Virus ? windows script host error

Zpráva

#16 Příspěvek od **vyosek** » 22 črc 2013 13:17

Poprosim o novy log z RSIT

lamakak · #17 Příspěvek od **lamakak** » 22 črc 2013 19:08

Logfile of random's system information tool 1.06 (written by random/random)
Run by LaMa at 2013-07-22 20:06:59
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 41 GB (27%) free of 153 GB
Total RAM: 959 MB (22% free)

HijackThis download failed

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2012-10-20 449512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7b523e7c-f096-4e36-a0cb-7efeb5c675c1}]
IEExtension.VDownloaderBHO - C:\Windows\system32\mscoree.dll [2010-11-20 297808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-05-09 198688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-10-20 155384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - avast! WebRep - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-05-09 198688]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast"=C:\Program Files\AVAST Software\Avast\avastUI.exe [2013-05-09 4858968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sers]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony PC Companion]
C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe /Background []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files\Steam\steam.exe [2013-07-16 1807272]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Program Files\uTorrent\uTorrent.exe /MINIMIZED []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GamePark klient 2.lnk]
C:\PROGRA~1\GAMEPA~1\gpcl.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Herní^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^regmonstd.lnk]
C:\PROGRA~2\00el.dat,XFG00 []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Browser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dhcp]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DnsCache]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ipnat.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanServer]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanWorkstation]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LmHosts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Messenger]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS Wrapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ndisuio]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOSGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetDDEGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetMan]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Network]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetworkProvider]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP_TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdsessmgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SharedAccess]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Streams Drivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Tcpip]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E972-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E973-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E974-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E975-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3bbd2db3-cdd4-11e1-9755-001d920bb236}]
shell\AutoRun\command - K:\LGAutoRun.exe

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2013-07-22 12:43:57 ----D---- C:\Users\LaMa\AppData\Roaming\Malwarebytes
2013-07-22 12:43:19 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2013-07-22 12:34:01 ----A---- C:\AdwCleaner[S1].txt
2013-07-22 12:29:12 ----A---- C:\AdwCleaner[R1].txt
2013-07-22 11:26:30 ----D---- C:\FRST
2013-07-22 10:40:07 ----D---- C:\Program Files\trend micro
2013-07-22 10:39:37 ----D---- C:\rsit
2013-07-21 11:13:06 ----D---- C:\Users\LaMa\AppData\Roaming\gd.sos.McPixel
2013-07-16 15:25:14 ----A---- C:\Windows\system32\PnkBstrB.exe
2013-07-16 15:25:13 ----A---- C:\Windows\system32\PnkBstrA.exe
2013-07-15 14:50:07 ----D---- C:\Program Files\Bandicam
2013-07-15 14:14:12 ----D---- C:\Users\LaMa\AppData\Roaming\Notepad++
2013-07-15 14:14:12 ----D---- C:\Program Files\Notepad++
2013-07-04 18:10:55 ----D---- C:\Users\LaMa\AppData\Roaming\VitySoft
2013-07-02 11:40:05 ----D---- C:\Users\LaMa\AppData\Roaming\WinRAR
2013-07-02 10:52:04 ----D---- C:\Program Files\Passware
2013-06-26 17:57:33 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2013-06-26 17:48:00 ----D---- C:\Program Files\Adobe Media Player
2013-06-26 17:43:57 ----D---- C:\Program Files\Common Files\Adobe AIR
2013-06-26 17:43:47 ----D---- C:\Program Files\Adobe
2013-06-26 17:37:22 ----D---- C:\ProgramData\Adobe
2013-06-26 17:33:25 ----D---- C:\Program Files\Shock Utility
2013-06-26 17:33:09 ----A---- C:\Windows\IFinst27.exe
2013-06-24 18:53:53 ----D---- C:\Program Files\MP3 Skype Recorder
2013-06-24 18:09:34 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2013-06-24 18:09:33 ----A---- C:\Windows\system32\d3dx10_40.dll
2013-06-24 18:09:32 ----A---- C:\Windows\system32\D3DX9_40.dll
2013-06-24 18:04:22 ----D---- C:\Program Files\Castle Crashers
2013-06-24 17:26:37 ----D---- C:\Program Files\Steam

======List of files/folders modified in the last 1 months======

2013-07-22 20:07:00 ----D---- C:\Windows\Temp
2013-07-22 20:05:04 ----D---- C:\Users\LaMa\AppData\Roaming\Skype
2013-07-22 14:52:44 ----D---- C:\Program Files\gta san andreas
2013-07-22 14:50:11 ----SD---- C:\Users\LaMa\AppData\Roaming\Microsoft
2013-07-22 14:48:21 ----D---- C:\Users\LaMa\AppData\Roaming\HLSW
2013-07-22 13:05:12 ----D---- C:\Windows\system32\drivers
2013-07-22 12:43:19 ----RD---- C:\Program Files
2013-07-22 12:34:07 ----D---- C:\Program Files\Common Files
2013-07-22 12:34:06 ----HD---- C:\ProgramData
2013-07-22 11:26:42 ----D---- C:\Windows
2013-07-22 10:17:51 ----D---- C:\Users\LaMa\AppData\Roaming\FileZilla
2013-07-21 11:11:48 ----D---- C:\Windows\inf
2013-07-21 10:52:56 ----D---- C:\Windows\system32\catroot2
2013-07-20 22:29:03 ----D---- C:\Windows\System32
2013-07-20 22:28:28 ----D---- C:\Program Files\CoD RconTool
2013-07-20 20:15:04 ----D---- C:\Users\LaMa\AppData\Roaming\Xfire
2013-07-20 20:07:21 ----D---- C:\ProgramData\Xfire
2013-07-17 22:29:39 ----D---- C:\Program Files\Common Files\Steam
2013-07-15 14:50:05 ----D---- C:\Program Files\BandiMPEG1
2013-07-15 12:21:40 ----D---- C:\Users\LaMa\AppData\Roaming\Aperture Deleter
2013-07-11 16:13:47 ----D---- C:\Windows\Prefetch
2013-07-09 14:10:41 ----RSD---- C:\Windows\Fonts
2013-07-08 17:07:34 ----D---- C:\Program Files\Opera
2013-07-05 19:10:38 ----D---- C:\Users\LaMa\AppData\Roaming\.minecraft
2013-07-02 19:44:50 ----SHD---- C:\System Volume Information
2013-07-02 14:37:39 ----D---- C:\Windows\debug
2013-07-02 11:09:25 ----D---- C:\Windows\system32\Tasks
2013-07-02 10:56:44 ----D---- C:\Windows\Logs
2013-06-26 18:30:57 ----D---- C:\Users\LaMa\AppData\Roaming\uTorrent
2013-06-26 17:55:19 ----D---- C:\Users\LaMa\AppData\Roaming\Adobe
2013-06-26 17:51:15 ----D---- C:\Program Files\Common Files\Adobe
2013-06-26 17:51:09 ----D---- C:\Windows\system32\config
2013-06-26 17:48:50 ----SHD---- C:\Windows\Installer
2013-06-26 17:40:04 ----D---- C:\Windows\winsxs
2013-06-26 14:33:15 ----D---- C:\ProgramData\PMB Files
2013-06-24 18:08:47 ----RSD---- C:\Windows\assembly
2013-06-23 11:48:31 ----D---- C:\temp

Děkuji za pomoc

#18 Příspěvek od **vyosek** » 23 črc 2013 08:46

Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
Pokud pouzivate 64bitovy OS, zkontrolujte, zda-li je zaskrtnuty ctverecek u Pro 64 bitové OS, pokud ne, zaskrtnete jej
Zaskrtnete okenko Pro vsechny uzivatele
Zaskrtnete okenko Kontrola na havet "LOP"
Zaskrtnete okenko Kontrola na havet "Purity"
Stari souboru zmente z 30 dnu na 7 dnu
Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

Kód: Vybrat vše

CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
atapi.sys
autochk.exe
cdrom.sys
explorer.exe
hal.dll
scecli.dll
services.exe
svchost.exe
tcpip.sys
userinit.exe
winlogon.exe
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s

%PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5
%PROGRAMFILES%\Internet Explorer\iexplore.exe /md5
%PROGRAMFILES%\Opera\opera.exe /md5
%PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5

%SystemDrive%\PhysicalMBR.bin /md5 

*crack* /s
*keygen* /s
*loader* /s

Kliknete na tlacitko Prohledat
Po dokonceni skenu (cca 10 az 15 min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte
Pokud budou logy dlouhe (forum bude kricet o prekroceni maximalniho poctu znaku), tak je rozdelte do vice prispevku

lamakak · #19 Příspěvek od **lamakak** » 23 črc 2013 10:57

Zdravím tento program jsem nechal scanovat 2 hodiny cca a pořád nic tak jsem ho pak vypnul protože nemam čas to celý den scanovat ... neni jiný program?

#20 Příspěvek od **vyosek** » 23 črc 2013 15:36

Zkuste jeste v nouzovem rezimu, bohuzel je tam odolna havet, kterou OTL pekne ukaze...

Pokud nemate cas, ja vas nic nenutim delat...

lamakak · #21 Příspěvek od **lamakak** » 23 črc 2013 21:24

Dobrý den zítra to nechám celé oskenovat děkuji

#22 Příspěvek od **vyosek** » 24 črc 2013 06:53

OK, budu sem v prubehu dne nahlizet...

lamakak · #23 Příspěvek od **lamakak** » 24 črc 2013 12:32

OK mam to

OTL

OTL logfile created on: 7/24/2013 10:22:21 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\LaMa\Desktop
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Czech Republic | Language: CSY | Date Format: d.M.yyyy

959.43 Mb Total Physical Memory | 212.30 Mb Available Physical Memory | 22.13% Memory free
3.48 Gb Paging File | 2.53 Gb Available in Paging File | 72.82% Paging File free
Paging file location(s): c:\pagefile.sys 2600 3000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 53.66 Gb Free Space | 36.00% Space Free | Partition Type: NTFS

Computer Name: LAMA-PC | User Name: LaMa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/07/24 10:20:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\LaMa\Desktop\OTL.exe
PRC - [2013/07/08 17:06:59 | 000,879,456 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2013/05/09 10:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/05/09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013/03/19 22:26:44 | 003,289,208 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012/11/02 15:57:18 | 001,888,608 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe
PRC - [2012/11/02 15:57:16 | 001,699,168 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe
PRC - [2012/05/15 12:26:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012/05/15 11:27:34 | 000,857,920 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2010/11/20 23:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/11/20 23:29:19 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

========== Modules (No Company Name) ==========

MOD - [2013/07/08 17:07:24 | 000,057,344 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstautodetect.dll
MOD - [2013/07/08 17:07:23 | 000,101,888 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwebmdec.dll
MOD - [2013/07/08 17:07:23 | 000,073,728 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwavparse.dll
MOD - [2013/07/08 17:07:23 | 000,038,912 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwaveform.dll
MOD - [2013/07/08 17:07:22 | 000,312,832 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstoggdec.dll
MOD - [2013/07/08 17:07:22 | 000,158,208 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
MOD - [2013/07/08 17:07:21 | 000,096,256 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstcoreplugins.dll
MOD - [2013/07/08 17:07:21 | 000,067,072 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstdirectsound.dll
MOD - [2013/07/08 17:07:21 | 000,062,976 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstdecodebin2.dll
MOD - [2013/07/08 17:07:20 | 000,094,208 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstaudioresample.dll
MOD - [2013/07/08 17:07:20 | 000,093,696 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstaudioconvert.dll
MOD - [2013/07/08 17:07:19 | 000,835,584 | ---- | M] () -- C:\Program Files\Opera\gstreamer\gstreamer.dll
MOD - [2013/06/17 16:32:04 | 016,033,160 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_7_700_224.dll
MOD - [2012/02/18 05:55:36 | 000,166,912 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2012/01/08 15:41:12 | 000,093,696 | ---- | M] () -- C:\Program Files\FileZilla FTP Client\fzshellext.dll

