Prosim o kontrolu logu z bf - rundll32.exe zaťažuje procak

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
steinum
Návštěvník
Návštěvník
Příspěvky: 6
Registrován: 28 Srp 2013 11:04

Prosim o kontrolu logu z bf - rundll32.exe zaťažuje procak

#1 Příspěvek od steinum »

ComboFix 13-08-28.02 - vojaga . 08. 2013 11:28:47.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1029.18.8086.5178 [GMT 2:00]
Running from: c:\users\vojaga\Downloads\ComboFix.exe
AV: ESET Smart Security 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\users\vojaga\AppData\Roaming\WTouch
c:\users\vojaga\AppData\Roaming\WTouch\WTouch.xml
c:\windows\iun6002.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-07-28 to 2013-08-28 )))))))))))))))))))))))))))))))
.
.
2013-08-28 09:51 . 2013-08-28 09:51 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-08-28 09:51 . 2013-08-28 09:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-28 09:05 . 2013-08-06 08:58 9515512 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F3F2C32F-5812-4A62-B394-BF454588756E}\mpengine.dll
2013-08-24 11:55 . 2013-08-24 11:55 17737608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2013-08-24 11:46 . 2013-08-24 11:46 -------- d-----w- c:\programdata\Steam
2013-08-24 09:57 . 2013-08-24 09:57 -------- d-----w- c:\program files\Sublime Text 3
2013-08-24 09:57 . 2013-08-24 09:57 -------- d-----w- c:\users\vojaga\AppData\Local\Programs
2013-08-15 19:58 . 2013-08-15 19:59 -------- d-----w- c:\windows\system32\MRT
2013-08-14 21:37 . 2013-08-14 21:39 -------- d-----w- c:\users\vojaga\.gradle
2013-08-14 21:37 . 2013-08-14 21:37 -------- d-----w- c:\users\vojaga\AndroidStudioProjects
2013-08-14 21:26 . 2013-08-14 21:26 -------- d-----w- c:\users\vojaga\AppData\Roaming\JetBrains
2013-08-14 16:24 . 2013-07-09 05:46 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-08-14 16:24 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-08-14 16:24 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-08-14 16:24 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-08-14 16:24 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-08-14 16:24 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-08-14 16:24 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-08-14 16:24 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-24 11:55 . 2013-03-06 23:06 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-24 11:55 . 2012-01-14 13:21 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-15 19:58 . 2012-10-24 12:29 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-07-26 18:07 . 2013-07-26 18:07 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-26 18:06 . 2012-10-24 12:15 867240 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2013-07-26 18:06 . 2012-01-14 13:41 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-07-09 04:45 . 2013-08-14 16:23 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-06-05 03:34 . 2013-07-26 18:13 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 06:00 . 2013-07-26 18:13 624128 ----a-w- c:\windows\system32\qedit.dll
2013-06-04 04:53 . 2013-07-26 18:13 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2013-06-03 14:55 . 2013-06-03 14:55 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-06-03 14:55 . 2013-06-03 14:55 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-06-03 14:55 . 2013-06-03 14:55 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-06-03 14:55 . 2013-06-03 14:55 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-06-03 14:55 . 2013-06-03 14:55 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-06-03 14:55 . 2013-06-03 14:55 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-06-03 14:55 . 2013-06-03 14:55 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-06-03 14:55 . 2013-06-03 14:55 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-06-03 14:55 . 2013-06-03 14:55 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-06-03 14:55 . 2013-06-03 14:55 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-06-03 14:55 . 2013-06-03 14:55 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-06-03 14:55 . 2013-06-03 14:55 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-06-03 14:55 . 2013-06-03 14:55 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-06-03 14:55 . 2013-06-03 14:55 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-06-03 14:55 . 2013-06-03 14:55 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-06-03 14:55 . 2013-06-03 14:55 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-06-03 14:55 . 2013-06-03 14:55 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-06-03 14:55 . 2013-06-03 14:55 216064 ----a-w- c:\windows\system32\msls31.dll
2013-06-03 14:55 . 2013-06-03 14:55 197120 ----a-w- c:\windows\system32\msrating.dll
2013-06-03 14:55 . 2013-06-03 14:55 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-06-03 14:55 . 2013-06-03 14:55 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-06-03 14:55 . 2013-06-03 14:55 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-06-03 14:55 . 2013-06-03 14:55 81408 ----a-w- c:\windows\system32\icardie.dll
2013-06-03 14:55 . 2013-06-03 14:55 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-06-03 14:55 . 2013-06-03 14:55 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-06-03 14:55 . 2013-06-03 14:55 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-06-03 14:55 . 2013-06-03 14:55 441856 ----a-w- c:\windows\system32\html.iec
2013-06-03 14:55 . 2013-06-03 14:55 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-06-03 14:55 . 2013-06-03 14:55 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-06-03 14:55 . 2013-06-03 14:55 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-06-03 14:55 . 2013-06-03 14:55 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-06-03 14:55 . 2013-06-03 14:55 235008 ----a-w- c:\windows\system32\url.dll
2013-06-03 14:55 . 2013-06-03 14:55 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-06-03 14:55 . 2013-06-03 14:55 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-06-03 14:55 . 2013-06-03 14:55 144896 ----a-w- c:\windows\system32\wextract.exe
2013-06-03 14:55 . 2013-06-03 14:55 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-06-03 14:55 . 2013-06-03 14:55 102912 ----a-w- c:\windows\system32\inseng.dll
2013-06-03 14:55 . 2013-06-03 14:55 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-06-03 14:55 . 2013-06-03 14:55 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-06-03 14:55 . 2013-06-03 14:55 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-06-03 14:55 . 2013-06-03 14:55 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-06-03 14:55 . 2013-06-03 14:55 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-06-03 14:55 . 2013-06-03 14:55 149504 ----a-w- c:\windows\system32\occache.dll
2013-06-03 14:55 . 2013-06-03 14:55 13824 ----a-w- c:\windows\system32\mshta.exe
2013-06-03 14:55 . 2013-06-03 14:55 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-06-03 14:55 . 2013-06-03 14:55 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-06-03 14:55 . 2013-06-03 14:55 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-06-03 14:55 . 2013-06-03 14:55 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-06-03 14:55 . 2013-06-03 14:55 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-06-03 14:52 . 2013-06-03 14:52 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 10752 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2013-06-03 14:52 . 2013-06-03 14:52 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-06-03 14:52 . 2013-06-03 14:52 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-06-03 14:52 . 2013-06-03 14:52 3928064 ----a-w- c:\windows\system32\d2d1.dll
2013-06-03 14:52 . 2013-06-03 14:52 364544 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2013-06-03 14:52 . 2013-06-03 14:52 363008 ----a-w- c:\windows\system32\dxgi.dll
2013-06-03 14:52 . 2013-06-03 14:52 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 2776576 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2013-06-03 14:52 . 2013-06-03 14:52 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2013-06-03 14:52 . 2013-06-03 14:52 2284544 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2013-06-03 14:52 . 2013-06-03 14:52 220160 ----a-w- c:\windows\SysWow64\d3d10core.dll
2013-06-03 14:52 . 2013-06-03 14:52 1682432 ----a-w- c:\windows\system32\XpsPrint.dll
2013-06-03 14:52 . 2013-06-03 14:52 1158144 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2013-06-03 14:52 . 2013-06-03 14:52 1080832 ----a-w- c:\windows\SysWow64\d3d10.dll
2013-06-03 14:52 . 2013-06-03 14:52 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-06-03 14:52 . 2013-06-03 14:52 648192 ----a-w- c:\windows\system32\d3d10level9.dll
2013-06-03 14:52 . 2013-06-03 14:52 604160 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2013-06-03 14:52 . 2013-06-03 14:52 3419136 ----a-w- c:\windows\SysWow64\d2d1.dll
2013-06-03 14:52 . 2013-06-03 14:52 333312 ----a-w- c:\windows\system32\d3d10_1core.dll
2013-06-03 14:52 . 2013-06-03 14:52 296960 ----a-w- c:\windows\system32\d3d10core.dll
2013-06-03 14:52 . 2013-06-03 14:52 293376 ----a-w- c:\windows\SysWow64\dxgi.dll
2013-06-03 14:52 . 2013-06-03 14:52 249856 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
2013-06-03 14:52 . 2013-06-03 14:52 245248 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2013-06-03 14:52 . 2013-06-03 14:52 221184 ----a-w- c:\windows\system32\UIAnimation.dll
2013-06-03 14:52 . 2013-06-03 14:52 207872 ----a-w- c:\windows\SysWow64\WindowsCodecsExt.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2013-07-26 1807272]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-21 19875432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-05-10 37960]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
"Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2011-08-04 4165440]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"PowerDVD12DMREngine"="c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe" [2012-01-02 501544]
"PowerDVD12Agent"="c:\program files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe" [2012-02-21 371256]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-10-15 296096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"Skype"="c:\programdata\Skype\Skype.vbs" [2012-09-18 103]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ALFA plus - rýchle spustenie.lnk - c:\program files (x86)\KROS\ALFA plus\!System\ALFAplus.exe /StartUp [2012-3-29 3261440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys;c:\windows\SYSNATIVE\drivers\SBREdrv.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AMPPALP;Protokol Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
R3 mvusbews;USB EWS Device;c:\windows\system32\Drivers\mvusbews.sys;c:\windows\SYSNATIVE\Drivers\mvusbews.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\drivers\nvstusb.sys;c:\windows\SYSNATIVE\drivers\nvstusb.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfp.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys;c:\windows\SYSNATIVE\DRIVERS\stdcfltn.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys;c:\windows\SYSNATIVE\DRIVERS\EpfwLWF.sys [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2012/05/08 18:29];c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl;c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [x]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 CLHNServiceForPowerDVD12;CLHNServiceForPowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [x]
S2 CyberLink PowerDVD 12 Media Server Monitor Service;CyberLink PowerDVD 12 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [x]
S2 CyberLink PowerDVD 12 Media Server Service;CyberLink PowerDVD 12 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [x]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe;c:\program files\ESET\ESET Smart Security\x86\ekrn.exe [x]
S2 FirebirdServerKROS_20400;Firebird Server - KROS_20400;c:\program files (x86)\KROS\KROS FBServer\Firebird001\bin\fbserver.exe;c:\program files (x86)\KROS\KROS FBServer\Firebird001\bin\fbserver.exe [x]
S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe;c:\windows\SYSNATIVE\HPSIsvc.exe [x]
S2 ntk_PowerDVD12;ntk_PowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [x]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe;c:\windows\SYSNATIVE\Pen_Tablet.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe;c:\program files\WTouch\WTouchService.exe [x]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys;c:\windows\SYSNATIVE\DRIVERS\Accelern.sys [x]
S3 AMPPAL;Virtuální adaptér Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 AVer7231_x64;AVerMedia 7231 capture service;c:\windows\system32\DRIVERS\AVer7231_x64.sys;c:\windows\SYSNATIVE\DRIVERS\AVer7231_x64.sys [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys;c:\windows\SYSNATIVE\DRIVERS\iwdbus.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 qicflt;upper Device Filter Driver;c:\windows\system32\DRIVERS\qicflt.sys;c:\windows\SYSNATIVE\DRIVERS\qicflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2013-08-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-06 11:55]
.
2013-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-26 07:34]
.
2013-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-26 07:34]
.
2013-08-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001Core.job
- c:\users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-08 06:48]
.
2013-08-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001UA.job
- c:\users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-08 06:48]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-08-30 7284328]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-08-16 2277480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-31 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-31 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-31 416024]
"FreeFallProtection"="c:\program files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe" [2010-12-17 686704]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-10-18 10357008]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-09-16 1935120]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2011-09-22 4035152]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www1.euro.dell.com/content/default.aspx?c=cz&l=cs&s=bsd
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-Stage Remote - c:\program files (x86)\Dell\Stage Remote\StageRemote.exe
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
AddRemove-{1146E8F3-4057-4F46-B39C-D18AB4BB1523}_is1 - c:\program files (x86)\Square Enix\Deus Ex - Human Revolution\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{329F96B6-DF1E-4328-BFDA-39EA953C1312}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-08-28 12:00:05
ComboFix-quarantined-files.txt 2013-08-28 10:00
.
Pre-Run: Volných bajtů: 369 136 881 664
Post-Run: Volných bajtů: 374 121 070 592
.
- - End Of File - - B108056D8FB9DEB123DE87811FC49E99
Nahoru
Avatar uživatele
Tempest
VIP
VIP
Příspěvky: 193
Registrován: 05 Črv 2005 08:18

