PČR opět v akci - Victimer

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Zamčeno
Zpráva
Autor
Victimer
Návštěvník
Návštěvník
Příspěvky: 10
Registrován: 26 Črv 2013 20:32

PČR opět v akci - Victimer

#1 Příspěvek od Victimer »

Počítač se mi zaviroval virem policie čr, v nouzovém režimu se mi povedlo získat log z FRST ale už nevím jak dál

log:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-06-2013 02
Ran by Bal (administrator) on 26-06-2013 21:07:20
Running from F:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 10
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\cmd.exe

==================== Registry (Whitelisted) ==================

HKCU\...\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent [1641896 2013-06-07] (Valve Corporation)
HKCU\...\Run: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart [19676256 2013-06-06] (Google)
MountPoints2: {b745145a-7f0f-11e1-ad51-806e6f6e6963} - D:\Launch.exe
MountPoints2: {b9bebbb5-c475-11e1-952a-7071bce87380} - F:\Startme.exe
MountPoints2: {c5292759-0948-11e2-a99b-7071bce87380} - F:\Startme.exe
MountPoints2: {dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} - E:\INSTALL.EXE
HKLM-x32\...\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" [135536 2010-12-13] (Microsoft Corporation)
HKLM-x32\...\Run: [DATAMNGR] C:\PROGRA~2\WI3C8A~1\Datamngr\DATAMN~1.EXE [1694608 2012-03-06] (Bandoo Media, inc)
HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [2236080 2013-06-26] ()
HKU\Matěj\...\Run: [Smart Driver Updater] C:\Program Files (x86)\Smart Driver Updater\SDULauncher.exe [338576 2012-09-20] (Avanquest Software)
HKU\Matěj\...\Run: [ctfmon32.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\797je.dat,XFG00 [131072 2013-06-26] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll [1791384 2012-03-06] (Bandoo Media, inc)
AppInit_DLLs-x32: C:\PROGRA~2\WI3C8A~1\Datamngr\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll [1233816 2012-03-06] (Bandoo Media, inc)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\797je.dat (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
HKLM-x32 SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.mocaflix.com/?l=1&q={searchTerms}
HKCU SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
SearchScopes: HKCU - {1BE0EDCE-4B79-4E17-AED2-7147AD286174} URL = http://search.conduit.com/ResultsExt.as ... 02299&UM=1
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={AE6D ... 2013-05-26 20:48:23&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.mocaflix.com/?l=1&q={searchTerms}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: phpnuke Helper Object - {890CA547-B66C-48BF-9663-DBE0BFDC7D0C} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\bh\phpnuke.dll (PHPNuke.org)
BHO-x32: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO-x32: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll ()
BHO-x32: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc)
BHO-x32: DealPly - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files (x86)\DealPly\DealPlyIE.dll (DealPly Technologies Ltd)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MIF5BA~1\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - phpnuke Toolbar - {7B206A1E-933F-4A50-9E60-5167598BDB03} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\phpnukeTlbr.dll (PHPNuke.org)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll ()
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll (AVG Secure Search)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:
=======
CHR Extension: (YouTube) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1
CHR Extension: (Google Search) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1
CHR Extension: (DealPly) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje\3.0.7.2_0
CHR Extension: (avast! WebRep) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1483_0
CHR Extension: (Skype Click to Call) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.7.0.12055_0
CHR Extension: (Gmail) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

==================== Services (Whitelisted) =================

S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-03-25] ()
S2 vToolbarUpdater15.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-26] (AVG Secure Search)

==================== Drivers (Whitelisted) ====================

S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-08] (AVG Technologies CZ, s.r.o.)
S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-08] (AVG Technologies CZ, s.r.o.)
S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-06-26] (AVG Technologies)
S1 hola_net; C:\Windows\System32\DRIVERS\hola_net.sys [86512 2013-04-06] (Hola Networks Ltd.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation)
S3 Sftfs; C:\Windows\System32\DRIVERS\Sftfswin7.sys [765288 2011-10-01] (Microsoft Corporation)
S3 Sftplay; C:\Windows\System32\DRIVERS\Sftplaywin7.sys [268648 2011-10-01] (Microsoft Corporation)
S3 Sftredir; C:\Windows\System32\DRIVERS\Sftredirwin7.sys [25960 2011-10-01] (Microsoft Corporation)
S3 Sftvol; C:\Windows\System32\DRIVERS\Sftvolwin7.sys [22376 2011-10-01] (Microsoft Corporation)