========== Services (SafeList) ==========

SRV - [2013/07/16 23:21:10 | 000,563,112 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013/06/17 16:32:17 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2013/03/19 22:26:44 | 003,289,208 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/11/02 15:57:16 | 001,699,168 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2012/05/15 12:26:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/05/03 17:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - [2013/06/27 22:02:13 | 000,770,344 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2013/06/27 22:02:13 | 000,369,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2013/06/27 22:02:13 | 000,175,176 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswVmm.sys -- (aswVmm)
DRV - [2013/05/09 10:59:10 | 000,061,680 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2013/05/09 10:59:10 | 000,056,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2013/05/09 10:59:10 | 000,049,376 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\aswRvrt.sys -- (aswRvrt)
DRV - [2013/05/09 10:59:09 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2013/05/09 10:59:08 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012/11/15 03:36:52 | 000,035,592 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss6.sys -- (taphss6)
DRV - [2012/09/19 09:50:50 | 000,010,088 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2012/08/20 14:48:44 | 000,015,576 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\pwdrvio.sys -- (pwdrvio)
DRV - [2012/08/20 14:48:44 | 000,010,200 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\pwdspio.sys -- (pwdspio)
DRV - [2012/05/15 12:26:00 | 011,354,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2011/07/26 19:49:12 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)
DRV - [2011/01/18 15:47:48 | 000,003,072 | ---- | M] (JJS) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pspdisp.sys -- (pspdisp)
DRV - [2010/11/20 23:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010/11/20 23:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 23:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/20 23:29:03 | 000,112,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - [2010/11/20 23:29:03 | 000,077,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Synth3dVsc.sys -- (Synth3dVsc)
DRV - [2010/11/20 23:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmvsc.sys -- (dmvsc)
DRV - [2010/11/20 23:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/20 23:29:03 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/20 23:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/20 23:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010/11/20 23:29:03 | 000,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\terminpt.sys -- (terminpt)
DRV - [2010/11/20 23:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/20 23:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/11/01 06:08:46 | 000,014,416 | ---- | M] (OpenLibSys.org) [File_System | On_Demand | Stopped] -- C:\Program Files\IObit\Game Booster 3\Driver\WinRing0.sys -- (WinRing0_1_2_0)
DRV - [2010/01/27 04:09:02 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (npf)
DRV - [2009/07/14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009/02/03 17:36:58 | 000,059,000 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfdrv01.sys -- (sfdrv01)
DRV - [2007/02/08 19:44:43 | 000,083,320 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfvfs02.sys -- (sfvfs02)
DRV - [2006/06/14 16:56:56 | 000,013,680 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfhlp02.sys -- (sfhlp02)
DRV - [2006/05/31 12:18:30 | 000,029,184 | ---- | M] (http://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\libusb0.sys -- (libusb0)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-2566214838-3444710164-4001035059-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-2566214838-3444710164-4001035059-1001\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-2566214838-3444710164-4001035059-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
IE - HKU\S-1-5-21-2566214838-3444710164-4001035059-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2566214838-3444710164-4001035059-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2566214838-3444710164-4001035059-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

IE - HKU\S-1-5-21-2566214838-3444710164-4001035059-1004\..\SearchScopes,DefaultScope =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Hotspot Shield Private Search"
FF - prefs.js..extensions.enabledAddons: %7Bea614400-e918-4741-9a97-7a972ff7c30b%7D:2.5.14
FF - prefs.js..extensions.enabledAddons: afurladvisor%40anchorfree.com:1.0
FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.4.3
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\vitzo.com/VDownloader: C:\Program Files\VDownloader\Addons\npVDownloader.dll (Vitzo)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/06/21 21:00:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\support@vdownloader.com: C:\Program Files\VDownloader\Addons\FireFox [2013/03/09 20:50:22 | 000,000,000 | ---D | M]

[2012/11/10 13:19:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaMa\AppData\Roaming\Mozilla\Extensions
[2013/07/22 12:34:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\LaMa\AppData\Roaming\Mozilla\Firefox\Profiles\ngr2m2kv.default\extensions
[2013/02/02 07:42:27 | 000,000,000 | ---D | M] (Seznam liĹˇtiÄŤka) -- C:\Users\LaMa\AppData\Roaming\Mozilla\Firefox\Profiles\ngr2m2kv.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
[2013/05/14 13:05:29 | 000,213,470 | ---- | M] () (No name found) -- C:\Users\LaMa\AppData\Roaming\Mozilla\Firefox\Profiles\ngr2m2kv.default\extensions\torntv2@torntv.com.xpi
[2013/03/18 19:54:50 | 000,348,483 | ---- | M] () (No name found) -- C:\Users\LaMa\AppData\Roaming\Mozilla\Firefox\Profiles\ngr2m2kv.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
[2013/07/22 12:34:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\AFURLADVISOR@ANCHORFREE.COM
[2011/06/21 20:12:32 | 000,001,847 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\privatesearch.xml

O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [VDownloader] C:\Program Files\VDownloader\VDownloader.exe (Vitzo)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2566214838-3444710164-4001035059-1004..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-2566214838-3444710164-4001035059-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.46.172.36 213.46.172.37
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5263CD50-08EF-4E40-873F-41BC5D28F4AD}: DhcpNameServer = 213.46.172.36 213.46.172.37
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\MP3 Skype Recorder\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{3bbd2db3-cdd4-11e1-9755-001d920bb236}\Shell - "" = AutoRun
O33 - MountPoints2\{3bbd2db3-cdd4-11e1-9755-001d920bb236}\Shell\AutoRun\command - "" = K:\LGAutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.bdmpeg - C:\Windows\System32\bdmpega.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\System32\vorbis.acm (HMS http://hp.vector.co.jp/authors/VA012897/)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.mjpg - C:\Windows\System32\bdmjpeg.dll ()
Drivers32: vidc.mpeg - C:\Windows\System32\bdmpegv.dll ()
Drivers32: vidc.tsc2 - C:\Windows\System32\tsc2_codec32.dll (TechSmith Corporation)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: VIDC.XFR1 - C:\Windows\System32\xfcodec.dll ()
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 30 Days ==========

