system32\drivers\aoors6z8.sys []
S3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-05-06 125456]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-02-15 10856960]
S3 ayf15m13;ayf15m13; C:\Windows\system32\drivers\ayf15m13.sys []
S3 azvusb;Virtual USB Hub; C:\Windows\system32\DRIVERS\azvusb.sys [2009-08-24 54784]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2012-09-20 102368]
S3 etdrv;etdrv; \??\C:\Windows\etdrv.sys [2011-02-09 25640]
S3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\SysWOW64\FsUsbExDisk.SYS [2013-02-05 37344]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2011-02-10 25640]
S3 GVTDrv64;GVTDrv64; \??\C:\Windows\GVTDrv64.sys [2011-02-10 30528]
S3 HTCAND64;HTC Device Driver; C:\Windows\System32\Drivers\ANDROIDUSB.sys [2009-11-02 33736]
S3 mod7700;DiBcom DIB7700 based TV tuner device; C:\Windows\system32\DRIVERS\mod7700.sys [2010-11-19 1077840]
S3 MODRC;PCTV Dib Infrared Receiver; C:\Windows\system32\DRIVERS\modrc.sys [2010-11-19 24272]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2009-12-08 82816]
S3 PRODIGY;PRODIGY; C:\Windows\System32\Drivers\PRODIGY.SYS [2006-08-29 32377]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 20992]
S3 Rockusb;Driver for Rockusb Device; C:\Windows\system32\DRIVERS\rockusb.sys [2012-08-20 65648]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2012-09-20 203104]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2010-11-20 32768]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]
S3 xnacc;Služba ovladače pro řadič XBOX 360 pro systém Windows; C:\Windows\system32\DRIVERS\xnacc.sys [2009-07-14 679936]
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys [2009-04-08 68992]
S3 zebrbus;Sony Ericsson Composite Device driver; C:\Windows\system32\DRIVERS\zebrbus.sys [2010-11-02 108544]
S3 zebrmdm;Sony Ericsson Port (WDM); C:\Windows\system32\DRIVERS\zebrmdm.sys [2010-11-02 145408]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2012-02-15 235520]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-12-08 76888]
R2 Samsung Link Service;Samsung Link Service; C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe [2013-04-23 605768]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-15 256904]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-04-15 115608]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2011-06-08 633856]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-07-09 1255736]
S4 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
-----------------EOF-----------------
- Přílohy
-
- virusinfo_syscheck.zip
- (28.04 KiB) Staženo 51 x
Re: Blokování policií
tak 2x mi to skončilo s hláškou "cannot create file c:\users\aldair\desktop\cmd.bat
Re: Blokování policií
teď už to proběhlo v pořádku tady je výsledek
- Přílohy
-
- otlextras.zip
- (177.23 KiB) Staženo 49 x
Re: Blokování policií
https://www.virustotal.com/cs/file/6df9 ... 367690766/
https://www.virustotal.com/cs/file/6df9 ... 367691005/
# AdwCleaner v2.300 - Log vytvooen 04/05/2013 v 20:12:40
# Aktualizováno 28/04/2013 Xplode
# Operaení systém : Windows 7 Ultimate Service Pack 1 (64 bits)
# Uživatel : Aldair - ALDAIR-PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\Aldair\Desktop\adwcleaner.exe
# Volba [Prohledat]
***** [Služby] *****
***** [Soubory / Složky] *****
Složka Nalezeno : C:\Program Files (x86)\Common Files\spigot
Složka Nalezeno : C:\Program Files (x86)\Conduit
Složka Nalezeno : C:\Program Files (x86)\Perion
Složka Nalezeno : C:\Program Files (x86)\Searchqu Toolbar
Složka Nalezeno : C:\Program Files\IB Updater
Složka Nalezeno : C:\ProgramData\Babylon
Složka Nalezeno : C:\ProgramData\boost_interprocess
Složka Nalezeno : C:\Users\Aldair\AppData\Local\Conduit
Složka Nalezeno : C:\Users\Aldair\AppData\LocalLow\Conduit
Složka Nalezeno : C:\Users\Aldair\AppData\LocalLow\Searchqutoolbar
Složka Nalezeno : C:\Users\Aldair\AppData\Roaming\Babylon
Složka Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
Složka Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
Složka Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\ffxtlbr@incredibar.com
Složka Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\Searchqutoolbar
Složka Nalezeno : C:\Windows\SysWOW64\WNLT
Soubor Nalezeno : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Soubor Nalezeno : C:\Program Files (x86)\Mozilla Firefox\searchplugins\crawlersrch.xml
Soubor Nalezeno : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml
Soubor Nalezeno : C:\user.js
Soubor Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\Conduit.xml
Soubor Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\MyStart Search.xml
Soubor Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\Search_Results.xml
***** [Registry] *****
Hodnota Nalezeno : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
Hodnota Nalezeno : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Hodnota Nalezeno : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Klíe Nalezeno : HKCU\Software\APN PIP
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\SmartBar
Klíe Nalezeno : HKCU\Software\Conduit
Klíe Nalezeno : HKCU\Software\IM
Klíe Nalezeno : HKCU\Software\ImInstaller
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Klíe Nalezeno : HKCU\Software\Softonic
Klíe Nalezeno : HKCU\Software\WNLT
Klíe Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Klíe Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Klíe Nalezeno : HKLM\Software\Babylon
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Prod.cap
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Toolbar.CT2481032
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Klíe Nalezeno : HKLM\Software\Conduit
Klíe Nalezeno : HKLM\Software\IB Updater
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASAPI32
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASMANCS
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Klíe Nalezeno : HKLM\Software\PIP
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Klíe Nalezeno : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Klíe Nalezeno : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT
Klíe Nalezeno : HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Klíe Nalezeno : HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
***** [Internetové prohlížeee] *****
-\\ Internet Explorer v9.0.8112.16476
[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2481032
-\\ Mozilla Firefox v20.0.1 (cs)
Soubor : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\prefs.js
Nalezeno : user_pref("CT2481032_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Nalezeno : user_pref("Smartbar.ConduitHomepagesList", "");
Nalezeno : user_pref("Smartbar.ConduitSearchEngineList", "Ashampoo US Customized Web Search");
Nalezeno : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032[...]
Nalezeno : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://mystart.incredibar.com/mb201/?loc=IB_DS&a[...]
Nalezeno : user_pref("Smartbar.keywordURLSelectedCTID", "CT2481032");
Nalezeno : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=117023&tt=0213_6&babsrc=NT_ss&mntr[...]
Nalezeno : user_pref("browser.search.defaultenginename", "MyStart Search");
Nalezeno : user_pref("browser.search.defaultthis.engineName", "Ashampoo US Customized Web Search");
Nalezeno : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&Sea[...]
Nalezeno : user_pref("browser.search.selectedEngine", "Ashampoo US Customized Web Search");
Nalezeno : user_pref("ct2481032.UserID", "UN40714723714996302");
Nalezeno : user_pref("extensions.incredibar_i.aflt", "orgnl");
Nalezeno : user_pref("extensions.incredibar_i.dfltLng", "");
Nalezeno : user_pref("extensions.incredibar_i.did", "10643");
Nalezeno : user_pref("extensions.incredibar_i.excTlbr", false);
Nalezeno : user_pref("extensions.incredibar_i.id", "e4a350d6000000000000000e2e2bf28f");
Nalezeno : user_pref("extensions.incredibar_i.installerproductid", "26");
Nalezeno : user_pref("extensions.incredibar_i.instlDay", "15669");
Nalezeno : user_pref("extensions.incredibar_i.instlRef", "");
Nalezeno : user_pref("extensions.incredibar_i.ms_url_id", "");
Nalezeno : user_pref("extensions.incredibar_i.newTab", false);
Nalezeno : user_pref("extensions.incredibar_i.ppd", "1");
Nalezeno : user_pref("extensions.incredibar_i.prdct", "incredibar");
Nalezeno : user_pref("extensions.incredibar_i.productid", "26");
Nalezeno : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Nalezeno : user_pref("extensions.incredibar_i.smplGrp", "none");
Nalezeno : user_pref("extensions.incredibar_i.tlbrId", "base");
Nalezeno : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQQN1M9Ez&loc=IB[...]
Nalezeno : user_pref("extensions.incredibar_i.upn2", "6PQQN1M9Ez");
Nalezeno : user_pref("extensions.incredibar_i.upn2n", "92543987150946151");
Nalezeno : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Nalezeno : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:47:08");
Nalezeno : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Nalezeno : user_pref("icqtoolbar.showPc", false);
Nalezeno : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&SearchSource=2&CU[...]
Nalezeno : user_pref("smartbar.machineId", "FTDELUOY6KTBS1XBMWMG25PCNSJTWY80VEI3TMR+UKQUHRFDNXAOHPKQ2TZCFCS+L1Y[...]
Nalezeno : user_pref("surfcanyon.fractions", "0.0_0.0\r\n");
Nalezeno : user_pref("surfcanyon.last_checked_ts", "1267039437168");
Soubor : C:\Users\Host\AppData\Roaming\Mozilla\Firefox\Profiles\71cg5xt7.default\prefs.js
[OK] Soubor je eistý.
-\\ Google Chrome v26.0.1410.64
Soubor : C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Preferences
Nalezeno [l.2790] : urls_to_restore_on_startup = [ "hxxp://www.searchnu.com/410", "hxxp://mystart.incredibar.com/mb201?a=6PQQN1M9Ez&i=26", "hxxp://search.conduit.com/?CUI=UN36068156621605316&ctid=CT2481032&SearchSource=48" ]
-\\ Opera v [Nemohu získat verzi]
Soubor : C:\Users\Aldair\AppData\Roaming\Opera\Opera\operaprefs.ini
Nalezeno : application/x-winampx-1.0.0.1=6,,C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll,Winamp A[...]