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\System32\Drivers\ssadadb.sys 4DE0D5D747A73797C95A97DCCE5018B5
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\avgidsdrivera.sys 139BD30C32BEE830D0CF39C5324D79DE
C:\Windows\System32\DRIVERS\avgidsha.sys 2940FACB6EF92BD1936E4A1E2502468E
C:\Windows\System32\DRIVERS\avgldx64.sys 54B66C4AEEC6C4F742F3569EBA03EBB8
C:\Windows\System32\DRIVERS\avgloga.sys 13667B5D6310228A9FEF2BA5FCD9081F
C:\Windows\System32\DRIVERS\avgmfx64.sys BE82F9A1F2CCF4CE746D0C645D94079E
C:\Windows\System32\DRIVERS\avgrkx64.sys 5D11620DEF66F9DC9468FEE385A8429B
C:\Windows\System32\DRIVERS\avgtdia.sys 69BD90E337625F96C718CACE7A9C9E29
C:\Windows\system32\drivers\avgtpx64.sys 34E9A86B0EF71BA72B58D72215EBFABC
C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD
C:\Windows\system32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D
C:\Windows\System32\DRIVERS\e1c62x64.sys 03F4C5C12FC1C69F838DA723475EF650
C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fssfltr.sys B16B626996C74B564005BA855C5DEE90
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ggflt.sys 16C2A6BCDDA8952C2035DEC861492A19
C:\Windows\System32\DRIVERS\ggsemc.sys 6B503DF845EABF3457E49FBBDA26C10E
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hola_net.sys 6E66C859C47343172B070B7C93EAFB7C
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys 0089B53F1BEFD34B7D8CA4AB021335FA
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHD64.sys 150AC23F21DBDBF8488408BA944B0D65
C:\Windows\System32\DRIVERS\IntcDAud.sys AE594CC17C33AC146739494615E14851
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mcdbus.sys 79D51E7F5926E8CE1B3EBECEBAE28CFF
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys A6518DCC42F7A6E999BB3BEA8FD87567
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\Drivers\nx6000.sys BB590070D606AE6F008341FC9A7B2AD7
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netr28x.sys D9A089E17112F04F452D22254B959D87
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nusb3hub.sys B227E75AD10A142DD326B4CC8D73A6D9
C:\Windows\System32\DRIVERS\nusb3xhc.sys 55959DB860E4E484681586824D09E52C
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\drivers\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\drivers\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\s0016bus.sys EA268BCE30691C2DD24F02E617FD2EB5
C:\Windows\System32\DRIVERS\s0016mdfl.sys F5F9DEB89996D333EF976624D37E24E3
C:\Windows\System32\DRIVERS\s0016mdm.sys C17CE2AEE67480FEBCC36ECCB54C0BE8
C:\Windows\System32\DRIVERS\s0016mgmt.sys CC267F04C54C5EC5B7BD658D7628469F
C:\Windows\System32\DRIVERS\s0016nd5.sys 30A35BBCE09D9FE67482FD62C61911FC
C:\Windows\System32\DRIVERS\s0016obex.sys CA394DCC38579C7AD82E83EE64D798A0
C:\Windows\System32\DRIVERS\s0016unic.sys EB267CCEA84E6E8598D92F73332AC67B
C:\Windows\System32\DRIVERS\s1039bus.sys 0031DD0C5D4446DA0A3E02617DC6D642
C:\Windows\System32\DRIVERS\s1039mdfl.sys 98C7DBE2290D8CB0235E9528F6A1A53D
C:\Windows\System32\DRIVERS\s1039mdm.sys 7EF052A067D862ECD2A2335914611074
C:\Windows\System32\DRIVERS\s1039mgmt.sys BCC3F31F1FE1E78A5BA2CD6A0E44BA64
C:\Windows\System32\DRIVERS\s1039nd5.sys A0CF11BFFA41176CCD54E701CEB68921
C:\Windows\System32\DRIVERS\s1039obex.sys BD2DA968C5DCEF51BA8014FBAC7A0B6A
C:\Windows\System32\DRIVERS\s1039unic.sys 96B4051B65C1974258A8A33A03C0B082
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\serenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Sftfswin7.sys B2F21560016B3C200FC34F2BD13DE469
