Windows Script Host a nefunkcni RSIT

Zpráva

wooz · #1 Příspěvek od **wooz** » 09 črc 2013 12:48

Po spusteni Win7 x64 se mi zacala objevovat hlaska "Windows Script Host" a pod ni adresa meho uzivatelskeho adresare (C:\Users\[username]).

Chtel jsem vlozit log z RSIT, ale obe verze (32bit i 64bit) mi hazou pri spusteni chybu. Stahnout jsem zkousel nekolikrat z ruznych zdroju.

Kód: Vybrat vše

AutoIt Error
Error: Subscript used with non-Array variable.

Comodo hlasi infekci nekde v "C:\Windows\inf", po restartu upresnim.

Tady je aspon HijackThis.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:48:00, on 9.7.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16576)
Boot mode: Normal

Running processes:
C:\Program Files\CleanMem\mini_monitor.exe
C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
C:\Program Files (x86)\StrokeIt\strokeit.exe
C:\Program Files (x86)\ATI Tray Tools\atitray.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\Program Files (x86)\AutoHotkey\AutoHotkey.exe
C:\Program Files (x86)\SpeedFan\speedfan.exe
C:\Program Files (x86)\Who Is On My Wifi\mywifi.exe
C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTSS.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
D:\Downloads\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\YourAdHere\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
O4 - HKLM\..\Run: [NtVdmSrv] C:\Windows\inf\ntvdm.vbe
O4 - HKCU\..\Run: [StrokeIt] C:\Program Files (x86)\StrokeIt\StrokeIt.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files (x86)\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [GizmoDriveDelegate] "C:\Program Files (x86)\Gizmo\gizmo.exe" /RemountStartupImages
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: always_top.ahk
O4 - Global Startup: speedfan.exe – zástupce.lnk = C:\Program Files (x86)\SpeedFan\speedfan.exe
O4 - Global Startup: Who Is On My Wifi.lnk = C:\Program Files (x86)\Who Is On My Wifi\mywifi.exe
O8 - Extra context menu item: Download all links by FlashGet3 - C:\Program Files (x86)\FlashGet 3\BHO\fdgetallurl.htm
O8 - Extra context menu item: Download by FlashGet3 - C:\Program Files (x86)\FlashGet 3\BHO\fdgeturl.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7846055-7F6C-4D73-B859-E431C3353F61}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll
O20 - AppInit_DLLs:
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
O23 - Service: BitComet Disk Boost Service (BITCOMET_HELPER_SERVICE) - www.BitComet.com - C:\Program Files\BitComet\tools\BitCometService.exe
O23 - Service: COMODO LPS Launcher (CLPSLauncher) - Comodo Security Solutions Inc. - C:\Program Files (x86)\Common Files\Comodo\launcher_service.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GeekBuddy Remote Screen Protocol (GeekBuddyRSP) - Comodo Security Solutions, Inc. - C:\Program Files (x86)\Common Files\Comodo\GeekBuddyRSP.exe
O23 - Service: Gizmo Central - Arainia Solutions - C:\Program Files (x86)\Gizmo\gservice.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: O&O Defrag (OODefragAgent) - O&O Software GmbH - C:\Program Files\OO Software\Defrag\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer8\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9086 bytes

Predem diky za navrhy reseni.

#2 Příspěvek od **vyosek** » 09 črc 2013 16:18

Zdravim

Stahnete RogueKiller http://www.sur-la-toile.com/RogueKiller/RogueKiller.exe

Ukoncete vsechny programy
Pokud pouzivate Win Vista ci W7, kliknete na RogueKiller pravym a dejte Run As Administrator ci Spustit jako spravce
Pockejte na dokonceni PreScanu
Zvolte moznost Prohledat (scan)
Po dokonceni skenu kliknete na Zpráva (Report)- otevre se log, ten sem vlozte
Detailni postup vc. obrazku mate zde http://forum.viry.cz/viewtopic.php?f=24&t=120452

wooz · #3 Příspěvek od **wooz** » 09 črc 2013 20:47

Rovnez zdravim a diky za reakci.

Zda se, ze nemuzu vubec nic zkopirovat na plochu - Win nejdriv tvrdi, ze tam stejny oubor o velikosti 0B uz je, kdyz dam prepsat, objevi se "Akci nelze dokoncit, protoze slozka nebo soubor jsou otevrene v jinem programu."
Nicmene, tady je log.

RogueKiller V8.6.2 [Jul 5 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Podpora : http://www.adlice.com/forum/
Webové stránky : http://www.adlice.com/softwares/roguekiller/
: http://tigzyrk.blogspot.com/

Operační systém : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Spuštěno v : Normální režim
Uživatel : YourAdHere [Práva správce]
Mód : Kontrola -- Datum : 07/09/2013 21:33:54
| ARK || FAK || MBR |

¤¤¤ Škodlivé procesy: : 0 ¤¤¤

¤¤¤ ¤¤¤ Záznamy Registrů: : 6 ¤¤¤
[HJ POL] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> NALEZENO
[HJ POL] HKLM\[...]\System : EnableLUA (0) -> NALEZENO
[HJ POL] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> NALEZENO
[HJ POL] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NALEZENO
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NALEZENO

¤¤¤ naplánované úlohy : 0 ¤¤¤

¤¤¤ spuštění položky : 0 ¤¤¤

¤¤¤ Webové prohlížeče : 0 ¤¤¤

¤¤¤ Zvláštní soubory / Složky: ¤¤¤

¤¤¤ Ovladač : [NENAHRÁNO 0x0] ¤¤¤

¤¤¤ Externí včelstvo: ¤¤¤

¤¤¤ Nákaza : ¤¤¤

¤¤¤ Soubor HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ Kontrola MBR: ¤¤¤

+++++ PhysicalDrive0: SAMSUNG HD103UJ ATA Device +++++
--- User ---
[MBR] 5c608d5f3207c925f2ed7819cd270857
[BSP] 99eca944bc6cd9f225ec86f2711be101 : Linux MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 30424 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 62521261 | Size: 923338 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Dokončeno : << RKreport[0]_S_07092013_213354.txt >>