Re: Prosim o kontrolu logu z bf - rundll32.exe zaťažuje proc

#2 Příspěvek od Tempest »

Zdravím a vítej na foru :)

Nepoužívej ComboFix bez dozoru zkušené osoby. Už dlouhou dobu neplatí, že prosté použití ComboFixu na počítači vyřeší tvoje problémy s viry a navíc jeho svévolným užitím ztrácíš nárok na podporu.

1) Nahraj soubor c:\programdata\Skype\Skype.vbs na analýzu podle tohoto návodu: http://forum.viry.cz/viewtopic.php?f=24&t=30935

2) Použij FRSTLauncher podle kolegova návodu a vlož sem log FRST.txt: http://forum.viry.cz/viewtopic.php?f=13 ... 7#p1248607
Nahoru
steinum
Návštěvník
Návštěvník
Příspěvky: 6
Registrován: 28 Srp 2013 11:04

log z FRST

#3 Příspěvek od steinum »

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-08-2013
Ran by vojaga (administrator) on 29-08-2013 16:56:43
Running from C:\Users\vojaga\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchService.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Firebird Project) C:\Program Files (x86)\KROS\KROS FBServer\Firebird001\bin\fbserver.exe
(HP) C:\Windows\system32\HPSIsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
(Wacom Technology, Corp.) C:\Windows\system32\Pen_Tablet.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Wacom Technology, Corp.) C:\Windows\system32\WTablet\Pen_TabletUser.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Wacom Technology, Corp.) C:\Windows\system32\Pen_Tablet.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(KROS a.s.) C:\Program Files (x86)\KROS\ALFA plus\!System\ALFAplus.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
() C:\Program Files\Sublime Text 3\sublime_text.exe
() C:\Program Files\Sublime Text 3\plugin_host.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchUser.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2818856 2011-08-26] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7284328 2011-08-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-17] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [10357008 2011-10-18] (Intel Corporation)
HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-09-16] (Intel(R) Corporation)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe -Quiet [x]
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET Smart Security\egui.exe [4035152 2011-09-22] (ESET)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1807272 2013-07-27] (Valve Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [Dell Registration] - C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [RoxWatchTray] - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] ()
HKLM-x32\...\Run: [PowerDVD12DMREngine] - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe [501544 2012-01-02] (CyberLink)
HKLM-x32\...\Run: [PowerDVD12Agent] - C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe [371256 2012-02-21] (CyberLink Corp.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [296096 2012-10-15] (RealNetworks, Inc.)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Skype] - C:\ProgramData\Skype\Skype.vbs [103 2012-09-18] ()
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ALFA plus - rýchle spustenie.lnk
ShortcutTarget: ALFA plus - rýchle spustenie.lnk -> C:\Program Files (x86)\KROS\ALFA plus\!System\ALFAplus.exe (KROS a.s.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.dell.com/content/defau ... l=cs&s=bsd
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {F478734E-E0B4-4701-9F8F-DD5827F60336} URL = http://www.bing.com/search?q={searchTer ... -SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {F478734E-E0B4-4701-9F8F-DD5827F60336} URL = http://www.bing.com/search?q={searchTer ... -SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {F478734E-E0B4-4701-9F8F-DD5827F60336} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\vojaga\AppData\Local\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\vojaga\AppData\Local\Google\Chrome\Application\29.0.1547.57\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\vojaga\AppData\Local\Google\Chrome\Application\29.0.1547.57\gcswf32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.270.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U27) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Bing Bar) - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (Google Update) - C:\Users\vojaga\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (Google Drive) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0
CHR Extension: (Anatronica - 3D Interactive Anatomy) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\nalpooddpdnhjicpjgnhaihnnfnmbpee\1.2.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
CHR StartMenuInternet: Google Chrome - C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 CLHNServiceForPowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [87336 2012-02-21] (CyberLink Corp.)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [75048 2012-02-21] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [296232 2012-02-21] (CyberLink)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [974944 2011-09-22] (ESET)
R2 FirebirdServerKROS_20400; C:\Program Files (x86)\KROS\KROS FBServer\Firebird001\bin\fbserver.exe [3764224 2011-10-11] (Firebird Project)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-16] ()
R2 WTouchService; C:\Program Files\WTouch\WTouchService.exe [127272 2009-07-15] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