C:\Windows\System32\DRIVERS\Sftplaywin7.sys AD9449F3BF407DBD1742A465F2163847
C:\Windows\System32\DRIVERS\Sftredirwin7.sys 78A1496BA75C7D5700CECB77DDD291BB
C:\Windows\System32\DRIVERS\Sftvolwin7.sys DA674FD0164D64BD4980A619410D57E3
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\System32\DRIVERS\ssadbus.sys 8F8324ED1DE63FFC7B1A02CD2D963C72
C:\Windows\System32\DRIVERS\ssadmdfl.sys 58221EFCB74167B73667F0024C661CE0
C:\Windows\System32\DRIVERS\ssadmdm.sys 4DA7C71BFAC5AD71255B7E4CAB980163
C:\Windows\System32\DRIVERS\ssadserd.sys D33D1BD3EC0E766211A234F56A12726D
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\taphss.sys F33FDC72298DF4BF9813A55D21F4EB31
C:\Windows\System32\drivers\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\DRIVERS\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\system32\drivers\TsUsbGD.sys 9CC2CCAE8A84820EAECB886D477CBCB8
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\drivers\usbaudio.sys 82E8F44688E6FAC57B5B7C6FC7ADBC2A
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\system32\drivers\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-26 21:06 - 2013-06-26 21:06 - 00000000 ____D C:\FRST
2013-06-26 19:40 - 2013-06-26 20:12 - 95023320 ___AT C:\ProgramData\ej797.pad
2013-06-26 19:40 - 2013-06-26 20:09 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-06-26 19:40 - 2013-06-26 19:40 - 00131072 ____A (Microsoft Corporation) C:\ProgramData\797je.dat
2013-06-26 19:40 - 2013-06-26 19:40 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-06-26 19:40 - 2013-06-26 19:40 - 00000151 ____A C:\ProgramData\ej797.reg
2013-06-26 19:40 - 2013-06-26 19:40 - 00000056 ____A C:\ProgramData\ej797.bat
2013-06-26 17:51 - 2013-06-26 17:51 - 00000000 ____D C:\ProgramData\AVG Secure Search
2013-06-26 15:32 - 2013-06-26 15:46 - 42945880 ____A C:\Users\Bal\Desktop\Aquaman 021 (2013) (Digital) (Zone-Empire).cbr
2013-06-26 00:06 - 2013-06-26 00:06 - 00022428 ____A C:\Users\Bal\Desktop\continuum-S02E08-web-dl-By-bladesip-clear-garan_-jolinar-vanthomass.zip
2013-06-26 00:06 - 2013-06-26 00:06 - 00022318 ____A C:\Users\Bal\Desktop\continuum-S02E08-hdtv-By-bladesip-clear-garan_-jolinar.zip
2013-06-25 22:26 - 2013-06-26 00:52 - 1360963091 ____A C:\Users\Bal\Desktop\Continuum.S02E08.Second.Listen.720p.WEB-DL.AAC2.0.H264.mkv
2013-06-25 16:10 - 2013-06-25 17:29 - 1403177416 ____A C:\Users\Bal\Desktop\Continuum.S02E07.Second.Degree.720p.WEB-DL.AAC2.0.H264.mkv
2013-06-25 15:26 - 2013-06-25 15:09 - 00056653 ____A C:\Users\Bal\Desktop\Continuum.S02E06.HDTV.XviD.srt
2013-06-25 15:09 - 2013-06-25 15:49 - 372852874 ____A C:\Users\Bal\Desktop\Continuum.S02E06.HDTV.XviD.avi
2013-06-25 15:09 - 2013-06-25 15:09 - 00023672 ____A C:\Users\Bal\Desktop\Continuum-S02E06(0000219302).zip
2013-06-24 23:37 - 2013-06-24 23:37 - 00050463 ____A C:\Users\Bal\Desktop\Continuum.S02E05.HDTV.XVID.srt
2013-06-24 23:37 - 2013-06-24 23:37 - 00021522 ____A C:\Users\Bal\Desktop\Continuum-S02E05(0000218968).zip
2013-06-24 21:29 - 2013-06-24 22:10 - 374328254 ____A C:\Users\Bal\Desktop\Continuum.S02E05.HDTV.XVID.avi
2013-06-24 20:58 - 2013-06-24 20:11 - 00044893 ____A C:\Users\Bal\Desktop\Continuum.S02E04.HDTV.XviD.srt
2013-06-24 20:12 - 2013-06-24 20:12 - 00019132 ____A C:\Users\Bal\Desktop\Continuum-S02E04(0000218313).zip
2013-06-24 20:07 - 2013-06-24 21:15 - 365310588 ____A C:\Users\Bal\Desktop\Continuum.S02E04.HDTV.XviD.avi
2013-06-23 11:39 - 2013-06-23 11:39 - 00002122 ____A C:\Users\Public\Desktop\Medieval II Total War.lnk