[2013/07/24 10:20:21 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\LaMa\Desktop\OTL.exe
[2013/07/23 22:16:21 | 000,000,000 | ---D | C] -- C:\Users\LaMa\AppData\Roaming\VDownloader
[2013/07/23 22:16:21 | 000,000,000 | ---D | C] -- C:\Users\LaMa\AppData\Local\VDownloader
[2013/07/23 14:24:19 | 000,000,000 | ---D | C] -- C:\Users\LaMa\Desktop\Pluginy
[2013/07/22 12:43:57 | 000,000,000 | ---D | C] -- C:\Users\LaMa\AppData\Roaming\Malwarebytes
[2013/07/22 10:40:07 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro
[2013/07/21 11:13:06 | 000,000,000 | ---D | C] -- C:\Users\LaMa\AppData\Roaming\gd.sos.McPixel
[2013/07/15 14:50:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bandicam
[2013/07/15 14:50:07 | 000,000,000 | ---D | C] -- C:\Program Files\Bandicam
[2013/07/15 14:47:27 | 000,000,000 | ---D | C] -- C:\Users\LaMa\Documents\Bandicam
[2013/07/15 14:14:12 | 000,000,000 | ---D | C] -- C:\Users\LaMa\AppData\Roaming\Notepad++
[2013/07/15 14:14:12 | 000,000,000 | ---D | C] -- C:\Program Files\Notepad++
[2013/07/04 18:10:55 | 000,000,000 | ---D | C] -- C:\Users\LaMa\AppData\Roaming\VitySoft
[2013/07/02 11:40:05 | 000,000,000 | ---D | C] -- C:\Users\LaMa\AppData\Roaming\WinRAR
[2013/07/02 10:52:04 | 000,000,000 | ---D | C] -- C:\Users\LaMa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware
[2013/07/02 10:52:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Passware
[2013/07/02 10:52:04 | 000,000,000 | ---D | C] -- C:\Program Files\Passware
[2013/07/02 10:03:31 | 000,000,000 | ---D | C] -- C:\Users\LaMa\minecraft
[2013/06/27 17:16:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\4Story_CZ
[2013/06/26 17:57:33 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2013/06/26 17:48:00 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe Media Player
[2013/06/26 17:48:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2013/06/26 17:43:57 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2013/06/26 17:43:47 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2013/06/26 17:37:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2013/06/26 17:33:27 | 000,000,000 | ---D | C] -- C:\Users\LaMa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Shock Utility
[2013/06/26 17:33:25 | 000,000,000 | ---D | C] -- C:\Program Files\Shock Utility
[2013/06/26 17:17:20 | 000,000,000 | ---D | C] -- C:\Users\LaMa\Desktop\Crack
[2013/06/24 18:53:53 | 000,000,000 | ---D | C] -- C:\Program Files\MP3 Skype Recorder
[2013/06/24 17:26:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2013/06/24 17:26:37 | 000,000,000 | ---D | C] -- C:\Program Files\Steam
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/07/24 10:29:08 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/07/24 10:28:43 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2013/07/24 10:20:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\LaMa\Desktop\OTL.exe
[2013/07/24 09:55:36 | 000,021,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/07/24 09:55:36 | 000,021,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/07/24 09:45:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/07/23 23:15:04 | 000,137,464 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2013/07/23 23:14:40 | 000,214,520 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2013/07/23 22:32:32 | 000,667,844 | ---- | M] () -- C:\Windows\System32\perfh005.dat
[2013/07/23 22:32:32 | 000,653,526 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/07/23 22:32:32 | 000,140,434 | ---- | M] () -- C:\Windows\System32\perfc005.dat
[2013/07/23 22:32:32 | 000,121,398 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/07/23 22:21:47 | 000,004,608 | ---- | M] () -- C:\Users\LaMa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/07/23 14:45:43 | 003,648,064 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/07/22 14:04:48 | 000,022,328 | ---- | M] () -- C:\Users\LaMa\AppData\Roaming\PnkBstrK.sys
[2013/07/21 11:12:21 | 000,000,000 | ---- | M] () -- C:\Users\LaMa\regbcm
[2013/07/15 17:12:43 | 000,214,520 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0
[2013/07/15 14:50:13 | 000,000,974 | ---- | M] () -- C:\Users\LaMa\Application Data\Microsoft\Internet Explorer\Quick Launch\Bandicam.lnk
[2013/07/10 15:12:04 | 000,000,213 | ---- | M] () -- C:\Users\LaMa\Desktop\Team Fortress 2.url
[2013/07/07 11:16:20 | 000,000,213 | ---- | M] () -- C:\Users\LaMa\Desktop\Left 4 Dead 2.url
[2013/06/27 22:02:13 | 000,770,344 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2013/06/27 22:02:13 | 000,369,584 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2013/06/27 22:02:13 | 000,175,176 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/06/27 22:02:13 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswVmm.sys.sum
[2013/06/27 22:02:13 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSP.sys.sum
[2013/06/27 22:02:13 | 000,000,175 | ---- | M] () -- C:\Windows\System32\drivers\aswSnx.sys.sum
[2013/06/26 17:33:09 | 000,065,536 | ---- | M] () -- C:\Windows\IFinst27.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/07/24 10:01:58 | 000,049,938 | ---- | C] () -- C:\Users\LaMa\Desktop\bots.iwd
[2013/07/23 14:42:14 | 003,648,064 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/07/23 10:38:39 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2013/07/21 11:12:21 | 000,000,000 | ---- | C] () -- C:\Users\LaMa\regbcm
[2013/07/16 15:25:42 | 000,137,464 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2013/07/16 15:25:14 | 000,214,520 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2013/07/16 15:25:13 | 000,075,064 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2013/07/15 14:50:13 | 000,000,974 | ---- | C] () -- C:\Users\LaMa\Application Data\Microsoft\Internet Explorer\Quick Launch\Bandicam.lnk
[2013/07/14 16:01:49 | 000,214,520 | ---- | C] () -- C:\Windows\System32\PnkBstrB.ex0
[2013/07/10 15:12:04 | 000,000,213 | ---- | C] () -- C:\Users\LaMa\Desktop\Team Fortress 2.url
[2013/07/07 11:16:20 | 000,000,213 | ---- | C] () -- C:\Users\LaMa\Desktop\Left 4 Dead 2.url
[2013/06/27 22:02:14 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys.sum
[2013/06/26 20:33:00 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSnx.sys.sum
[2013/06/26 20:32:48 | 000,000,175 | ---- | C] () -- C:\Windows\System32\drivers\aswSP.sys.sum
[2013/06/26 17:56:12 | 000,001,169 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.lnk
[2013/06/26 17:52:54 | 000,001,131 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
[2013/06/26 17:51:33 | 000,001,224 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
[2013/06/26 17:46:57 | 000,001,315 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2013/06/26 17:46:23 | 000,001,481 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2013/06/26 17:44:13 | 000,000,967 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2013/06/26 17:33:09 | 000,065,536 | ---- | C] () -- C:\Windows\IFinst27.exe
[2013/06/24 18:54:09 | 000,002,599 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MP3 Skype Recorder.lnk
[2013/06/21 21:00:55 | 000,175,176 | ---- | C] () -- C:\Windows\System32\drivers\aswVmm.sys
[2013/06/21 21:00:55 | 000,049,376 | ---- | C] () -- C:\Windows\System32\drivers\aswRvrt.sys
[2013/06/11 16:51:44 | 000,066,808 | ---- | C] () -- C:\Users\LaMa\.recently-used.xbel
[2013/03/21 06:10:18 | 000,042,880 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
[2013/03/09 20:50:22 | 000,444,283 | ---- | C] () -- C:\Program Files\Common Files\WinPcapNmap.exe
[2013/02/19 16:31:18 | 000,178,688 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2013/01/01 21:50:51 | 000,109,256 | ---- | C] () -- C:\Windows\System32\EasyHook64.dll
[2013/01/01 21:50:50 | 000,090,824 | ---- | C] () -- C:\Windows\System32\EasyHook32.dll
[2012/12/27 22:26:28 | 000,212,912 | ---- | C] () -- C:\Users\LaMa\AppData\Local\debuggee.mdmp
[2012/11/19 09:33:32 | 000,065,656 | ---- | C] () -- C:\Windows\System32\bdmpegv.dll
[2012/11/19 09:33:30 | 000,022,640 | ---- | C] () -- C:\Windows\System32\bdmjpeg.dll
[2012/11/11 15:33:55 | 000,001,096 | ---- | C] () -- C:\Users\LaMa\AppData\Local\SRDownloader.nast
[2012/09/14 22:15:36 | 000,000,000 | ---- | C] () -- C:\Users\LaMa\adb
[2012/07/31 17:26:17 | 002,872,000 | ---- | C] () -- C:\Windows\System32\pwNative.exe
[2012/07/31 17:26:16 | 000,015,576 | ---- | C] () -- C:\Windows\System32\pwdrvio.sys
[2012/07/31 17:25:57 | 000,010,200 | ---- | C] () -- C:\Windows\System32\pwdspio.sys
[2012/07/15 21:20:56 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat
[2012/06/11 14:58:21 | 000,004,608 | ---- | C] () -- C:\Users\LaMa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/06/10 14:20:05 | 000,006,550 | ---- | C] () -- C:\Windows\jautoexp.dat
[2012/06/10 11:10:23 | 000,000,644 | RHS- | C] () -- C:\Users\LaMa\ntuser.pol
[2012/06/05 02:35:46 | 000,022,328 | ---- | C] () -- C:\Users\LaMa\AppData\Roaming\PnkBstrK.sys
[2012/06/05 02:34:04 | 002,580,552 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2012/06/05 01:53:27 | 000,000,287 | ---- | C] () -- C:\Windows\game.ini
[2012/06/05 01:24:58 | 000,292,004 | ---- | C] () -- C:\Windows\System32\perfi005.dat
[2012/06/05 01:24:57 | 000,667,844 | ---- | C] () -- C:\Windows\System32\perfh005.dat
[2012/06/05 01:24:57 | 000,140,434 | ---- | C] () -- C:\Windows\System32\perfc005.dat
[2012/06/05 01:24:57 | 000,036,232 | ---- | C] () -- C:\Windows\System32\perfd005.dat

========== ZeroAccess Check ==========

[2009/07/14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010/11/20 23:29:11 | 012,872,192 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 23:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/06/22 10:06:32 | 000,000,000 | ---D | M] -- C:\Users\Herní\AppData\Roaming\Opera
[2013/06/22 10:13:53 | 000,000,000 | ---D | M] -- C:\Users\Herní\AppData\Roaming\TuneUp Software
[2013/06/22 10:34:10 | 000,000,000 | ---D | M] -- C:\Users\Herní\AppData\Roaming\Wargaming.net
[2013/03/08 23:40:26 | 000,000,000 | ---D | M] -- C:\Users\Kapitán\AppData\Roaming\HLSW
[2012/06/27 11:58:02 | 000,000,000 | ---D | M] -- C:\Users\Kapitán\AppData\Roaming\OpenOffice.org
[2012/12/25 04:26:13 | 000,000,000 | ---D | M] -- C:\Users\Kapitán\AppData\Roaming\Opera
[2013/06/19 10:58:54 | 000,000,000 | ---D | M] -- C:\Users\Kapitán\AppData\Roaming\TuneUp Software
[2012/11/22 15:01:03 | 000,000,000 | ---D | M] -- C:\Users\Kapitán\AppData\Roaming\Wargaming.net
[2012/06/09 04:22:55 | 000,000,000 | ---D | M] -- C:\Users\Kapitán\AppData\Roaming\Zoner
[2013/07/05 19:10:38 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\.minecraft
[2012/10/07 13:54:27 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\.techniclauncher
[2013/07/15 12:21:40 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Aperture Deleter
[2012/11/10 14:41:44 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\ApkInstaller
[2013/03/02 14:35:13 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Ashampoo
[2013/05/31 18:18:50 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Audacity
[2013/03/22 20:22:48 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\BANDISOFT
[2012/10/20 17:32:12 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Clickteam
[2005/11/30 07:22:07 | 000,000,000 | RHSD | M] -- C:\Users\LaMa\AppData\Roaming\cod2hack
[2012/07/04 21:52:30 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\craftbukkit
[2013/01/22 17:05:05 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Dev-Cpp
[2013/01/12 11:11:32 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\EQATEC Analytics
[2013/07/23 18:16:47 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\FileZilla
[2013/07/21 11:13:06 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\gd.sos.McPixel
[2013/06/09 12:57:37 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\gtk-2.0
[2013/07/24 10:26:59 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\HLSW
[2013/05/28 18:12:06 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\LolClient
[2013/07/15 14:17:14 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Notepad++
[2012/06/06 02:32:00 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\OpenOffice.org
[2013/06/16 17:41:05 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Opera
[2012/06/06 00:14:15 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\PhotoFiltre
[2013/01/17 18:56:29 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Pinet
[2012/07/07 12:05:09 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Publish Providers
[2012/07/07 12:19:39 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Sony
[2013/04/20 22:06:50 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\TeamViewer
[2013/03/30 18:52:16 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\TechSmith
[2013/06/15 10:47:05 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\TuneUp Software
[2013/06/26 18:30:57 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\uTorrent
[2013/07/23 22:17:54 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\VDownloader
[2013/07/04 18:10:55 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\VitySoft
[2012/12/13 17:11:58 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\wargaming.net

========== Purity Check ==========

========== Custom Scans ==========

< >
[2009/07/14 06:53:46 | 000,032,588 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2009/07/14 06:53:47 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2013/06/17 16:14:09 | 000,000,914 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

< >

< MD5 for: ATAPI.SYS >
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys

< MD5 for: AUTOCHK.EXE >
[2010/11/20 23:29:06 | 000,668,160 | ---- | M] (Microsoft Corporation) MD5=F88A52EB62019D6A62FDD9E08034DBD8 -- C:\Windows\System32\autochk.exe
[2010/11/20 23:29:06 | 000,668,160 | ---- | M] (Microsoft Corporation) MD5=F88A52EB62019D6A62FDD9E08034DBD8 -- C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_e3fb573520033bfa\autochk.exe

< MD5 for: CDROM.SYS >
[2010/11/20 23:29:03 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BE167ED0FDB9C1FA1133953C18D5A6C9 -- C:\Windows\System32\drivers\cdrom.sys
[2010/11/20 23:29:03 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BE167ED0FDB9C1FA1133953C18D5A6C9 -- C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_x86_neutral_6381e09675524225\cdrom.sys
[2010/11/20 23:29:03 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=BE167ED0FDB9C1FA1133953C18D5A6C9 -- C:\Windows\winsxs\x86_cdrom.inf_31bf3856ad364e35_6.1.7601.17514_none_61b0c5ce02098355\cdrom.sys

< MD5 for: EXPLORER.EXE >
[2010/11/20 23:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\explorer.exe
[2010/11/20 23:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe

< MD5 for: HAL.DLL >
[2010/11/20 23:29:19 | 000,194,432 | ---- | M] (Microsoft Corporation) MD5=1BF0D4727FDB437D513CFF8A9359C050 -- C:\Windows\System32\hal.dll
[2010/11/20 23:29:19 | 000,194,432 | ---- | M] (Microsoft Corporation) MD5=1BF0D4727FDB437D513CFF8A9359C050 -- C:\Windows\winsxs\x86_microsoft-windows-hal_31bf3856ad364e35_6.1.7601.17514_none_ad305c8fb7ec5060\hal.dll

< MD5 for: SCECLI.DLL >
[2010/11/20 23:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010/11/20 23:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll

< MD5 for: SERVICES.EXE >
[2009/07/14 03:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\System32\services.exe
[2009/07/14 03:14:36 | 000,259,072 | ---- | M] (Microsoft Corporation) MD5=5F1B6A9C35D3D5CA72D6D6FDEF9747D6 -- C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/14 03:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\System32\svchost.exe
[2009/07/14 03:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe

< MD5 for: TCPIP.SYS >
[2010/11/20 23:29:20 | 001,290,112 | ---- | M] (Microsoft Corporation) MD5=37E8FA3779668837CA9E2C36D2415949 -- C:\Windows\System32\drivers\tcpip.sys
[2010/11/20 23:29:20 | 001,290,112 | ---- | M] (Microsoft Corporation) MD5=37E8FA3779668837CA9E2C36D2415949 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17514_none_b5257c3dc4a85a01\tcpip.sys

< MD5 for: USERINIT.EXE >
[2010/11/20 23:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010/11/20 23:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 23:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010/11/20 23:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe

< >

< %systemroot%*.* /U /s >
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[5 C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[1 C:\Windows\Installer\*.tmp files -> C:\Windows\Installer\*.tmp -> ]
[18 C:\Windows\Temp\_avast_\*.tmp files -> C:\Windows\Temp\_avast_\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2013/07/05 19:10:38 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\.minecraft
[2012/10/07 13:54:27 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\.techniclauncher
[2013/06/26 17:55:19 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Adobe
[2013/07/15 12:21:40 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Aperture Deleter
[2012/11/10 14:41:44 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\ApkInstaller
[2013/03/02 14:35:13 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Ashampoo
[2013/05/31 18:18:50 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Audacity
[2013/03/22 20:22:48 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\BANDISOFT
[2012/10/20 17:32:12 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Clickteam
[2005/11/30 07:22:07 | 000,000,000 | RHSD | M] -- C:\Users\LaMa\AppData\Roaming\cod2hack
[2012/07/04 21:52:30 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\craftbukkit
[2013/01/22 17:05:05 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Dev-Cpp
[2013/03/08 23:39:47 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\DVD Flick
[2013/01/12 11:11:32 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\EQATEC Analytics
[2013/07/24 10:53:53 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\FileZilla
[2013/07/21 11:13:06 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\gd.sos.McPixel
[2013/06/09 12:57:37 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\gtk-2.0
[2013/07/24 10:56:23 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\HLSW
[2012/06/05 00:21:26 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Identities
[2013/05/28 18:12:06 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\LolClient
[2012/06/09 23:17:25 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Macromedia
[2013/07/22 12:43:57 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Malwarebytes
[2011/04/12 04:24:18 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Media Center Programs
[2013/06/17 14:25:52 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Media Player Classic
[2013/07/22 14:50:11 | 000,000,000 | --SD | M] -- C:\Users\LaMa\AppData\Roaming\Microsoft
[2012/12/27 21:34:16 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Microsoft Corporation
[2012/11/10 13:19:12 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Mozilla
[2012/11/01 19:37:59 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Nero
[2013/07/15 14:17:14 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Notepad++
[2012/06/24 21:14:53 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\NVIDIA
[2012/06/06 02:32:00 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\OpenOffice.org
[2013/06/16 17:41:05 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Opera
[2012/06/06 00:14:15 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\PhotoFiltre
[2013/01/17 18:56:29 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Pinet
[2012/07/07 12:05:09 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Publish Providers
[2013/07/24 11:45:43 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Skype
[2012/07/07 12:19:39 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Sony
[2013/04/20 22:06:50 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\TeamViewer
[2013/03/30 18:52:16 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\TechSmith
[2013/06/15 10:47:05 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\TuneUp Software
[2013/06/26 18:30:57 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\uTorrent
[2013/07/23 22:17:54 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\VDownloader
[2013/07/04 18:10:55 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\VitySoft
[2012/12/13 17:11:58 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\wargaming.net
[2013/07/02 11:40:05 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\WinRAR
[2013/07/23 13:26:31 | 000,000,000 | ---D | M] -- C:\Users\LaMa\AppData\Roaming\Xfire

< %APPDATA%\*.exe /s >
[2011/03/01 15:26:14 | 000,270,848 | ---- | M] (Teckda) -- C:\Users\LaMa\AppData\Roaming\.minecraft\Minecraft Beta Cracked.exe
[2011/12/14 23:59:04 | 000,270,142 | ---- | M] () -- C:\Users\LaMa\AppData\Roaming\.minecraft\Minecraft.exe
[2011/07/19 17:12:44 | 000,290,834 | ---- | M] () -- C:\Users\LaMa\AppData\Roaming\.minecraft\Uninstall.exe
[2013/03/10 00:21:19 | 000,102,349 | ---- | M] () -- C:\Users\LaMa\AppData\Roaming\Aperture Deleter\MC service.exe
[2012/11/10 14:41:43 | 000,191,488 | ---- | M] () -- C:\Users\LaMa\AppData\Roaming\ApkInstaller\adb.exe
[2012/11/10 13:23:16 | 000,158,000 | ---- | M] () -- C:\Users\LaMa\AppData\Roaming\Mozilla\Firefox\Profiles\ngr2m2kv.default\FlashGot.exe
[2013/05/14 13:03:41 | 001,051,984 | ---- | M] (BitTorrent Inc.) -- C:\Users\LaMa\AppData\Roaming\uTorrent\uTorrent.exe

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job >
[2013/07/24 11:29:50 | 000,000,914 | ---- | M] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\system32\drivers\*.sys /3 >
[2013.07.24 10:57:59 | 000,137,464 | ---- | M] () -- C:\Windows\system32\drivers\PnkBstrK.sys

< %systemroot%\system32\*.* /3 >
[2013.07.24 09:55:36 | 000,021,072 | -H-- | M] () -- C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.24 09:55:36 | 000,021,072 | -H-- | M] () -- C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.23 14:45:43 | 003,648,064 | ---- | M] () -- C:\Windows\system32\FNTCACHE.DAT
[2013.07.23 22:32:32 | 000,140,434 | ---- | M] () -- C:\Windows\system32\perfc005.dat
[2013.07.23 22:32:32 | 000,121,398 | ---- | M] () -- C:\Windows\system32\perfc009.dat
[2013.07.23 22:32:32 | 000,667,844 | ---- | M] () -- C:\Windows\system32\perfh005.dat
[2013.07.23 22:32:32 | 000,653,526 | ---- | M] () -- C:\Windows\system32\perfh009.dat
[2013.07.23 22:32:32 | 001,581,574 | ---- | M] () -- C:\Windows\system32\PerfStringBackup.INI
[2013.07.24 12:10:43 | 000,066,872 | ---- | M] () -- C:\Windows\system32\PnkBstrA.exe
[2013.07.24 12:09:34 | 000,214,520 | ---- | M] () -- C:\Windows\system32\PnkBstrB.exe
[2013.07.24 12:09:34 | 000,214,520 | ---- | M] () -- C:\Windows\system32\PnkBstrB.xtr

< %SYSTEMDRIVE%\*.exe >

< >

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >

< >

< %PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5 >

< %PROGRAMFILES%\Internet Explorer\iexplore.exe /md5 >
[2012.09.23 20:56:08 | 000,748,336 | ---- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 -- C:\Program Files\Internet Explorer\iexplore.exe

< %PROGRAMFILES%\Opera\opera.exe /md5 >
[2013.07.08 17:06:59 | 000,879,456 | ---- | M] (Opera Software) MD5=FFC67949EF7C2BF307ED91B293581DD2 -- C:\Program Files\Opera\opera.exe

< %PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5 >

< >

< %SystemDrive%\PhysicalMBR.bin /md5 >
[2013.07.24 10:28:43 | 000,000,512 | ---- | M] () MD5=D13554D2D1D1BBA003A77126429F5574 -- C:\PhysicalMBR.bin

< >

< *crack* /s >
[2013.05.22 06:31:10 | 000,005,566 | ---- | M] () -- \Games\Don't Starve (21 May 2013) Underground\data\inventoryimages\tallbirdegg_cracked.tex
[2013.05.22 06:31:16 | 000,174,884 | ---- | M] () -- \Games\Don't Starve (21 May 2013) Underground\data\levels\textures\noise_cracked.tex
[2013.04.20 14:30:42 | 000,004,296 | ---- | M] () -- \Games\Don't Starve (21 May 2013) Underground\data\scripts\components\wisecracker.lua
[2008.03.04 16:01:54 | 000,062,238 | ---- | M] () -- \Program Files\GIMP-2.0\share\gimp\2.0\patterns\cracked.pat
[2003.12.05 15:52:40 | 000,000,796 | ---- | M] () -- \Program Files\gta san andreas\data\Decision\Craig\crack1.ped
[2008.09.08 22:55:14 | 000,000,204 | ---- | M] () -- \Program Files\Image-Line\FL Studio 10\Plugins\Fruity\Effects\Hardcore\Presets\I cracked my Tube!.hdprg
[2010.01.15 22:56:40 | 000,000,272 | ---- | M] () -- \Program Files\Image-Line\FL Studio 10\Plugins\Fruity\Generators\Drumaxx\Drum Patches\Sound FX\Crack.dmpatch
[2010.01.15 22:56:40 | 000,000,272 | ---- | M] () -- \Program Files\Image-Line\FL Studio 10\Plugins\Fruity\Generators\DrumPad\Drum Patches\Sound FX\Crack.dmpatch
[2013.06.25 15:44:43 | 000,034,302 | ---- | M] () -- \Program Files\Steam\SteamApps\common\Team Fortress 2\tf\download\sound\cga\iwantcrackgiveaway.mp3
[2013.03.30 19:39:50 | 000,000,201 | ---- | M] () -- \Users\Kapitán\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.9worldcrack.com%2Ffavicon.png
[2013.03.30 19:39:10 | 000,000,868 | ---- | M] () -- \Users\Kapitán\AppData\Local\Opera\Opera\icons\http%3A%2F%2Fwww.crackserialcodes.com%2Ffavicon.png
[2012.02.09 17:36:05 | 000,001,069 | ---- | M] () -- \Users\Kapitán\Desktop\Kaja\Desktop\Minecraft Beta Cracked – zástupce.lnk
[2011.03.01 15:26:14 | 000,270,848 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.minecraft\Minecraft Beta Cracked.exe
[2013.01.10 06:45:48 | 000,000,129 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.minecraft\texturepacks\Lagreduce\textures\blocks\stonebricksmooth_cracked.png
[2013.04.26 09:38:24 | 000,000,469 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.minecraft\texturepacks\LaMa´s text.pack v0.1 - beta\textures\blocks\stonebricksmooth_cracked.png
[2013.07.04 18:11:11 | 000,005,369 | ---- | M] () -- \Users\LaMa\AppData\Roaming\VitySoft\FRD\plugins\crackle.frp
[2013.06.26 17:17:57 | 000,315,178 | R--- | M] () -- \Users\LaMa\Desktop\Crack\ADBE_CRACK - 32bit.rar
[2013.06.26 17:17:57 | 000,377,747 | R--- | M] () -- \Users\LaMa\Desktop\Crack\ADBE_CRACK - 64bit.rar
[2012.03.28 20:27:54 | 019,396,518 | ---- | M] () -- \Users\LaMa\Desktop\dulezite\Blbosti\TABLETAK\TABLET SD KARTA\00334-GOF2_1.0.4.9_Adreno_Cracked_Nops (2).apk
[2012.03.28 20:27:54 | 019,396,518 | ---- | M] () -- \Users\LaMa\Desktop\dulezite\Blbosti\TABLETAK\TABLET SD KARTA\00334-GOF2_1.0.4.9_Adreno_Cracked_Nops.apk
[2013.01.15 17:15:48 | 004,363,581 | ---- | M] () -- \Users\LaMa\Desktop\dulezite\Blbosti\TABLETAK\TABLET SD KARTA\Download\Android (HTC Sensation) Apps and Games\Games\Backstab_HD_Samsung_GTi9000_Galaxy_S_android_v1.2.3_Cracked_Twingo.apk
[2013.01.15 17:16:32 | 014,266,749 | ---- | M] () -- \Users\LaMa\Desktop\dulezite\Blbosti\TABLETAK\TABLET SD KARTA\Download\Android (HTC Sensation) Apps and Games\Games\EA_SPORTS_FIFA_12_Cracked_Nops.apk
[2013.01.15 17:18:22 | 005,574,806 | ---- | M] () -- \Users\LaMa\Desktop\dulezite\Blbosti\TABLETAK\TABLET SD KARTA\Download\Android (HTC Sensation) Apps and Games\Games\PES 12 v1 cracked.apk