R3 AVer7231_x64; C:\Windows\System32\DRIVERS\AVer7231_x64.sys [1799808 2010-06-11] (AVerMedia TECHNOLOGIES, Inc.)
R2 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [202576 2011-08-09] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [146432 2011-08-04] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [187632 2011-08-04] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [38288 2011-08-04] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62496 2011-08-04] (ESET)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2009-12-04] (Marvell Semiconductor, Inc.)
R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [82928 2011-10-27] (Cyberlink Corp.)
R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [82928 2011-10-27] (Cyberlink Corp.)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284008 2012-10-08] (NVIDIA Corporation)
S3 NvStUSB; C:\Windows\system32\drivers\nvstusb.sys [122472 2011-06-13] ()
R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [146928 2012-02-16] (CyberLink Corp.)
R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [146928 2012-02-16] (CyberLink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-29 16:55 - 2013-08-29 16:55 - 00000000 ____D C:\Users\vojaga\AppData\Local\qbBC8C4B.56
2013-08-29 16:55 - 2013-08-29 16:55 - 00000000 ____D C:\FRST
2013-08-29 16:55 - 2013-08-27 21:11 - 01579080 _____ (Farbar) C:\Users\vojaga\Desktop\FRST64.exe
2013-08-29 13:46 - 2013-08-29 13:46 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\Sublime Text 3
2013-08-29 13:46 - 2013-08-29 13:46 - 00000000 ____D C:\Users\vojaga\AppData\Local\Sublime Text 3
2013-08-28 20:48 - 2013-08-28 21:51 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\WTouch
2013-08-28 13:16 - 2013-08-28 14:29 - 00001180 _____ C:\Users\vojaga\Desktop\kontakt na spravcovske spolocnosti.txt
2013-08-28 12:00 - 2013-08-28 12:00 - 00032766 _____ C:\ComboFix.txt
2013-08-28 11:25 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-28 11:25 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-28 11:25 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-28 11:25 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-28 11:25 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-28 11:25 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-28 11:25 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-28 11:23 - 2013-08-28 12:00 - 00000000 ____D C:\Qoobox
2013-08-28 11:22 - 2013-08-28 11:55 - 00000000 ____D C:\Windows\erdnt
2013-08-28 11:19 - 2013-08-28 11:20 - 05114728 ____R (Swearware) C:\Users\vojaga\Downloads\ComboFix.exe
2013-08-24 13:55 - 2013-08-24 13:55 - 17737608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-08-24 13:46 - 2013-08-24 13:46 - 00000000 ____D C:\ProgramData\Steam
2013-08-24 11:57 - 2013-08-24 11:57 - 00000000 ____D C:\Program Files\Sublime Text 3
2013-08-24 11:55 - 2013-08-24 11:57 - 07774288 _____ (Sublime HQ Pty Ltd ) C:\Users\vojaga\Downloads\Sublime Text Build 3047 x64 Setup.exe
2013-08-24 11:55 - 2013-08-24 11:56 - 06513608 _____ ( ) C:\Users\vojaga\Downloads\Sublime Text 2.0.2 x64 Setup.exe
2013-08-15 22:04 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 22:04 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 22:04 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 22:04 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 22:04 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 22:04 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 22:04 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 22:04 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 22:04 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 22:04 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 22:04 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 22:04 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-15 21:58 - 2013-08-15 21:59 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 23:37 - 2013-08-14 23:39 - 00000000 ____D C:\Users\vojaga\.gradle
2013-08-14 23:37 - 2013-08-14 23:37 - 00000000 ____D C:\Users\vojaga\AndroidStudioProjects
2013-08-14 23:26 - 2013-08-14 23:26 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\JetBrains
2013-08-14 22:45 - 2013-08-14 23:13 - 396091268 _____ (Google Inc.) C:\Users\vojaga\Downloads\android-studio-bundle-130.737825-windows.exe
2013-08-14 18:24 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 18:24 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 18:24 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 18:24 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 18:24 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 18:24 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 18:24 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 18:24 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 18:23 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 18:23 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 18:23 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 18:23 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 18:23 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 18:23 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 18:23 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 18:23 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 18:23 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 18:23 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 18:23 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 18:23 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 18:23 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 18:23 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 18:23 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 18:23 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 18:23 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 18:23 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 18:23 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-12 14:19 - 2013-08-12 14:20 - 00040960 _____ C:\Users\vojaga\Downloads\obmedzenia-prevadzky-post.xls
2013-08-07 14:35 - 2013-08-07 14:35 - 00088064 _____ C:\Users\vojaga\Downloads\Zadanie Sp.plochy Nové Sady.xls

==================== One Month Modified Files and Folders =======

2013-08-29 16:55 - 2013-08-29 16:55 - 00000000 ____D C:\Users\vojaga\AppData\Local\qbBC8C4B.56
2013-08-29 16:55 - 2013-08-29 16:55 - 00000000 ____D C:\FRST
2013-08-29 16:55 - 2013-03-07 01:06 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-29 16:54 - 2012-01-14 16:02 - 00000000 ____D C:\ProgramData\Skype
2013-08-29 16:49 - 2012-07-26 09:34 - 00000936 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-29 16:49 - 2012-05-14 17:27 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\Skype
2013-08-29 16:49 - 2012-05-08 08:48 - 00000950 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001UA.job
2013-08-29 13:46 - 2013-08-29 13:46 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\Sublime Text 3
2013-08-29 13:46 - 2013-08-29 13:46 - 00000000 ____D C:\Users\vojaga\AppData\Local\Sublime Text 3
2013-08-29 13:38 - 2013-06-04 07:58 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{37F9D6F9-AA52-489C-8EE4-7F30EDD621B3}
2013-08-29 13:38 - 2009-07-14 06:45 - 00025008 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-29 13:38 - 2009-07-14 06:45 - 00025008 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-29 13:34 - 2012-01-14 08:13 - 01437918 _____ C:\Windows\WindowsUpdate.log
2013-08-29 13:32 - 2012-05-18 20:23 - 00000000 ____D C:\ProgramData\firebird
2013-08-29 13:31 - 2012-05-09 23:48 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-29 13:31 - 2012-01-14 15:59 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-08-29 13:30 - 2012-11-21 20:38 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\WTablet
2013-08-29 13:30 - 2012-07-26 09:34 - 00000932 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-29 13:30 - 2012-01-14 16:04 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-08-29 13:30 - 2012-01-14 16:04 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-08-29 13:30 - 2012-01-14 08:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-29 13:30 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-29 13:30 - 2009-07-14 06:51 - 00106506 _____ C:\Windows\setupact.log
2013-08-29 13:29 - 2010-11-21 05:47 - 00022888 _____ C:\Windows\PFRO.log
2013-08-28 21:51 - 2013-08-28 20:48 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\WTouch
2013-08-28 20:48 - 2012-05-08 08:48 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001Core.job
2013-08-28 14:29 - 2013-08-28 13:16 - 00001180 _____ C:\Users\vojaga\Desktop\kontakt na spravcovske spolocnosti.txt
2013-08-28 12:00 - 2013-08-28 12:00 - 00032766 _____ C:\ComboFix.txt
2013-08-28 12:00 - 2013-08-28 11:23 - 00000000 ____D C:\Qoobox
2013-08-28 12:00 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-28 11:55 - 2013-08-28 11:22 - 00000000 ____D C:\Windows\erdnt
2013-08-28 11:52 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-28 11:20 - 2013-08-28 11:19 - 05114728 ____R (Swearware) C:\Users\vojaga\Downloads\ComboFix.exe
2013-08-27 21:11 - 2013-08-29 16:55 - 01579080 _____ (Farbar) C:\Users\vojaga\Desktop\FRST64.exe
2013-08-25 01:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-08-24 13:55 - 2013-08-24 13:55 - 17737608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-08-24 13:55 - 2013-03-07 01:06 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-24 13:55 - 2013-03-07 01:06 - 00003852 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-24 13:55 - 2012-01-14 15:21 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-24 13:46 - 2013-08-24 13:46 - 00000000 ____D C:\ProgramData\Steam
2013-08-24 13:46 - 2012-05-13 23:56 - 00000000 ____D C:\Users\vojaga\Documents\My Games
2013-08-24 11:57 - 2013-08-24 11:57 - 00000000 ____D C:\Program Files\Sublime Text 3
2013-08-24 11:57 - 2013-08-24 11:55 - 07774288 _____ (Sublime HQ Pty Ltd ) C:\Users\vojaga\Downloads\Sublime Text Build 3047 x64 Setup.exe
2013-08-24 11:56 - 2013-08-24 11:55 - 06513608 _____ ( ) C:\Users\vojaga\Downloads\Sublime Text 2.0.2 x64 Setup.exe
2013-08-23 13:09 - 2012-05-08 08:39 - 00000000 ____D C:\Users\vojaga\AppData\Local\Adobe
2013-08-21 18:25 - 2012-05-08 08:49 - 00002374 _____ C:\Users\vojaga\Desktop\Google Chrome.lnk
2013-08-15 22:03 - 2012-05-18 19:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-15 21:59 - 2013-08-15 21:58 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 21:58 - 2012-10-24 14:29 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 23:39 - 2013-08-14 23:37 - 00000000 ____D C:\Users\vojaga\.gradle
2013-08-14 23:37 - 2013-08-14 23:37 - 00000000 ____D C:\Users\vojaga\AndroidStudioProjects
2013-08-14 23:37 - 2012-05-08 08:33 - 00000000 ____D C:\Users\vojaga
2013-08-14 23:26 - 2013-08-14 23:26 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\JetBrains
2013-08-14 23:22 - 2012-11-07 17:56 - 00000000 ____D C:\Program Files (x86)\Android
2013-08-14 23:13 - 2013-08-14 22:45 - 396091268 _____ (Google Inc.) C:\Users\vojaga\Downloads\android-studio-bundle-130.737825-windows.exe
2013-08-14 19:04 - 2012-11-12 12:14 - 00000000 ____D C:\Users\vojaga\AppData\Local\Eclipse
2013-08-12 14:20 - 2013-08-12 14:19 - 00040960 _____ C:\Users\vojaga\Downloads\obmedzenia-prevadzky-post.xls
2013-08-09 12:40 - 2012-11-26 23:04 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-07 14:35 - 2013-08-07 14:35 - 00088064 _____ C:\Users\vojaga\Downloads\Zadanie Sp.plochy Nové Sady.xls
2013-08-03 18:25 - 2012-07-26 09:34 - 00000000 ____D C:\Program Files (x86)\Google