2013-06-23 11:24 - 2013-06-23 11:24 - 00000000 ____D C:\ProgramData\InstallShield
2013-06-21 16:32 - 2013-06-21 16:32 - 00000000 ____D C:\Users\Bal\Desktop\2010 - Burlesque - soundtrack [320]
2013-06-21 16:18 - 2013-06-21 16:29 - 76053228 ____A C:\Users\Bal\Desktop\2010---Burlesque---soundtrack-[320].rar
2013-06-18 19:51 - 2013-06-19 00:53 - 1603668072 ____A C:\Users\Bal\Desktop\Burlesque 2010 BluRay 720p DTS x264-CHD [brrip.net].mkv
2013-06-17 15:58 - 2013-06-17 15:58 - 00000000 ____D C:\Users\Matěj\AppData\LocalGoogle
2013-06-17 08:25 - 2013-06-26 10:52 - 00000000 ___SD C:\Users\Bal\Disk Google
2013-06-17 08:25 - 2013-06-17 08:25 - 00001712 ____A C:\Users\Bal\Desktop\Disk Google.lnk
2013-06-17 08:22 - 2013-06-17 08:22 - 00000000 ____D C:\Users\Bal\AppData\LocalGoogle
2013-06-16 20:29 - 2013-06-16 20:29 - 00000000 ____D C:\Windows\SysWOW64\saves
2013-06-16 20:23 - 2013-06-23 11:40 - 00475376 ____A C:\Windows\DirectX.log
2013-06-15 08:46 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-15 08:46 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-15 08:46 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-15 08:46 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-15 08:46 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-15 08:46 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-15 08:46 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-15 08:46 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-15 08:46 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-15 08:46 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-15 08:46 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-15 08:46 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-15 07:59 - 2013-06-23 11:19 - 00002582 ____A C:\Windows\PFRO.log
2013-06-14 22:28 - 2013-06-14 22:28 - 02032700 ____A C:\Users\Matěj\Desktop\minecraftforge-universal-1.5.2-7.8.0.736.zip
2013-06-14 21:09 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\Podcasts
2013-06-14 21:09 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\Documents\Media Go
2013-06-14 21:07 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\AppData\Local\Sony
2013-06-14 21:07 - 2013-06-14 21:07 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-06-14 21:06 - 2013-06-14 21:06 - 00000000 ____D C:\Users\Matěj\AppData\Local\Downloaded Installations
2013-06-14 21:04 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Sony
2013-06-14 21:04 - 2013-06-14 21:06 - 00000000 ____D C:\Program Files (x86)\Sony Media Go Install
2013-06-13 00:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 00:19 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 00:19 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 00:19 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 00:19 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 00:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 16:58 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 16:58 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 16:58 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 16:58 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 16:58 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 16:58 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 16:58 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 16:58 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 16:58 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 