#4 Příspěvek od **vyosek** » 09 črc 2013 21:08

Poprosim o log z DDS http://forum.viry.cz/viewtopic.php?f=13&t=125171

wooz · #5 Příspěvek od **wooz** » 09 črc 2013 22:34

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16576 BrowserJavaVersion: 10.13.2
Run by YourAdHere at 23:32:30 on 2013-07-09
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4087.2944 [GMT 2:00]
.
AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: COMODO Firewall *Disabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
.
============== Running Processes ===============
.
C:\PROGRA~2\AVG\AVG2013\avgrsa.exe
C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
D:\Games\Fallout New Vegas\ENBInjector.exe
C:\Program Files (x86)\Razer Game Booster\gbtray.exe
C:\Program Files (x86)\AutoHotkey\AutoHotkey.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
D:\Games\Fallout New Vegas\FOMM\fomm.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\taskeng.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit = userinit.exe
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: FlashGetBHO: {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\YourAdHere\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
uRun: [StrokeIt] C:\Program Files (x86)\StrokeIt\StrokeIt.exe
uRun: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
uRun: [AtiTrayTools] "C:\Program Files (x86)\ATI Tray Tools\atitray.exe"
uRun: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
uRun: [GizmoDriveDelegate] "C:\Program Files (x86)\Gizmo\gizmo.exe" /RemountStartupImages
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
mRun: [Driver Genius] <no file>
StartupFolder: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\always_top.ahk
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SPEEDF~1.LNK - C:\Program Files (x86)\SpeedFan\speedfan.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\WHOISO~1.LNK - C:\Program Files (x86)\Who Is On My Wifi\mywifi.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: Download all links by FlashGet3 - C:\Program Files (x86)\FlashGet 3\BHO\fdgetallurl.htm
IE: Download by FlashGet3 - C:\Program Files (x86)\FlashGet 3\BHO\fdgeturl.htm
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 213.46.172.36 213.46.172.37
TCP: Interfaces\{B7846055-7F6C-4D73-B859-E431C3353F61} : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{B7846055-7F6C-4D73-B859-E431C3353F61} : DHCPNameServer = 213.46.172.36 213.46.172.37
AppInit_DLLs=
SSODL: WebCheck - <orphaned>
x64-Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe
x64-Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\YourAdHere\AppData\Roaming\Mozilla\Firefox\Profiles\iyl6gyzr.default\
FF - prefs.js: browser.startup.homepage - chrome://fvd.speeddial/content/fvd_about_blank.html
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\VLC\npvlc.dll
FF - plugin: C:\Users\YourAdHere\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2013-2-8 71480]
R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2013-2-8 311096]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2013-2-8 116536]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2013-2-8 45880]
R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2013-3-29 246072]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2013-2-8 206136]
R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2013-3-21 240952]
R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2013-1-23 39768]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;C:\Windows\System32\drivers\cmdGuard.sys [2012-3-11 577824]
R1 cmdHlp;COMODO Internet Security Helper Driver;C:\Windows\System32\drivers\cmdhlp.sys [2012-3-11 43248]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2012-9-26 283200]
R1 GizmoDrv;Gizmo Device Driver;C:\Windows\System32\drivers\gizmodrv.sys [2013-6-18 34704]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2013-5-23 143120]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-12-19 240640]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2013-5-14 4937264]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2013-4-18 283136]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-11-6 96256]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-3-1 187392]
R3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\Razer Game Booster\Driver\WinRing0x64.sys [2013-5-22 14544]
S2 CLPSLauncher;COMODO LPS Launcher;C:\Program Files (x86)\Common Files\Comodo\launcher_service.exe [2012-11-1 70352]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 GeekBuddyRSP;GeekBuddy Remote Screen Protocol;C:\Program Files (x86)\Common Files\Comodo\GeekBuddyRSP.exe [2012-10-31 1467088]
S2 Gizmo Central;Gizmo Central;C:\Program Files (x86)\Gizmo\gservice.exe [2013-6-18 34728]
S2 OODefragAgent;O&O Defrag;C:\Program Files\OO Software\Defrag\oodag.exe [2011-6-6 3246920]
S2 TeamViewer8;TeamViewer 8;C:\Program Files (x86)\TeamViewer8\TeamViewer_Service.exe [2012-12-9 3463080]
S3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;C:\Program Files\BitComet\tools\BitCometService.exe -service --> C:\Program Files\BitComet\tools\BitCometService.exe -service [?]
S3 epmntdrv;epmntdrv;C:\Windows\System32\epmntdrv.sys [2012-9-26 16776]
S3 EuGdiDrv;EuGdiDrv;C:\Windows\System32\EuGdiDrv.sys [2012-9-26 9096]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\System32\drivers\ssadbus.sys [2012-12-1 157672]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\System32\drivers\ssadmdfl.sys [2012-12-1 16872]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\System32\drivers\ssadmdm.sys [2012-12-1 177640]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-9-28 59392]
S3 WatAdminSvc;Služba Technologie aktivace Windows;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-9-29 1255736]
.
=============== File Associations ===============
.
FileExt: .ini: Applications\PSPad.exe="C:\Program Files (x86)\PSPad\PSPad.exe" "%1" [UserChoice]
.
=============== Created Last 30 ================
.
2013-07-09 14:25:00 -------- d-----w- C:\Users\YourAdHere\AppData\Roaming\SUPERAntiSpyware.com
2013-07-09 14:24:42 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2013-07-09 14:24:42 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2013-07-09 14:19:03 -------- d-----w- C:\Users\YourAdHere\AppData\Roaming\Malwarebytes
2013-07-09 14:19:01 -------- d-----w- C:\ProgramData\Malwarebytes
2013-07-09 14:18:59 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2013-07-09 14:18:59 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-09 14:17:16 -------- d-----w- C:\Program Files (x86)\Windows Repair
2013-07-09 11:44:37 -------- d-----w- C:\Program Files (x86)\trend micro
2013-07-09 11:43:26 -------- d-----w- C:\Program Files\trend micro
2013-07-09 11:20:20 789096 ----a-w- C:\Windows\SysWow64\phatk121016Cypressv2w128l4.bin
2013-07-08 16:14:34 -------- d-----w- C:\ProgramData\PopCap Games
2013-06-21 10:11:16 -------- d-----w- C:\ProgramData\Steam
2013-06-21 01:43:39 23 ----a-w- C:\Windows\SysWow64\register.bat
2013-06-21 01:43:39 204800 ----a-w- C:\Windows\SysWow64\MADFilter.ax
2013-06-21 01:42:24 -------- d-----w- C:\Program Files (x86)\Combined Community Codec Pack
2013-06-19 16:12:20 -------- d-----w- C:\Program Files\Realtek
2013-06-19 16:12:19 -------- d-----w- C:\Windows\SysWow64\RTCOM
2013-06-19 16:03:51 -------- d-----w- C:\ProgramData\DriverGenius
2013-06-19 16:02:33 -------- d-----w- C:\Program Files (x86)\DriverGenius
2013-06-19 15:55:20 -------- d-----w- C:\Users\YourAdHere\AppData\Roaming\Realtek Driver Updates Scanner
2013-06-19 14:33:36 -------- d-----w- C:\Users\YourAdHere\AppData\Roaming\Mp3CompressorFreeEdition
2013-06-19 14:30:52 -------- d-----w- C:\Program Files (x86)\Mp3 Compressor
2013-06-19 14:09:56 -------- d-----w- C:\Users\YourAdHere\AppData\Roaming\MP3 Quality Modifier
2013-06-19 13:26:35 178688 ----a-w- C:\Windows\SysWow64\unrar.dll
2013-06-19 13:26:33 -------- d-----w- C:\Program Files (x86)\K-Lite Codec Pack
2013-06-18 10:14:53 -------- d-----w- C:\Users\YourAdHere\AppData\Local\Dataram_Corporation
2013-06-18 10:14:40 -------- d-----w- C:\Program Files (x86)\Radeon RAMDisk
2013-06-18 10:11:32 -------- d-----w- C:\Users\YourAdHere\AppData\Roaming\Gizmo
2013-06-18 10:11:29 34704 ----a-w- C:\Windows\System32\drivers\gizmodrv.sys
2013-06-18 10:11:22 -------- d-----w- C:\Program Files (x86)\Gizmo
2013-06-14 20:55:49 98304 ----a-w- C:\Windows\SysWow64\CmdLineExt.dll
2013-06-14 20:43:16 65024 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe
2013-06-14 20:43:15 204800 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll
2013-06-14 20:43:14 69715 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll
2013-06-14 20:43:14 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
2013-06-14 20:43:14 274432 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll
2013-06-14 20:43:13 757760 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll
2013-06-14 20:43:12 200836 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll
2013-06-14 20:26:47 331908 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
2013-06-13 22:39:12 -------- d-----w- C:\Program Files (x86)\Who Is On My Wifi
2013-06-11 18:06:35 -------- d-----we C:\Users\YourAdHere\AppData\Local\Temp
2013-06-11 15:30:46 -------- d-----w- C:\Windows\pss
2013-06-10 23:57:40 -------- d-----w- C:\Program Files\CCleaner
2013-06-10 23:35:20 -------- d-----w- C:\Textures Backup
.
==================== Find3M ====================
.
2013-06-12 16:25:00 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 16:25:00 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-07 11:45:00 84992 --s-a-w- C:\Windows\inf\msrfepfw\zlib1.dll
2013-06-07 11:45:00 612352 --s-a-w- C:\Windows\inf\msrfepfw\libcurl.dll
2013-06-07 11:45:00 568334 --s-a-w- C:\Windows\inf\msrfepfw\msrfepfw.exe
2013-06-07 11:45:00 364544 --s-a-w- C:\Windows\inf\msrfepfw\ssleay32.dll
2013-06-07 11:45:00 279955 --s-a-w- C:\Windows\inf\msrfepfw\libidn-11.dll
2013-06-07 11:45:00 183382 --s-a-w- C:\Windows\inf\msrfepfw\librtmp.dll
2013-06-07 11:45:00 171008 --s-a-w- C:\Windows\inf\msrfepfw\libssh2.dll
2013-06-07 11:45:00 1704448 --s-a-w- C:\Windows\inf\msrfepfw\libeay32.dll
2013-06-07 11:45:00 110094 --s-a-w- C:\Windows\inf\msrfepfw\libusb-1.0.dll
2013-06-04 16:43:52 14387 ----a-w- C:\Users\YourAdHere\AppData\Roaming\TheHunterSettings_live.bin
2013-05-31 10:56:58 2079816 ----a-w- C:\Windows\RtlExUpd.dll
2013-05-15 07:56:51 314016 ----a-w- C:\Windows\System32\drivers\atksgt.sys
2013-05-15 07:56:50 43680 ----a-w- C:\Windows\System32\drivers\lirsgt.sys
2013-04-13 05:49:23 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49:19 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49:19 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49:19 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45:16 474624 ----a-w- C:\Windows\apppatch\AcSpecfc.dll
2013-04-13 04:45:15 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll
2013-04-12 14:45:08 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys
.
============= FINISH: 23:32:40,72 ===============

#6 Příspěvek od **vyosek** » 10 črc 2013 10:15

Trvate na antiviru AVG - u nas neni moc obliben - vysoka zatez systemu, slabsi detekce

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

Ulozte nejlepe na plochu
Ukoncete vsechny programy
Kliknete na Prohledat
Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte

wooz · #7 Příspěvek od **wooz** » 10 črc 2013 15:22

Na AVG netrvam, proste ho jen mam. Klidne dam na doporuceni.
Dalsi log? To nikde nic neni videt? Nemam proste preinstalovat Win? Mam je na samostatnem oddile, nebude to az takovy problem.

# AdwCleaner v2.304 - Log vytvooen 10/07/2013 v 16:19:45
# Aktualizováno 03/07/2013 Xplode
# Operaení systém : Windows 7 Home Premium Service Pack 1 (64 bits)
# Uživatel : YourAdHere - YOURADHERE-PC
# Spuštin systém : Normální
# Spuštino z : D:\Downloads\adwcleaner.exe
# Volba [Prohledat]

***** [Služby] *****

***** [Soubory / Složky] *****

***** [Registry] *****

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry jsou eisté.

-\\ Mozilla Firefox v22.0 (cs)

Soubor : C:\Users\YourAdHere\AppData\Roaming\Mozilla\Firefox\Profiles\iyl6gyzr.default\prefs.js

[OK] Soubor je eistý.

-\\ Opera v12.14.1738.0

Soubor : C:\Users\YourAdHere\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Soubor je eistý.

*************************

AdwCleaner[R1].txt - [6812 octets] - [09/07/2013 14:31:59]
AdwCleaner[R2].txt - [6872 octets] - [09/07/2013 14:35:15]
AdwCleaner[R3].txt - [936 octets] - [10/07/2013 16:19:45]
AdwCleaner[S1].txt - [6786 octets] - [09/07/2013 14:35:27]

########## EOF - C:\AdwCleaner[R3].txt - [1055 octets] ##########

#8 Příspěvek od **vyosek** » 10 črc 2013 15:27

reinstal je krajni reseni, myslim ze to bez nej zvladnem

Avg je spise parodie na antivir

Odinstalujte Avg

Nainstalujte Avast Free http://www.avast.com/get/gWR5mo92

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

wooz · #9 Příspěvek od **wooz** » 10 črc 2013 16:54

Stala se takova nahoda - pred chvili nam vypadly pojistky, zrovna jsem bootoval. Pri dalsim bootovani se spustila obnova systemu a po ni problemu vyrazne ubylo (vlastne si ted ani nejsem jisty, jestli je porad neco v neporadku) - lze kopirovat na plochu, "Windows script host" hlaska je pryc, lze spustit RSIT. Tady je log:

Logfile of random's system information tool 1.09 (written by random/random)
Run by YourAdHere at 2013-07-10 17:52:30
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 1 GB (4%) free of 30 GB
Total RAM: 4087 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:52:33, on 10.7.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16576)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
C:\Program Files\CleanMem\mini_monitor.exe
C:\Program Files (x86)\StrokeIt\strokeit.exe
C:\Program Files (x86)\AutoHotkey\AutoHotkey.exe
C:\Program Files (x86)\Who Is On My Wifi\mywifi.exe
C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTSS.exe
C:\Program Files\Avast\AvastUI.exe
C:\Program Files\trend micro\YourAdHere.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast\aswWebRepIE.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\YourAdHere\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avast] "C:\Program Files\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [StrokeIt] C:\Program Files (x86)\StrokeIt\StrokeIt.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files (x86)\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [GizmoDriveDelegate] "C:\Program Files (x86)\Gizmo\gizmo.exe" /RemountStartupImages
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: always_top.ahk
O4 - Global Startup: speedfan.exe – zástupce.lnk = C:\Program Files (x86)\SpeedFan\speedfan.exe
O4 - Global Startup: Who Is On My Wifi.lnk = C:\Program Files (x86)\Who Is On My Wifi\mywifi.exe
O8 - Extra context menu item: Download all links by FlashGet3 - C:\Program Files (x86)\FlashGet 3\BHO\fdgetallurl.htm
O8 - Extra context menu item: Download by FlashGet3 - C:\Program Files (x86)\FlashGet 3\BHO\fdgeturl.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B7846055-7F6C-4D73-B859-E431C3353F61}: NameServer = 208.67.222.222,208.67.220.220
O20 - AppInit_DLLs:
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: BitComet Disk Boost Service (BITCOMET_HELPER_SERVICE) - http://www.BitComet.com - C:\Program Files\BitComet\tools\BitCometService.exe
O23 - Service: COMODO LPS Launcher (CLPSLauncher) - Comodo Security Solutions Inc. - C:\Program Files (x86)\Common Files\Comodo\launcher_service.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GeekBuddy Remote Screen Protocol (GeekBuddyRSP) - Comodo Security Solutions, Inc. - C:\Program Files (x86)\Common Files\Comodo\GeekBuddyRSP.exe
O23 - Service: Gizmo Central - Arainia Solutions - C:\Program Files (x86)\Gizmo\gservice.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: O&O Defrag (OODefragAgent) - O&O Software GmbH - C:\Program Files\OO Software\Defrag\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer8\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8448 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Program Files (x86)\Common Files\Comodo\launcher_service.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe"
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Common Files\Comodo\GeekBuddyRSP.exe" -service
"C:\Program Files (x86)\Gizmo\gservice.exe"
"C:\Program Files\OO Software\Defrag\oodag.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer8\TeamViewer_Service.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-8c05b4d2-9cc4-47a7-9d77-99e4a5a54c4d -SystemEventPortName:HostProcess-58c20ae9-41e8-409b-a989-cf106b5c7b25 -IoCancelEventPortName:HostProcess-51e1402d-0bc7-460d-b2bb-784baa563f17 -NonStateChangingEventPortName:HostProcess-6ffaca8d-1371-4a2e-9edc-5b834063e6f3 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:324142b2-f465-4ed4-b208-9a971fc346df -DeviceGroupId:WpdFsGroup
"taskhost.exe"
taskeng.exe {2D0C8514-E5C9-4D40-AA13-46ECF4FAA9AF}
"C:\Windows\system32\Dwm.exe"
"C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe" /s
C:\Windows\Explorer.EXE
"C:\Program Files\CleanMem\mini_monitor.exe" /startup
"C:\Program Files\OO Software\Defrag\oodtray.exe"
"C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\StrokeIt\strokeit.exe"
"C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
"C:\Program Files (x86)\AutoHotkey\AutoHotkey.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\always_top.ahk"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\Who Is On My Wifi\mywifi.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTSS.exe" /h
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files\Avast\AvastSvc.exe"
"C:\Program Files\Avast\AvastUI.exe" /nogui
"c:\program files\windows defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey D718D4F3-8AB9-5552-24D5-63CB60F9A798 -Reinvoke
"D:\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\YourAdHere\AppData\Roaming\Mozilla\Firefox\Profiles\iyl6gyzr.default

prefs.js - "browser.startup.homepage" - "chrome://fvd.speeddial/content/fvd_about_blank.html"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.224 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.13.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\SysWOW64\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.224 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Program Files (x86)\Mozilla Firefox\components\
nsIBitCometAgent.xpt