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit



==================== Scheduled Tasks (whitelisted) ===========

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001Core.job => C:\Users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001UA.job => C:\Users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Supplementary Scan (All) ================


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000001
"EnableSecureUIAPaths"=dword:00000001
"EnableUIADesktopToggle"=dword:00000000
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"scforceoption"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"FilterAdministratorToken"=dword:00000000
"DisableRegistryTools"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval"=dword:00000001
"FirewallDisableNotify"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"AntiSpywareOverride"=dword:00000000
"FirewallOverride"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x0
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x0
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"="msrle32.dll"
"vidc.msvc"="msvidc32.dll"
"msacm.imaadpcm"="imaadp32.acm"
"msacm.msg711"="msg711.acm"
"msacm.msgsm610"="msgsm32.acm"
"msacm.msadpcm"="msadp32.acm"
"midimapper"="midimap.dll"
"wavemapper"="msacm32.drv"
"VIDC.UYVY"="msyuv.dll"
"VIDC.YUY2"="msyuv.dll"
"VIDC.YVYU"="msyuv.dll"
"VIDC.IYUV"="iyuv_32.dll"
"vidc.i420"="iyuv_32.dll"
"VIDC.YVU9"="tsbyuv.dll"
"msacm.l3acm"="C:\\Windows\\System32\\l3codeca.acm"
"MSVideo8"="VfWWDM32.dll"
"wave"="wdmaud.drv"
"midi"="wdmaud.drv"
"mixer"="wdmaud.drv"
"aux"="wdmaud.drv"
"wave1"="wdmaud.drv"
"midi1"="wdmaud.drv"
"mixer1"="wdmaud.drv"
"aux1"="wdmaud.drv"
"wave2"="wdmaud.drv"
"midi2"="wdmaud.drv"
"mixer2"="wdmaud.drv"
"wave3"="wdmaud.drv"
"midi3"="wdmaud.drv"
"mixer3"="wdmaud.drv"
"vidc.ffds"="ff_vfw.dll"
"vidc.lags"="lagarith.dll"
"vidc.XVID"="xvidvfw.dll"


==================== Drive and Memory info ===================

Drive c: (OS) (Fixed) (Total:446.13 GB) (Free:347.51 GB) NTFS
Drive d: () (Fixed) (Total:465.76 GB) (Free:397.36 GB) NTFS

Available physical RAM: 5401.75 MB
Total physical RAM: 8086.17 MB
Percentage of memory in use: 33%

LastRegBack: 2013-08-09 17:41

==================== End Of Log ==============================
Nahoru
steinum
Návštěvník
Návštěvník
Příspěvky: 6
Registrován: 28 Srp 2013 11:04

Re: Prosim o kontrolu logu z bf - rundll32.exe zaťažuje proc

#4 Příspěvek od steinum »

Vďaka, poslal som súbor a spravil log cez FRST. Jedine som vypol proces rundll32 inak dosť hučí ventilátor a prehrieva sa mašina. Dúfam, že to pri skúmaní nebude vadiť, keď nie je aktívny problémový proces.
Nahoru
Avatar uživatele
Tempest
VIP
VIP
Příspěvky: 193
Registrován: 05 Črv 2005 08:18

Re: Prosim o kontrolu logu z bf - rundll32.exe zaťažuje proc

#5 Příspěvek od Tempest »

V pohodě :)

1) Spusť Poznámkový blok přes nabídku Start - do volného řádku napiš: notepad a zkopíruj do něj celý tento text:

Kód: Vybrat vše

Start
C:\ProgramData\Skype\Skype.vbs
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] ()
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [296096 2012-10-15] (RealNetworks, Inc.)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Skype] - C:\ProgramData\Skype\Skype.vbs [103 2012-09-18] ()
CHR Plugin: (Shockwave Flash) - C:\Users\vojaga\AppData\Local\Google\Chrome\Application\29.0.1547.57\gcswf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.270.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U27) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Bing Bar) - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Google Update) - C:\Users\vojaga\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [x]
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001Core.job => C:\Users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001UA.job => C:\Users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe
End
Zvol možnost Uložit soubor jako, pojmenuj soubor fixlist.txt a zvol Uložit jako typ Všechny soubory. Ulož soubor do stejného umístění, kde máš uložený FRST64.exe.

Spusť FRST64.exe a klikni na tlačítko Fix. Program vytvoří a otevře log - fixlog.txt. Zkopíruj mi sem prosím celý jeho obsah.

2) Proskenuj počítač s Hitmanem Pro podle tohoto návodu: http://forum.viry.cz/viewtopic.php?f=29&t=101984 a ulož si jeho log.

3) Proveď úplnou kontrolou s MalwareBytes' Anti-Malware podle tohoto návodu: http://forum.viry.cz/viewtopic.php?f=29&t=115222 a ulož si log, který vytvoří.

Restartuj manuálně počítač.

Vlož sem logy z FRST, Hitmana a MBAMu a napiš, jestli problémy přetrvávají :)
Nahoru
steinum
Návštěvník
Návštěvník
Příspěvky: 6
Registrován: 28 Srp 2013 11:04

Re: Prosim o kontrolu logu z bf - rundll32.exe zaťažuje proc

#6 Příspěvek od steinum »

log z FRST po vlozeni fixlist

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-08-2013
Ran by vojaga at 2013-08-29 20:52:20 Run:1
Running from C:\Users\vojaga\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
C:\ProgramData\Skype\Skype.vbs
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] ()
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TkBellExe] - c:\program files (x86)\real\realplayer\Update\realsched.exe [296096 2012-10-15] (RealNetworks, Inc.)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Skype] - C:\ProgramData\Skype\Skype.vbs [103 2012-09-18] ()
CHR Plugin: (Shockwave Flash) - C:\Users\vojaga\AppData\Local\Google\Chrome\Application\29.0.1547.57\gcswf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.270.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U27) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Bing Bar) - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Google Update) - C:\Users\vojaga\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [x]
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001Core.job => C:\Users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001UA.job => C:\Users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe
End
*****************

C:\ProgramData\Skype\Skype.vbs => Moved successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\IntelTBRunOnce => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeAAMUpdater-1.0 => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\DivXUpdate => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\GrooveMonitor => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\AdobeCS5ServiceManager => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\TkBellExe => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\AdobeCS6ServiceManager => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Skype => Value deleted successfully.
C:\Users\vojaga\AppData\Local\Google\Chrome\Application\29.0.1547.57\gcswf32.dll not found.
C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll not found.
C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll not found.
C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll not found.
C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll not found.
C:\Users\vojaga\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll not found.
catchme => Service deleted successfully.
SBRE => Service deleted successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001Core.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-90506936-3836597502-1605652982-1001UA.job => Moved successfully.

==== End of Fixlog ====










log z hitmana



Kód: Vybrat vše

HitmanPro 3.7.7.205
www.hitmanpro.com

   Computer name . . . . : VOJAGA-PC
   Windows . . . . . . . : 6.1.1.7601.X64/8
   User name . . . . . . : vojaga-PC\vojaga
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2013-08-29 21:14:35
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 7m 34s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 7
   Traces  . . . . . . . : 876

   Objects scanned . . . : 1 668 250
   Files scanned . . . . : 18 884
   Remnants scanned  . . : 430 802 files / 1 218 564 keys

Malware _____________________________________________________________________

   C:\Users\vojaga\Downloads\FRSTLauncher.exe
      Size . . . . . . . : 364 544 bytes
      Age  . . . . . . . : 0.2 days (2013-08-29 16:55:17)
      Entropy  . . . . . : 6.7
      SHA-256  . . . . . : EB3398629BB776DABD614EB955EDB90C10DB1F5FC2E4F35AAFDD5D7A6BE32573
      Product  . . . . . : Farbar Recovery Scan Tool Launcher
      Publisher  . . . . : forum.viry.cz
      Description  . . . : Farbar Recovery Scan Tool Launcher is a tool that downloads Farbar Recovery Scan Tool from the Internet, starts it and modifies its log according to the needs of forum.viry.cz.
      Version
      Copyright  . . . . : Farbar Recovery Scan Tool is a tool by farbar, Farbar Recovery Scan Tool Launcher is a tool by forum.viry.cz.
    > Ikarus . . . . . . : Backdoor.Win32.SuspectCRC!IK
      Fuzzy  . . . . . . : 105.0