16:58 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 16:58 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 16:58 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 16:58 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 16:58 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 16:58 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 16:58 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 16:58 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 16:58 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 16:58 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-11 15:44 - 2013-06-11 15:44 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_ssadadb_01005.Wdf
2013-06-10 22:59 - 2013-06-11 00:21 - 00000000 ____D C:\Users\Bal\Documents\Děják
2013-06-10 14:42 - 2013-06-10 14:42 - 00000000 ____D C:\Users\Default\AppData\Roaming\TuneUp Software
2013-06-10 14:42 - 2013-06-10 14:42 - 00000000 ____D C:\Users\Default User\AppData\Roaming\TuneUp Software
2013-06-09 16:00 - 2013-06-09 16:01 - 00001175 ____A C:\Users\Bal\Desktop\iw3sp – zástupce.lnk
2013-06-09 14:49 - 2013-06-09 14:49 - 00000000 ____D C:\Users\Bal\AppData\Local\Microsoft Games
2013-06-09 10:29 - 2013-06-09 10:29 - 00000282 ____A C:\SSUUpdater.log
2013-06-08 20:13 - 2013-06-08 20:21 - 00000000 ____D C:\Users\Bal\Documents\Euro Truck Simulator 2
2013-06-07 16:02 - 2013-06-07 16:02 - 00001392 ____A C:\Users\Matěj\Desktop\Spustit Euro Truck Simulator 2.lnk
2013-06-06 20:08 - 2013-06-06 20:09 - 00000000 ____D C:\Program Files (x86)\Euro Truck Simulator 2
2013-06-06 20:08 - 2012-10-20 16:34 - 544087432 ____A (SCS Software ) C:\Users\Matěj\Desktop\EuroTruckSimulator2.exe
2013-06-06 19:56 - 2013-06-16 20:28 - 00000000 ____D C:\Users\Matěj\Documents\Euro Truck Simulator 2
2013-06-06 19:11 - 2013-06-06 19:54 - 00000000 ____D C:\Users\Matěj\Desktop\Euro Truck Simulator 2
2013-06-06 16:37 - 2013-06-06 18:55 - 1185251012 ____A C:\Users\Matěj\Desktop\euro-truck-simulator-2(cz-sk)plna-verzia-(verze).rar
2013-06-06 11:59 - 2013-06-06 13:28 - 00000000 ____D C:\Users\Bal\Documents\Fyzika
2013-06-05 20:42 - 2013-06-05 20:42 - 00000013 ____A C:\Users\Matěj\Desktop\sirka.txt
2013-06-03 16:15 - 2013-06-03 16:15 - 00000117 ____A C:\Users\Public\sdelevURL.tmp
2013-06-03 15:03 - 2013-06-03 15:03 - 00000000 ____D C:\Users\Matěj\Desktop\SCPContainmentBreachv021
2013-06-03 15:01 - 2013-06-03 15:03 - 31044328 ____A C:\Users\Matěj\Desktop\SCPContainmentBreachv021.zip
2013-06-01 01:39 - 2013-06-01 01:39 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2013-06-01 01:33 - 2013-06-02 17:33 - 00001554 ____A C:\Users\Bal\Desktop\Terraria.lnk
2013-05-30 19:36 - 2013-06-10 20:10 - 00000045 ____A C:\Users\Matěj\Desktop\france.txt
2013-05-29 00:14 - 2013-05-29 00:14 - 00001959 ____A C:\Users\Bal\Desktop\Opera Mail.lnk
2013-05-29 00:14 - 2013-05-29 00:14 - 00000000 ____D C:\Users\Bal\AppData\Roaming\Opera Mail
2013-05-29 00:14 - 2013-05-29 00:14 - 00000000 ____D C:\Users\Bal\AppData\Local\Opera Mail
2013-05-28 19:56 - 2013-05-31 14:26 - 00000000 ____D C:\Program Files (x86)\Opera Next
2013-05-27 16:30 - 2013-06-06 20:00 - 00000000 ____D C:\Users\Matěj\AppData\Local\Avg2013
2013-05-27 16:30 - 2013-05-27 16:30 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\AVG2013
2013-05-27 16:30 - 2013-05-27 16:30 - 00000000 ____D C:\Users\Matěj\AppData\Local\AVG Secure Search
2013-05-27 14:28 - 2013-06-26 21:01 - 00005238 ____A C:\Windows\setupact.log