Nalezeno : application/x-winampx-1.0.0.1=,0
*************************
AdwCleaner[R1].txt - [12468 octets] - [04/05/2013 20:12:40]
########## EOF - C:\AdwCleaner[R1].txt - [12529 octets] ##########
https://www.virustotal.com/cs/file/6df9 ... 367691005/
# AdwCleaner v2.300 - Log vytvooen 04/05/2013 v 20:12:40
# Aktualizováno 28/04/2013 Xplode
# Operaení systém : Windows 7 Ultimate Service Pack 1 (64 bits)
# Uživatel : Aldair - ALDAIR-PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\Aldair\Desktop\adwcleaner.exe
# Volba [Prohledat]
***** [Služby] *****
***** [Soubory / Složky] *****
Složka Nalezeno : C:\Program Files (x86)\Common Files\spigot
Složka Nalezeno : C:\Program Files (x86)\Conduit
Složka Nalezeno : C:\Program Files (x86)\Perion
Složka Nalezeno : C:\Program Files (x86)\Searchqu Toolbar
Složka Nalezeno : C:\Program Files\IB Updater
Složka Nalezeno : C:\ProgramData\Babylon
Složka Nalezeno : C:\ProgramData\boost_interprocess
Složka Nalezeno : C:\Users\Aldair\AppData\Local\Conduit
Složka Nalezeno : C:\Users\Aldair\AppData\LocalLow\Conduit
Složka Nalezeno : C:\Users\Aldair\AppData\LocalLow\Searchqutoolbar
Složka Nalezeno : C:\Users\Aldair\AppData\Roaming\Babylon
Složka Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
Složka Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
Složka Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\ffxtlbr@incredibar.com
Složka Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\Searchqutoolbar
Složka Nalezeno : C:\Windows\SysWOW64\WNLT
Soubor Nalezeno : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Soubor Nalezeno : C:\Program Files (x86)\Mozilla Firefox\searchplugins\crawlersrch.xml
Soubor Nalezeno : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml
Soubor Nalezeno : C:\user.js
Soubor Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\Conduit.xml
Soubor Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\MyStart Search.xml
Soubor Nalezeno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\Search_Results.xml
***** [Registry] *****
Hodnota Nalezeno : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
Hodnota Nalezeno : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Hodnota Nalezeno : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Klíe Nalezeno : HKCU\Software\APN PIP
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\SmartBar
Klíe Nalezeno : HKCU\Software\Conduit
Klíe Nalezeno : HKCU\Software\IM
Klíe Nalezeno : HKCU\Software\ImInstaller
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Klíe Nalezeno : HKCU\Software\Softonic
Klíe Nalezeno : HKCU\Software\WNLT
Klíe Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Klíe Nalezeno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Klíe Nalezeno : HKLM\Software\Babylon
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Prod.cap
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Toolbar.CT2481032
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Klíe Nalezeno : HKLM\Software\Conduit
Klíe Nalezeno : HKLM\Software\IB Updater
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASAPI32
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASMANCS
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Klíe Nalezeno : HKLM\Software\PIP
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Klíe Nalezeno : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Klíe Nalezeno : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT
Klíe Nalezeno : HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Klíe Nalezeno : HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
***** [Internetové prohlížeee] *****
-\\ Internet Explorer v9.0.8112.16476
[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2481032
-\\ Mozilla Firefox v20.0.1 (cs)
Soubor : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\prefs.js
Nalezeno : user_pref("CT2481032_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Nalezeno : user_pref("Smartbar.ConduitHomepagesList", "");
Nalezeno : user_pref("Smartbar.ConduitSearchEngineList", "Ashampoo US Customized Web Search");
Nalezeno : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032[...]
Nalezeno : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://mystart.incredibar.com/mb201/?loc=IB_DS&a[...]
Nalezeno : user_pref("Smartbar.keywordURLSelectedCTID", "CT2481032");
Nalezeno : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=117023&tt=0213_6&babsrc=NT_ss&mntr[...]
Nalezeno : user_pref("browser.search.defaultenginename", "MyStart Search");
Nalezeno : user_pref("browser.search.defaultthis.engineName", "Ashampoo US Customized Web Search");
Nalezeno : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&Sea[...]
Nalezeno : user_pref("browser.search.selectedEngine", "Ashampoo US Customized Web Search");
Nalezeno : user_pref("ct2481032.UserID", "UN40714723714996302");
Nalezeno : user_pref("extensions.incredibar_i.aflt", "orgnl");
Nalezeno : user_pref("extensions.incredibar_i.dfltLng", "");
Nalezeno : user_pref("extensions.incredibar_i.did", "10643");
Nalezeno : user_pref("extensions.incredibar_i.excTlbr", false);
Nalezeno : user_pref("extensions.incredibar_i.id", "e4a350d6000000000000000e2e2bf28f");
Nalezeno : user_pref("extensions.incredibar_i.installerproductid", "26");
Nalezeno : user_pref("extensions.incredibar_i.instlDay", "15669");
Nalezeno : user_pref("extensions.incredibar_i.instlRef", "");
Nalezeno : user_pref("extensions.incredibar_i.ms_url_id", "");
Nalezeno : user_pref("extensions.incredibar_i.newTab", false);
Nalezeno : user_pref("extensions.incredibar_i.ppd", "1");
Nalezeno : user_pref("extensions.incredibar_i.prdct", "incredibar");
Nalezeno : user_pref("extensions.incredibar_i.productid", "26");
Nalezeno : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Nalezeno : user_pref("extensions.incredibar_i.smplGrp", "none");
Nalezeno : user_pref("extensions.incredibar_i.tlbrId", "base");
Nalezeno : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQQN1M9Ez&loc=IB[...]
Nalezeno : user_pref("extensions.incredibar_i.upn2", "6PQQN1M9Ez");
Nalezeno : user_pref("extensions.incredibar_i.upn2n", "92543987150946151");
Nalezeno : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Nalezeno : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:47:08");
Nalezeno : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Nalezeno : user_pref("icqtoolbar.showPc", false);
Nalezeno : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&SearchSource=2&CU[...]
Nalezeno : user_pref("smartbar.machineId", "FTDELUOY6KTBS1XBMWMG25PCNSJTWY80VEI3TMR+UKQUHRFDNXAOHPKQ2TZCFCS+L1Y[...]
Nalezeno : user_pref("surfcanyon.fractions", "0.0_0.0\r\n");
Nalezeno : user_pref("surfcanyon.last_checked_ts", "1267039437168");
Soubor : C:\Users\Host\AppData\Roaming\Mozilla\Firefox\Profiles\71cg5xt7.default\prefs.js
[OK] Soubor je eistý.
-\\ Google Chrome v26.0.1410.64
Soubor : C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Preferences
Nalezeno [l.2790] : urls_to_restore_on_startup = [ "hxxp://www.searchnu.com/410", "hxxp://mystart.incredibar.com/mb201?a=6PQQN1M9Ez&i=26", "hxxp://search.conduit.com/?CUI=UN36068156621605316&ctid=CT2481032&SearchSource=48" ]
-\\ Opera v [Nemohu získat verzi]
Soubor : C:\Users\Aldair\AppData\Roaming\Opera\Opera\operaprefs.ini
Nalezeno : application/x-winampx-1.0.0.1=6,,C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll,Winamp A[...]
Nalezeno : application/x-winampx-1.0.0.1=,0
*************************
AdwCleaner[R1].txt - [12468 octets] - [04/05/2013 20:12:40]
########## EOF - C:\AdwCleaner[R1].txt - [12529 octets] ##########
Re: Blokování policií
a tady je log po vymazání
# AdwCleaner v2.300 - Log vytvooen 04/05/2013 v 20:16:53
# Aktualizováno 28/04/2013 Xplode
# Operaení systém : Windows 7 Ultimate Service Pack 1 (64 bits)
# Uživatel : Aldair - ALDAIR-PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\Aldair\Desktop\adwcleaner.exe
# Volba [Vymazat]
***** [Služby] *****
***** [Soubory / Složky] *****
Složka Vymazáno : C:\Program Files (x86)\Common Files\spigot
Složka Vymazáno : C:\Program Files (x86)\Conduit
Složka Vymazáno : C:\Program Files (x86)\Perion
Složka Vymazáno : C:\Program Files (x86)\Searchqu Toolbar
Složka Vymazáno : C:\Program Files\IB Updater
Složka Vymazáno : C:\ProgramData\Babylon
Složka Vymazáno : C:\ProgramData\boost_interprocess
Složka Vymazáno : C:\Users\Aldair\AppData\Local\Conduit
Složka Vymazáno : C:\Users\Aldair\AppData\LocalLow\Conduit
Složka Vymazáno : C:\Users\Aldair\AppData\LocalLow\Searchqutoolbar
Složka Vymazáno : C:\Users\Aldair\AppData\Roaming\Babylon
Složka Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
Složka Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\ffxtlbr@incredibar.com
Složka Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\Searchqutoolbar
Složka Vymazáno : C:\Windows\SysWOW64\WNLT
Soubor Vymazáno : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Soubor Vymazáno : C:\Program Files (x86)\Mozilla Firefox\searchplugins\crawlersrch.xml
Soubor Vymazáno : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml
Soubor Vymazáno : C:\user.js
Soubor Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\Conduit.xml
Soubor Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\MyStart Search.xml
Soubor Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\Search_Results.xml
Vymazáno poi restartu : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
***** [Registry] *****
Hodnota Vymazáno : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
Hodnota Vymazáno : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Klíe Vymazáno : HKCU\Software\APN PIP
Klíe Vymazáno : HKCU\Software\AppDataLow\Software\SmartBar
Klíe Vymazáno : HKCU\Software\Conduit
Klíe Vymazáno : HKCU\Software\IM
Klíe Vymazáno : HKCU\Software\ImInstaller
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Klíe Vymazáno : HKCU\Software\Softonic
Klíe Vymazáno : HKCU\Software\WNLT
Klíe Vymazáno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Klíe Vymazáno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Klíe Vymazáno : HKLM\Software\Babylon
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Prod.cap
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Toolbar.CT2481032
Klíe Vymazáno : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Klíe Vymazáno : HKLM\Software\Conduit
Klíe Vymazáno : HKLM\Software\IB Updater
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASAPI32
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASMANCS
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Klíe Vymazáno : HKLM\Software\PIP
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Klíe Vymazáno : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT
***** [Internetové prohlížeee] *****
-\\ Internet Explorer v9.0.8112.16476
Zaminino : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2481032 --> hxxp://www.google.com
-\\ Mozilla Firefox v20.0.1 (cs)
Soubor : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\prefs.js
C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\user.js ... Vymazáno !