Cookies _____________________________________________________________________

   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:112.2o7.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:2o7.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:4sex.cz
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.360yield.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.doubleclick.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.netropolis.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.profesia.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.propellerads.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.sitelement.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yashi.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.zones.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.ad4game.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.adplxmd.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.atlas.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.centrum.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.czc.cz
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.fhserve.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.joj.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.live-media.cz
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.monogram.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.p161.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.pointroll.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.pubmatic.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.techbox.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtech.de
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:adultadworld.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:advert.uloz.to
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:advertising.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:affiliate.4sex.cz
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:at.atwola.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:atwola.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:casalemedia.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:collective-media.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:emjcd.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:fastclick.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:gay.porn.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:getclicky.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:googleads.g.doubleclick.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:in.getclicky.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:invitemedia.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:kontera.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:media6degrees.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:mediaplex.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:najlacnejsisexshop.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:nissaneurope.112.2o7.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:oracle.112.2o7.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:pointroll.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:pool-eu-ie.creative-serving.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:pubads.g.doubleclick.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:realmedia.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:ru4.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:xyx-match-book.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:sexad.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:sexualne.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:smartadserver.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:specificclick.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:stat.ringier.cz
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:statcounter.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:statse.webtrendslive.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:tacoda.at.atwola.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:track.adform.net
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:tradedoubler.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:tribalfusion.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.etracker.de
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.googleadservices.com
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.najlacnejsisexshop.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.sexualne.sk
   C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Cookies:zedo.com
   C:\Users\vojaga\AppData\Roaming\Microsoft\Windows\Cookies\7K1AKQ9D.txt
   C:\Users\vojaga\AppData\Roaming\Microsoft\Windows\Cookies\8N7PSH6N.txt
   C:\Users\vojaga\AppData\Roaming\Microsoft\Windows\Cookies\B22IYW7E.txt
   C:\Users\vojaga\AppData\Roaming\Microsoft\Windows\Cookies\Q3N949MF.txt
   C:\Users\vojaga\AppData\Roaming\Microsoft\Windows\Cookies\S7IN4CHI.txt










log z MBAM







Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2013.08.29.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16660
vojaga :: VOJAGA-PC [administrátor]

Ochrana: Povolena

29. 8. 2013 21:25:21
MBAM-log-2013-08-29 (23-19-24).txt

Typ: Kompletní kontrola (C:\|D:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 680200
Uplynulý čas: 1 hodin, 51 minut, 42 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 13
C:\Program Files\Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.
C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.
C:\ProgramData\Skype\rundll32.exe (PUP.Optional.BitCoinMiner) -> Nebyla provedena žádná instrukce.
C:\Users\vojaga\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\stub_data\stubinst_pkg_en-eu.cab (PUP.Optional.OpenCandy) -> Nebyla provedena žádná instrukce.
D:\soft\Adobe CS6 Master Collection\crack\DLL\Program Files (64)\Adobe\Adobe After Effects CS6\Support Files\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.
D:\soft\Adobe CS6 Master Collection\crack\DLL\Program Files (64)\Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.
D:\soft\Adobe CS6 Master Collection\crack\DLL\Program Files (64)\Adobe\Adobe Photoshop CS6 (64 Bit)\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.
D:\soft\Adobe CS6 Master Collection\crack\DLL\Program Files (64)\Adobe\Adobe Premiere Pro CS6\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.
D:\soft\Adobe CS6 Master Collection\crack\DLL\Program Files (x86)\Adobe\Adobe Flash CS6\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.
D:\soft\Adobe CS6 Master Collection\crack\DLL\Program Files (x86)\Adobe\Adobe Illustrator CS6\Support Files\Contents\Windows\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.
D:\soft\Adobe CS6 Master Collection\crack\DLL\Program Files (x86)\Adobe\Adobe InDesign CS6\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.
D:\soft\Adobe CS6 Master Collection\crack\DLL\Program Files (x86)\Adobe\Adobe Photoshop CS6\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.
D:\soft\Adobe CS6 Master Collection\crack\DLL\Program Files (x86)\Adobe\Adobe Prelude CS6\amtlib.dll (PUP.RiskwareTool.CK) -> Nebyla provedena žádná instrukce.

(konec)












Zdá sa, že po prečistení MBAM problém ustúpil. rundll32.exe nezere procesorový výkon tak ako predtým a vetntilák je v tichosti. Dufam ze nenastane zadna recidiva a ta pliaga sa neobnovy. V kazdom pripade dakujem za pomoc vazim si to.
Nahoru
Avatar uživatele
Tempest
VIP
VIP
Příspěvky: 193
Registrován: 05 Črv 2005 08:18

Re: Prosim o kontrolu logu z bf - rundll32.exe zaťažuje proc

#7 Příspěvek od Tempest »

Vypadá to dobře :)

1) Vše, co MBAM našel, nech smazat.

2) Udělej prosím poslední log z FRST - spusť FRST64.exe a klikni na tlačítko Scan. Po chvíli skenování se vytvoří a otevře log FRST.txt - jeho obsah mi sem zkopíruj.

Na základě toho logu už jen uklidíme :)
Nahoru
steinum
Návštěvník
Návštěvník
Příspěvky: 6
Registrován: 28 Srp 2013 11:04

Re: Prosim o kontrolu logu z bf - rundll32.exe zaťažuje proc

#8 Příspěvek od steinum »

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-09-2013 04
Ran by vojaga (administrator) on VOJAGA-PC on 02-09-2013 10:24:23
Running from C:\Users\vojaga\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchService.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Firebird Project) C:\Program Files (x86)\KROS\KROS FBServer\Firebird001\bin\fbserver.exe
(HP) C:\Windows\system32\HPSIsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
(Wacom Technology, Corp.) C:\Windows\system32\Pen_Tablet.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Wacom Technology, Corp.) C:\Windows\system32\WTablet\Pen_TabletUser.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Wacom Technology, Corp.) C:\Windows\system32\Pen_Tablet.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(KROS a.s.) C:\Program Files (x86)\KROS\ALFA plus\!System\ALFAplus.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
(Dell) C:\Users\vojaga\AppData\Local\Apps\2.0\KKPMJZ3B.AL0\38BAYP2O.3D1\dell..tion_0f612f649c4a10af_0005.0001_240bd831ade3aeac\DellSystemDetect.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
() D:\android\adt-bundle-windows-x86_64-20130219\eclipse\eclipse.exe
(Oracle Corporation) C:\Windows\system32\javaw.exe
(Oracle Corporation) C:\Program Files\Java\jdk1.7.0_09\bin\javaw.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Update\1.3.21.153\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
() D:\android\adt-bundle-windows-x86_64-20130219\sdk\platform-tools\adb.exe
(Oracle Corporation) C:\Program Files\Java\jdk1.7.0_09\jre\bin\java.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Update\GoogleUpdate.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchUser.exe
(Microsoft Corporation) C:\Windows\system32\winsat.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe
() C:\Users\vojaga\AppData\Local\Google\Update\Install\{1DF2632D-B31A-44F2-8426-1785B3EEAF57}\29.0.1547.62_29.0.1547.57_chrome_updater.exe
(Google Inc.) C:\Users\vojaga\AppData\Local\Temp\CR_60338.tmp\setup.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2818856 2011-08-26] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7284328 2011-08-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-17] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [10357008 2011-10-18] (Intel Corporation)
HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-09-16] (Intel(R) Corporation)
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe -Quiet [x]
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET Smart Security\egui.exe [4035152 2011-09-22] (ESET)
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028896 2013-08-27] (NVIDIA Corporation)
HKLM\...\Runonce: [WinSATRestorePower] - powercfg -setactive a1841308-3541-4fab-bc81-f71556f20b4a [x]
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1811880 2013-08-28] (Valve Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [DellSystemDetect] - C:\Users\vojaga\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell\Dell System Detect.appref-ms [370 2013-08-29] ()
HKCU\...\Policies\Explorer: [NoDrives] 0
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [Dell Registration] - C:\Program Files (x86)\System Registration\prodreg.exe [4165440 2011-08-04] (Dell, Inc.)
HKLM-x32\...\Run: [RoxWatchTray] - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [PowerDVD12DMREngine] - C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe [501544 2012-01-02] (CyberLink)
HKLM-x32\...\Run: [PowerDVD12Agent] - C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe [371256 2012-02-21] (CyberLink Corp.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll,C:\Windows\system32\nvinitx.dll [266448 2013-06-21] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [214448 2013-06-21] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ALFA plus - rýchle spustenie.lnk
ShortcutTarget: ALFA plus - rýchle spustenie.lnk -> C:\Program Files (x86)\KROS\ALFA plus\!System\ALFAplus.exe (KROS a.s.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.euro.dell.com/content/defau ... l=cs&s=bsd
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {F478734E-E0B4-4701-9F8F-DD5827F60336} URL = http://www.bing.com/search?q={searchTer ... -SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {F478734E-E0B4-4701-9F8F-DD5827F60336} URL = http://www.bing.com/search?q={searchTer ... -SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {F478734E-E0B4-4701-9F8F-DD5827F60336} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Pomocná služba pro přihlášení ke službě Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR Extension: (Google Drive) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0
CHR Extension: (Anatronica - 3D Interactive Anatomy) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\nalpooddpdnhjicpjgnhaihnnfnmbpee\1.2.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\vojaga\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
CHR StartMenuInternet: Google Chrome - C:\Users\vojaga\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 CLHNServiceForPowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [87336 2012-02-21] (CyberLink Corp.)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [75048 2012-02-21] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [296232 2012-02-21] (CyberLink)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [974944 2011-09-22] (ESET)
R2 FirebirdServerKROS_20400; C:\Program Files (x86)\KROS\KROS FBServer\Firebird001\bin\fbserver.exe [3764224 2011-10-11] (Firebird Project)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-16] ()
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14997280 2013-08-27] (NVIDIA Corporation)
R2 WTouchService; C:\Program Files\WTouch\WTouchService.exe [127272 2009-07-15] (Wacom Technology, Corp.)