C:\Program Files (x86)\Mozilla Firefox\plugins\
npBitCometAgent.dll

C:\Users\YourAdHere\AppData\Roaming\Mozilla\Firefox\Profiles\iyl6gyzr.default\extensions\
pavel.sherbakov@gmail.com
{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}]
avast! Online Security - C:\Program Files\Avast\aswWebRepIE64.dll [2013-05-09 242496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-02-11 461216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\Avast\aswWebRepIE.dll [2013-05-09 198688]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0}]
FlashGetBHO - C:\Users\YourAdHere\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll [2012-01-06 149128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-02-11 170912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - avast! Online Security - C:\Program Files\Avast\aswWebRepIE64.dll [2013-05-09 242496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! Online Security - C:\Program Files\Avast\aswWebRepIE.dll [2013-05-09 198688]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"OODefragTray"=C:\Program Files\OO Software\Defrag\oodtray.exe [2011-06-06 3992904]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [2012-03-11 9569096]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-05-31 13545032]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"StrokeIt"=C:\Program Files (x86)\StrokeIt\StrokeIt.exe [2010-01-03 26248]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-08-28 3671904]
"AtiTrayTools"=C:\Program Files (x86)\ATI Tray Tools\atitray.exe [2011-10-29 929792]
"BitComet"=C:\Program Files\BitComet\BitComet.exe [2013-02-19 20529920]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2013-05-15 5622512]
"GizmoDriveDelegate"=C:\Program Files (x86)\Gizmo\gizmo.exe [2013-06-18 223640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tvncontrol]
C:\Program Files (x86)\Common Files\Comodo\tvnserver.exe -controlservice -slave []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-12-19 642808]
"Driver Genius"= []
"avast"=C:\Program Files\Avast\avastUI.exe [2013-05-09 4858968]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
always_top.ahk
speedfan.exe – zástupce.lnk - C:\Program Files (x86)\SpeedFan\speedfan.exe
Who Is On My Wifi.lnk - C:\Program Files (x86)\Who Is On My Wifi\mywifi.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\FlashGet 3\FlashGet3.exe"="C:\Program Files (x86)\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"VIDC.RTV1"=rtvcvfw64.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"vidc.iv50"=ir50_32.dll
"vidc.iv41"=ir41_32.ax
"vidc.iv32"=ir32_32.dll
"vidc.iv31"=ir32_32.dll
"msacm.iac2"=C:\Windows\system32\iac25_32.ax

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-07-10 17:52:01 ----A---- C:\AdwCleaner[R5].txt
2013-07-10 17:39:38 ----A---- C:\Windows\system32\drivers\aswFsBlk.sys
2013-07-10 17:39:37 ----A---- C:\Windows\system32\drivers\aswSP.sys
2013-07-10 17:39:36 ----A---- C:\Windows\system32\drivers\aswRdr2.sys
2013-07-10 17:39:35 ----A---- C:\Windows\system32\drivers\aswTdi.sys
2013-07-10 17:39:35 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2013-07-10 17:39:33 ----A---- C:\Windows\system32\drivers\aswVmm.sys
2013-07-10 17:39:33 ----A---- C:\Windows\system32\drivers\aswRvrt.sys
2013-07-10 17:39:29 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2013-07-10 17:39:29 ----A---- C:\Windows\system32\aswBoot.exe
2013-07-10 17:38:58 ----A---- C:\Windows\avastSS.scr
2013-07-10 17:38:44 ----D---- C:\Program Files\Avast
2013-07-10 17:37:47 ----D---- C:\ProgramData\AVAST Software
2013-07-10 16:23:30 ----A---- C:\AdwCleaner[R4].txt
2013-07-10 16:19:45 ----A---- C:\AdwCleaner[R3].txt
2013-07-09 16:25:00 ----D---- C:\Users\YourAdHere\AppData\Roaming\SUPERAntiSpyware.com
2013-07-09 16:24:42 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2013-07-09 16:24:42 ----D---- C:\Program Files\SUPERAntiSpyware
2013-07-09 16:19:03 ----D---- C:\Users\YourAdHere\AppData\Roaming\Malwarebytes
2013-07-09 16:19:01 ----D---- C:\ProgramData\Malwarebytes
2013-07-09 16:18:59 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-09 16:18:59 ----A---- C:\Windows\system32\drivers\mbam.sys
2013-07-09 16:17:16 ----D---- C:\Program Files (x86)\Windows Repair
2013-07-09 14:35:27 ----A---- C:\AdwCleaner[S1].txt
2013-07-09 14:35:15 ----A---- C:\AdwCleaner[R2].txt
2013-07-09 14:31:59 ----A---- C:\AdwCleaner[R1].txt
2013-07-09 13:44:37 ----D---- C:\Program Files (x86)\trend micro
2013-07-09 13:43:26 ----D---- C:\Program Files\trend micro
2013-07-09 13:43:25 ----D---- C:\rsit
2013-07-08 18:14:34 ----D---- C:\ProgramData\PopCap Games
2013-07-07 18:51:12 ----D---- C:\Windows\Sun
2013-06-26 00:15:14 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-06-21 12:11:16 ----D---- C:\ProgramData\Steam
2013-06-21 03:43:39 ----A---- C:\Windows\SYSWOW64\register.bat
2013-06-21 03:42:24 ----D---- C:\Program Files (x86)\Combined Community Codec Pack
2013-06-19 18:12:20 ----D---- C:\Program Files\Realtek
2013-06-19 18:12:19 ----D---- C:\Windows\SYSWOW64\RTCOM
2013-06-19 18:11:48 ----A---- C:\Windows\system32\drivers\DTSU2PParamEQ.DAT
2013-06-19 18:11:48 ----A---- C:\Windows\system32\drivers\DTSU2PClearAudio.DAT
2013-06-19 18:11:48 ----A---- C:\Windows\system32\drivers\DTSU2P.DAT
2013-06-19 18:11:45 ----A---- C:\Windows\system32\WavesGUILib64.dll
2013-06-19 18:11:45 ----A---- C:\Windows\system32\SRSWOW64.dll
2013-06-19 18:11:45 ----A---- C:\Windows\system32\SRSTSX64.dll
2013-06-19 18:11:45 ----A---- C:\Windows\system32\SRSTSH64.dll
2013-06-19 18:11:45 ----A---- C:\Windows\system32\SRSHP64.dll
2013-06-19 18:11:44 ----A---- C:\Windows\system32\RtPgEx64.dll
2013-06-19 18:11:44 ----A---- C:\Windows\system32\RtlCPAPI64.dll
2013-06-19 18:11:44 ----A---- C:\Windows\system32\RtkCoLDR64.dll
2013-06-19 18:11:44 ----A---- C:\Windows\system32\RtkCfg64.dll
2013-06-19 18:11:44 ----A---- C:\Windows\system32\drivers\RTKVHD64.sys
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RtkAPO64.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RtkApi64.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RTEEP64A.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RTEEL64A.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RTEEG64A.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RTEED64A.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RtDataProc64.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RTCOM64.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RP3DHT64.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RP3DAA64.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\RCoInstII64.dll
2013-06-19 18:11:43 ----A---- C:\Windows\system32\drivers\RTAIODAT.DAT
2013-06-19 18:11:42 ----A---- C:\Windows\SYSWOW64\MBAPO32.dll
2013-06-19 18:11:42 ----A---- C:\Windows\system32\MBWrp64.dll
2013-06-19 18:11:42 ----A---- C:\Windows\system32\MBppld64.dll
2013-06-19 18:11:42 ----A---- C:\Windows\system32\MBPPCn64.dll
2013-06-19 18:11:42 ----A---- C:\Windows\system32\MBAPO64.dll
2013-06-19 18:11:42 ----A---- C:\Windows\system32\MaxxAudioEQ64.dll
2013-06-19 18:11:42 ----A---- C:\Windows\system32\MaxxAudioAPOShell64.dll
2013-06-19 18:11:42 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2013-06-19 18:11:40 ----A---- C:\Windows\system32\FMAPO64.dll
2013-06-19 18:11:39 ----D---- C:\Program Files (x86)\Realtek
2013-06-19 18:11:39 ----A---- C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2013-06-19 18:11:39 ----A---- C:\Windows\system32\AERTAR64.dll
2013-06-19 18:11:39 ----A---- C:\Windows\system32\AERTAC64.dll
2013-06-19 18:11:36 ----HD---- C:\Program Files (x86)\Temp
2013-06-19 18:11:36 ----A---- C:\Windows\RtlExUpd.dll
2013-06-19 18:03:51 ----D---- C:\ProgramData\DriverGenius
2013-06-19 18:02:33 ----D---- C:\Program Files (x86)\DriverGenius
2013-06-19 17:55:20 ----D---- C:\Users\YourAdHere\AppData\Roaming\Realtek Driver Updates Scanner
2013-06-19 17:02:35 ----A---- C:\RAMDisk.img.bak
2013-06-19 16:33:36 ----D---- C:\Users\YourAdHere\AppData\Roaming\Mp3CompressorFreeEdition
2013-06-19 16:30:52 ----D---- C:\Program Files (x86)\Mp3 Compressor
2013-06-19 16:09:56 ----D---- C:\Users\YourAdHere\AppData\Roaming\MP3 Quality Modifier
2013-06-19 15:26:35 ----A---- C:\Windows\SYSWOW64\unrar.dll
2013-06-19 15:26:33 ----D---- C:\Program Files (x86)\K-Lite Codec Pack
2013-06-18 12:14:40 ----D---- C:\Program Files (x86)\Radeon RAMDisk
2013-06-18 12:11:32 ----D---- C:\Users\YourAdHere\AppData\Roaming\Gizmo
2013-06-18 12:11:29 ----A---- C:\Windows\system32\drivers\gizmodrv.sys
2013-06-18 12:11:22 ----D---- C:\Program Files (x86)\Gizmo
2013-06-14 22:55:49 ----A---- C:\Windows\SYSWOW64\CmdLineExt.dll
2013-06-14 00:39:12 ----D---- C:\Program Files (x86)\Who Is On My Wifi
2013-06-11 17:30:46 ----D---- C:\Windows\pss
2013-06-11 01:57:40 ----D---- C:\Program Files\CCleaner
2013-06-11 01:35:20 ----D---- C:\Textures Backup