Vymazáno : user_pref("CT2481032_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Vymazáno : user_pref("Smartbar.ConduitHomepagesList", "");
Vymazáno : user_pref("Smartbar.ConduitSearchEngineList", "Ashampoo US Customized Web Search");
Vymazáno : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032[...]
Vymazáno : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://mystart.incredibar.com/mb201/?loc=IB_DS&a[...]
Vymazáno : user_pref("Smartbar.keywordURLSelectedCTID", "CT2481032");
Vymazáno : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=117023&tt=0213_6&babsrc=NT_ss&mntr[...]
Vymazáno : user_pref("browser.search.defaultenginename", "MyStart Search");
Vymazáno : user_pref("browser.search.defaultthis.engineName", "Ashampoo US Customized Web Search");
Vymazáno : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&Sea[...]
Vymazáno : user_pref("browser.search.selectedEngine", "Ashampoo US Customized Web Search");
Vymazáno : user_pref("ct2481032.UserID", "UN40714723714996302");
Vymazáno : user_pref("extensions.incredibar_i.aflt", "orgnl");
Vymazáno : user_pref("extensions.incredibar_i.dfltLng", "");
Vymazáno : user_pref("extensions.incredibar_i.did", "10643");
Vymazáno : user_pref("extensions.incredibar_i.excTlbr", false);
Vymazáno : user_pref("extensions.incredibar_i.id", "e4a350d6000000000000000e2e2bf28f");
Vymazáno : user_pref("extensions.incredibar_i.installerproductid", "26");
Vymazáno : user_pref("extensions.incredibar_i.instlDay", "15669");
Vymazáno : user_pref("extensions.incredibar_i.instlRef", "");
Vymazáno : user_pref("extensions.incredibar_i.ms_url_id", "");
Vymazáno : user_pref("extensions.incredibar_i.newTab", false);
Vymazáno : user_pref("extensions.incredibar_i.ppd", "1");
Vymazáno : user_pref("extensions.incredibar_i.prdct", "incredibar");
Vymazáno : user_pref("extensions.incredibar_i.productid", "26");
Vymazáno : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Vymazáno : user_pref("extensions.incredibar_i.smplGrp", "none");
Vymazáno : user_pref("extensions.incredibar_i.tlbrId", "base");
Vymazáno : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQQN1M9Ez&loc=IB[...]
Vymazáno : user_pref("extensions.incredibar_i.upn2", "6PQQN1M9Ez");
Vymazáno : user_pref("extensions.incredibar_i.upn2n", "92543987150946151");
Vymazáno : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Vymazáno : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:47:08");
Vymazáno : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Vymazáno : user_pref("icqtoolbar.showPc", false);
Vymazáno : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&SearchSource=2&CU[...]
Vymazáno : user_pref("smartbar.machineId", "FTDELUOY6KTBS1XBMWMG25PCNSJTWY80VEI3TMR+UKQUHRFDNXAOHPKQ2TZCFCS+L1Y[...]
Vymazáno : user_pref("surfcanyon.fractions", "0.0_0.0\r\n");
Vymazáno : user_pref("surfcanyon.last_checked_ts", "1267039437168");
Soubor : C:\Users\Host\AppData\Roaming\Mozilla\Firefox\Profiles\71cg5xt7.default\prefs.js
[OK] Soubor je eistý.
-\\ Google Chrome v26.0.1410.64
Soubor : C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Preferences
Vymazáno [l.2790] : urls_to_restore_on_startup = [ "hxxp://www.searchnu.com/410", "hxxp://mystart.incredibar.com/[...]
-\\ Opera v [Nemohu získat verzi]
Soubor : C:\Users\Aldair\AppData\Roaming\Opera\Opera\operaprefs.ini
Vymazáno : application/x-winampx-1.0.0.1=6,,C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll,Winamp A[...]
Vymazáno : application/x-winampx-1.0.0.1=,0
*************************
AdwCleaner[R1].txt - [12553 octets] - [04/05/2013 20:12:40]
AdwCleaner[R2].txt - [12614 octets] - [04/05/2013 20:16:35]
AdwCleaner[S1].txt - [12051 octets] - [04/05/2013 20:16:53]
########## EOF - C:\AdwCleaner[S1].txt - [12112 octets] ##########
# AdwCleaner v2.300 - Log vytvooen 04/05/2013 v 20:16:53
# Aktualizováno 28/04/2013 Xplode
# Operaení systém : Windows 7 Ultimate Service Pack 1 (64 bits)
# Uživatel : Aldair - ALDAIR-PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\Aldair\Desktop\adwcleaner.exe
# Volba [Vymazat]
***** [Služby] *****
***** [Soubory / Složky] *****
Složka Vymazáno : C:\Program Files (x86)\Common Files\spigot
Složka Vymazáno : C:\Program Files (x86)\Conduit
Složka Vymazáno : C:\Program Files (x86)\Perion
Složka Vymazáno : C:\Program Files (x86)\Searchqu Toolbar
Složka Vymazáno : C:\Program Files\IB Updater
Složka Vymazáno : C:\ProgramData\Babylon
Složka Vymazáno : C:\ProgramData\boost_interprocess
Složka Vymazáno : C:\Users\Aldair\AppData\Local\Conduit
Složka Vymazáno : C:\Users\Aldair\AppData\LocalLow\Conduit
Složka Vymazáno : C:\Users\Aldair\AppData\LocalLow\Searchqutoolbar
Složka Vymazáno : C:\Users\Aldair\AppData\Roaming\Babylon
Složka Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
Složka Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\ffxtlbr@incredibar.com
Složka Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\Searchqutoolbar
Složka Vymazáno : C:\Windows\SysWOW64\WNLT
Soubor Vymazáno : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Soubor Vymazáno : C:\Program Files (x86)\Mozilla Firefox\searchplugins\crawlersrch.xml
Soubor Vymazáno : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml
Soubor Vymazáno : C:\user.js
Soubor Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\Conduit.xml
Soubor Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\MyStart Search.xml
Soubor Vymazáno : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\searchplugins\Search_Results.xml
Vymazáno poi restartu : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\{1fd91a9c-410c-4090-bbcc-55d3450ef433}
***** [Registry] *****
Hodnota Vymazáno : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{4B3803EA-5230-4DC3-A7FC-33638F3D3542}]
Hodnota Vymazáno : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
Klíe Vymazáno : HKCU\Software\APN PIP
Klíe Vymazáno : HKCU\Software\AppDataLow\Software\SmartBar
Klíe Vymazáno : HKCU\Software\Conduit
Klíe Vymazáno : HKCU\Software\IM
Klíe Vymazáno : HKCU\Software\ImInstaller
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Klíe Vymazáno : HKCU\Software\Softonic
Klíe Vymazáno : HKCU\Software\WNLT
Klíe Vymazáno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Klíe Vymazáno : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Klíe Vymazáno : HKLM\Software\Babylon
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Klíe Vymazáno : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Prod.cap
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Toolbar.CT2481032
Klíe Vymazáno : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Klíe Vymazáno : HKLM\Software\Conduit
Klíe Vymazáno : HKLM\Software\IB Updater
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\CToolbar_RASMANCS
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASAPI32
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_installer_RASMANCS
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Klíe Vymazáno : HKLM\Software\PIP
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg
Klíe Vymazáno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
Klíe Vymazáno : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
Klíe Vymazáno : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403A-B9D2-65C292C39087}
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Klíe Vymazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WNLT
***** [Internetové prohlížeee] *****
-\\ Internet Explorer v9.0.8112.16476
Zaminino : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2481032 --> hxxp://www.google.com
-\\ Mozilla Firefox v20.0.1 (cs)
Soubor : C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\prefs.js
C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\user.js ... Vymazáno !
Vymazáno : user_pref("CT2481032_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Vymazáno : user_pref("Smartbar.ConduitHomepagesList", "");
Vymazáno : user_pref("Smartbar.ConduitSearchEngineList", "Ashampoo US Customized Web Search");
Vymazáno : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032[...]
Vymazáno : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://mystart.incredibar.com/mb201/?loc=IB_DS&a[...]
Vymazáno : user_pref("Smartbar.keywordURLSelectedCTID", "CT2481032");
Vymazáno : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=117023&tt=0213_6&babsrc=NT_ss&mntr[...]
Vymazáno : user_pref("browser.search.defaultenginename", "MyStart Search");
Vymazáno : user_pref("browser.search.defaultthis.engineName", "Ashampoo US Customized Web Search");
Vymazáno : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&Sea[...]