==================== Drivers (Whitelisted) ====================

R3 AVer7231_x64; C:\Windows\System32\DRIVERS\AVer7231_x64.sys [1799808 2010-06-11] (AVerMedia TECHNOLOGIES, Inc.)
R2 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [202576 2011-08-09] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [146432 2011-08-04] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [187632 2011-08-04] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [38288 2011-08-04] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62496 2011-08-04] (ESET)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2009-12-04] (Marvell Semiconductor, Inc.)
R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [82928 2011-10-27] (Cyberlink Corp.)
R2 ntk_PowerDVD12; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [82928 2011-10-27] (Cyberlink Corp.)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-06-21] (NVIDIA Corporation)
S3 NvStUSB; C:\Windows\system32\drivers\nvstusb.sys [122472 2011-06-13] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-08-20] (NVIDIA Corporation)
R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [146928 2012-02-16] (CyberLink Corp.)
R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [146928 2012-02-16] (CyberLink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-02 10:23 - 2013-09-02 10:23 - 00000000 ____D C:\Users\vojaga\AppData\Local\qbF89E16A.33
2013-09-02 10:23 - 2013-09-02 06:22 - 01951950 _____ (Farbar) C:\Users\vojaga\Desktop\FRST64.exe
2013-08-29 23:40 - 2013-08-29 23:41 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell
2013-08-29 23:40 - 2013-08-29 23:40 - 00010699 _____ C:\Users\vojaga\Downloads\dellsystemdetect.bootstrapper.application
2013-08-29 21:24 - 2013-08-29 21:24 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\Malwarebytes
2013-08-29 21:24 - 2013-08-29 21:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-29 21:24 - 2013-08-29 21:24 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-29 21:24 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-29 21:16 - 2013-08-29 21:17 - 10284816 _____ (Malwarebytes Corporation ) C:\Users\vojaga\Downloads\mbam-setup.exe
2013-08-29 21:09 - 2013-08-29 21:26 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-29 20:56 - 2013-08-29 20:57 - 09879648 _____ (SurfRight B.V.) C:\Users\vojaga\Downloads\HitmanPro_x64.exe
2013-08-29 20:51 - 2013-08-29 20:51 - 00000000 ____D C:\Users\vojaga\AppData\Local\qb13F70B.C8
2013-08-29 20:46 - 2013-08-29 20:46 - 00000000 ____D C:\Users\vojaga\AppData\Local\qb0FA312.A2
2013-08-29 20:20 - 2013-08-20 15:33 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-08-29 20:20 - 2013-08-20 15:32 - 00029984 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-08-29 20:20 - 2013-08-20 15:32 - 00028448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-08-29 20:18 - 2013-08-29 20:18 - 00000000 ____D C:\Users\vojaga\AppData\Local\NVIDIA
2013-08-29 20:16 - 2013-08-29 20:16 - 00000000 ____D C:\Windows\SysWOW64\NV
2013-08-29 20:16 - 2013-08-29 20:16 - 00000000 ____D C:\Windows\system32\NV
2013-08-29 20:16 - 2013-08-29 20:16 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2013-08-29 20:13 - 2013-06-21 14:06 - 27781920 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 21102368 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 15920536 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 15144928 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 13411896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 11235104 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2013-08-29 20:13 - 2013-06-21 14:06 - 09239344 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 07687592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 07641832 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 06324360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 02953504 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 02777888 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 02363680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 02002720 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 01832224 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6432049.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6432049.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 00572704 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 00570656 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 00467232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 00465184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 00284448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvkflt.sys
2013-08-29 20:13 - 2013-06-21 14:06 - 00266448 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 00218592 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 00181488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2013-08-29 20:13 - 2013-06-21 14:06 - 00030496 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2013-08-29 20:11 - 2013-08-29 20:11 - 00000000 ____D C:\NVIDIA
2013-08-29 20:06 - 2013-08-29 20:10 - 233871960 _____ (NVIDIA Corporation) C:\Users\vojaga\Downloads\320.49-notebook-win8-win7-64bit-international-whql.exe
2013-08-29 16:55 - 2013-08-29 16:55 - 00000000 ____D C:\Users\vojaga\AppData\Local\qbBC8C4B.56
2013-08-29 16:55 - 2013-08-29 16:55 - 00000000 ____D C:\FRST
2013-08-29 13:46 - 2013-08-29 13:46 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\Sublime Text 3
2013-08-29 13:46 - 2013-08-29 13:46 - 00000000 ____D C:\Users\vojaga\AppData\Local\Sublime Text 3
2013-08-28 20:48 - 2013-08-28 21:51 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\WTouch
2013-08-28 13:16 - 2013-08-28 14:29 - 00001180 _____ C:\Users\vojaga\Desktop\kontakt na spravcovske spolocnosti.txt
2013-08-28 12:00 - 2013-08-28 12:00 - 00032766 _____ C:\ComboFix.txt
2013-08-28 11:25 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-28 11:25 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-28 11:25 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-28 11:25 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-28 11:25 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-28 11:25 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-28 11:25 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-28 11:23 - 2013-08-28 12:00 - 00000000 ____D C:\Qoobox
2013-08-28 11:22 - 2013-08-28 11:55 - 00000000 ____D C:\Windows\erdnt
2013-08-28 11:19 - 2013-08-28 11:20 - 05114728 ____R (Swearware) C:\Users\vojaga\Downloads\ComboFix.exe
2013-08-24 13:55 - 2013-08-24 13:55 - 17737608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-08-24 13:46 - 2013-08-24 13:46 - 00000000 ____D C:\ProgramData\Steam
2013-08-24 11:57 - 2013-08-24 11:57 - 00000848 _____ C:\Users\vojaga\Desktop\Sublime Text 3.lnk
2013-08-24 11:57 - 2013-08-24 11:57 - 00000000 ____D C:\Program Files\Sublime Text 3
2013-08-24 11:55 - 2013-08-24 11:57 - 07774288 _____ (Sublime HQ Pty Ltd ) C:\Users\vojaga\Downloads\Sublime Text Build 3047 x64 Setup.exe
2013-08-24 11:55 - 2013-08-24 11:56 - 06513608 _____ ( ) C:\Users\vojaga\Downloads\Sublime Text 2.0.2 x64 Setup.exe
2013-08-15 22:04 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 22:04 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 22:04 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 22:04 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 22:04 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 22:04 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 22:04 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 22:04 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 22:04 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 22:04 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 22:04 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 22:04 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 22:04 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 22:04 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-15 21:58 - 2013-08-15 21:59 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 23:37 - 2013-08-14 23:39 - 00000000 ____D C:\Users\vojaga\.gradle
2013-08-14 23:37 - 2013-08-14 23:37 - 00000000 ____D C:\Users\vojaga\AndroidStudioProjects
2013-08-14 23:26 - 2013-08-14 23:26 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\JetBrains
2013-08-14 22:45 - 2013-08-14 23:13 - 396091268 _____ (Google Inc.) C:\Users\vojaga\Downloads\android-studio-bundle-130.737825-windows.exe
2013-08-14 18:24 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 18:24 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 18:24 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 18:24 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 18:24 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 18:24 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 18:24 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 18:24 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 18:23 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 18:23 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 18:23 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 18:23 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 18:23 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 18:23 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 18:23 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 18:23 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 18:23 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 18:23 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 18:23 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 18:23 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 18:23 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 18:23 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 18:23 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 18:23 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 18:23 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 18:23 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 18:23 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-12 14:19 - 2013-08-12 14:20 - 00040960 _____ C:\Users\vojaga\Downloads\obmedzenia-prevadzky-post.xls
2013-08-07 14:35 - 2013-08-07 14:35 - 00088064 _____ C:\Users\vojaga\Downloads\Zadanie Sp.plochy Nové Sady.xls