======List of files/folders modified in the last 1 month======

2013-07-10 18:31:45 ----D---- C:\Windows\system32\config
2013-07-10 18:31:42 ----RD---- C:\Program Files (x86)
2013-07-10 18:31:42 ----D---- C:\Windows\system32\wfp
2013-07-10 18:31:42 ----D---- C:\Windows\system32\catroot2
2013-07-10 18:31:42 ----D---- C:\ProgramData\MFAData
2013-07-10 18:31:42 ----D---- C:\Program Files (x86)\SpeedFan
2013-07-10 18:31:42 ----D---- C:\Program Files (x86)\AVG
2013-07-10 18:31:41 ----D---- C:\Windows\system32\wbem
2013-07-10 18:31:41 ----D---- C:\Windows\registration
2013-07-10 17:52:34 ----D---- C:\Windows\Temp
2013-07-10 17:52:09 ----D---- C:\Windows\Prefetch
2013-07-10 17:44:04 ----D---- C:\Users\YourAdHere\AppData\Roaming\BitComet
2013-07-10 17:39:41 ----D---- C:\Windows\system32\drivers
2013-07-10 17:39:29 ----D---- C:\Windows\SysWOW64
2013-07-10 17:39:29 ----D---- C:\Windows\system32\Tasks
2013-07-10 17:39:29 ----D---- C:\Windows\System32
2013-07-10 17:39:26 ----SHD---- C:\Windows\Installer
2013-07-10 17:39:26 ----SHD---- C:\Config.Msi
2013-07-10 17:38:58 ----D---- C:\Windows
2013-07-10 17:38:44 ----SHD---- C:\System Volume Information
2013-07-10 17:38:44 ----RD---- C:\Program Files
2013-07-10 17:37:47 ----HD---- C:\ProgramData
2013-07-10 17:15:56 ----D---- C:\ProgramData\AVG2013
2013-07-10 17:15:24 ----D---- C:\Windows\inf
2013-07-10 06:10:53 ----D---- C:\Program Files (x86)\MSI Afterburner
2013-07-09 22:02:41 ----D---- C:\Program Files (x86)\Razer Game Booster
2013-07-09 22:00:39 ----D---- C:\Users\YourAdHere\AppData\Roaming\DAEMON Tools Lite
2013-07-09 22:00:35 ----D---- C:\Windows\debug
2013-07-09 17:45:52 ----D---- C:\Windows\system32\LogFiles
2013-07-09 16:37:33 ----D---- C:\Windows\system32\NDF
2013-07-09 14:50:49 ----D---- C:\Windows\SYSWOW64\drivers
2013-07-09 14:35:44 ----D---- C:\Program Files (x86)\Common Files
2013-07-09 14:08:37 ----D---- C:\Users\YourAdHere\AppData\Roaming\vlc
2013-07-09 13:24:12 ----SD---- C:\ProgramData\Microsoft
2013-06-27 23:58:44 ----D---- C:\Program Files (x86)\Paint Shop Pro 7
2013-06-26 19:01:05 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-19 18:12:11 ----D---- C:\Windows\system32\catroot
2013-06-19 18:12:09 ----D---- C:\Windows\system32\DriverStore
2013-06-19 18:11:39 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2013-06-19 17:59:06 ----D---- C:\Users\YourAdHere\AppData\Roaming\Ubisoft
2013-06-14 22:38:29 ----RSD---- C:\Windows\assembly
2013-06-12 18:25:00 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-06-11 02:18:09 ----D---- C:\Windows\Panther
2013-06-11 02:18:09 ----D---- C:\Windows\Logs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amdxata;amdxata; C:\Windows\system32\drivers\amdxata.sys [2011-03-11 27008]
R0 aswVmm;aswVmm; C:\Windows\system32\drivers\aswVmm.sys [2013-07-10 189936]
R0 CNG;CNG; C:\Windows\System32\Drivers\cng.sys [2012-06-02 458704]
R0 fvevol;@%SystemRoot%\system32\drivers\fvevol.sys,-100; C:\Windows\System32\DRIVERS\fvevol.sys [2013-01-24 223752]
R0 hwpolicy;@%systemroot%\system32\drivers\hwpolicy.sys,-101; C:\Windows\System32\drivers\hwpolicy.sys [2010-11-20 14720]
R0 KSecPkg;KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [2012-06-02 151920]
R0 pcw;Performance Counters for Windows Driver; C:\Windows\System32\drivers\pcw.sys [2009-07-14 50768]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2012-12-29 28664]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2013-03-17 560184]
R0 vdrvroot;Ovladač rozpoznávacího modulu virtuální jednotky společnosti Microsoft; C:\Windows\system32\drivers\vdrvroot.sys [2009-07-14 36432]
R1 aswRdr;aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [2013-05-09 72016]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2013-07-10 378944]
R1 aswTdi;avast! Network Shield Support; C:\Windows\system32\drivers\aswTdi.sys [2013-05-09 64288]
R1 avgtp;avgtp; \??\C:\Windows\system32\drivers\avgtpx64.sys [2013-02-19 39768]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\System32\DRIVERS\cmdguard.sys [2012-03-11 577824]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2012-03-11 43248]
R1 discache;@%systemroot%\system32\drivers\discache.sys,-102; C:\Windows\System32\drivers\discache.sys [2009-07-14 40448]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-09-26 283200]
R1 GizmoDrv;Gizmo Device Driver; C:\Windows\system32\drivers\GizmoDrv.sys [2013-06-18 34704]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2012-02-03 93200]
R1 RDPREFMP;@%systemroot%\system32\drivers\RdpRefMp.sys,-101; C:\Windows\system32\drivers\rdprefmp.sys [2009-07-14 8192]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
R1 VBoxDrv;VirtualBox Service; C:\Windows\system32\DRIVERS\VBoxDrv.sys [2012-12-19 237992]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\Windows\system32\DRIVERS\VBoxUSBMon.sys [2012-12-19 120232]
R1 WfpLwf;WFP Lightweight Filter; C:\Windows\system32\DRIVERS\wfplwf.sys [2009-07-14 12800]
R2 aswFsBlk;aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [2013-05-09 33400]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2013-05-09 80816]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2013-05-15 314016]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2013-05-15 43680]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2012-12-19 11278336]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2012-12-19 552960]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2012-11-06 96256]
R3 CompositeBus;Ovladač rozpoznávacího modulu složené sběrnice; C:\Windows\system32\drivers\CompositeBus.sys [2010-11-20 38912]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2013-05-31 3432776]
R3 RasAgileVpn;WAN Miniport (IKEv2); C:\Windows\system32\DRIVERS\AgileVpn.sys [2009-07-14 60416]
R3 RTCore64;RTCore64; \??\C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [2013-01-23 13368]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter; C:\Windows\system32\DRIVERS\VBoxNetAdp.sys [2012-12-19 132008]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service; C:\Windows\system32\DRIVERS\VBoxNetFlt.sys [2012-12-19 146856]
R3 WudfPf;@%SystemRoot%\system32\drivers\Wudfpf.sys,-1000; C:\Windows\system32\drivers\WudfPf.sys [2012-07-26 87040]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2012-07-26 198656]
S0 aswRvrt;aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [2013-05-09 65336]
S1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2013-07-10 1030952]
S1 CFRMD;CFRMD; C:\Windows\system32\DRIVERS\CFRMD.sys []
S3 1394ohci;Hostitelský řadič pro rozhraní OHCI standardu 1394; C:\Windows\system32\drivers\1394ohci.sys [2010-11-20 229888]
S3 a9wv8z98;a9wv8z98; C:\Windows\system32\drivers\a9wv8z98.sys []
S3 AcpiPmi;Ovladač měřiče napájení standardu ACPI; C:\Windows\system32\drivers\acpipmi.sys [2010-11-20 12800]
S3 AmdPPM;AMD Processor Driver; C:\Windows\system32\DRIVERS\amdppm.sys [2009-07-14 60928]
S3 amdsata;amdsata; C:\Windows\system32\drivers\amdsata.sys [2011-03-11 107904]
S3 amdsbs;amdsbs; C:\Windows\system32\DRIVERS\amdsbs.sys [2009-07-14 194128]
S3 AppID;@%systemroot%\system32\appidsvc.dll,-102; C:\Windows\system32\drivers\appid.sys [2010-11-20 61440]
S3 b06bdrv;Broadcom NetXtreme II VBD; C:\Windows\system32\DRIVERS\bxvbda.sys [2009-06-10 468480]
S3 b57nd60a;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60a.sys [2009-06-10 270848]
S3 drmkaud;Ovladače zvuku považované společností Microsoft za důvěryhodné; C:\Windows\system32\drivers\drmkaud.sys [2009-07-14 5632]
S3 ebdrv;Broadcom NetXtreme II 10 GigE VBD; C:\Windows\system32\DRIVERS\evbda.sys [2009-06-10 3286016]
S3 epmntdrv;epmntdrv; \??\C:\Windows\syswow64\epmntdrv.sys [2011-07-29 14216]
S3 ErrDev;Ovladače chybového zařízení hardwaru Microsoft; C:\Windows\system32\drivers\errdev.sys [2009-07-14 9728]
S3 EuGdiDrv;EuGdiDrv; \??\C:\Windows\syswow64\EuGdiDrv.sys [2011-07-29 8456]
S3 FsDepends;@%SystemRoot%\system32\drivers\fsdepends.sys,-10001; C:\Windows\System32\drivers\FsDepends.sys [2009-07-14 55376]
S3 hcw85cir;Hauppauge Consumer Infrared Receiver; C:\Windows\system32\drivers\hcw85cir.sys [2009-06-10 31232]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2010-11-20 350208]
S3 HidBatt;HID UPS Battery Driver; C:\Windows\system32\DRIVERS\HidBatt.sys [2009-07-14 26624]
S3 HpSAMD;HpSAMD; C:\Windows\system32\drivers\HpSAMD.sys [2010-11-20 78720]
S3 LSI_SAS2;LSI_SAS2; C:\Windows\system32\DRIVERS\lsi_sas2.sys [2009-07-14 65600]
S3 MegaSR;MegaSR; C:\Windows\system32\DRIVERS\MegaSR.sys [2009-07-14 284736]
S3 mshidkmdf;@%SystemRoot%\system32\drivers\mshidkmdf.sys,-100; C:\Windows\System32\drivers\mshidkmdf.sys [2009-07-14 8192]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2009-07-14 11136]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2009-07-14 7168]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2009-07-14 6784]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2009-07-14 8064]
S3 MTConfig;Microsoft Input Configuration Driver; C:\Windows\system32\DRIVERS\MTConfig.sys [2009-07-14 15360]
S3 NdisCap;NDIS Capture LightWeight Filter; C:\Windows\system32\DRIVERS\ndiscap.sys [2009-07-14 35328]
S3 RAMDiskVE;RAMDiskVE; C:\Windows\System32\Drivers\RAMDiskVE.sys []
S3 rdpbus;Remote Desktop Device Redirector Bus Driver; C:\Windows\system32\DRIVERS\rdpbus.sys [2009-07-14 24064]
S3 scfilter;@%SystemRoot%\System32\drivers\scfilter.sys,-11; C:\Windows\System32\DRIVERS\scfilter.sys [2010-11-20 29696]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2012-06-27 157672]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2012-06-27 16872]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2012-06-27 177640]
S3 stexstor;stexstor; C:\Windows\system32\DRIVERS\stexstor.sys [2009-07-14 24656]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 UmPass;Microsoft UMPass Driver; C:\Windows\system32\DRIVERS\umpass.sys [2009-07-14 9728]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 vhdmp;vhdmp; C:\Windows\system32\drivers\vhdmp.sys [2010-11-20 215936]
S3 vwifibus;@%SystemRoot%\System32\drivers\vwifibus.sys,-257; C:\Windows\System32\drivers\vwifibus.sys [2009-07-14 24576]
S3 WIMMount;WIMMount; C:\Windows\system32\drivers\wimmount.sys [2009-07-14 22096]
S3 WinRing0_1_2_0;WinRing0_1_2_0; \??\C:\Program Files (x86)\Razer Game Booster\Driver\WinRing0x64.sys [2012-08-01 14544]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2013-05-23 143120]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2012-12-19 240640]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Avast\AvastSvc.exe [2013-05-09 46808]
R2 CLPSLauncher;COMODO LPS Launcher; C:\Program Files (x86)\Common Files\Comodo\launcher_service.exe [2012-11-01 70352]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2012-03-11 2815496]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 GeekBuddyRSP;GeekBuddy Remote Screen Protocol; C:\Program Files (x86)\Common Files\Comodo\GeekBuddyRSP.exe [2012-10-31 1467088]
R2 Gizmo Central;Gizmo Central; C:\Program Files (x86)\Gizmo\gservice.exe [2013-06-18 34728]
R2 OODefragAgent;O&O Defrag; C:\Program Files\OO Software\Defrag\oodag.exe [2011-06-06 3246920]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-10-22 76888]
R2 Power;@%SystemRoot%\system32\umpo.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 RpcEptMapper;@%windir%\system32\RpcEpMap.dll,-1001; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 TeamViewer8;TeamViewer 8; C:\Program Files (x86)\TeamViewer8\TeamViewer_Service.exe [2012-11-29 3463080]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 sppsvc;@%SystemRoot%\system32\sppsvc.exe,-101; C:\Windows\system32\sppsvc.exe [2010-11-20 3524608]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12 256904]
S3 AppIDSvc;@%systemroot%\system32\appidsvc.dll,-100; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 AxInstSV;@%SystemRoot%\system32\AxInstSV.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 BDESVC;@%SystemRoot%\system32\bdesvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service; C:\Program Files\BitComet\tools\BitCometService.exe [2010-12-28 1296728]
S3 bthserv;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 defragsvc;@%SystemRoot%\system32\defragsvc.dll,-101; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 EFS;@%SystemRoot%\system32\efssvc.dll,-100; C:\Windows\System32\lsass.exe [2011-11-17 31232]
S3 HomeGroupListener;@%SystemRoot%\System32\ListSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 HomeGroupProvider;@%SystemRoot%\System32\provsvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-06-26 117144]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2009-07-14 20992]
S3 sppuinotify;@%SystemRoot%\system32\sppuinotify.dll,-103; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 VaultSvc;@%SystemRoot%\system32\vaultsvc.dll,-1003; C:\Windows\system32\lsass.exe [2011-11-17 31232]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-09-29 1255736]
S3 WwanSvc;@%SystemRoot%\System32\wwansvc.dll,-257; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 SensrSvc;Adaptivní jas; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S4 WbioSrvc;Biometrická služba systému Windows; C:\Windows\system32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