Vymazáno : user_pref("browser.search.selectedEngine", "Ashampoo US Customized Web Search");
Vymazáno : user_pref("ct2481032.UserID", "UN40714723714996302");
Vymazáno : user_pref("extensions.incredibar_i.aflt", "orgnl");
Vymazáno : user_pref("extensions.incredibar_i.dfltLng", "");
Vymazáno : user_pref("extensions.incredibar_i.did", "10643");
Vymazáno : user_pref("extensions.incredibar_i.excTlbr", false);
Vymazáno : user_pref("extensions.incredibar_i.id", "e4a350d6000000000000000e2e2bf28f");
Vymazáno : user_pref("extensions.incredibar_i.installerproductid", "26");
Vymazáno : user_pref("extensions.incredibar_i.instlDay", "15669");
Vymazáno : user_pref("extensions.incredibar_i.instlRef", "");
Vymazáno : user_pref("extensions.incredibar_i.ms_url_id", "");
Vymazáno : user_pref("extensions.incredibar_i.newTab", false);
Vymazáno : user_pref("extensions.incredibar_i.ppd", "1");
Vymazáno : user_pref("extensions.incredibar_i.prdct", "incredibar");
Vymazáno : user_pref("extensions.incredibar_i.productid", "26");
Vymazáno : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Vymazáno : user_pref("extensions.incredibar_i.smplGrp", "none");
Vymazáno : user_pref("extensions.incredibar_i.tlbrId", "base");
Vymazáno : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6PQQN1M9Ez&loc=IB[...]
Vymazáno : user_pref("extensions.incredibar_i.upn2", "6PQQN1M9Ez");
Vymazáno : user_pref("extensions.incredibar_i.upn2n", "92543987150946151");
Vymazáno : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Vymazáno : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:47:08");
Vymazáno : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Vymazáno : user_pref("icqtoolbar.showPc", false);
Vymazáno : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2481032&SearchSource=2&CU[...]
Vymazáno : user_pref("smartbar.machineId", "FTDELUOY6KTBS1XBMWMG25PCNSJTWY80VEI3TMR+UKQUHRFDNXAOHPKQ2TZCFCS+L1Y[...]
Vymazáno : user_pref("surfcanyon.fractions", "0.0_0.0\r\n");
Vymazáno : user_pref("surfcanyon.last_checked_ts", "1267039437168");
Soubor : C:\Users\Host\AppData\Roaming\Mozilla\Firefox\Profiles\71cg5xt7.default\prefs.js
[OK] Soubor je eistý.
-\\ Google Chrome v26.0.1410.64
Soubor : C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Preferences
Vymazáno [l.2790] : urls_to_restore_on_startup = [ "hxxp://www.searchnu.com/410", "hxxp://mystart.incredibar.com/[...]
-\\ Opera v [Nemohu získat verzi]
Soubor : C:\Users\Aldair\AppData\Roaming\Opera\Opera\operaprefs.ini
Vymazáno : application/x-winampx-1.0.0.1=6,,C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll,Winamp A[...]
Vymazáno : application/x-winampx-1.0.0.1=,0
*************************
AdwCleaner[R1].txt - [12553 octets] - [04/05/2013 20:12:40]
AdwCleaner[R2].txt - [12614 octets] - [04/05/2013 20:16:35]
AdwCleaner[S1].txt - [12051 octets] - [04/05/2013 20:16:53]
########## EOF - C:\AdwCleaner[S1].txt - [12112 octets] ##########
Re: Blokování policií
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-2903425235-1483294055-1189771601-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Ythyicxip deleted successfully.
C:\Users\Aldair\AppData\Roaming\datacore.exe moved successfully.
C:\ProgramData\8gr4.pad moved successfully.
C:\Users\Aldair\Desktop\1640580_gina_gerson_zorrita_adorable.flv moved successfully.
C:\Users\Aldair\Desktop\240P_365K_4779921.mp4 moved successfully.
C:\Users\Aldair\Desktop\0436213.flv moved successfully.
C:\Users\Aldair\Desktop\0324926.flv moved successfully.
C:\Users\Aldair\Desktop\480P_600K_8717661.mp4 moved successfully.
C:\Users\Aldair\Desktop\1672807.flv moved successfully.
C:\ProgramData\itfo.pad moved successfully.
C:\ProgramData\8gr4.reg moved successfully.
C:\Users\Aldair\Desktop\YouPorn_20-_20Petite_20Gina_20Gerson_20erotic_20fuck.mp4 moved successfully.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Ythyicxip not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\Aldair\AppData\Roaming\datacore.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\Aldair\AppData\Roaming\datacore.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe not found.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner.exe\ not found.
========== FILES ==========
File\Folder C:\Users\Aldair\AppData\Roaming\Obwu\uzepy.exe not found.
File move failed. C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe scheduled to be moved on reboot.
File\Folder C:\Users\Aldair\AppData\Roaming\majHCfhOhnvkQZaYdBHPsG\majHCfhOhnvkQZaYdBHPsG\0.0.0.0\CCleaner.exe not found.
========== COMMANDS ==========
OTL by OldTimer - Version 3.2.69.0 log created on 05042013_204505
Files\Folders moved on Reboot...
File move failed. C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe scheduled to be moved on reboot.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Registry value HKEY_USERS\S-1-5-21-2903425235-1483294055-1189771601-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Ythyicxip deleted successfully.
C:\Users\Aldair\AppData\Roaming\datacore.exe moved successfully.
C:\ProgramData\8gr4.pad moved successfully.
C:\Users\Aldair\Desktop\1640580_gina_gerson_zorrita_adorable.flv moved successfully.
C:\Users\Aldair\Desktop\240P_365K_4779921.mp4 moved successfully.
C:\Users\Aldair\Desktop\0436213.flv moved successfully.
C:\Users\Aldair\Desktop\0324926.flv moved successfully.
C:\Users\Aldair\Desktop\480P_600K_8717661.mp4 moved successfully.
C:\Users\Aldair\Desktop\1672807.flv moved successfully.
C:\ProgramData\itfo.pad moved successfully.
C:\ProgramData\8gr4.reg moved successfully.
C:\Users\Aldair\Desktop\YouPorn_20-_20Petite_20Gina_20Gerson_20erotic_20fuck.mp4 moved successfully.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Ythyicxip not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\Aldair\AppData\Roaming\datacore.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Users\Aldair\AppData\Roaming\datacore.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe not found.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner.exe\ not found.
========== FILES ==========
File\Folder C:\Users\Aldair\AppData\Roaming\Obwu\uzepy.exe not found.
File move failed. C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe scheduled to be moved on reboot.
File\Folder C:\Users\Aldair\AppData\Roaming\majHCfhOhnvkQZaYdBHPsG\majHCfhOhnvkQZaYdBHPsG\0.0.0.0\CCleaner.exe not found.
========== COMMANDS ==========
OTL by OldTimer - Version 3.2.69.0 log created on 05042013_204505
Files\Folders moved on Reboot...
File move failed. C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe scheduled to be moved on reboot.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Re: Blokování policií
Tak ten smajlík asi znamená, že je to v pořádku 
. Děkuji za pomoc, bylo to poučné.