< *keygen* /s >
[2013.06.26 17:17:25 | 000,063,365 | R--- | M] () -- \Users\LaMa\Desktop\Crack\adobe_PS_CS5_keygen.exe
[2013.06.26 17:17:25 | 000,003,121 | R--- | M] () -- \Users\LaMa\Desktop\Crack\KeyGen-Readme.txt

< *loader* /s >
[2012.12.07 11:08:57 | 000,071,208 | ---- | M] () -- \Games\World_of_Tanks\PhysXLoader.dll
[1 \Games\World_of_Tanks\*.tmp files -> \Games\World_of_Tanks\*.tmp -> ]
[2013.02.26 18:36:29 | 000,003,668 | ---- | M] () -- \Games\World_of_Tanks\res\scripts\client\helpers\rssdownloader.pyc
[2013.06.12 13:05:20 | 000,006,463 | ---- | M] () -- \Games\World_of_Tanks\res\scripts\client\tutorial\loader.pyc
[2010.03.09 04:28:40 | 005,297,608 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\Photodownloader.exe
[2010.03.09 01:38:58 | 000,011,161 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\bitmaps\main_window\C_LoadError.png
[2010.03.09 01:38:58 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\da_dk\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\de_de\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\en_us\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\es_es\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\fi_fi\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\fr_fr\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\it_it\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\ja_jp\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\ko_kr\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\nl_nl\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\no_no\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\pt_br\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\sv_se\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,308 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\zh_cn\Photodownloader.ini
[2010.03.09 01:39:00 | 000,000,011 | ---- | M] () -- \Program Files\Adobe\Adobe Bridge CS5\apd\shared_assets\locales\zh_tw\Photodownloader.ini
[2010.03.19 00:21:56 | 000,063,312 | ---- | M] () -- \Program Files\Common Files\microsoft shared\VS7Debug\coloader80.dll
[2010.03.18 01:17:14 | 000,004,096 | ---- | M] () -- \Program Files\Common Files\microsoft shared\VS7Debug\coloader80.tlb
[2013.02.19 13:35:18 | 000,032,768 | ---- | M] () -- \Program Files\Gameforge4D\4Story_CZ\TLoader.exe
[2008.02.13 12:43:00 | 000,003,264 | ---- | M] () -- \Program Files\GIMP-2.0\etc\gtk-2.0\gdk-pixbuf.loaders
[2008.03.04 16:20:24 | 000,032,280 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-ani.dll
[2008.03.04 16:20:24 | 000,031,040 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-bmp.dll
[2008.03.04 16:20:24 | 000,045,392 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-gif.dll
[2008.03.04 16:20:24 | 000,030,392 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-ico.dll
[2008.03.04 16:20:26 | 000,037,456 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-jpeg.dll
[2008.03.04 16:20:26 | 000,024,904 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-pcx.dll
[2008.03.04 16:20:26 | 000,039,400 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-png.dll
[2008.03.04 16:20:26 | 000,027,264 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-pnm.dll
[2008.03.04 16:20:26 | 000,022,088 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-ras.dll
[2008.03.04 16:20:26 | 000,027,592 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-tga.dll
[2008.03.04 16:20:28 | 000,031,400 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-tiff.dll
[2008.03.04 16:20:28 | 000,021,632 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-wbmp.dll
[2008.03.04 16:20:28 | 000,027,584 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-xbm.dll
[2008.03.04 16:20:28 | 000,045,304 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-xpm.dll
[2008.01.21 20:57:42 | 000,009,272 | ---- | M] () -- \Program Files\GIMP-2.0\lib\gtk-2.0\2.10.0\loaders\svg_loader.dll
[2010.11.30 09:32:34 | 000,170,288 | ---- | M] () -- \Program Files\Cheat Engine 6.2\Kernelmoduleunloader.exe
[2012.02.16 14:44:38 | 000,000,404 | ---- | M] () -- \Program Files\leageoflegends\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.30\deploy\assets\storeImages\layout\small_loader.gif
[2012.07.20 21:38:54 | 000,701,440 | ---- | M] () -- \Program Files\MTA San Andreas 1.3\MTA\loader.dll
[2012.04.19 17:47:30 | 000,006,081 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\program\pythonloader.py
[2012.04.13 21:00:14 | 000,020,992 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\program\pythonloader.uno.dll
[2012.04.19 17:50:38 | 000,000,171 | ---- | M] () -- \Program Files\OpenOffice.org 3\Basis\program\pythonloader.uno.ini
[2012.04.13 21:00:00 | 000,029,696 | ---- | M] () -- \Program Files\OpenOffice.org 3\URE\bin\javaloader.uno.dll
[2012.04.19 13:08:12 | 000,003,867 | ---- | M] () -- \Program Files\OpenOffice.org 3\URE\java\unoloader.jar
[2008.10.10 14:50:26 | 000,002,223 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp7_azul_preloader.swf
[2008.10.10 14:50:26 | 000,001,841 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp7_black_outline_preloader.swf
[2008.10.10 14:50:26 | 000,001,810 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp7_black_preloader.swf
[2008.10.10 14:50:26 | 000,002,173 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp7_blue_preloader.swf
[2008.10.10 14:50:26 | 000,028,899 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp7_branded_large_preloader.swf
[2008.10.10 14:50:26 | 000,017,183 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp7_branded_small_preloader.swf
[2008.10.10 14:50:26 | 000,002,140 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp7_gray_grad_preloader.swf
[2008.10.10 14:50:26 | 000,001,845 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp7_white_preloader.swf
[2008.10.10 14:50:26 | 000,002,278 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp8_azul_preloader.swf
[2008.10.10 14:50:26 | 000,001,899 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp8_black_outline_preloader.swf
[2008.10.10 14:50:26 | 000,001,863 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp8_black_preloader.swf
[2008.10.10 14:50:26 | 000,002,227 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp8_blue_preloader.swf
[2008.10.10 14:50:26 | 000,028,967 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp8_branded_large_preloader.swf
[2008.10.10 14:50:26 | 000,017,248 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp8_branded_small_preloader.swf
[2008.10.10 14:50:26 | 000,002,204 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp8_gray_grad_preloader.swf
[2008.10.10 14:50:26 | 000,001,899 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\fp8_white_preloader.swf
[2008.10.10 14:50:26 | 000,236,529 | ---- | M] () -- \Program Files\TechSmith\Camtasia Studio 6\Media\Studio\Swf\Preloaders\preloaders_src.zip
[2012.12.20 23:25:42 | 000,879,104 | ---- | M] () -- \Program Files\VDownloader\VDownloader.exe
[2011.03.06 17:42:30 | 000,015,086 | ---- | M] () -- \Program Files\VDownloader\VDownloader.ico
[2012.12.20 23:25:42 | 000,007,680 | ---- | M] () -- \Program Files\VDownloader\VDownloader.pdb
[2012.12.20 23:20:54 | 000,369,664 | ---- | M] () -- \Program Files\VDownloader\VDownloaderUI.dll
[2011.08.18 18:14:40 | 004,348,416 | ---- | M] () -- \Program Files\VDownloader\Addons\npVDownloader.dll
[2012.06.16 11:09:42 | 000,004,810 | ---- | M] () -- \Program Files\VDownloader\Addons\FireFox\Vdownloader.xpi
[2011.08.18 18:14:18 | 000,000,247 | ---- | M] () -- \Program Files\VDownloader\Addons\FireFox\chrome\content\vdownloader.xul
[2012.12.20 23:20:56 | 000,053,248 | ---- | M] () -- \Program Files\VDownloader\ar\VDownloader.resources.dll
[2012.12.20 23:20:56 | 000,053,248 | ---- | M] () -- \Program Files\VDownloader\de\VDownloader.resources.dll
[2012.12.20 23:20:56 | 000,053,248 | ---- | M] () -- \Program Files\VDownloader\es\VDownloader.resources.dll
[2012.12.20 23:20:56 | 000,053,248 | ---- | M] () -- \Program Files\VDownloader\fr\VDownloader.resources.dll
[2012.12.20 23:20:56 | 000,040,960 | ---- | M] () -- \Program Files\VDownloader\hu\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,049,152 | ---- | M] () -- \Program Files\VDownloader\it\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,049,152 | ---- | M] () -- \Program Files\VDownloader\ja\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,032,768 | ---- | M] () -- \Program Files\VDownloader\ko\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,049,152 | ---- | M] () -- \Program Files\VDownloader\nl\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,032,768 | ---- | M] () -- \Program Files\VDownloader\pl\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,040,960 | ---- | M] () -- \Program Files\VDownloader\pt-BR\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,057,344 | ---- | M] () -- \Program Files\VDownloader\ru\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,018,944 | ---- | M] () -- \Program Files\VDownloader\sr\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,036,864 | ---- | M] () -- \Program Files\VDownloader\sr-Cyrl-CS\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,045,056 | ---- | M] () -- \Program Files\VDownloader\tr\VDownloader.resources.dll