Jeste jednou diky, ze se tim zabyvate.

#10 Příspěvek od **vyosek** » 10 črc 2013 17:01

Nemate zac, log z ComboFixu mi dejte do noveho prispevku prosim

wooz · #11 Příspěvek od **wooz** » 10 črc 2013 17:16

ComboFix 13-07-09.01 - YourAdHere 10.07.2013 17:59:32.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4087.2955 [GMT 2:00]
Spuštěný z: c:\users\YourAdHere\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: COMODO Firewall *Disabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\muzapp.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-10 do 2013-07-10 )))))))))))))))))))))))))))))))
.
.
2013-07-10 16:03 . 2013-07-10 16:03 -------- d-----w- c:\users\YourAdHere\AppData\Local\temp
2013-07-10 16:03 . 2013-07-10 16:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-10 15:50 . 2013-07-10 15:50 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F7C995EF-9B5B-44A8-A039-19B42C8B131A}\offreg.dll
2013-07-10 15:39 . 2013-05-09 08:59 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-07-10 15:39 . 2013-07-10 15:39 378944 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-07-10 15:39 . 2013-05-09 08:59 72016 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-07-10 15:39 . 2013-07-10 15:39 1030952 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-07-10 15:39 . 2013-05-09 08:59 64288 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-07-10 15:39 . 2013-07-10 15:39 189936 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-07-10 15:39 . 2013-05-09 08:59 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-07-10 15:39 . 2013-05-09 08:59 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-07-10 15:39 . 2013-05-09 08:58 287840 ----a-w- c:\windows\system32\aswBoot.exe
2013-07-10 15:38 . 2013-05-09 08:58 41664 ----a-w- c:\windows\avastSS.scr
2013-07-10 15:38 . 2013-07-10 15:39 -------- d-----w- c:\program files\Avast
2013-07-10 15:37 . 2013-07-10 15:38 -------- d-----w- c:\programdata\AVAST Software
2013-07-09 14:25 . 2013-07-09 14:25 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\SUPERAntiSpyware.com
2013-07-09 14:24 . 2013-07-09 14:24 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-07-09 14:24 . 2013-07-09 14:24 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-07-09 14:19 . 2013-07-09 14:19 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\Malwarebytes
2013-07-09 14:19 . 2013-07-09 14:19 -------- d-----w- c:\programdata\Malwarebytes
2013-07-09 14:18 . 2013-07-09 14:19 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-09 14:18 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-09 14:17 . 2013-07-09 14:17 -------- d-----w- c:\program files (x86)\Windows Repair
2013-07-09 11:44 . 2013-07-09 12:54 -------- d-----w- c:\program files (x86)\trend micro
2013-07-09 11:43 . 2013-07-10 15:52 -------- d-----w- c:\program files\trend micro
2013-07-09 11:43 . 2013-07-10 15:39 -------- d-----w- C:\rsit
2013-07-09 11:20 . 2013-07-09 11:20 789096 ----a-w- c:\windows\SysWow64\phatk121016Cypressv2w128l4.bin
2013-07-08 16:14 . 2013-07-08 16:14 -------- d-----w- c:\programdata\PopCap Games
2013-07-07 16:51 . 2013-07-07 16:51 -------- d-----w- c:\windows\Sun
2013-06-21 10:11 . 2013-06-21 10:11 -------- d-----w- c:\programdata\Steam
2013-06-21 01:43 . 2003-08-20 21:48 23 ----a-w- c:\windows\SysWow64\register.bat
2013-06-21 01:43 . 2002-04-24 14:56 204800 ----a-w- c:\windows\SysWow64\MADFilter.ax
2013-06-21 01:42 . 2013-06-21 01:42 -------- d-----w- c:\program files (x86)\Combined Community Codec Pack
2013-06-19 16:12 . 2013-06-19 16:12 -------- d-----w- c:\program files\Realtek
2013-06-19 16:12 . 2013-06-19 16:12 -------- d-----w- c:\windows\SysWow64\RTCOM
2013-06-19 16:03 . 2013-06-19 16:13 -------- d-----w- c:\programdata\DriverGenius
2013-06-19 16:02 . 2013-07-09 11:47 -------- d-----w- c:\program files (x86)\DriverGenius
2013-06-19 15:55 . 2013-06-19 15:55 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\Realtek Driver Updates Scanner
2013-06-19 14:33 . 2013-06-19 14:33 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\Mp3CompressorFreeEdition
2013-06-19 14:30 . 2013-06-19 14:30 -------- d-----w- c:\program files (x86)\Mp3 Compressor
2013-06-19 14:09 . 2013-06-19 14:29 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\MP3 Quality Modifier
2013-06-19 13:26 . 2012-06-09 17:21 178688 ----a-w- c:\windows\SysWow64\unrar.dll
2013-06-19 13:26 . 2013-06-19 13:44 -------- d-----w- c:\program files (x86)\K-Lite Codec Pack
2013-06-18 10:14 . 2013-06-18 10:15 -------- d-----w- c:\users\YourAdHere\AppData\Local\Dataram_Corporation
2013-06-18 10:14 . 2013-06-18 10:15 -------- d-----w- c:\program files (x86)\Radeon RAMDisk
2013-06-18 10:11 . 2013-06-18 10:11 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\Gizmo
2013-06-18 10:11 . 2013-06-18 10:11 34704 ----a-w- c:\windows\system32\drivers\gizmodrv.sys
2013-06-18 10:11 . 2013-06-18 10:11 -------- d-----w- c:\program files (x86)\Gizmo
2013-06-14 20:55 . 2013-06-14 20:55 98304 ----a-w- c:\windows\SysWow64\CmdLineExt.dll
2013-06-14 20:43 . 2006-02-07 13:44 65024 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe
2013-06-14 20:43 . 2006-02-07 13:40 204800 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll
2013-06-14 20:43 . 2006-02-07 13:40 69715 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll
2013-06-14 20:43 . 2006-02-07 13:40 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll
2013-06-14 20:43 . 2005-11-13 21:19 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
2013-06-14 20:43 . 2006-02-07 13:45 757760 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll
2013-06-14 20:43 . 2013-06-14 20:43 200836 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll
2013-06-14 20:26 . 2013-06-14 20:26 331908 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
2013-06-13 22:39 . 2013-06-13 22:39 -------- d-----w- c:\program files (x86)\Who Is On My Wifi
2013-06-10 23:57 . 2013-06-10 23:57 -------- d-----w- c:\program files\CCleaner
2013-06-10 23:35 . 2013-06-22 12:09 -------- d-----w- C:\Textures Backup
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-12 16:25 . 2012-09-26 17:55 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 16:25 . 2012-09-26 17:55 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-07 11:45 . 2013-07-08 16:10 84992 --s-a-w- c:\windows\inf\msrfepfw\zlib1.dll
2013-06-07 11:45 . 2013-07-08 16:10 612352 --s-a-w- c:\windows\inf\msrfepfw\libcurl.dll
2013-06-07 11:45 . 2013-07-08 16:10 568334 --s-a-w- c:\windows\inf\msrfepfw\msrfepfw.exe
2013-06-07 11:45 . 2013-07-08 16:10 364544 --s-a-w- c:\windows\inf\msrfepfw\ssleay32.dll
2013-06-07 11:45 . 2013-07-08 16:10 279955 --s-a-w- c:\windows\inf\msrfepfw\libidn-11.dll
2013-06-07 11:45 . 2013-07-08 16:10 183382 --s-a-w- c:\windows\inf\msrfepfw\librtmp.dll
2013-06-07 11:45 . 2013-07-08 16:10 171008 --s-a-w- c:\windows\inf\msrfepfw\libssh2.dll
2013-06-07 11:45 . 2013-07-08 16:10 1704448 --s-a-w- c:\windows\inf\msrfepfw\libeay32.dll
2013-06-07 11:45 . 2013-07-08 16:10 110094 --s-a-w- c:\windows\inf\msrfepfw\libusb-1.0.dll
2013-06-04 16:43 . 2012-11-27 14:19 14387 ----a-w- c:\users\YourAdHere\AppData\Roaming\TheHunterSettings_live.bin
2013-05-15 20:16 . 2012-10-11 02:30 75016696 ------w- c:\windows\system32\MRT.exe
2013-05-15 07:56 . 2013-05-15 07:56 314016 ----a-w- c:\windows\system32\drivers\atksgt.sys
2013-05-15 07:56 . 2013-05-15 07:56 43680 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2013-04-13 05:49 . 2013-05-15 18:36 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 18:36 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 18:36 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 18:36 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 18:36 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 18:36 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 08:03 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StrokeIt"="c:\program files (x86)\StrokeIt\StrokeIt.exe" [2010-01-03 26248]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-08-28 3671904]
"AtiTrayTools"="c:\program files (x86)\ATI Tray Tools\atitray.exe" [2011-10-29 929792]
"BitComet"="c:\program files\BitComet\BitComet.exe" [2013-02-19 20529920]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2013-05-15 5622512]
"GizmoDriveDelegate"="c:\program files (x86)\Gizmo\gizmo.exe" [2013-06-18 223640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"avast"="c:\program files\Avast\avastUI.exe" [2013-05-09 4858968]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
always_top.ahk [2013-6-20 2043]