. Děkuji za pomoc, bylo to poučné.Re: Blokování policií
jo aha já zapoměl že jsem to dal kontrolovat
OTL logfile created on: 4.5.2013 20:56:15 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Aldair\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy
2,00 Gb Total Physical Memory | 0,89 Gb Available Physical Memory | 44,58% Memory free
4,00 Gb Paging File | 2,49 Gb Available in Paging File | 62,27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 232,88 Gb Total Space | 95,17 Gb Free Space | 40,87% Space Free | Partition Type: NTFS
Drive D: | 74,56 Gb Total Space | 17,44 Gb Free Space | 23,40% Space Free | Partition Type: NTFS
Drive E: | 372,61 Gb Total Space | 160,09 Gb Free Space | 42,97% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Computer Name: ALDAIR-PC | User Name: Aldair | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days
========== Processes (SafeList) ==========
PRC - [2013.05.04 12:16:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Aldair\Desktop\OTL.exe
PRC - [2013.04.23 14:05:38 | 000,407,384 | ---- | M] (Samsung Electronics) -- C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe
PRC - [2013.04.15 22:14:15 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2013.04.15 20:50:46 | 001,855,880 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
PRC - [2013.02.13 12:38:24 | 000,844,144 | ---- | M] (Samsung) -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2013.02.13 12:38:18 | 000,310,128 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
PRC - [2013.02.13 12:38:14 | 001,509,232 | ---- | M] (Samsung) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe
PRC - [2012.12.08 13:00:54 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2009.11.23 23:13:12 | 000,380,928 | ---- | M] (AMD) -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
========== Modules (No Company Name) ==========
MOD - [2013.04.15 22:14:15 | 003,133,336 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013.04.15 20:50:45 | 016,032,648 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
MOD - [2013.02.13 20:05:07 | 000,221,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7d8f6866864f78cf83d3701641c46178\System.ServiceProcess.ni.dll
MOD - [2013.01.09 20:51:27 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\7a33af3fa6a140afb8ab0d9190ab2c9d\System.Runtime.Remoting.ni.dll
MOD - [2013.01.09 20:45:33 | 001,812,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\40c7a89fe2cbf3c12a2c39e034da54cf\System.Xaml.ni.dll
MOD - [2013.01.09 20:30:25 | 018,022,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\b8e60f81fd56934c9f9da7b15bee3376\PresentationFramework.ni.dll
MOD - [2013.01.09 20:30:09 | 011,522,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\932901ff0ad5e365ffbe705d7459a37e\PresentationCore.ni.dll
MOD - [2013.01.09 20:29:58 | 003,883,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\8abaedf6aecb073b22f8801aa0b8babf\WindowsBase.ni.dll
MOD - [2013.01.09 20:29:54 | 007,070,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\b519f42484e1d488662a9a8a87cb8849\System.Core.ni.dll
MOD - [2013.01.09 20:29:51 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\fc476bbac36944e352c2f547352ffa64\System.Xml.ni.dll
MOD - [2013.01.09 20:29:47 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\7cd4aa51f6e6b9330b8f50bba8bb62c6\System.Configuration.ni.dll
MOD - [2013.01.09 20:29:46 | 009,095,168 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\f93dca0e4baa1dcb37cf75392b7c89da\System.ni.dll
MOD - [2013.01.09 20:29:40 | 014,416,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6a1ccc1e1a79ce267d3d1808af382cd6\mscorlib.ni.dll
MOD - [2009.11.23 23:12:38 | 000,090,112 | ---- | M] () -- C:\Program Files (x86)\ATI Technologies\HydraVision\hydracsy.dll
========== Services (SafeList) ==========
SRV:64bit: - [2013.04.23 14:05:40 | 000,605,768 | ---- | M] (Copyright 2013 SAMSUNG) [Auto | Running] -- C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe -- (Samsung Link Service)
SRV:64bit: - [2012.02.15 05:13:00 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2013.04.15 22:14:15 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.04.15 20:50:46 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.12.08 13:00:54 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012.09.20 06:35:36 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:64bit: - [2012.09.20 06:35:36 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:64bit: - [2012.09.09 19:03:51 | 000,560,184 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2012.08.20 15:45:54 | 000,065,648 | ---- | M] (Fuzhou Rockchip Electronics Co,Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rockusb.sys -- (Rockusb)
DRV:64bit: - [2012.05.14 08:12:30 | 000,096,896 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 05:48:32 | 010,856,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2012.02.15 05:48:32 | 010,856,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.02.15 04:13:12 | 000,327,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.23 16:50:14 | 000,018,232 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SmartDefragDriver.sys -- (SmartDefragDriver)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.11.20 12:43:57 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2010.11.19 11:23:10 | 001,077,840 | ---- | M] (DiBcom SA) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mod7700.sys -- (mod7700)
DRV:64bit: - [2010.11.19 11:23:10 | 000,024,272 | ---- | M] (DiBcom S.A.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\modrc.sys -- (MODRC)
DRV:64bit: - [2010.11.02 21:45:05 | 000,034,032 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\seehcri.sys -- (seehcri)
DRV:64bit: - [2010.11.02 21:44:45 | 000,145,408 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zebrmdm.sys -- (zebrmdm)
DRV:64bit: - [2010.11.02 21:44:45 | 000,108,544 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zebrbus.sys -- (zebrbus)
DRV:64bit: - [2010.05.06 11:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010.01.27 04:09:02 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (npf)
DRV:64bit: - [2009.12.08 21:35:48 | 000,082,816 | ---- | M] (VSO Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pcouffin.sys -- (pcouffin)
DRV:64bit: - [2009.12.04 22:00:41 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2009.12.04 22:00:40 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2009.11.02 19:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys -- (HTCAND64)
DRV:64bit: - [2009.08.24 11:14:30 | 000,054,784 | ---- | M] (AzureWave Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\azvusb.sys -- (azvusb)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc)
DRV:64bit: - [2009.06.20 04:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.06.10 22:35:53 | 000,051,712 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rtnic64.sys -- (RTL8023x64)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.04.29 17:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV:64bit: - [2009.04.08 15:28:46 | 000,068,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2008.08.28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2006.08.29 16:56:20 | 000,032,377 | ---- | M] (B-phreaks) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\prodigy.sys -- (PRODIGY)
DRV - [2013.02.05 10:54:40 | 000,037,344 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2011.02.10 18:25:48 | 000,030,528 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\GVTDrv64.sys -- (GVTDrv64)
DRV - [2011.02.10 18:25:25 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\gdrv.sys -- (gdrv)
DRV - [2011.02.09 08:22:41 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\etdrv.sys -- (etdrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.cz/
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = cs
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D3 B8 6E 61 3E 74 CA 01 [binary data]
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\URLSearchHook: {124d001a-bdcb-472f-aa59-bbe7e4bc3204} - No CLSID value found
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\SearchScopes\{11E80FF3-1353-4369-AAC8-90CBF85DDAE3}: "URL" = http://search.yahoo.com/search?fr=chr-g ... earchTerms}
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\SearchScopes\{8459069C-9260-4453-BE17-324E4C34FAC8}: "URL" = http://search.centrum.cz/index.php?q={s ... trum-1.0.0
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=382950"
FF - prefs.js..browser.search.useDBForOrder: "false"
FF - prefs.js..browser.startup.homepage: "https://www.google.cz/"
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.14
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.74
FF - prefs.js..extensions.enabledItems: wrc@avast.com:20110101
FF - prefs.js..extensions.enabledItems: maps@ovi.com:5.2.7.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.5
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.666: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.666: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.666: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.666: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.666: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Aldair\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Aldair\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Aldair\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\samsung.com/SamsungLinkPCPlugin: C:\Program Files\Samsung\Samsung Link\utils\npSamsungLinkPCPlugin.dll (Samsung)
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\IB UPDATER\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.10.25 20:03:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.04.15 22:14:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.04.15 22:14:10 | 000,000,000 | ---D | M]
[2012.10.23 23:10:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Extensions
[2010.04.22 21:35:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013.05.04 20:20:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions
[2013.02.23 19:03:56 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.04.25 10:04:42 | 000,000,000 | ---D | M] (Ovi Maps 3D browser plugin) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\maps@ovi.com
[2012.01.08 21:35:50 | 000,040,065 | ---- | M] () (No name found) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\rsDownloader@163.com.xpi
[2011.04.14 13:27:52 | 000,000,003 | ---- | M] () (No name found) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\maps@ovi.com\plugins\package.XPI
[2013.05.04 20:20:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013.04.15 22:14:08 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.04.15 22:14:15 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2009.10.21 04:10:38 | 000,001,425 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Cetrumcz_igeared.xml
[2013.02.20 22:05:27 | 000,002,421 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\heureka-cz.xml
[2013.02.20 22:05:27 | 000,000,851 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\jyxo-cz.xml
[2013.02.20 22:05:27 | 000,001,580 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\seznam-cz.xml
[2013.02.20 22:05:27 | 000,000,867 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\slunecnice-cz.xml
[2013.02.20 22:05:27 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-cz.xml
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: file://czfile01/PUB/www/START.htm
CHR - Extension: YouTube = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Ashampoo US = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggagiiobgjmfpdadhecbofeoelcpidec\10.14.40.128_0\
CHR - Extension: Ashampoo US = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggagiiobgjmfpdadhecbofeoelcpidec\10.15.2.523_0\
CHR - Extension: Ultimate Flash Sonic = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmgmfbijldhdncjcipeocgkgbjhaecfp\1.0_0\
CHR - Extension: Grooveshark = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnlkcnlmlenciieopglodnbpedpejeel\1.0_0\
CHR - Extension: Color Piano! = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihmigmmflfcbhdpdgbkkeojchjhhphnh\2.1.1.40_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - No CLSID value found.