[2012.12.20 23:20:58 | 000,045,056 | ---- | M] () -- \Program Files\VDownloader\zh-CHS\VDownloader.resources.dll
[2013.03.09 20:50:24 | 000,001,901 | ---- | M] () -- \ProgramData\Microsoft\Windows\Start Menu\Programs\VDownloader\VDownloader.lnk
[2012.04.28 02:14:26 | 000,072,638 | ---- | M] () -- \ProgramData\Skype\Apps\login\images\loader.gif
[2012.04.28 02:14:26 | 000,003,032 | ---- | M] () -- \ProgramData\Skype\Apps\login\images\loader.png
[2013.03.09 20:50:24 | 000,001,901 | ---- | M] () -- \Users\All Users\Microsoft\Windows\Start Menu\Programs\VDownloader\VDownloader.lnk
[2012.04.28 02:14:26 | 000,072,638 | ---- | M] () -- \Users\All Users\Skype\Apps\login\images\loader.gif
[2012.04.28 02:14:26 | 000,003,032 | ---- | M] () -- \Users\All Users\Skype\Apps\login\images\loader.png
[2013.04.28 12:42:58 | 000,000,753 | ---- | M] () -- \Users\Herní\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFFQ71SE\AdLoader[1].htm
[2013.06.21 21:33:50 | 000,001,511 | ---- | M] () -- \Users\Herní\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VS2UK4CA\AdLoader[1].htm
[2013.06.21 21:33:51 | 000,109,448 | ---- | M] () -- \Users\Herní\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YHGHTFB5\AdLoader-b3e321cab5fbc3c4ed10b513bb467bae.min[1].js
[2013.06.19 10:54:50 | 000,109,448 | ---- | M] () -- \Users\Kapitán\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CSXGD6MY\AdLoader-b3e321cab5fbc3c4ed10b513bb467bae.min[1].js
[2013.06.19 10:54:49 | 000,001,511 | ---- | M] () -- \Users\Kapitán\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO8K33DX\AdLoader[1].htm
[2013.06.19 07:57:25 | 000,000,701 | ---- | M] () -- \Users\Kapitán\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\AR0YK2BQ\fontLoader[1].swf
[2013.06.19 07:59:27 | 000,000,177 | ---- | M] () -- \Users\Kapitán\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FXJ9M4X7\loaderxml[1].swf
[2013.06.19 10:58:37 | 000,000,365 | ---- | M] () -- \Users\Kapitán\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\FXJ9M4X7\widget_ajax_loader[1].js
[2013.06.19 07:59:26 | 000,000,701 | ---- | M] () -- \Users\Kapitán\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PK2Z6GR1\fontLoader[1].swf
[2013.06.19 12:05:30 | 000,000,365 | ---- | M] () -- \Users\Kapitán\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PK2Z6GR1\widget_ajax_loader[1].js
[2013.06.19 07:57:26 | 000,000,177 | ---- | M] () -- \Users\Kapitán\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VEXRJHWZ\loaderxml[1].swf
[2013.06.19 10:55:13 | 000,000,365 | ---- | M] () -- \Users\Kapitán\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VEXRJHWZ\widget_ajax_loader[1].js
[2012.11.11 15:35:23 | 000,001,096 | ---- | M] () -- \Users\LaMa\AppData\Local\SRDownloader.nast
[2005.06.21 00:45:24 | 000,000,544 | ---- | M] () -- \Users\LaMa\AppData\Local\Macromedia\Flash 8\en\Configuration\Classes\FP7\MovieClipLoader.as
[2005.06.21 00:45:26 | 000,000,544 | ---- | M] () -- \Users\LaMa\AppData\Local\Macromedia\Flash 8\en\Configuration\Classes\FP8\MovieClipLoader.as
[2005.07.13 21:06:52 | 000,010,454 | ---- | M] () -- \Users\LaMa\AppData\Local\Macromedia\Flash 8\en\Configuration\Classes\mx\controls\Loader.as
[32 \Users\LaMa\AppData\Local\Temp\*.tmp files -> \Users\LaMa\AppData\Local\Temp\*.tmp -> ]
[2012.09.28 16:14:30 | 000,003,203 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.minecraft\ModLoader.txt
[2012.10.07 19:52:44 | 000,003,170 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.minecraft\ModLoader.txt.1
[2012.10.07 20:20:16 | 000,000,000 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.minecraft\ModLoader.txt.1.lck
[2012.10.07 20:20:18 | 000,003,170 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.minecraft\ModLoader.txt.2
[2012.10.07 20:20:16 | 000,000,000 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.minecraft\ModLoader.txt.lck
[2012.10.07 20:20:17 | 000,000,194 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.minecraft\config\ModLoader.cfg
[2012.10.06 12:08:19 | 000,027,152 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.techniclauncher\yogbox\ModLoader.txt
[2012.10.06 12:07:53 | 000,000,833 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.techniclauncher\yogbox\config\ModLoader.cfg
[2012.10.06 12:07:29 | 000,000,047 | ---- | M] () -- \Users\LaMa\AppData\Roaming\.techniclauncher\yogbox\config\mod_ModLoaderMp.cfg
[2013.03.09 20:50:25 | 000,001,907 | ---- | M] () -- \Users\LaMa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\VDownloader.lnk
[2013.06.16 09:51:28 | 000,012,760 | ---- | M] () -- \Users\LaMa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\File Downloader.lnk
[2012.03.27 20:28:52 | 000,790,016 | ---- | M] () -- \Users\LaMa\Desktop\dulezite\Blbosti\TABLETAK\TABLET SD KARTA\downloader_letitbit_23642538_93.exe
[2012.12.27 15:31:04 | 000,053,726 | ---- | M] () -- \Users\LaMa\Desktop\dulezite\Blbosti\TABLETAK\TABLET SD KARTA\Download\APK Games\YouTube Downloader 2.1r1.apk
[2013.07.23 22:16:23 | 000,126,906 | ---- | M] () -- \Windows\Prefetch\VDOWNLOADER.EXE-ED1B9E58.pf
[2009.07.14 03:03:49 | 000,003,584 | -H-- | M] () -- \Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2009.07.14 03:15:12 | 000,038,400 | ---- | M] () -- \Windows\System32\dmloader.dll
[2009.07.14 06:54:01 | 000,003,532 | ---- | M] () -- \Windows\System32\Tasks\Microsoft\Windows\WindowsColorSystem\Calibration Loader
[2012.06.05 01:21:31 | 000,002,883 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_3318c4cd5e5d0f86.manifest
[2012.06.05 01:21:31 | 000,034,896 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_3318c4cd5e5d0f86_winload.exe.mui_3bc5b827
[2012.06.05 01:21:31 | 000,030,272 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_3318c4cd5e5d0f86_winresume.exe.mui_ff8b5358
[2011.04.12 04:15:57 | 000,002,883 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_en-us_766f102945576be4.manifest
[2011.04.12 04:15:57 | 000,033,344 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_en-us_766f102945576be4_winload.exe.mui_3bc5b827
[2011.04.12 04:15:57 | 000,029,776 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_en-us_766f102945576be4_winresume.exe.mui_ff8b5358
[2010.11.20 23:31:02 | 000,004,225 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_5d2e241dcae8f953.manifest
[2010.11.20 23:31:02 | 000,508,904 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_5d2e241dcae8f953_winload.exe_75835076
[2010.11.20 23:31:02 | 000,442,720 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_5d2e241dcae8f953_winresume.exe_85cd1215
[2009.07.14 04:17:38 | 000,002,894 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-s..ive-blackbox-loader_31bf3856ad364e35_6.1.7600.16385_none_6b097e5cb26f7a23.manifest
[2009.07.14 04:17:38 | 000,017,472 | ---- | M] () -- \Windows\winsxs\Backup\x86_microsoft-windows-s..ive-blackbox-loader_31bf3856ad364e35_6.1.7600.16385_none_6b097e5cb26f7a23_spldr.sys_98bd87a0
[2009.07.14 03:54:50 | 000,002,883 | ---- | M] () -- \Windows\winsxs\Manifests\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_3318c4cd5e5d0f86.manifest
[2011.04.12 04:15:12 | 000,002,883 | ---- | M] () -- \Windows\winsxs\Manifests\x86_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_en-us_766f102945576be4.manifest
[2010.11.20 23:23:54 | 000,004,225 | ---- | M] () -- \Windows\winsxs\Manifests\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_5d2e241dcae8f953.manifest
[2009.07.14 03:52:31 | 000,002,894 | ---- | M] () -- \Windows\winsxs\Manifests\x86_microsoft-windows-s..ive-blackbox-loader_31bf3856ad364e35_6.1.7600.16385_none_6b097e5cb26f7a23.manifest
[2009.07.14 03:15:12 | 000,038,400 | ---- | M] () -- \Windows\winsxs\x86_microsoft-windows-audio-dmusic_31bf3856ad364e35_6.1.7600.16385_none_45ca7214f0f664cb\dmloader.dll
[2009.07.14 03:03:49 | 000,003,584 | -H-- | M] () -- \Windows\winsxs\x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7600.16385_none_0a884619dd2388ad\api-ms-win-core-libraryloader-l1-1-0.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 6144 bytes -> C:\Windows\Cursors\arrow_n.cur:NEDTA.DAT
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:56E2E879