==================== One Month Modified Files and Folders =======

2013-09-02 10:23 - 2013-09-02 10:23 - 00000000 ____D C:\Users\vojaga\AppData\Local\qbF89E16A.33
2013-09-02 10:22 - 2012-05-08 08:39 - 00000000 ____D C:\Users\vojaga\AppData\Local\Adobe
2013-09-02 10:22 - 2012-01-14 08:13 - 01626969 _____ C:\Windows\WindowsUpdate.log
2013-09-02 10:20 - 2012-05-14 17:27 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\Skype
2013-09-02 06:22 - 2013-09-02 10:23 - 01951950 _____ (Farbar) C:\Users\vojaga\Desktop\FRST64.exe
2013-08-31 12:56 - 2012-01-14 15:59 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-08-31 12:04 - 2013-06-04 07:58 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{37F9D6F9-AA52-489C-8EE4-7F30EDD621B3}
2013-08-30 11:08 - 2009-07-14 06:51 - 00108195 _____ C:\Windows\setupact.log
2013-08-30 10:07 - 2009-07-14 06:45 - 00025008 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-30 10:07 - 2009-07-14 06:45 - 00025008 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-30 10:01 - 2012-05-18 20:23 - 00000000 ____D C:\ProgramData\firebird
2013-08-30 10:01 - 2012-05-09 23:48 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-30 10:00 - 2012-05-08 08:47 - 00000000 ____D C:\Users\vojaga\AppData\Local\Deployment
2013-08-30 10:00 - 2012-01-14 16:04 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-08-30 10:00 - 2012-01-14 16:04 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-08-30 09:59 - 2012-11-21 20:38 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\WTablet
2013-08-30 09:59 - 2012-01-14 08:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-30 09:59 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-29 23:41 - 2013-08-29 23:40 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell
2013-08-29 23:40 - 2013-08-29 23:40 - 00010699 _____ C:\Users\vojaga\Downloads\dellsystemdetect.bootstrapper.application
2013-08-29 23:40 - 2012-05-08 08:47 - 00000000 ____D C:\Users\vojaga\AppData\Local\Apps\2.0
2013-08-29 23:22 - 2010-11-21 05:47 - 00027442 _____ C:\Windows\PFRO.log
2013-08-29 23:20 - 2012-01-14 16:02 - 00000000 ____D C:\ProgramData\Skype
2013-08-29 21:26 - 2013-08-29 21:09 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-29 21:24 - 2013-08-29 21:24 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\Malwarebytes
2013-08-29 21:24 - 2013-08-29 21:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-29 21:24 - 2013-08-29 21:24 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-29 21:17 - 2013-08-29 21:16 - 10284816 _____ (Malwarebytes Corporation ) C:\Users\vojaga\Downloads\mbam-setup.exe
2013-08-29 20:57 - 2013-08-29 20:56 - 09879648 _____ (SurfRight B.V.) C:\Users\vojaga\Downloads\HitmanPro_x64.exe
2013-08-29 20:51 - 2013-08-29 20:51 - 00000000 ____D C:\Users\vojaga\AppData\Local\qb13F70B.C8
2013-08-29 20:46 - 2013-08-29 20:46 - 00000000 ____D C:\Users\vojaga\AppData\Local\qb0FA312.A2
2013-08-29 20:21 - 2012-01-14 08:11 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-08-29 20:20 - 2012-01-14 08:11 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-08-29 20:18 - 2013-08-29 20:18 - 00000000 ____D C:\Users\vojaga\AppData\Local\NVIDIA
2013-08-29 20:18 - 2012-01-14 08:11 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-08-29 20:16 - 2013-08-29 20:16 - 00000000 ____D C:\Windows\SysWOW64\NV
2013-08-29 20:16 - 2013-08-29 20:16 - 00000000 ____D C:\Windows\system32\NV
2013-08-29 20:16 - 2013-08-29 20:16 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2013-08-29 20:11 - 2013-08-29 20:11 - 00000000 ____D C:\NVIDIA
2013-08-29 20:10 - 2013-08-29 20:06 - 233871960 _____ (NVIDIA Corporation) C:\Users\vojaga\Downloads\320.49-notebook-win8-win7-64bit-international-whql.exe
2013-08-29 16:55 - 2013-08-29 16:55 - 00000000 ____D C:\Users\vojaga\AppData\Local\qbBC8C4B.56
2013-08-29 16:55 - 2013-08-29 16:55 - 00000000 ____D C:\FRST
2013-08-29 13:46 - 2013-08-29 13:46 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\Sublime Text 3
2013-08-29 13:46 - 2013-08-29 13:46 - 00000000 ____D C:\Users\vojaga\AppData\Local\Sublime Text 3
2013-08-28 21:51 - 2013-08-28 20:48 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\WTouch
2013-08-28 14:29 - 2013-08-28 13:16 - 00001180 _____ C:\Users\vojaga\Desktop\kontakt na spravcovske spolocnosti.txt
2013-08-28 12:00 - 2013-08-28 12:00 - 00032766 _____ C:\ComboFix.txt
2013-08-28 12:00 - 2013-08-28 11:23 - 00000000 ____D C:\Qoobox
2013-08-28 12:00 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-28 11:55 - 2013-08-28 11:22 - 00000000 ____D C:\Windows\erdnt
2013-08-28 11:52 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-28 11:20 - 2013-08-28 11:19 - 05114728 ____R (Swearware) C:\Users\vojaga\Downloads\ComboFix.exe
2013-08-25 01:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-08-24 13:55 - 2013-08-24 13:55 - 17737608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-08-24 13:55 - 2013-03-07 01:06 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-24 13:55 - 2013-03-07 01:06 - 00003852 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-24 13:55 - 2012-01-14 15:21 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-24 13:46 - 2013-08-24 13:46 - 00000000 ____D C:\ProgramData\Steam
2013-08-24 13:46 - 2012-05-13 23:56 - 00000000 ____D C:\Users\vojaga\Documents\My Games
2013-08-24 11:57 - 2013-08-24 11:57 - 00000848 _____ C:\Users\vojaga\Desktop\Sublime Text 3.lnk
2013-08-24 11:57 - 2013-08-24 11:57 - 00000000 ____D C:\Program Files\Sublime Text 3
2013-08-24 11:57 - 2013-08-24 11:55 - 07774288 _____ (Sublime HQ Pty Ltd ) C:\Users\vojaga\Downloads\Sublime Text Build 3047 x64 Setup.exe
2013-08-24 11:56 - 2013-08-24 11:55 - 06513608 _____ ( ) C:\Users\vojaga\Downloads\Sublime Text 2.0.2 x64 Setup.exe
2013-08-21 18:25 - 2012-05-08 08:49 - 00002374 _____ C:\Users\vojaga\Desktop\Google Chrome.lnk
2013-08-20 15:33 - 2013-08-29 20:20 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2013-08-20 15:32 - 2013-08-29 20:20 - 00029984 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2013-08-20 15:32 - 2013-08-29 20:20 - 00028448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2013-08-15 22:03 - 2012-05-18 19:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-15 21:59 - 2013-08-15 21:58 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 21:58 - 2012-10-24 14:29 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 23:39 - 2013-08-14 23:37 - 00000000 ____D C:\Users\vojaga\.gradle
2013-08-14 23:37 - 2013-08-14 23:37 - 00000000 ____D C:\Users\vojaga\AndroidStudioProjects
2013-08-14 23:37 - 2012-05-08 08:33 - 00000000 ____D C:\Users\vojaga
2013-08-14 23:26 - 2013-08-14 23:26 - 00000000 ____D C:\Users\vojaga\AppData\Roaming\JetBrains
2013-08-14 23:22 - 2012-11-07 17:56 - 00000000 ____D C:\Program Files (x86)\Android
2013-08-14 23:13 - 2013-08-14 22:45 - 396091268 _____ (Google Inc.) C:\Users\vojaga\Downloads\android-studio-bundle-130.737825-windows.exe
2013-08-14 19:04 - 2012-11-12 12:14 - 00000000 ____D C:\Users\vojaga\AppData\Local\Eclipse
2013-08-12 14:20 - 2013-08-12 14:19 - 00040960 _____ C:\Users\vojaga\Downloads\obmedzenia-prevadzky-post.xls
2013-08-09 12:40 - 2012-11-26 23:04 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-07 14:35 - 2013-08-07 14:35 - 00088064 _____ C:\Users\vojaga\Downloads\Zadanie Sp.plochy Nové Sady.xls
2013-08-03 18:25 - 2012-07-26 09:34 - 00000000 ____D C:\Program Files (x86)\Google