O3 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\Toolbar\WebBrowser: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Samsung Link] C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe (Samsung Electronics)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [AdobeBridge] File not found
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [HydraVisionDesktopManager] C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD)
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [ICQ] C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup File not found
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://active.macromedia.com/flash2/cabs/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.4.20 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1F1AD1EF-A3B8-45B4-9E0D-74508E8DC70F}: DhcpNameServer = 192.168.4.20 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2E908E1C-3454-436A-BAAF-D3CD824AC575}: DhcpNameServer = 80.92.240.6 80.92.240.10
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{1171d67f-887f-11e0-a60d-f51f27ace22d}\Shell - "" = AutoRun
O33 - MountPoints2\{1171d67f-887f-11e0-a60d-f51f27ace22d}\Shell\AutoRun\command - "" = F:\autorun.exe
O33 - MountPoints2\{32c7d907-3c23-11df-b23c-000e2e2bf28f}\Shell - "" = AutoRun
O33 - MountPoints2\{32c7d907-3c23-11df-b23c-000e2e2bf28f}\Shell\AutoRun\command - "" = F:\HPLauncher.exe
O33 - MountPoints2\{7a52bc55-08d9-11df-b451-000e2e2bf28f}\Shell - "" = AutoRun
O33 - MountPoints2\{7a52bc55-08d9-11df-b451-000e2e2bf28f}\Shell\AutoRun\command - "" = F:\USBAutoRun.exe
O33 - MountPoints2\{d9cfe36b-040a-11e2-b8de-000e2e2bf28f}\Shell - "" = AutoRun
O33 - MountPoints2\{d9cfe36b-040a-11e2-b8de-000e2e2bf28f}\Shell\AutoRun\command - "" = G:\Startme.exe
O33 - MountPoints2\{eced7785-c5a7-11df-bcdb-000e2e2bf28f}\Shell - "" = AutoRun
O33 - MountPoints2\{eced7785-c5a7-11df-bcdb-000e2e2bf28f}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 7 Days ==========
[2013.05.04 20:45:05 | 000,000,000 | ---D | C] -- C:\_OTL
[2013.05.04 15:12:28 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\Driver
[2013.05.04 14:59:01 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\Rockusb_Drivers
[2013.05.04 14:54:31 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\drivers
[2013.05.04 12:35:05 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Documents\Nová složka
[2013.05.04 12:16:50 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Aldair\Desktop\OTL.exe
[2013.05.04 09:52:17 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\avz4
[2013.05.04 09:23:24 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2013.05.03 23:27:45 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\MBAMPortable
[2013.05.03 23:27:28 | 009,808,829 | ---- | C] (PortableXapps®) -- C:\Users\Aldair\Desktop\MBAMPortable_1.75.paf.exe
[2013.05.02 20:46:28 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\Kroutil zrušení
[2013.05.02 20:02:06 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\doc
[2013.04.30 23:03:29 | 000,000,000 | ---D | C] -- C:\Users\Aldair\BWINCOMPokerDir
[2013.04.27 21:31:23 | 000,000,000 | ---D | C] -- C:\Users\Aldair\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Samsung
[2010.11.01 00:01:52 | 017,899,590 | ---- | C] (Any-DVD-Converter.com ) -- C:\Users\Aldair\AppData\Roaming\any-dvd-converter.exe
[2009.12.08 21:35:48 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\Aldair\AppData\Roaming\pcouffin.sys
[10 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
========== Files - Modified Within 7 Days ==========
[2013.05.04 20:54:14 | 000,019,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.04 20:54:14 | 000,019,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.04 20:53:43 | 001,613,292 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.04 20:53:43 | 000,678,370 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat
[2013.05.04 20:53:43 | 000,663,838 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.04 20:53:43 | 000,146,260 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat
[2013.05.04 20:53:43 | 000,125,968 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.04 20:49:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.04 20:48:59 | 1609,424,896 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.04 20:35:01 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.04 20:27:04 | 000,000,966 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2903425235-1483294055-1189771601-1000UA.job
[2013.05.04 20:11:48 | 000,628,743 | ---- | M] () -- C:\Users\Aldair\Desktop\adwcleaner.exe
[2013.05.04 18:27:01 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2903425235-1483294055-1189771601-1000Core.job
[2013.05.04 17:45:44 | 000,000,500 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Aldair.job
[2013.05.04 17:28:51 | 000,181,479 | ---- | M] () -- C:\Users\Aldair\Desktop\otlextras.zip
[2013.05.04 16:28:19 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2013.05.04 12:16:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Aldair\Desktop\OTL.exe
[2013.05.04 09:21:00 | 000,935,175 | ---- | M] () -- C:\Users\Aldair\Desktop\RSITx64.exe
[2013.05.03 23:22:08 | 009,808,829 | ---- | M] (PortableXapps®) -- C:\Users\Aldair\Desktop\MBAMPortable_1.75.paf.exe
[10 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.05.04 20:12:08 | 000,628,743 | ---- | C] () -- C:\Users\Aldair\Desktop\adwcleaner.exe
[2013.05.04 17:28:51 | 000,181,479 | ---- | C] () -- C:\Users\Aldair\Desktop\otlextras.zip
[2013.05.04 12:43:53 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2013.05.04 09:23:18 | 000,935,175 | ---- | C] () -- C:\Users\Aldair\Desktop\RSITx64.exe
[2013.04.01 19:09:19 | 000,216,064 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe
[2013.04.01 19:09:19 | 000,001,223 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-Saint Paint Studio.dat
[2013.02.17 17:54:26 | 000,110,592 | ---- | C] () -- C:\Windows\SysWow64\FsUsbExDevice.Dll
[2013.02.17 17:54:26 | 000,037,344 | ---- | C] () -- C:\Windows\SysWow64\FsUsbExDisk.Sys
[2013.01.27 21:08:58 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.04.25 22:20:12 | 000,281,688 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.04.25 22:20:06 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2012.04.25 22:20:06 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.01.31 06:00:24 | 000,016,896 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2011.12.20 23:31:50 | 000,001,303 | ---- | C] () -- C:\Users\Aldair\AppData\Local\SRDownloader.err
[2011.12.20 23:27:52 | 000,001,008 | ---- | C] () -- C:\Users\Aldair\AppData\Local\SRDownloader.nast
[2011.12.17 12:30:38 | 000,075,776 | ---- | C] () -- C:\Windows\cadkasdeinst01e.exe
[2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.09.04 11:03:33 | 000,000,604 | ---- | C] () -- C:\Windows\Thps3.INI
[2011.07.06 12:33:23 | 000,000,979 | ---- | C] () -- C:\Windows\eReg.dat
[2011.06.07 11:13:38 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.06.07 11:13:38 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.06.07 11:13:38 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.06.07 11:13:38 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.06.07 11:13:38 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.05.31 20:19:47 | 000,000,011 | ---- | C] () -- C:\ProgramData\.tv6
[2011.02.12 11:04:38 | 000,007,605 | ---- | C] () -- C:\Users\Aldair\AppData\Local\Resmon.ResmonCfg
[2010.10.31 17:59:07 | 000,010,240 | ---- | C] () -- C:\Users\Aldair\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.03.22 21:46:00 | 000,000,094 | ---- | C] () -- C:\Users\Aldair\AppData\Local\fusioncache.dat
[2009.12.11 22:54:14 | 000,001,057 | ---- | C] () -- C:\Users\Aldair\AppData\Roaming\vso_ts_preview.xml
[2009.12.08 21:35:48 | 000,099,384 | ---- | C] () -- C:\Users\Aldair\AppData\Roaming\inst.exe
[2009.12.08 21:35:48 | 000,007,859 | ---- | C] () -- C:\Users\Aldair\AppData\Roaming\pcouffin.cat
[2009.12.08 21:35:48 | 000,001,167 | ---- | C] () -- C:\Users\Aldair\AppData\Roaming\pcouffin.inf
========== ZeroAccess Check ==========
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2012.08.06 23:41:09 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\.mono
[2011.12.22 20:58:15 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\602Installer
[2011.12.30 20:08:25 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\602XML
[2010.11.01 00:02:17 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\AnvSoft
[2009.12.03 20:43:11 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Ashampoo
[2012.11.22 23:45:46 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\avidemux
[2010.03.20 14:35:56 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Bioshock2
[2010.10.06 20:25:47 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\BlackBean
[2010.08.07 15:20:18 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Boilsoft
[2012.10.08 20:43:05 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\BWIN
[2011.12.17 12:30:49 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\CAD-KAS
[2012.12.08 12:52:19 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\DAEMON Tools Lite
[2009.12.03 20:20:44 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\GHISLER
[2013.05.04 20:52:21 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\ICQ
[2011.12.29 21:54:47 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\IObit
[2010.12.08 22:47:12 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\J River
[2012.03.18 00:05:14 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Kainy
[2010.10.03 11:22:57 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Leadertech
[2012.10.27 20:00:50 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\LockHunter
[2012.09.08 09:46:09 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\majHCfhOhnvkQZaYdBHPsG
[2011.07.21 22:36:52 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\mkvtoolnix
[2011.04.30 11:43:32 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\MummyPuzzle
[2011.09.28 11:58:53 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Nokia Ovi Suite
[2010.11.22 21:58:37 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Opera
[2012.02.07 21:04:00 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Outlook
[2010.12.25 16:00:08 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\PC Suite
[2011.01.02 16:22:51 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\ProtectDISC
[2011.03.19 00:19:53 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\PunkBuster
[2011.04.04 21:30:09 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\QIP
[2012.09.19 22:32:24 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Samsung
[2012.09.22 20:17:38 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\TeamViewer
[2012.04.20 20:00:45 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Temp
[2013.03.31 22:04:58 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Theta
[2010.04.22 21:35:35 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Thunderbird
[2012.01.29 14:08:31 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Trine2
[2010.01.14 21:15:17 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Tropico 3
[2010.04.24 20:00:04 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Ubisoft
[2012.08.06 23:41:31 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Unity
[2010.06.30 19:11:46 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\uTorrent
[2012.11.01 23:36:24 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Vso
[2012.12.01 15:53:10 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Zoner
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 160 bytes -> C:\ProgramData\TEMP:FB1B13D8
< End of report >
OTL logfile created on: 4.5.2013 20:56:15 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Aldair\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy
2,00 Gb Total Physical Memory | 0,89 Gb Available Physical Memory | 44,58% Memory free
4,00 Gb Paging File | 2,49 Gb Available in Paging File | 62,27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 232,88 Gb Total Space | 95,17 Gb Free Space | 40,87% Space Free | Partition Type: NTFS
Drive D: | 74,56 Gb Total Space | 17,44 Gb Free Space | 23,40% Space Free | Partition Type: NTFS
Drive E: | 372,61 Gb Total Space | 160,09 Gb Free Space | 42,97% Space Free | Partition Type: NTFS
Unable to calculate disk information.