< End of report >

lamakak · #24 Příspěvek od **lamakak** » 24 črc 2013 12:33

extras

OTL Extras logfile created on: 7/24/2013 10:22:21 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\LaMa\Desktop
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Czech Republic | Language: CSY | Date Format: d.M.yyyy

959.43 Mb Total Physical Memory | 212.30 Mb Available Physical Memory | 22.13% Memory free
3.48 Gb Paging File | 2.53 Gb Available in Paging File | 72.82% Paging File free
Paging file location(s): c:\pagefile.sys 2600 3000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 53.66 Gb Free Space | 36.00% Space Free | Partition Type: NTFS

Computer Name: LAMA-PC | User Name: LaMa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03E90286-35FE-4047-AF92-1A173FE6C964}" = lport=443 | protocol=6 | dir=in | app=system |
"{04D8E2B8-51D8-4DDA-BE74-BF314316A863}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{26D6BAEE-2C2D-46DC-BD37-73852E079645}" = rport=138 | protocol=17 | dir=out | app=system |
"{30B26F46-EBE2-423A-AE78-F1D90683A402}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3563BF42-EAE1-4FCD-95EB-7FF8D6465E37}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{3D51C1C2-BAF8-4723-8FBD-E061AAA3D03C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{465AE2F2-869B-4B5B-9718-281A9D47D4CB}" = lport=138 | protocol=17 | dir=in | app=system |
"{572EDB83-3878-4898-B847-169E542DF878}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{64EDD61A-C8A0-4BE9-A9B4-C39CDE729B80}" = rport=1723 | protocol=6 | dir=out | app=system |
"{69A2D50B-6C27-4884-906D-B863FEED9C61}" = lport=162 | protocol=17 | dir=in | svc=snmptrap | app=%systemroot%\system32\snmptrap.exe |
"{69B6AA68-7C88-49E5-9BDA-A011854EDF8A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6C10051A-4756-4234-B97E-FEEBDF0FA7D5}" = lport=137 | protocol=17 | dir=in | app=system |
"{73B30239-A20C-4E5A-979D-BEEBE039D999}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7D0859E4-08D5-4145-A2ED-4EDAA478F106}" = rport=445 | protocol=6 | dir=out | app=system |
"{7EFB193A-E89E-4E21-BA50-8881D1C9D27B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{7F5B3D41-9A2D-4F43-A03E-7C84946293F6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{80CB7199-C442-4DC2-976B-EA1A7C27590B}" = rport=137 | protocol=17 | dir=out | app=system |
"{83CD7CA2-E04C-41E1-8BB1-87559EF55C56}" = lport=445 | protocol=6 | dir=in | app=system |
"{8632DAE5-6629-4EDA-A9AF-87AECA79179B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{88AD323B-1E4B-444A-B048-2583B5E8DCF9}" = rport=139 | protocol=6 | dir=out | app=system |
"{8A8CFF7A-B7AE-47A2-95F2-CBA565768AB9}" = rport=1701 | protocol=17 | dir=out | app=system |
"{A4EE7477-57B0-4B1F-A69D-12DFD27443F6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B51B5F71-8817-4926-A150-7DDE65A9588B}" = lport=1701 | protocol=17 | dir=in | app=system |
"{C43322B4-6D5B-4B61-AE71-86B83264693B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CB31146D-8928-463C-99A0-C011A72B4DCA}" = lport=1723 | protocol=6 | dir=in | app=system |
"{D472FB87-4F55-48B5-A236-1B941226E73A}" = lport=10245 | protocol=6 | dir=in | app=system |
"{D9F410CA-EA2B-476C-9F1B-44D6B2637C11}" = lport=139 | protocol=6 | dir=in | app=system |
"{DB4234B4-38D3-42A2-B898-A8880E19EE83}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EEE4BD1B-5D49-4DC1-A60A-0F6A24E6A62D}" = lport=2869 | protocol=6 | dir=in | app=system |
"{FDAB0516-9822-44BC-B78B-8950FFA229B6}" = lport=10243 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{029DF7AD-F36D-4BC6-A77C-23033B68437A}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{02A7D9C1-F8AC-4ED3-98C9-2E28DAEBFE5E}" = protocol=47 | dir=in | app=system |
"{07BE0649-EA86-45B2-8725-C7C8A4EC83E6}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{0FBFACB7-EA26-4209-8C80-C645A6FB7C21}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{0FCBBCBC-405B-4043-8AD8-C57DEED99642}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{27853278-DAA0-45E4-B9D7-1DDE8D5F4D1F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{2CD9AE65-04C0-4D43-883B-7683E6C1E2B6}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2EC72BFE-0F1C-4E8D-9BD2-4A17968FD697}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{305BFB81-133E-495F-9918-E1B3C227A817}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{34A46B7B-23BB-4990-995E-4CD0DDA916B4}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{3A88CD60-EDFA-44D2-9BAB-43E775774234}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3B073063-BFA1-4252-899D-CC4C2E2148FA}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{3E407DAC-CE0B-44B6-8D16-1A0BE823A4ED}" = protocol=47 | dir=out | app=system |
"{43A57DCE-5A99-4CF1-8EE5-20917C286094}" = protocol=6 | dir=out | app=system |
"{554B1948-E3FE-4CCA-BF43-4FB123DE15D0}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{6C860BDC-74A6-4544-B43F-BE5DC0A8825B}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{6D81EE59-4F51-42A1-8AED-83EF3FF655A2}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{6EE6108F-B40B-4853-9142-33640ECDEBB0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{76BCB6DB-E581-4C12-BF31-5D405302FA81}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{7F110F27-D300-451C-A26F-B2E5593330AB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{83AA085B-0F98-4137-BA11-C4189D99B442}" = protocol=1 | dir=in | name=hlsw icmp |
"{9F6F6CDD-9443-4670-B36D-CBF295EF9D74}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{A1DE333A-C538-4AAD-8426-7DDB23FF24C6}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{A9C9C099-7CBC-4F7A-85C2-D8627D5FDC58}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AC9A7FF5-5DF6-4FF7-8EC7-9152D1B1BC43}" = protocol=17 | dir=in | app=c:\users\lama\appdata\roaming\utorrent\utorrent.exe |
"{AD1C80F5-B07F-44B5-BC13-038BBEF0DFC2}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{B9EFF0F1-1673-40A6-B062-0B6597C075C0}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BB3595D4-F5A7-44B3-B66F-5C393FE7E25B}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{BFC7C27A-9EB2-482F-9D70-0754C55A591F}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{D2E25F8B-A31F-4176-8DB3-5ABA0F66D7D1}" = protocol=58 | dir=in | app=system |
"{D3B7A016-C322-4C8C-82A2-A04D0E3FF224}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DADA78B1-6881-473B-BCCE-CAA0E42E00A1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DFFC0F97-E846-463F-B0D8-6F3F9BCCDE71}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{EFEF5633-F71F-474B-9848-51BC5DCA9AAD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F295C9CA-6EB5-403D-93EC-A6FCD5599276}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F327ECC4-E463-407D-BB4D-8BB26848A950}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F81A5EFC-B269-4E43-9C5C-F71BF6E75799}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\team fortress 2\hl2.exe |
"{F8F89727-3657-4236-97BD-0F7BEF7AF177}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\team fortress 2\hl2.exe |
"{FB8500AA-7739-4D02-A890-7342E2F28F26}" = protocol=6 | dir=in | app=c:\users\lama\appdata\roaming\utorrent\utorrent.exe |
"TCP Query User{0985DA39-85AE-455C-9932-CBE3FE71CF54}C:\program files\hlsw\hlsw.exe" = protocol=6 | dir=in | app=c:\program files\hlsw\hlsw.exe |
"TCP Query User{1622D04E-CEC7-406D-8F81-69E04CFDCEF2}C:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe |
"TCP Query User{1E1F6079-CE3B-42F8-8F0B-CCEE433B9770}C:\games\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=c:\games\world_of_tanks\wotlauncher.exe |
"TCP Query User{1F168AC0-FE20-4EE7-BFD4-90C5C668D8D3}C:\program files\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\java.exe |
"TCP Query User{46FBC2A4-1EEC-48AA-85C4-D347633F07E3}C:\users\lama\desktop\wow private server\arcemu\arcemu-world.exe" = protocol=6 | dir=in | app=c:\users\lama\desktop\wow private server\arcemu\arcemu-world.exe |
"TCP Query User{5D435E5B-91C5-4F7C-9134-09A4524DDB7B}C:\program files\xfire\xfire.exe" = protocol=6 | dir=in | app=c:\program files\xfire\xfire.exe |
"TCP Query User{5ED2FBC4-2F98-48C8-ACF4-5B44B89DC493}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{6710E1CC-AD40-49A0-A012-1ABF81FBDA6C}C:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe |
"TCP Query User{884E9E33-C34A-4CD7-BFAB-41B18D2AFC3A}C:\users\lama\desktop\wow private server\arcemu\database\bin\mysqld-nt.exe" = protocol=6 | dir=in | app=c:\users\lama\desktop\wow private server\arcemu\database\bin\mysqld-nt.exe |
"TCP Query User{923D0F23-9C1B-4D3A-B4AD-57CAA44F3367}C:\windows\system32\javaw.exe" = protocol=6 | dir=in | app=c:\windows\system32\javaw.exe |
"TCP Query User{9F6532C6-2239-48B6-BCCD-EFC282639209}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe |
"TCP Query User{A2852D37-E348-43DF-9FF4-0D249FD48533}C:\users\lama\desktop\wow private server\arcemu\arcemu-logonserver.exe" = protocol=6 | dir=in | app=c:\users\lama\desktop\wow private server\arcemu\arcemu-logonserver.exe |
"TCP Query User{DAB6C074-6544-4A45-A899-9E2039776890}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{DAE38D42-F5C0-42E0-B278-042B2ED00288}C:\games\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=c:\games\world_of_tanks\worldoftanks.exe |
"TCP Query User{E0591318-0E35-4C3D-89E6-DDBA5BF07AFC}C:\windows\system32\javaw.exe" = protocol=6 | dir=in | app=c:\windows\system32\javaw.exe |
"UDP Query User{03DBB82F-D283-422A-95C0-F8C9A836819D}C:\games\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=c:\games\world_of_tanks\worldoftanks.exe |
"UDP Query User{10744538-A254-4584-9152-0A79EE650AB1}C:\games\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=c:\games\world_of_tanks\wotlauncher.exe |
"UDP Query User{250DC9B6-2AA9-4495-B949-679B26FCDC50}C:\windows\system32\javaw.exe" = protocol=17 | dir=in | app=c:\windows\system32\javaw.exe |
"UDP Query User{5C626101-3697-4A98-9902-65D56E31CA5C}C:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe |
"UDP Query User{64621670-A3A1-42C0-A551-16486DF85E3B}C:\program files\activision\call of duty 2\cod2mp_s.exe" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 2\cod2mp_s.exe |
"UDP Query User{6FB42F6C-2D1F-4E5D-8923-CACEA275DE4B}C:\program files\xfire\xfire.exe" = protocol=17 | dir=in | app=c:\program files\xfire\xfire.exe |
"UDP Query User{79CBB6C1-A16D-4F0A-985A-3B5379565403}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{803E7526-410F-4EC3-9BB4-0C86C9E8E985}C:\program files\hlsw\hlsw.exe" = protocol=17 | dir=in | app=c:\program files\hlsw\hlsw.exe |
"UDP Query User{8832B645-B2FF-40F7-A520-06972C4EB8C6}C:\users\lama\desktop\wow private server\arcemu\database\bin\mysqld-nt.exe" = protocol=17 | dir=in | app=c:\users\lama\desktop\wow private server\arcemu\database\bin\mysqld-nt.exe |
"UDP Query User{A9D9EB32-AF15-4FF5-9859-9030193F74E0}C:\windows\system32\javaw.exe" = protocol=17 | dir=in | app=c:\windows\system32\javaw.exe |
"UDP Query User{ABBB12DD-488C-4062-B7A5-68458DDC63F5}C:\users\lama\desktop\wow private server\arcemu\arcemu-world.exe" = protocol=17 | dir=in | app=c:\users\lama\desktop\wow private server\arcemu\arcemu-world.exe |
"UDP Query User{BC5EB4FA-351E-4864-8979-8B19E56C4B9D}C:\users\lama\desktop\wow private server\arcemu\arcemu-logonserver.exe" = protocol=17 | dir=in | app=c:\users\lama\desktop\wow private server\arcemu\arcemu-logonserver.exe |
"UDP Query User{C2B56CEA-9237-4774-BF7D-A3789A9BE930}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{CE6113B2-409D-4813-8572-57BAF0C970A0}C:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe |
"UDP Query User{E37483B0-AB8E-4FBC-AA86-EA2AF301C0F2}C:\program files\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\java.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FBC9EF-A32B-3F57-BE9D-9023B69700E0}" = Microsoft .NET Framework 4.5 Beta
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{112C23F2-C036-4D40-BED4-0CB47BF5555C}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1" = World of Tanks
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{2A2F3AE8-246A-4252-BB26-1BEB45627074}" = Microsoft SQL Server System CLR Types
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{49253DE2-FC99-4BE3-99A4-DAB01A8E6088}" = Camtasia Studio 6
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E968D9C-21A7-4915-B698-F7AEB913541D}" = Microsoft SQL Server 2008 R2 Management Objects
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59F24743-2EA1-3A45-B8C2-6E0E1E078FA8}" = Microsoft Visual C# 2010 Express - ENU
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty(R) 2 Patch 1.3
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A7E19604-93AF-4611-8C9F-CE509C2B286E}_is1" = VDownloader 3.9.1360
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = Ovládací panel NVIDIA 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Ovladače grafiky 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = Aktualizace NVIDIA 1.8.15
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}" = TuneUp Utilities 2013
"{CB606F47-7D0E-40DF-95BB-0E5413A1295F}" = MP3 Skype Recorder
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DC785DB7-D389-48C3-B146-96FE99BF4E2B}" = Vegas Pro 9.0
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DE43AA92-E8C0-4620-AFE2-FBD623C71643}" = Sizer 3.34
"{E0363CCC-3535-4BAA-9F2C-200F548675D6}" = TuneUp Utilities Language Pack (cs-CZ)
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{F0C0221D-1DCD-487A-A3D1-E0C5B954F1DC}" = OpenOffice.org 3.4
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"4Story_CZ_is1" = 4Story CZ 4.1.98
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ASIO4ALL" = ASIO4ALL
"asterisk key" = Asterisk Key 10.0
"Audacity_is1" = Audacity 2.0.2
"avast" = avast! Free Antivirus
"Bandicam" = Bandicam
"BandiMPEG1" = Bandisoft MPEG-1 Decoder
"Call of Duty 2 Patch Switcher" = Call of Duty 2 Patch Switcher
"CCleaner" = CCleaner
"CoD RconTool" = CoD RconTool
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"FL Studio 10" = FL Studio 10
"Fraps" = Fraps (remove only)
"Game Booster_is1" = Game Booster 3
"HLSW_is1" = HLSW v1.4.0.2
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Cheat Engine 6.2_is1" = Cheat Engine 6.2
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"KLiteCodecPack_is1" = K-Lite Codec Pack 9.7.5 (Standard)
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Visual C# 2010 Express - ENU" = Microsoft Visual C# 2010 Express - ENU
"MoodEditor" = Pamela RME 2.0
"MsJavaVM" = Microsoft VM for Java
"MTA:SA 1.3" = MTA:SA v1.3
"Opera 12.16.1860" = Opera 12.16
"Shock Desktop 3D v0.5" = Shock Desktop 3D v0.5
"Steam App 440" = Team Fortress 2
"Steam App 550" = Left 4 Dead 2
"TuneUp Utilities 2013" = TuneUp Utilities 2013
"uTorrent" = µTorrent
"WebPost" = Microsoft Web Publishing Wizard 1.53
"Windows Movie Maker" = Windows Movie Maker
"WinGimp-2.0_is1" = GIMP 2.4.5
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR 4.11 (32-bit)
"Xfire" = Xfire (remove only)