==================== One Month Modified Files and Folders =======

2013-06-26 21:06 - 2013-06-26 21:06 - 00000000 ____D C:\FRST
2013-06-26 21:01 - 2013-05-27 14:28 - 00005238 ____A C:\Windows\setupact.log
2013-06-26 21:01 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-26 20:58 - 2011-04-12 10:34 - 00666874 ____A C:\Windows\System32\perfh005.dat
2013-06-26 20:58 - 2011-04-12 10:34 - 00140312 ____A C:\Windows\System32\perfc005.dat
2013-06-26 20:58 - 2009-07-14 07:13 - 01579034 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-26 20:40 - 2012-04-05 13:14 - 01139508 ____A C:\Windows\WindowsUpdate.log
2013-06-26 20:12 - 2013-06-26 19:40 - 95023320 ___AT C:\ProgramData\ej797.pad
2013-06-26 20:09 - 2013-06-26 19:40 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-06-26 20:09 - 2012-04-12 19:49 - 00000942 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-26 19:41 - 2013-05-26 20:33 - 00000000 ____D C:\ProgramData\MFAData
2013-06-26 19:41 - 2012-04-12 19:41 - 00000914 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-26 19:40 - 2013-06-26 19:40 - 00131072 ____A (Microsoft Corporation) C:\ProgramData\797je.dat
2013-06-26 19:40 - 2013-06-26 19:40 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-06-26 19:40 - 2013-06-26 19:40 - 00000151 ____A C:\ProgramData\ej797.reg
2013-06-26 19:40 - 2013-06-26 19:40 - 00000056 ____A C:\ProgramData\ej797.bat
2013-06-26 19:28 - 2012-04-12 19:49 - 00000946 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-26 17:51 - 2013-06-26 17:51 - 00000000 ____D C:\ProgramData\AVG Secure Search
2013-06-26 17:51 - 2013-05-26 20:48 - 00045856 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx64.sys
2013-06-26 17:51 - 2013-05-26 20:48 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search
2013-06-26 15:46 - 2013-06-26 15:32 - 42945880 ____A C:\Users\Bal\Desktop\Aquaman 021 (2013) (Digital) (Zone-Empire).cbr
2013-06-26 12:30 - 2013-02-24 13:30 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-06-26 11:07 - 2012-08-21 10:44 - 00000000 ____D C:\Users\Bal\Documents\Instalace
2013-06-26 11:03 - 2013-05-07 20:47 - 00000000 ____D C:\Users\Bal\AppData\Roaming\.technic
2013-06-26 10:58 - 2009-07-14 06:45 - 00021888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-26 10:58 - 2009-07-14 06:45 - 00021888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-26 10:52 - 2013-06-17 08:25 - 00000000 ___SD C:\Users\Bal\Disk Google
2013-06-26 10:51 - 2012-06-15 18:15 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-26 00:59 - 2012-04-14 18:54 - 00000000 ____D C:\Users\Bal\AppData\Roaming\vlc
2013-06-26 00:52 - 2013-06-25 22:26 - 1360963091 ____A C:\Users\Bal\Desktop\Continuum.S02E08.Second.Listen.720p.WEB-DL.AAC2.0.H264.mkv
2013-06-26 00:06 - 2013-06-26 00:06 - 00022428 ____A C:\Users\Bal\Desktop\continuum-S02E08-web-dl-By-bladesip-clear-garan_-jolinar-vanthomass.zip
2013-06-26 00:06 - 2013-06-26 00:06 - 00022318 ____A C:\Users\Bal\Desktop\continuum-S02E08-hdtv-By-bladesip-clear-garan_-jolinar.zip
2013-06-25 21:53 - 2012-04-14 11:04 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Skype
2013-06-25 21:52 - 2012-04-14 10:48 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\.minecraft