Computer Name: ALDAIR-PC | User Name: Aldair | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days
========== Processes (SafeList) ==========
PRC - [2013.05.04 12:16:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Aldair\Desktop\OTL.exe
PRC - [2013.04.23 14:05:38 | 000,407,384 | ---- | M] (Samsung Electronics) -- C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe
PRC - [2013.04.15 22:14:15 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2013.04.15 20:50:46 | 001,855,880 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
PRC - [2013.02.13 12:38:24 | 000,844,144 | ---- | M] (Samsung) -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2013.02.13 12:38:18 | 000,310,128 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
PRC - [2013.02.13 12:38:14 | 001,509,232 | ---- | M] (Samsung) -- C:\Program Files (x86)\Samsung\Kies\Kies.exe
PRC - [2012.12.08 13:00:54 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2009.11.23 23:13:12 | 000,380,928 | ---- | M] (AMD) -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
========== Modules (No Company Name) ==========
MOD - [2013.04.15 22:14:15 | 003,133,336 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2013.04.15 20:50:45 | 016,032,648 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
MOD - [2013.02.13 20:05:07 | 000,221,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\7d8f6866864f78cf83d3701641c46178\System.ServiceProcess.ni.dll
MOD - [2013.01.09 20:51:27 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\7a33af3fa6a140afb8ab0d9190ab2c9d\System.Runtime.Remoting.ni.dll
MOD - [2013.01.09 20:45:33 | 001,812,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\40c7a89fe2cbf3c12a2c39e034da54cf\System.Xaml.ni.dll
MOD - [2013.01.09 20:30:25 | 018,022,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\b8e60f81fd56934c9f9da7b15bee3376\PresentationFramework.ni.dll
MOD - [2013.01.09 20:30:09 | 011,522,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\932901ff0ad5e365ffbe705d7459a37e\PresentationCore.ni.dll
MOD - [2013.01.09 20:29:58 | 003,883,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\8abaedf6aecb073b22f8801aa0b8babf\WindowsBase.ni.dll
MOD - [2013.01.09 20:29:54 | 007,070,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\b519f42484e1d488662a9a8a87cb8849\System.Core.ni.dll
MOD - [2013.01.09 20:29:51 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\fc476bbac36944e352c2f547352ffa64\System.Xml.ni.dll
MOD - [2013.01.09 20:29:47 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\7cd4aa51f6e6b9330b8f50bba8bb62c6\System.Configuration.ni.dll
MOD - [2013.01.09 20:29:46 | 009,095,168 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\f93dca0e4baa1dcb37cf75392b7c89da\System.ni.dll
MOD - [2013.01.09 20:29:40 | 014,416,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\6a1ccc1e1a79ce267d3d1808af382cd6\mscorlib.ni.dll
MOD - [2009.11.23 23:12:38 | 000,090,112 | ---- | M] () -- C:\Program Files (x86)\ATI Technologies\HydraVision\hydracsy.dll
========== Services (SafeList) ==========
SRV:64bit: - [2013.04.23 14:05:40 | 000,605,768 | ---- | M] (Copyright 2013 SAMSUNG) [Auto | Running] -- C:\Program Files\Samsung\Samsung Link\Samsung Link Service.exe -- (Samsung Link Service)
SRV:64bit: - [2012.02.15 05:13:00 | 000,235,520 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2013.04.15 22:14:15 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.04.15 20:50:46 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.12.08 13:00:54 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.12.23 23:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012.09.20 06:35:36 | 000,203,104 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)
DRV:64bit: - [2012.09.20 06:35:36 | 000,102,368 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)
DRV:64bit: - [2012.09.09 19:03:51 | 000,560,184 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2012.08.20 15:45:54 | 000,065,648 | ---- | M] (Fuzhou Rockchip Electronics Co,Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rockusb.sys -- (Rockusb)
DRV:64bit: - [2012.05.14 08:12:30 | 000,096,896 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 05:48:32 | 010,856,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2012.02.15 05:48:32 | 010,856,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.02.15 04:13:12 | 000,327,680 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.23 16:50:14 | 000,018,232 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\SmartDefragDriver.sys -- (SmartDefragDriver)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.11.20 12:43:57 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2010.11.19 11:23:10 | 001,077,840 | ---- | M] (DiBcom SA) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mod7700.sys -- (mod7700)
DRV:64bit: - [2010.11.19 11:23:10 | 000,024,272 | ---- | M] (DiBcom S.A.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\modrc.sys -- (MODRC)
DRV:64bit: - [2010.11.02 21:45:05 | 000,034,032 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\seehcri.sys -- (seehcri)
DRV:64bit: - [2010.11.02 21:44:45 | 000,145,408 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zebrmdm.sys -- (zebrmdm)
DRV:64bit: - [2010.11.02 21:44:45 | 000,108,544 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zebrbus.sys -- (zebrbus)
DRV:64bit: - [2010.05.06 11:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010.01.27 04:09:02 | 000,047,632 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (npf)
DRV:64bit: - [2009.12.08 21:35:48 | 000,082,816 | ---- | M] (VSO Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pcouffin.sys -- (pcouffin)
DRV:64bit: - [2009.12.04 22:00:41 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2009.12.04 22:00:40 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2009.11.02 19:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys -- (HTCAND64)
DRV:64bit: - [2009.08.24 11:14:30 | 000,054,784 | ---- | M] (AzureWave Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\azvusb.sys -- (azvusb)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc)
DRV:64bit: - [2009.06.20 04:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.06.10 22:35:53 | 000,051,712 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rtnic64.sys -- (RTL8023x64)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.04.29 17:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV:64bit: - [2009.04.08 15:28:46 | 000,068,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2008.08.28 12:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2006.08.29 16:56:20 | 000,032,377 | ---- | M] (B-phreaks) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\prodigy.sys -- (PRODIGY)
DRV - [2013.02.05 10:54:40 | 000,037,344 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2011.02.10 18:25:48 | 000,030,528 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\GVTDrv64.sys -- (GVTDrv64)
DRV - [2011.02.10 18:25:25 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\gdrv.sys -- (gdrv)
DRV - [2011.02.09 08:22:41 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\etdrv.sys -- (etdrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.cz/
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = cs
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D3 B8 6E 61 3E 74 CA 01 [binary data]
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\URLSearchHook: {124d001a-bdcb-472f-aa59-bbe7e4bc3204} - No CLSID value found
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\SearchScopes\{11E80FF3-1353-4369-AAC8-90CBF85DDAE3}: "URL" = http://search.yahoo.com/search?fr=chr-g ... earchTerms}
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\SearchScopes\{8459069C-9260-4453-BE17-324E4C34FAC8}: "URL" = http://search.centrum.cz/index.php?q={s ... trum-1.0.0
IE - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=382950"
FF - prefs.js..browser.search.useDBForOrder: "false"
FF - prefs.js..browser.startup.homepage: "https://www.google.cz/"
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.14
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.74
FF - prefs.js..extensions.enabledItems: wrc@avast.com:20110101
FF - prefs.js..extensions.enabledItems: maps@ovi.com:5.2.7.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.5
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.666: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.666: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.666: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.666: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.666: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Aldair\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Aldair\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Aldair\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\samsung.com/SamsungLinkPCPlugin: C:\Program Files\Samsung\Samsung Link\utils\npSamsungLinkPCPlugin.dll (Samsung)
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\IB UPDATER\FIREFOX
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.10.25 20:03:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.04.15 22:14:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.04.15 22:14:10 | 000,000,000 | ---D | M]
[2012.10.23 23:10:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Extensions
[2010.04.22 21:35:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013.05.04 20:20:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions
[2013.02.23 19:03:56 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.04.25 10:04:42 | 000,000,000 | ---D | M] (Ovi Maps 3D browser plugin) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\maps@ovi.com
[2012.01.08 21:35:50 | 000,040,065 | ---- | M] () (No name found) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\rsDownloader@163.com.xpi
[2011.04.14 13:27:52 | 000,000,003 | ---- | M] () (No name found) -- C:\Users\Aldair\AppData\Roaming\Mozilla\Firefox\Profiles\by5b9dz4.default\extensions\maps@ovi.com\plugins\package.XPI
[2013.05.04 20:20:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013.04.15 22:14:08 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.04.15 22:14:15 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2009.10.21 04:10:38 | 000,001,425 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Cetrumcz_igeared.xml
[2013.02.20 22:05:27 | 000,002,421 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\heureka-cz.xml
[2013.02.20 22:05:27 | 000,000,851 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\jyxo-cz.xml
[2013.02.20 22:05:27 | 000,001,580 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\seznam-cz.xml
[2013.02.20 22:05:27 | 000,000,867 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\slunecnice-cz.xml
[2013.02.20 22:05:27 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-cz.xml
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: file://czfile01/PUB/www/START.htm
CHR - Extension: YouTube = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Ashampoo US = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggagiiobgjmfpdadhecbofeoelcpidec\10.14.40.128_0\
CHR - Extension: Ashampoo US = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggagiiobgjmfpdadhecbofeoelcpidec\10.15.2.523_0\
CHR - Extension: Ultimate Flash Sonic = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmgmfbijldhdncjcipeocgkgbjhaecfp\1.0_0\
CHR - Extension: Grooveshark = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnlkcnlmlenciieopglodnbpedpejeel\1.0_0\
CHR - Extension: Color Piano! = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihmigmmflfcbhdpdgbkkeojchjhhphnh\2.1.1.40_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\Aldair\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0\
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - No CLSID value found.