Files to move or delete:
====================
C:\Users\vojaga\AppData\Local\Temp\nvStInst.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\setup.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\NvVAD\nvaudcap32v.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\NvVAD\nvaudcap64v.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\NvVAD\nvgenco32.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\NvVAD\nvgenco64.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\NVI2\NVI2.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\NVI2\NVI2UI.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\NVI2\NVPrxy32.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\NVI2\NVPrxy64.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\NVI2\ReleaseHighlights.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\MS.NET\dotNetFx40_Full_setup.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\MS.NET\MSNetExt.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\x86\server\detoured.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\x86\server\nvFBC.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\x86\server\NvGfeServiceBridge.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\x86\server\nvsteamsupport.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\x86\server\nvstreamer.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\x86\server\nvstreamsvc.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\x86\server\protobuf-net.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\x86\server\rxinput.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\x86\server\steam_api.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\SteamLauncher\NVIDIA.SteamLauncher.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\amd64\server\detoured.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\amd64\server\nvFBC.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\amd64\server\NvGfeServiceBridge.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\amd64\server\nvsteamsupport.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\amd64\server\nvstreamer.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\amd64\server\nvstreamsvc.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\amd64\server\rxinput.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamSrv\amd64\server\steam_api64.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamC\avcodec-52.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamC\avdevice-52.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamC\avformat-52.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamC\avutil-49.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamC\Bifrost.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamC\cudart32_41_0.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamC\NvStreamCExt.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamC\nvwinstreamc.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience.NvStreamC\swscale-0.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\7z.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\DisplayCplExt.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\ExtensionLoader.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\GalaSoft.MvvmLight.Extras.WPF4.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\GalaSoft.MvvmLight.WPF4.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\GFExperience.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\GFExperienceControls.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\GFExperienceCore.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\GFExperienceExt.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\GridService.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\InstallerService.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\InstallerUIExtension.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\log4net.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\Microsoft.Practices.ServiceLocation.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\Microsoft.WindowsAPICodePack.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\Microsoft.WindowsAPICodePack.Shell.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\NVIDIA.Settings.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\NVIDIA.Settings.Properties.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\NVIDIA.UpdateService.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\NVIDIA.Win32Api.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\nvtmru.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\oaremote_plugin.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\ShadowPlay.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\System.Reactive.Core.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\System.Reactive.Interfaces.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\System.Reactive.Linq.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\System.Reactive.PlatformServices.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\System.Reactive.Providers.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\System.Reactive.Runtime.Remoting.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\System.Reactive.Windows.Threading.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\System.Windows.Interactivity.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\zh-CHT\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\zh-CHS\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\tr-TR\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\th-TH\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\sv-SE\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\sl-SI\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\sk-SK\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\ru-RU\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\pt-PT\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\pt-BR\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\pl-PL\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\nl-NL\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\nb-NO\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\ko-KR\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\ja-JP\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\it-IT\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\hu-HU\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\he-IL\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\fr-FR\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\fi-FI\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\es-MX\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\es-ES\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\en-US\GFExperience.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\en-US\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\en-GB\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\el-GR\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\de-DE\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\da-DK\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\cs-CZ\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\GFExperience\ar-AE\GFExperienceControls.resources.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\ComUpdatus.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\daemonu.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\easyDaemonAPIU32.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\easyDaemonAPIU64.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\nvupdt32.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\nvupdt64.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\nvupdtr32.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\nvupdtr64.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\nvupdtrXP32.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\nvupdtrXP64.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\nvupdtXP32.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\nvupdtXP64.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\UpdateExt.dll
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Update\WLMerger.exe
C:\Users\vojaga\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\8.3.14.1\Display.Optimus\OptimusExt.dll
C:\Users\vojaga\AppData\Local\Temp\CR_60338.tmp\setup.exe
C:\Users\vojaga\AppData\Local\Temp\com.nvidia\NVIDIA GPU_Reader\1.3.3\GPU_Reader.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit



==================== Scheduled Tasks (whitelisted) ===========


==================== Supplementary Scan (All) ================


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000001
"EnableSecureUIAPaths"=dword:00000001
"EnableUIADesktopToggle"=dword:00000000
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"scforceoption"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"FilterAdministratorToken"=dword:00000000
"DisableRegistryTools"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval"=dword:00000001
"FirewallDisableNotify"=dword:00000000
"AntiVirusDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"AntiSpywareOverride"=dword:00000000
"FirewallOverride"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x0
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x0
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"="msrle32.dll"
"vidc.msvc"="msvidc32.dll"
"msacm.imaadpcm"="imaadp32.acm"
"msacm.msg711"="msg711.acm"
"msacm.msgsm610"="msgsm32.acm"
"msacm.msadpcm"="msadp32.acm"
"midimapper"="midimap.dll"
"wavemapper"="msacm32.drv"
"VIDC.UYVY"="msyuv.dll"
"VIDC.YUY2"="msyuv.dll"
"VIDC.YVYU"="msyuv.dll"
"VIDC.IYUV"="iyuv_32.dll"
"vidc.i420"="iyuv_32.dll"
"VIDC.YVU9"="tsbyuv.dll"
"msacm.l3acm"="C:\\Windows\\System32\\l3codeca.acm"
"MSVideo8"="VfWWDM32.dll"
"wave"="wdmaud.drv"
"midi"="wdmaud.drv"
"mixer"="wdmaud.drv"
"aux"="wdmaud.drv"
"wave1"="wdmaud.drv"
"midi1"="wdmaud.drv"
"mixer1"="wdmaud.drv"
"aux1"="wdmaud.drv"
"wave2"="wdmaud.drv"
"midi2"="wdmaud.drv"
"mixer2"="wdmaud.drv"
"wave3"="wdmaud.drv"
"midi3"="wdmaud.drv"
"mixer3"="wdmaud.drv"
"vidc.ffds"="ff_vfw.dll"
"vidc.lags"="lagarith.dll"
"vidc.XVID"="xvidvfw.dll"
"wave4"="wdmaud.drv"
"midi4"="wdmaud.drv"
"mixer4"="wdmaud.drv"


==================== Drive and Memory info ===================



LastRegBack: 2013-08-09 17:41

==================== End Of Log ==============================






Zrejme som si nieco odmazal, lebo ked pridavam alebo uberam zvuk skratkou na klavesnici tak sa mi nezobrazuje priehladny repracik v strede obrazovky ako to bolo doteraz.
Inak sa zda ze vsetko bezi ako ma.
Nahoru
Avatar uživatele
Tempest
VIP
VIP
Příspěvky: 193
Registrován: 05 Črv 2005 08:18

Re: Prosim o kontrolu logu z bf - rundll32.exe zaťažuje proc

#9 Příspěvek od Tempest »

Odstranili jsme pár zbytečných programů spouštějících se po startu počítače, tak je možné, že některý z nich tuto funkci zajišťoval. Pokud na ní trváš, zkus po jednom spouštět soubory uvedené u položek "...\Run:" v tomto postu a zkoušej, jestli po jejich spuštění ta funkce opět bude fungovat. Jakmile najdeš program, který ji zajišťuje, můžeš jeho zástupce umístit do nabídky Start - Po Spuštění a ten se tak bude spouštět při každém startu počítače a ta funkce ti zase poběží :-)

1) Jdi přes nabídku Start a do volného řádku zkopíruj tento příkaz a potvrď: ComboFix /Uninstall - tohle odinstaluje ComboFix

2) Aplikuj program T-Cleaner - vymaže záložní adresáře a pozůstatky vytvořené použitými programy - http://sweb.cz/Tharifas/T-Cleaner.exe

3) Smaž tyto soubory a složky, pokud existují:

C:\ProgramData\HitmanPro
C:\Users\vojaga\AppData\Local\qb0FA312.A2
C:\Users\vojaga\AppData\Local\qb13F70B.C8
C:\Users\vojaga\AppData\Local\qbBC8C4B.56
C:\Users\vojaga\AppData\Local\qbF89E16A.33
C:\Users\vojaga\Downloads\mbam-setup.exe
C:\Users\vojaga\Downloads\HitmanPro_x64.exe

4) Stáhni si portable verzi CCleaneru http://www.piriform.com/ccleaner/download/portable a na hlavní záložce Cleaner klikni na tlačítko Run Cleaner a potvrď - to odstraní dočasné soubory a uvolní místo na disku.

5) MBAM je dobrý antispyware, pokud ti vyhovuje, můžeš si ho nechat nainstalovaný.

Pokud nepozoruješ problémy, bude to vše :)
Nahoru
steinum
Návštěvník
Návštěvník
Příspěvky: 6
Registrován: 28 Srp 2013 11:04

Re: Prosim o kontrolu logu z bf - rundll32.exe zaťažuje proc

#10 Příspěvek od steinum »

Vdaka za pomoc. Ten subor som nakoniec nenasiel, ale nevadi asi som ho odmazal combofixom.
Nahoru
Avatar uživatele
Tempest
VIP
VIP
Příspěvky: 193
Registrován: 05 Črv 2005 08:18

Re: Prosim o kontrolu logu z bf - rundll32.exe zaťažuje proc

#11 Příspěvek od Tempest »

Ty máš notebook od Dellu? U těchto notebooků by danou funkci měl zajišťovat Dell Quickset. Zde zadej, co máš za produkt a následně budeš přesměrován na stránku se softwarem Dell ke stažení, kde ze sekce Applications stáhni a nainstaluj Dell Quickset :)
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“