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 22.7.2013 4:55:28 | Computer Name = LaMa-PC | Source = Application Hang | ID = 1002
Description = Program gimp-2.4.exe verze 0.0.0.0 přestal spolupracovat se systémem
Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto
problému, vyhledejte historii problému v ovládacím panelu Centrum akcí. ID procesu:
6f0 Čas spuštění: 01ce86b8e8f29ed0 Čas ukončení: 21 Cesta k aplikaci: C:\Program Files\GIMP-2.0\bin\gimp-2.4.exe

ID
hlášení: 6c86ced9-f2ac-11e2-aca0-001d920bb236

Error - 22.7.2013 6:20:20 | Computer Name = LaMa-PC | Source = WinMgmt | ID = 10
Description =

Error - 22.7.2013 6:37:31 | Computer Name = LaMa-PC | Source = WinMgmt | ID = 10
Description =

Error - 22.7.2013 8:50:15 | Computer Name = LaMa-PC | Source = Application Hang | ID = 1002
Description = Program mspaint.exe verze 6.1.7600.16385 přestal spolupracovat se
systémem Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací
o tomto problému, vyhledejte historii problému v ovládacím panelu Centrum akcí.

ID
procesu: 9c8 Čas spuštění: 01ce86d9e8514ed8 Čas ukončení: 70 Cesta k aplikaci: C:\Windows\system32\mspaint.exe

ID
hlášení: 3cdbdea1-f2cd-11e2-b4d7-001d920bb236

Error - 22.7.2013 9:55:32 | Computer Name = LaMa-PC | Source = WinMgmt | ID = 10
Description =

Error - 22.7.2013 12:30:41 | Computer Name = LaMa-PC | Source = WinMgmt | ID = 10
Description =

Error - 23.7.2013 3:53:35 | Computer Name = LaMa-PC | Source = WinMgmt | ID = 10
Description =

Error - 23.7.2013 8:43:46 | Computer Name = LaMa-PC | Source = WinMgmt | ID = 10
Description =

Error - 23.7.2013 8:50:37 | Computer Name = LaMa-PC | Source = Application Hang | ID = 1002
Description = Program WorldOfTanks.exe verze 0.8.6.0 přestal spolupracovat se systémem
Windows a byl ukončen. Chcete-li zjistit, zda je k dispozici více informací o tomto
problému, vyhledejte historii problému v ovládacím panelu Centrum akcí. ID procesu:
d48 Čas spuštění: 01ce87a2fe836a00 Čas ukončení: 476 Cesta k aplikaci: C:\Games\World_of_Tanks\WorldOfTanks.exe

ID
hlášení: 730cd141-f396-11e2-a792-001d920bb236

Error - 23.7.2013 12:22:24 | Computer Name = LaMa-PC | Source = WinMgmt | ID = 10
Description =

Error - 23.7.2013 14:13:25 | Computer Name = LaMa-PC | Source = WinMgmt | ID = 10
Description =

Error - 24.7.2013 3:47:06 | Computer Name = LaMa-PC | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 23.7.2013 4:46:40 | Computer Name = LaMa-PC | Source = Service Control Manager | ID = 7001
Description = Služba Windows Image Acquisition (WIA) závisí na službě Shell Hardware
Detection, která neuspěla při spuštění v důsledku následující chyby: %%1058

Error - 23.7.2013 8:41:49 | Computer Name = LaMa-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Některé funkce řízení napájení při činnosti procesoru byly zakázány
z důvodu potíží s firmwarem. Požádejte výrobce počítače o aktualizovaný firmware.

Error - 23.7.2013 8:42:29 | Computer Name = LaMa-PC | Source = Service Control Manager | ID = 7000
Description = Služba TuneUp Theme Extension neuspěla při spuštění v důsledku následující
chyby: %%1083

Error - 23.7.2013 12:20:32 | Computer Name = LaMa-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Některé funkce řízení napájení při činnosti procesoru byly zakázány
z důvodu potíží s firmwarem. Požádejte výrobce počítače o aktualizovaný firmware.

Error - 23.7.2013 12:21:04 | Computer Name = LaMa-PC | Source = Service Control Manager | ID = 7000
Description = Služba TuneUp Theme Extension neuspěla při spuštění v důsledku následující
chyby: %%1083

Error - 23.7.2013 14:11:33 | Computer Name = LaMa-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Některé funkce řízení napájení při činnosti procesoru byly zakázány
z důvodu potíží s firmwarem. Požádejte výrobce počítače o aktualizovaný firmware.

Error - 23.7.2013 14:12:03 | Computer Name = LaMa-PC | Source = Service Control Manager | ID = 7000
Description = Služba TuneUp Theme Extension neuspěla při spuštění v důsledku následující
chyby: %%1083

Error - 23.7.2013 16:29:20 | Computer Name = LaMa-PC | Source = Disk | ID = 262155
Description = Ovladač zjistil chybu řadiče na \Device\Harddisk5\DR7.

Error - 24.7.2013 3:45:14 | Computer Name = LaMa-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Některé funkce řízení napájení při činnosti procesoru byly zakázány
z důvodu potíží s firmwarem. Požádejte výrobce počítače o aktualizovaný firmware.

Error - 24.7.2013 3:45:45 | Computer Name = LaMa-PC | Source = Service Control Manager | ID = 7000
Description = Služba TuneUp Theme Extension neuspěla při spuštění v důsledku následující
chyby: %%1083

< End of report >

#25 Příspěvek od **vyosek** » 24 črc 2013 15:57

Spustte znovu OTL

Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

Kód: Vybrat vše

:otl
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2566214838-3444710164-4001035059-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2566214838-3444710164-4001035059-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
O13 - gopher Prefix: missing
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O33 - MountPoints2\{3bbd2db3-cdd4-11e1-9755-001d920bb236}\Shell - "" = AutoRun
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[5 C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[1 C:\Windows\Installer\*.tmp files -> C:\Windows\Installer\*.tmp -> ]
[2013/07/24 11:29:50 | 000,000,914 | ---- | M] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job
@Alternate Data Stream - 6144 bytes -> C:\Windows\Cursors\arrow_n.cur:NEDTA.DAT
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:56E2E879

:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sers]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony PC Companion]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GamePark klient 2.lnk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Herní^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^regmonstd.lnk]

:files
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[RESETHOSTS]
[EMPTYTEMP]
[EMPTYFLASH]
[EMPTYJAVA]

Nasledne kliknete na Opravit
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

lamakak · #26 Příspěvek od **lamakak** » 24 črc 2013 16:14

Dobrý den omylem jsem log zavřel ale pak jsem ho našel v C:\_otl

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-2566214838-3444710164-4001035059-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-2566214838-3444710164-4001035059-1001\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3bbd2db3-cdd4-11e1-9755-001d920bb236}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3bbd2db3-cdd4-11e1-9755-001d920bb236}\ not found.
C:\Windows\msdownld.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP147C.tmp\EnvDTE80.dll deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP147C.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP5E64.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP7C7F.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8545.tmp folder deleted successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9FEB.tmp folder deleted successfully.
C:\Windows\Installer\MSIEE19.tmp deleted successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
ADS C:\Windows\Cursors\arrow_n.cur:NEDTA.DAT deleted successfully.
ADS C:\ProgramData\TEMP:56E2E879 deleted successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sers\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony PC Companion\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GamePark klient 2.lnk\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Herní^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^regmonstd.lnk\ deleted successfully.
========== FILES ==========
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
File/Folder C:\Windows\*.tmp not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Herní
->Temp folder emptied: 96507841 bytes
->Temporary Internet Files folder emptied: 229311226 bytes
->Java cache emptied: 214276 bytes
->Google Chrome cache emptied: 286746219 bytes
->Opera cache emptied: 58181671 bytes
->Flash cache emptied: 2357 bytes

User: Kapitán
->Temp folder emptied: 57786696 bytes
->Temporary Internet Files folder emptied: 154294137 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 227417109 bytes
->Opera cache emptied: 16977555 bytes
->Flash cache emptied: 2382 bytes

User: LaMa
->Temp folder emptied: 15522070 bytes
->Temporary Internet Files folder emptied: 5644456 bytes
->Java cache emptied: 4746647 bytes
->Opera cache emptied: 51224539 bytes
->Flash cache emptied: 6468 bytes

User: Public

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 56003222 bytes
RecycleBin emptied: 48747980 bytes

Total Files Cleaned = 1,249.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Herní
->Flash cache emptied: 0 bytes

User: Kapitán
->Flash cache emptied: 0 bytes

User: LaMa
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser

Total Flash Files Cleaned = 0.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Herní
->Java cache emptied: 0 bytes

User: Kapitán
->Java cache emptied: 0 bytes

User: LaMa
->Java cache emptied: 0 bytes

User: Public

User: UpdatusUser

Total Java Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 07242013_170201

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
File\Folder C:\Windows\temp\sigBF98.tmp not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

#27 Příspěvek od **vyosek** » 24 črc 2013 16:38

Tak jeste uklidime

T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

lamakak · #28 Příspěvek od **lamakak** » 24 črc 2013 16:50

Děkuji vám moc za pomoc s tímto virem

CCleaner znám a teď už jen udělám poslední krok a opravim ty registry

Eště jednou bych vám chtěl poděkovat

#29 Příspěvek od **vyosek** » 24 črc 2013 17:25

Nemate zac, rad jsem pomohl

Zase nekdy Obrázek

A na zaklade Pravidla o zamykani temat

VIRY.CZ

Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error

Re: Virus ? windows script host error