speedfan.exe – zástupce.lnk - c:\program files (x86)\SpeedFan\speedfan.exe [2013-3-15 4683768]
Who Is On My Wifi.lnk - c:\program files (x86)\Who Is On My Wifi\mywifi.exe [2013-6-14 559104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R0 aswRvrt;aswRvrt; [x]
R1 aswSnx;aswSnx; [x]
R1 CFRMD;CFRMD;c:\windows\system32\DRIVERS\CFRMD.sys;c:\windows\SYSNATIVE\DRIVERS\CFRMD.sys [x]
R2 CLPSLauncher;COMODO LPS Launcher;c:\program files (x86)\Common Files\Comodo\launcher_service.exe;c:\program files (x86)\Common Files\Comodo\launcher_service.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Gizmo Central;Gizmo Central;c:\program files (x86)\Gizmo\gservice.exe;c:\program files (x86)\Gizmo\gservice.exe [x]
R2 OODefragAgent;O&O Defrag;c:\program files\OO Software\Defrag\oodag.exe;c:\program files\OO Software\Defrag\oodag.exe [x]
R3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;c:\program files\BitComet\tools\BitCometService.exe;c:\program files\BitComet\tools\BitCometService.exe [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 RAMDiskVE;RAMDiskVE;c:\windows\system32\Drivers\RAMDiskVE.sys;c:\windows\SYSNATIVE\Drivers\RAMDiskVE.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\Razer Game Booster\Driver\WinRing0x64.sys;c:\program files (x86)\Razer Game Booster\Driver\WinRing0x64.sys [x]
S0 aswVmm;aswVmm; [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSP;aswSP; [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys;c:\windows\SYSNATIVE\DRIVERS\cmdguard.sys [x]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys;c:\windows\SYSNATIVE\DRIVERS\cmdhlp.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 GizmoDrv;Gizmo Device Driver; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 GeekBuddyRSP;GeekBuddy Remote Screen Protocol;c:\program files (x86)\Common Files\Comodo\GeekBuddyRSP.exe;c:\program files (x86)\Common Files\Comodo\GeekBuddyRSP.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer8\TeamViewer_Service.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 RTCore64;RTCore64;c:\program files (x86)\MSI Afterburner\RTCore64.sys;c:\program files (x86)\MSI Afterburner\RTCore64.sys [x]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - ASWFSBLK
*NewlyCreated* - ASWMONFLT
*NewlyCreated* - ASWRDR
*NewlyCreated* - ASWSP
*NewlyCreated* - ASWTDI
*NewlyCreated* - ASWVMM
*NewlyCreated* - AVGTP
.
Obsah adresáře 'Naplánované úlohy'
.
2013-07-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-26 16:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 133840 ----a-w- c:\program files\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2011-06-06 3992904]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2012-03-11 9569096]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-05-31 13545032]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Download all links by FlashGet3 - c:\program files (x86)\FlashGet 3\BHO\fdgetallurl.htm
IE: Download by FlashGet3 - c:\program files (x86)\FlashGet 3\BHO\fdgeturl.htm
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
TCP: Interfaces\{B7846055-7F6C-4D73-B859-E431C3353F61}: NameServer = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\users\YourAdHere\AppData\Roaming\Mozilla\Firefox\Profiles\iyl6gyzr.default\
FF - prefs.js: browser.startup.homepage - chrome://fvd.speeddial/content/fvd_about_blank.html
FF - ExtSQL: 2013-07-10 17:39; wrc@avast.com; c:\program files\Avast\WebRep\FF
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-Driver Genius - (no file)
AddRemove-Might & Magic VI Limited Edition_is1 - d:\games\Might & Magic VI\unins000.exe
AddRemove-Might and Magic® VI - d:\games\Might & Magic VI\unins000.exe
AddRemove-PlugY, The Survival Kit - d:\games\Diablo II\PlugY\PlugY Uninstaller.exe
AddRemove-Wubi - m:\ubuntu\uninstall-wubi.exe
AddRemove-{E122AACF-066B-2015-B676-78D0CB4329CF}_is1 - d:\games\Plants vs. Zombies\unins000.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-3304682622-555214572-2038165883-1001\Software\SecuROM\License information*]
"datasecu"=hex:1b,fb,2b,44,bc,64,09,92,41,35,85,60,34,1d,39,50,c7,e2,8d,b9,bf,
f8,1d,ec,46,63,1f,b6,c7,23,29,e9,aa,cd,21,96,10,0d,d4,d2,f5,d0,3b,3c,27,37,\
"rkeysecu"=hex:93,a2,f0,42,89,32,2e,08,fb,ca,d9,ea,ec,74,a8,54
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG15.00.00.01PROFESSIONAL"="B9FAF17AFE9325301C1483CF6F404EAF7ACEFED1313A5C74D50449FACE8361732831A83C3606038417D9A5C2745FAAC6C32D0F0804EBC35B150B7E2EAF34916D29C7EF367B1A9288444DF77C28E370455B08700ABB8B06C0AAA2CCB5A665EBDED790EF156E15A06DAC6E98BBEAD13A83DF2A5ACC99F8A5BEE283285BF6F47B4AD0D4F297EF71E2B86032CB5760DE83A96ED5295CA14687468E5BA6FCA4FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6171C11EC38DE3D9DB7CE019D40AA5CC038D530D6EB3452ED942FD5E53555D7C68D5DA94AE6AA0DAEC6C27D905E3A864399DA4C8114A2BAA908B61DD08CFD00EB3E771A5D9A7EB21A2696B43D3DE1E0BD0AFBDC978E308720456A4A55B54B625F89B5CD1A79D14D502ECB3C11554E2B359689E48C27B6ECC1A0EB936E66C01CEDAA00AC66F27C769C242F4F016CC8A3112D578E7F1E176CAF5232B58676718C16C492231D98E6927AB063A8F26E33CCE9A20A07845643C541F688F001E387D78A5C7BA30A9F8F451BE45B8DC1E7FDEB8D2F9B0323D9C502018F8D0731CFC065B3D9A020F2620A76E132E0C03E8DB10CFB6BD83859D33AEC2DFEB3C1E07DEDE3AD8C38940ADE7CD5E7ED900CA9B5E8FBECD7E5611593CF95390E41EACDD6F44047254EFAFBB69F537AD35BBE3C5C54CB49D9363C3C0D4CCD49EAD25328E84DB10539C3D365AF43A31982062A1F9E36D2AC36940EA55987AC3AA3D4CD95E485AD1D41CBA5583449C0F77BA8A27340E5AB6B1A1F1A1D32ED8E9AAE8AB22D9EBF727B9BEC785CD2286780253103CB29CE348A1347ADE2F87F922BE18C5E7E90AFFEBF898458E9BB68984F4B5F28ADE2F08D41965296AB32CF9AE37CC4AE09562098BDAF42D57045AA9A341A48F4161CDD9F7FFA5AA61F0409CF6F9DF087C2306CC57C9929074FEA21F435A5D34DF329BE14E5FA4EB558BA651B2A49A4D1140507D238B111835F4890F40863411C2800CD584AB76E1E6948352D2967C6F8D9DC76525FCAA6E6E9A1D22E9BAE1F4F8BBA5A1E36B3503ED4BEDEF7B14612ECE5645115169B68D3AB5AD8F190C4D2D7E81AC75C66565FF812D4D9343F15949EFCECC63635BA2B6D587EA2DCB9C9152A7F800D4ECDEAD7B40F69315C7E68B189576A181045A8965E943B4849A0C1734381F3B6708F21CC5CAAFA852FD4B9212722F6194288C4A5D07CE172DA03194E1D96206285870C23DDB8AC8C30D5636CF6004E3433F1D3A9769B69DE754E1E59BCD85444134324932D01C70D26CDA6717E0452E68927024405756AE1C1A9019E255902A3E483C2AEC04137639CBA286542B887C1B1065AEE34002461AD6CDA7A601941DA083DA8D412A70B8162CEF04DD19997E9DB1D4FF43FA37756EAA4A49D"
"OODEFRAG14.00.00.01PROFESSIONAL"="C869E2BEF8277DBA4A6FCEA55915AC53E9C076520F56FA09CFC2993052E122E9A9D0E7F0CEE57835E798E65260142942FDC8EDAD622FF13C3C8AAFD68BEF7AA5B5CFD7CDDF42B13336EF30BFACBC46F54913DFD6187FA252CFF0335AC05303462859799FE9A01987E194EA4CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6171C11EC38DE3D9DB7CE019D40AA5CC038D530D6EB345264D65D7AD9FD6C774A4D99A974DDDC21F0BBCAAB0DA579D93E829C1F589285077AEFB9C3F03F6C2376BCE2988B072C00D44AAA3E3F3054564F3A33345AE886271954825FC9961C684FB5E36390E9488D74DBDACACB5659CDFDF4A77F4BC6FBCD77835691362D1B8C2BD6E154455E4A9F664D6BC0053E3B4BC3687333AEBD4F5E0CB2B7728B24AD64A2F00B0671B0EB2385AC4F604401CEF05D0374580D530FCE16C90DF0A30E38DC15896C6DDE9F8E1AF13B60C3642B0C7449E0EBCB7402ED289566A04BDAF0C774A35B7B4FDCE035160E71DAD3C4BD911ECBD7803A7537BF0BCF58219715C80BBF35D10EC4BD9B89C28179DDCEC82F9ECB6EEEB82AA35680274EA4A13EB584D2E3738F603CD76B555936AFEFC8D966186EFCE0837298344C445E8296FC2807981F4DEA907706E10A2BDC29F7A7E0C1088B869EB33EF01B663C10DFDBE2D9A7763EF46BA38C28813A1C68AAC22750121BBC60CAFB0E4BC933FC3ADDB0563B30AA245F5180E31EC21F260FB08054991BA1AF23BCF635CFF03E0A74CEB48FC3E198CAC70B72BDD1121453CB68C593369811A32901A35C24B735789CBC719BEAEC47BAABC0A829AA4F1945DEB30B9CA0B48170135661FEF63769F253644FD9307B6195CD4AB78D9A4DD130CB2AAC775992B07DC5AF75EBF77ECF38FEB49C0114A5B50D33B515A41256055C5896EB83E2C57EC8E9360B47DB0F041948540D981D7C37E7A7451DFB872421A590F66BF5C45872E3E9442E89DA5FC3FD1B1A36FDD3027D83B86D10F3F7E8B4FBC27D34D20DC6B1F27769D07EB2D8F0DFA99313E1472D424EB7D88F445FC674E3039134F6C7828B3185E848C5A2D990CCE9010149096AE44A3B63A3764157B67629CC398F8CF0F06ACD3B4DD1F0B34CE79256430C2D9769109D2039E7A52578DF4E7EF920EFE8F47F4A8BFDEC65AD73E6243C00574F07F4CAFD549ECA16B0D8DFD2290D7E8E3A53673DB9DBB0CC8176145D10412C0B81D3B9BC780624216F9DC9D982F0578825E5292AD8CB0EF7DB6D4E43E176DF0441732F013B88CDD8C72C8749F584A781DC30E4D8301748BAE08F0720F6719ADD746894357DA1F5D4951215CEA10C43208CD549D5BAEC76EE253D4581C5685844BFE86207D52F9E30AA7E02D758AFD011509F1D702ADB86EFB2F523B67CF46C"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2013-07-10 18:05:04
ComboFix-quarantined-files.txt 2013-07-10 16:05
.
Před spuštěním: 1 076 203 520
Po spuštění: 929 603 584
.
- - End Of File - - ADDBF77C116B169896809BB8D6C81083
8E734BD7AA1D4F7E9AF58DF495F6CF9E