O3 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\..\Toolbar\WebBrowser: (no name) - {D5D47440-0750-463D-BAEF-A47D02414806} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Samsung Link] C:\Program Files\Samsung\Samsung Link\utils\Samsung Link Launcher.exe (Samsung Electronics)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung)
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [AdobeBridge] File not found
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [HydraVisionDesktopManager] C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD)
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [ICQ] C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [KiesAirMessage] C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup File not found
O4 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe (Samsung)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2903425235-1483294055-1189771601-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://active.macromedia.com/flash2/cabs/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.4.20 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1F1AD1EF-A3B8-45B4-9E0D-74508E8DC70F}: DhcpNameServer = 192.168.4.20 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2E908E1C-3454-436A-BAAF-D3CD824AC575}: DhcpNameServer = 80.92.240.6 80.92.240.10
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{1171d67f-887f-11e0-a60d-f51f27ace22d}\Shell - "" = AutoRun
O33 - MountPoints2\{1171d67f-887f-11e0-a60d-f51f27ace22d}\Shell\AutoRun\command - "" = F:\autorun.exe
O33 - MountPoints2\{32c7d907-3c23-11df-b23c-000e2e2bf28f}\Shell - "" = AutoRun
O33 - MountPoints2\{32c7d907-3c23-11df-b23c-000e2e2bf28f}\Shell\AutoRun\command - "" = F:\HPLauncher.exe
O33 - MountPoints2\{7a52bc55-08d9-11df-b451-000e2e2bf28f}\Shell - "" = AutoRun
O33 - MountPoints2\{7a52bc55-08d9-11df-b451-000e2e2bf28f}\Shell\AutoRun\command - "" = F:\USBAutoRun.exe
O33 - MountPoints2\{d9cfe36b-040a-11e2-b8de-000e2e2bf28f}\Shell - "" = AutoRun
O33 - MountPoints2\{d9cfe36b-040a-11e2-b8de-000e2e2bf28f}\Shell\AutoRun\command - "" = G:\Startme.exe
O33 - MountPoints2\{eced7785-c5a7-11df-bcdb-000e2e2bf28f}\Shell - "" = AutoRun
O33 - MountPoints2\{eced7785-c5a7-11df-bcdb-000e2e2bf28f}\Shell\AutoRun\command - "" = "F:\WD SmartWare.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 7 Days ==========
[2013.05.04 20:45:05 | 000,000,000 | ---D | C] -- C:\_OTL
[2013.05.04 15:12:28 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\Driver
[2013.05.04 14:59:01 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\Rockusb_Drivers
[2013.05.04 14:54:31 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\drivers
[2013.05.04 12:35:05 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Documents\Nová složka
[2013.05.04 12:16:50 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Aldair\Desktop\OTL.exe
[2013.05.04 09:52:17 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\avz4
[2013.05.04 09:23:24 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2013.05.03 23:27:45 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\MBAMPortable
[2013.05.03 23:27:28 | 009,808,829 | ---- | C] (PortableXapps®) -- C:\Users\Aldair\Desktop\MBAMPortable_1.75.paf.exe
[2013.05.02 20:46:28 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\Kroutil zrušení
[2013.05.02 20:02:06 | 000,000,000 | ---D | C] -- C:\Users\Aldair\Desktop\doc
[2013.04.30 23:03:29 | 000,000,000 | ---D | C] -- C:\Users\Aldair\BWINCOMPokerDir
[2013.04.27 21:31:23 | 000,000,000 | ---D | C] -- C:\Users\Aldair\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Samsung
[2010.11.01 00:01:52 | 017,899,590 | ---- | C] (Any-DVD-Converter.com ) -- C:\Users\Aldair\AppData\Roaming\any-dvd-converter.exe
[2009.12.08 21:35:48 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\Aldair\AppData\Roaming\pcouffin.sys
[10 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
========== Files - Modified Within 7 Days ==========
[2013.05.04 20:54:14 | 000,019,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.04 20:54:14 | 000,019,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.04 20:53:43 | 001,613,292 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.04 20:53:43 | 000,678,370 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat
[2013.05.04 20:53:43 | 000,663,838 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.04 20:53:43 | 000,146,260 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat
[2013.05.04 20:53:43 | 000,125,968 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.04 20:49:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.04 20:48:59 | 1609,424,896 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.04 20:35:01 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.04 20:27:04 | 000,000,966 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2903425235-1483294055-1189771601-1000UA.job
[2013.05.04 20:11:48 | 000,628,743 | ---- | M] () -- C:\Users\Aldair\Desktop\adwcleaner.exe
[2013.05.04 18:27:01 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2903425235-1483294055-1189771601-1000Core.job
[2013.05.04 17:45:44 | 000,000,500 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Aldair.job
[2013.05.04 17:28:51 | 000,181,479 | ---- | M] () -- C:\Users\Aldair\Desktop\otlextras.zip
[2013.05.04 16:28:19 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2013.05.04 12:16:51 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Aldair\Desktop\OTL.exe
[2013.05.04 09:21:00 | 000,935,175 | ---- | M] () -- C:\Users\Aldair\Desktop\RSITx64.exe
[2013.05.03 23:22:08 | 009,808,829 | ---- | M] (PortableXapps®) -- C:\Users\Aldair\Desktop\MBAMPortable_1.75.paf.exe
[10 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.05.04 20:12:08 | 000,628,743 | ---- | C] () -- C:\Users\Aldair\Desktop\adwcleaner.exe
[2013.05.04 17:28:51 | 000,181,479 | ---- | C] () -- C:\Users\Aldair\Desktop\otlextras.zip
[2013.05.04 12:43:53 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2013.05.04 09:23:18 | 000,935,175 | ---- | C] () -- C:\Users\Aldair\Desktop\RSITx64.exe
[2013.04.01 19:09:19 | 000,216,064 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe
[2013.04.01 19:09:19 | 000,001,223 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-Saint Paint Studio.dat
[2013.02.17 17:54:26 | 000,110,592 | ---- | C] () -- C:\Windows\SysWow64\FsUsbExDevice.Dll
[2013.02.17 17:54:26 | 000,037,344 | ---- | C] () -- C:\Windows\SysWow64\FsUsbExDisk.Sys
[2013.01.27 21:08:58 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.04.25 22:20:12 | 000,281,688 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.04.25 22:20:06 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2012.04.25 22:20:06 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.01.31 06:00:24 | 000,016,896 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2011.12.20 23:31:50 | 000,001,303 | ---- | C] () -- C:\Users\Aldair\AppData\Local\SRDownloader.err
[2011.12.20 23:27:52 | 000,001,008 | ---- | C] () -- C:\Users\Aldair\AppData\Local\SRDownloader.nast
[2011.12.17 12:30:38 | 000,075,776 | ---- | C] () -- C:\Windows\cadkasdeinst01e.exe
[2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.09.04 11:03:33 | 000,000,604 | ---- | C] () -- C:\Windows\Thps3.INI
[2011.07.06 12:33:23 | 000,000,979 | ---- | C] () -- C:\Windows\eReg.dat
[2011.06.07 11:13:38 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.06.07 11:13:38 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.06.07 11:13:38 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.06.07 11:13:38 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.06.07 11:13:38 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.05.31 20:19:47 | 000,000,011 | ---- | C] () -- C:\ProgramData\.tv6
[2011.02.12 11:04:38 | 000,007,605 | ---- | C] () -- C:\Users\Aldair\AppData\Local\Resmon.ResmonCfg
[2010.10.31 17:59:07 | 000,010,240 | ---- | C] () -- C:\Users\Aldair\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.03.22 21:46:00 | 000,000,094 | ---- | C] () -- C:\Users\Aldair\AppData\Local\fusioncache.dat
[2009.12.11 22:54:14 | 000,001,057 | ---- | C] () -- C:\Users\Aldair\AppData\Roaming\vso_ts_preview.xml
[2009.12.08 21:35:48 | 000,099,384 | ---- | C] () -- C:\Users\Aldair\AppData\Roaming\inst.exe
[2009.12.08 21:35:48 | 000,007,859 | ---- | C] () -- C:\Users\Aldair\AppData\Roaming\pcouffin.cat
[2009.12.08 21:35:48 | 000,001,167 | ---- | C] () -- C:\Users\Aldair\AppData\Roaming\pcouffin.inf
========== ZeroAccess Check ==========
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2012.08.06 23:41:09 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\.mono
[2011.12.22 20:58:15 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\602Installer
[2011.12.30 20:08:25 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\602XML
[2010.11.01 00:02:17 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\AnvSoft
[2009.12.03 20:43:11 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Ashampoo
[2012.11.22 23:45:46 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\avidemux
[2010.03.20 14:35:56 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Bioshock2
[2010.10.06 20:25:47 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\BlackBean
[2010.08.07 15:20:18 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Boilsoft
[2012.10.08 20:43:05 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\BWIN
[2011.12.17 12:30:49 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\CAD-KAS
[2012.12.08 12:52:19 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\DAEMON Tools Lite
[2009.12.03 20:20:44 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\GHISLER
[2013.05.04 20:52:21 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\ICQ
[2011.12.29 21:54:47 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\IObit
[2010.12.08 22:47:12 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\J River
[2012.03.18 00:05:14 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Kainy
[2010.10.03 11:22:57 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Leadertech
[2012.10.27 20:00:50 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\LockHunter
[2012.09.08 09:46:09 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\majHCfhOhnvkQZaYdBHPsG
[2011.07.21 22:36:52 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\mkvtoolnix
[2011.04.30 11:43:32 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\MummyPuzzle
[2011.09.28 11:58:53 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Nokia Ovi Suite
[2010.11.22 21:58:37 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Opera
[2012.02.07 21:04:00 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Outlook
[2010.12.25 16:00:08 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\PC Suite
[2011.01.02 16:22:51 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\ProtectDISC
[2011.03.19 00:19:53 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\PunkBuster
[2011.04.04 21:30:09 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\QIP
[2012.09.19 22:32:24 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Samsung
[2012.09.22 20:17:38 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\TeamViewer
[2012.04.20 20:00:45 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Temp
[2013.03.31 22:04:58 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Theta
[2010.04.22 21:35:35 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Thunderbird
[2012.01.29 14:08:31 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Trine2
[2010.01.14 21:15:17 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Tropico 3
[2010.04.24 20:00:04 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Ubisoft
[2012.08.06 23:41:31 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Unity
[2010.06.30 19:11:46 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\uTorrent
[2012.11.01 23:36:24 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Vso
[2012.12.01 15:53:10 | 000,000,000 | ---D | M] -- C:\Users\Aldair\AppData\Roaming\Zoner
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 160 bytes -> C:\ProgramData\TEMP:FB1B13D8
< End of report >
Re: Blokování policií
Tady je soubor a já restartuju
http://uloz.to/xZQQ4KKs/desktop-zip
Ještě jednou děkuji moc si mi pomohl.
http://uloz.to/xZQQ4KKs/desktop-zip
Ještě jednou děkuji moc si mi pomohl.
Přispějete na provoz fóra?