#12 Příspěvek od **vyosek** » 10 črc 2013 21:48

Pokud nemate, tak presunte Combofix na plochu

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

KillAll::

File::
c:\windows\SysWow64\register.bat
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\always_top.ahk
c:\windows\Tasks\Adobe Flash Player Updater.job

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=-
"BitComet"=-
"SUPERAntiSpyware"=-

RegNull::
[HKEY_USERS\S-1-5-21-3304682622-555214572-2038165883-1001\Software\SecuROM\License information*]
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

Reboot::

Ulozte vytvoreny TXT jako CFScript.txt
Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci

wooz · #13 Příspěvek od **wooz** » 11 črc 2013 15:18

ComboFix 13-07-09.01 - YourAdHere 11.07.2013 6:16.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4087.3050 [GMT 2:00]
Spuštěný z: c:\users\YourAdHere\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\YourAdHere\Desktop\CFscript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: COMODO Firewall *Enabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\always_top.ahk"
"c:\windows\SysWow64\register.bat"
"c:\windows\Tasks\Adobe Flash Player Updater.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\always_top.ahk
c:\windows\SysWow64\register.bat
c:\windows\Tasks\Adobe Flash Player Updater.job
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-06-11 do 2013-07-11 )))))))))))))))))))))))))))))))
.
.
2013-07-11 04:20 . 2013-07-11 04:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-10 16:08 . 2013-07-10 16:08 -------- d-----w- c:\users\YourAdHere\AppData\Local\Diagnostics
2013-07-10 16:05 . 2013-07-11 14:05 -------- d-----w- c:\users\YourAdHere\AppData\Local\temp
2013-07-10 15:39 . 2013-05-09 08:59 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-07-10 15:39 . 2013-07-10 15:39 378944 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-07-10 15:39 . 2013-05-09 08:59 72016 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-07-10 15:39 . 2013-07-10 15:39 1030952 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-07-10 15:39 . 2013-05-09 08:59 64288 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-07-10 15:39 . 2013-07-10 15:39 189936 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-07-10 15:39 . 2013-05-09 08:59 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-07-10 15:39 . 2013-05-09 08:59 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-07-10 15:39 . 2013-05-09 08:58 287840 ----a-w- c:\windows\system32\aswBoot.exe
2013-07-10 15:38 . 2013-05-09 08:58 41664 ----a-w- c:\windows\avastSS.scr
2013-07-10 15:38 . 2013-07-11 14:03 -------- d-----w- c:\program files\Avast
2013-07-10 15:37 . 2013-07-10 15:38 -------- d-----w- c:\programdata\AVAST Software
2013-07-09 14:25 . 2013-07-09 14:25 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\SUPERAntiSpyware.com
2013-07-09 14:24 . 2013-07-09 14:24 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-07-09 14:24 . 2013-07-09 14:24 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-07-09 14:19 . 2013-07-09 14:19 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\Malwarebytes
2013-07-09 14:19 . 2013-07-09 14:19 -------- d-----w- c:\programdata\Malwarebytes
2013-07-09 14:18 . 2013-07-09 14:19 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-09 14:18 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-09 14:17 . 2013-07-09 14:17 -------- d-----w- c:\program files (x86)\Windows Repair
2013-07-09 11:44 . 2013-07-09 12:54 -------- d-----w- c:\program files (x86)\trend micro
2013-07-09 11:43 . 2013-07-10 15:52 -------- d-----w- c:\program files\trend micro
2013-07-09 11:43 . 2013-07-10 15:39 -------- d-----w- C:\rsit
2013-07-09 11:20 . 2013-07-09 11:20 789096 ----a-w- c:\windows\SysWow64\phatk121016Cypressv2w128l4.bin
2013-07-08 16:14 . 2013-07-08 16:14 -------- d-----w- c:\programdata\PopCap Games
2013-07-07 16:51 . 2013-07-07 16:51 -------- d-----w- c:\windows\Sun
2013-06-21 10:11 . 2013-06-21 10:11 -------- d-----w- c:\programdata\Steam
2013-06-21 01:43 . 2002-04-24 14:56 204800 ----a-w- c:\windows\SysWow64\MADFilter.ax
2013-06-21 01:42 . 2013-06-21 01:42 -------- d-----w- c:\program files (x86)\Combined Community Codec Pack
2013-06-19 16:12 . 2013-06-19 16:12 -------- d-----w- c:\program files\Realtek
2013-06-19 16:12 . 2013-06-19 16:12 -------- d-----w- c:\windows\SysWow64\RTCOM
2013-06-19 16:03 . 2013-06-19 16:13 -------- d-----w- c:\programdata\DriverGenius
2013-06-19 16:02 . 2013-07-09 11:47 -------- d-----w- c:\program files (x86)\DriverGenius
2013-06-19 15:55 . 2013-06-19 15:55 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\Realtek Driver Updates Scanner
2013-06-19 14:33 . 2013-06-19 14:33 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\Mp3CompressorFreeEdition
2013-06-19 14:30 . 2013-06-19 14:30 -------- d-----w- c:\program files (x86)\Mp3 Compressor
2013-06-19 14:09 . 2013-06-19 14:29 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\MP3 Quality Modifier
2013-06-19 13:26 . 2012-06-09 17:21 178688 ----a-w- c:\windows\SysWow64\unrar.dll
2013-06-19 13:26 . 2013-06-19 13:44 -------- d-----w- c:\program files (x86)\K-Lite Codec Pack
2013-06-18 10:14 . 2013-06-18 10:15 -------- d-----w- c:\users\YourAdHere\AppData\Local\Dataram_Corporation
2013-06-18 10:14 . 2013-06-18 10:15 -------- d-----w- c:\program files (x86)\Radeon RAMDisk
2013-06-18 10:11 . 2013-06-18 10:11 -------- d-----w- c:\users\YourAdHere\AppData\Roaming\Gizmo
2013-06-18 10:11 . 2013-06-18 10:11 34704 ----a-w- c:\windows\system32\drivers\gizmodrv.sys
2013-06-18 10:11 . 2013-06-18 10:11 -------- d-----w- c:\program files (x86)\Gizmo
2013-06-14 20:55 . 2013-06-14 20:55 98304 ----a-w- c:\windows\SysWow64\CmdLineExt.dll
2013-06-14 20:43 . 2006-02-07 13:44 65024 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ISBEW64.exe
2013-06-14 20:43 . 2006-02-07 13:40 204800 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll
2013-06-14 20:43 . 2006-02-07 13:40 69715 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll
2013-06-14 20:43 . 2006-02-07 13:40 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll
2013-06-14 20:43 . 2005-11-13 21:19 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
2013-06-14 20:43 . 2006-02-07 13:45 757760 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll
2013-06-14 20:43 . 2013-06-14 20:43 200836 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll
2013-06-14 20:26 . 2013-06-14 20:26 331908 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
2013-06-13 22:39 . 2013-06-13 22:39 -------- d-----w- c:\program files (x86)\Who Is On My Wifi
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-12 16:25 . 2012-09-26 17:55 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 16:25 . 2012-09-26 17:55 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-07 11:45 . 2013-07-08 16:10 84992 --s-a-w- c:\windows\inf\msrfepfw\zlib1.dll
2013-06-07 11:45 . 2013-07-08 16:10 612352 --s-a-w- c:\windows\inf\msrfepfw\libcurl.dll
2013-06-07 11:45 . 2013-07-08 16:10 568334 --s-a-w- c:\windows\inf\msrfepfw\msrfepfw.exe
2013-06-07 11:45 . 2013-07-08 16:10 364544 --s-a-w- c:\windows\inf\msrfepfw\ssleay32.dll
2013-06-07 11:45 . 2013-07-08 16:10 279955 --s-a-w- c:\windows\inf\msrfepfw\libidn-11.dll
2013-06-07 11:45 . 2013-07-08 16:10 183382 --s-a-w- c:\windows\inf\msrfepfw\librtmp.dll
2013-06-07 11:45 . 2013-07-08 16:10 171008 --s-a-w- c:\windows\inf\msrfepfw\libssh2.dll
2013-06-07 11:45 . 2013-07-08 16:10 1704448 --s-a-w- c:\windows\inf\msrfepfw\libeay32.dll
2013-06-07 11:45 . 2013-07-08 16:10 110094 --s-a-w- c:\windows\inf\msrfepfw\libusb-1.0.dll
2013-06-04 16:43 . 2012-11-27 14:19 14387 ----a-w- c:\users\YourAdHere\AppData\Roaming\TheHunterSettings_live.bin
2013-05-15 20:16 . 2012-10-11 02:30 75016696 ------w- c:\windows\system32\MRT.exe
2013-05-15 07:56 . 2013-05-15 07:56 314016 ----a-w- c:\windows\system32\drivers\atksgt.sys
2013-05-15 07:56 . 2013-05-15 07:56 43680 ----a-w- c:\windows\system32\drivers\lirsgt.sys
2013-04-13 05:49 . 2013-05-15 18:36 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 18:36 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 18:36 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 18:36 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 18:36 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 18:36 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 08:03 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StrokeIt"="c:\program files (x86)\StrokeIt\StrokeIt.exe" [2010-01-03 26248]
"AtiTrayTools"="c:\program files (x86)\ATI Tray Tools\atitray.exe" [2011-10-29 929792]
"GizmoDriveDelegate"="c:\program files (x86)\Gizmo\gizmo.exe" [2013-06-18 223640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"avast"="c:\program files\Avast\avastUI.exe" [2013-05-09 4858968]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
speedfan.exe – zástupce.lnk - c:\program files (x86)\SpeedFan\speedfan.exe [2013-3-15 4683768]
Who Is On My Wifi.lnk - c:\program files (x86)\Who Is On My Wifi\mywifi.exe [2013-6-14 559104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R1 CFRMD;CFRMD;c:\windows\system32\DRIVERS\CFRMD.sys;c:\windows\SYSNATIVE\DRIVERS\CFRMD.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;c:\program files\BitComet\tools\BitCometService.exe;c:\program files\BitComet\tools\BitCometService.exe [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 RAMDiskVE;RAMDiskVE;c:\windows\system32\Drivers\RAMDiskVE.sys;c:\windows\SYSNATIVE\Drivers\RAMDiskVE.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\Razer Game Booster\Driver\WinRing0x64.sys;c:\program files (x86)\Razer Game Booster\Driver\WinRing0x64.sys [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys;c:\windows\SYSNATIVE\DRIVERS\cmdguard.sys [x]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys;c:\windows\SYSNATIVE\DRIVERS\cmdhlp.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 GizmoDrv;Gizmo Device Driver; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 CLPSLauncher;COMODO LPS Launcher;c:\program files (x86)\Common Files\Comodo\launcher_service.exe;c:\program files (x86)\Common Files\Comodo\launcher_service.exe [x]
S2 GeekBuddyRSP;GeekBuddy Remote Screen Protocol;c:\program files (x86)\Common Files\Comodo\GeekBuddyRSP.exe;c:\program files (x86)\Common Files\Comodo\GeekBuddyRSP.exe [x]
S2 Gizmo Central;Gizmo Central;c:\program files (x86)\Gizmo\gservice.exe;c:\program files (x86)\Gizmo\gservice.exe [x]
S2 OODefragAgent;O&O Defrag;c:\program files\OO Software\Defrag\oodag.exe;c:\program files\OO Software\Defrag\oodag.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer8\TeamViewer_Service.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 RTCore64;RTCore64;c:\program files (x86)\MSI Afterburner\RTCore64.sys;c:\program files (x86)\MSI Afterburner\RTCore64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
S4 DRIVER_B;DRIVER_B;c:\windows\system32\Drivers\DRIVER_BIN64;c:\windows\SYSNATIVE\Drivers\DRIVER_BIN64 [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58 133840 ----a-w- c:\program files\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2011-06-06 3992904]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2012-03-11 9569096]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-05-31 13545032]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Download all links by FlashGet3 - c:\program files (x86)\FlashGet 3\BHO\fdgetallurl.htm
IE: Download by FlashGet3 - c:\program files (x86)\FlashGet 3\BHO\fdgeturl.htm
TCP: DhcpNameServer = 213.46.172.36 213.46.172.37
TCP: Interfaces\{B7846055-7F6C-4D73-B859-E431C3353F61}: NameServer = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\users\YourAdHere\AppData\Roaming\Mozilla\Firefox\Profiles\iyl6gyzr.default\
FF - prefs.js: browser.startup.homepage - chrome://fvd.speeddial/content/fvd_about_blank.html
FF - ExtSQL: 2013-07-10 17:39; wrc@avast.com; c:\program files\Avast\WebRep\FF
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-Might & Magic VI Limited Edition_is1 - d:\games\Might & Magic VI\unins000.exe
AddRemove-Might and Magic® VI - d:\games\Might & Magic VI\unins000.exe
AddRemove-PlugY, The Survival Kit - d:\games\Diablo II\PlugY\PlugY Uninstaller.exe
AddRemove-Wubi - m:\ubuntu\uninstall-wubi.exe
AddRemove-{E122AACF-066B-2015-B676-78D0CB4329CF}_is1 - d:\games\Plants vs. Zombies\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\DRIVER_B]
"ImagePath"="\??\c:\windows\system32\Drivers\DRIVER_BIN64"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG15.00.00.01PROFESSIONAL"="B9FAF17AFE9325301C1483CF6F404EAF7ACEFED1313A5C74D50449FACE8361732831A83C3606038417D9A5C2745FAAC6C32D0F0804EBC35B150B7E2EAF34916D29C7EF367B1A9288444DF77C28E370455B08700ABB8B06C0AAA2CCB5A665EBDED790EF156E15A06DAC6E98BBEAD13A83DF2A5ACC99F8A5BEE283285BF6F47B4AD0D4F297EF71E2B86032CB5760DE83A96ED5295CA14687468E5BA6FCA4FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6171C11EC38DE3D9DB7CE019D40AA5CC038D530D6EB3452ED942FD5E53555D7C68D5DA94AE6AA0DAEC6C27D905E3A864399DA4C8114A2BAA908B61DD08CFD00EB3E771A5D9A7EB21A2696B43D3DE1E0BD0AFBDC978E308720456A4A55B54B625F89B5CD1A79D14D502ECB3C11554E2B359689E48C27B6ECC1A0EB936E66C01CEDAA00AC66F27C769C242F4F016CC8A3112D578E7F1E176CAF5232B58676718C16C492231D98E6927AB063A8F26E33CCE9A20A07845643C541F688F001E387D78A5C7BA30A9F8F451BE45B8DC1E7FDEB8D2F9B0323D9C502018F8D0731CFC065B3D9A020F2620A76E132E0C03E8DB10CFB6BD83859D33AEC2DFEB3C1E07DEDE3AD8C38940ADE7CD5E7ED900CA9B5E8FBECD7E5611593CF95390E41EACDD6F44047254EFAFBB69F537AD35BBE3C5C54CB49D9363C3C0D4CCD49EAD25328E84DB10539C3D365AF43A31982062A1F9E36D2AC36940EA55987AC3AA3D4CD95E485AD1D41CBA5583449C0F77BA8A27340E5AB6B1A1F1A1D32ED8E9AAE8AB22D9EBF727B9BEC785CD2286780253103CB29CE348A1347ADE2F87F922BE18C5E7E90AFFEBF898458E9BB68984F4B5F28ADE2F08D41965296AB32CF9AE37CC4AE09562098BDAF42D57045AA9A341A48F4161CDD9F7FFA5AA61F0409CF6F9DF087C2306CC57C9929074FEA21F435A5D34DF329BE14E5FA4EB558BA651B2A49A4D1140507D238B111835F4890F40863411C2800CD584AB76E1E6948352D2967C6F8D9DC76525FCAA6E6E9A1D22E9BAE1F4F8BBA5A1E36B3503ED4BEDEF7B14612ECE5645115169B68D3AB5AD8F190C4D2D7E81AC75C66565FF812D4D9343F15949EFCECC63635BA2B6D587EA2DCB9C9152A7F800D4ECDEAD7B40F69315C7E68B189576A181045A8965E943B4849A0C1734381F3B6708F21CC5CAAFA852FD4B9212722F6194288C4A5D07CE172DA03194E1D96206285870C23DDB8AC8C30D5636CF6004E3433F1D3A9769B69DE754E1E59BCD85444134324932D01C70D26CDA6717E0452E68927024405756AE1C1A9019E255902A3E483C2AEC04137639CBA286542B887C1B1065AEE34002461AD6CDA7A601941DA083DA8D412A70B8162CEF04DD19997E9DB1D4FF43FA37756EAA4A49D"
"OODEFRAG14.00.00.01PROFESSIONAL"="C869E2BEF8277DBA4A6FCEA55915AC53E9C076520F56FA09CFC2993052E122E9A9D0E7F0CEE57835E798E65260142942FDC8EDAD622FF13C3C8AAFD68BEF7AA5B5CFD7CDDF42B13336EF30BFACBC46F54913DFD6187FA252CFF0335AC05303462859799FE9A01987E194EA4CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6171C11EC38DE3D9DB7CE019D40AA5CC038D530D6EB345264D65D7AD9FD6C774A4D99A974DDDC21F0BBCAAB0DA579D93E829C1F589285077AEFB9C3F03F6C2376BCE2988B072C00D44AAA3E3F3054564F3A33345AE886271954825FC9961C684FB5E36390E9488D74DBDACACB5659CDFDF4A77F4BC6FBCD77835691362D1B8C2BD6E154455E4A9F664D6BC0053E3B4BC3687333AEBD4F5E0CB2B7728B24AD64A2F00B0671B0EB2385AC4F604401CEF05D0374580D530FCE16C90DF0A30E38DC15896C6DDE9F8E1AF13B60C3642B0C7449E0EBCB7402ED289566A04BDAF0C774A35B7B4FDCE035160E71DAD3C4BD911ECBD7803A7537BF0BCF58219715C80BBF35D10EC4BD9B89C28179DDCEC82F9ECB6EEEB82AA35680274EA4A13EB584D2E3738F603CD76B555936AFEFC8D966186EFCE0837298344C445E8296FC2807981F4DEA907706E10A2BDC29F7A7E0C1088B869EB33EF01B663C10DFDBE2D9A7763EF46BA38C28813A1C68AAC22750121BBC60CAFB0E4BC933FC3ADDB0563B30AA245F5180E31EC21F260FB08054991BA1AF23BCF635CFF03E0A74CEB48FC3E198CAC70B72BDD1121453CB68C593369811A32901A35C24B735789CBC719BEAEC47BAABC0A829AA4F1945DEB30B9CA0B48170135661FEF63769F253644FD9307B6195CD4AB78D9A4DD130CB2AAC775992B07DC5AF75EBF77ECF38FEB49C0114A5B50D33B515A41256055C5896EB83E2C57EC8E9360B47DB0F041948540D981D7C37E7A7451DFB872421A590F66BF5C45872E3E9442E89DA5FC3FD1B1A36FDD3027D83B86D10F3F7E8B4FBC27D34D20DC6B1F27769D07EB2D8F0DFA99313E1472D424EB7D88F445FC674E3039134F6C7828B3185E848C5A2D990CCE9010149096AE44A3B63A3764157B67629CC398F8CF0F06ACD3B4DD1F0B34CE79256430C2D9769109D2039E7A52578DF4E7EF920EFE8F47F4A8BFDEC65AD73E6243C00574F07F4CAFD549ECA16B0D8DFD2290D7E8E3A53673DB9DBB0CC8176145D10412C0B81D3B9BC780624216F9DC9D982F0578825E5292AD8CB0EF7DB6D4E43E176DF0441732F013B88CDD8C72C8749F584A781DC30E4D8301748BAE08F0720F6719ADD746894357DA1F5D4951215CEA10C43208CD549D5BAEC76EE253D4581C5685844BFE86207D52F9E30AA7E02D758AFD011509F1D702ADB86EFB2F523B67CF46C"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Avast\AvastSvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files\CleanMem\mini_monitor.exe
c:\program files (x86)\MSI Afterburner\MSIAfterburner.exe
.
**************************************************************************
.
Celkový čas: 2013-07-11 16:08:22 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-07-11 14:08
ComboFix2.txt 2013-07-10 16:05
.
Před spuštěním: 938 242 048
Po spuštění: 1 177 489 408
.
- - End Of File - - D94919847BA8E1B0B6DAC110E9D37531
8E734BD7AA1D4F7E9AF58DF495F6CF9E

wooz · #14 Příspěvek od **wooz** » 11 črc 2013 15:51

Jeje, smazalo mi to autohotkey script na "always on top", ten tam patril

Nevadi, ten je nahraditelny.

#15 Příspěvek od **vyosek** » 12 črc 2013 07:20

Tak jej vratime zpatky, jeste jeden skript pro CF, postup stejny

Kód: Vybrat vše

KillAll::

FMove::
C:\Qoobox\Quarantine\c\programdata\Microsoft\Windows\Start Menu\Programs\Startup\always_top.ahk | c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\always_top.ahk

RegLock::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

RegNull::
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

Reboot::

VIRY.CZ

Windows Script Host a nefunkcni RSIT

Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT

Re: Windows Script Host a nefunkcni RSIT