2013-06-25 17:29 - 2013-06-25 16:10 - 1403177416 ____A C:\Users\Bal\Desktop\Continuum.S02E07.Second.Degree.720p.WEB-DL.AAC2.0.H264.mkv
2013-06-25 15:49 - 2013-06-25 15:09 - 372852874 ____A C:\Users\Bal\Desktop\Continuum.S02E06.HDTV.XviD.avi
2013-06-25 15:09 - 2013-06-25 15:26 - 00056653 ____A C:\Users\Bal\Desktop\Continuum.S02E06.HDTV.XviD.srt
2013-06-25 15:09 - 2013-06-25 15:09 - 00023672 ____A C:\Users\Bal\Desktop\Continuum-S02E06(0000219302).zip
2013-06-24 23:37 - 2013-06-24 23:37 - 00050463 ____A C:\Users\Bal\Desktop\Continuum.S02E05.HDTV.XVID.srt
2013-06-24 23:37 - 2013-06-24 23:37 - 00021522 ____A C:\Users\Bal\Desktop\Continuum-S02E05(0000218968).zip
2013-06-24 22:10 - 2013-06-24 21:29 - 374328254 ____A C:\Users\Bal\Desktop\Continuum.S02E05.HDTV.XVID.avi
2013-06-24 21:15 - 2013-06-24 20:07 - 365310588 ____A C:\Users\Bal\Desktop\Continuum.S02E04.HDTV.XviD.avi
2013-06-24 20:43 - 2013-02-24 18:37 - 00000000 ____D C:\Users\Bal\AppData\Local\Windows Live
2013-06-24 20:12 - 2013-06-24 20:12 - 00019132 ____A C:\Users\Bal\Desktop\Continuum-S02E04(0000218313).zip
2013-06-24 20:11 - 2013-06-24 20:58 - 00044893 ____A C:\Users\Bal\Desktop\Continuum.S02E04.HDTV.XviD.srt
2013-06-23 11:40 - 2013-06-16 20:23 - 00475376 ____A C:\Windows\DirectX.log
2013-06-23 11:39 - 2013-06-23 11:39 - 00002122 ____A C:\Users\Public\Desktop\Medieval II Total War.lnk
2013-06-23 11:29 - 2012-04-05 20:01 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-23 11:24 - 2013-06-23 11:24 - 00000000 ____D C:\ProgramData\InstallShield
2013-06-23 11:21 - 2012-04-14 10:24 - 00128680 ____A C:\Users\Matěj\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-23 11:19 - 2013-06-15 07:59 - 00002582 ____A C:\Windows\PFRO.log
2013-06-22 20:36 - 2012-04-05 20:03 - 00128680 ____A C:\Users\Bal\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-21 22:01 - 2009-07-14 06:45 - 00500280 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-21 16:32 - 2013-06-21 16:32 - 00000000 ____D C:\Users\Bal\Desktop\2010 - Burlesque - soundtrack [320]
2013-06-21 16:29 - 2013-06-21 16:18 - 76053228 ____A C:\Users\Bal\Desktop\2010---Burlesque---soundtrack-[320].rar
2013-06-21 15:44 - 2013-03-06 10:11 - 00000000 ____D C:\Users\Bal\AppData\Roaming\SoftGrid Client
2013-06-20 15:47 - 2012-04-14 18:55 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\vlc
2013-06-19 16:46 - 2013-04-20 00:03 - 00000000 ____D C:\Users\Bal\AppData\Roaming\BitLord
2013-06-19 00:53 - 2013-06-18 19:51 - 1603668072 ____A C:\Users\Bal\Desktop\Burlesque 2010 BluRay 720p DTS x264-CHD [brrip.net].mkv
2013-06-18 19:51 - 2013-04-20 00:03 - 00000000 ____D C:\Users\Bal\Documents\BitLord
2013-06-18 18:36 - 2012-05-11 23:09 - 00000000 ____D C:\Users\Bal\AppData\Local\Paint.NET
2013-06-17 15:58 - 2013-06-17 15:58 - 00000000 ____D C:\Users\Matěj\AppData\LocalGoogle
2013-06-17 15:58 - 2012-04-14 20:03 - 00000000 ____D C:\Users\Matěj\AppData\Local\Google
2013-06-17 08:25 - 2013-06-17 08:25 - 00001712 ____A C:\Users\Bal\Desktop\Disk Google.lnk
2013-06-17 08:25 - 2012-04-05 13:15 - 00000000 ____D C:\users\Bal
2013-06-17 08:22 - 2013-06-17 08:22 - 00000000 ____D C:\Users\Bal\AppData\LocalGoogle
2013-06-17 08:22 - 2012-04-12 19:49 - 00000000 ____D C:\Users\Bal\AppData\Local\Google
2013-06-17 08:22 - 2012-04-12 19:49 - 00000000 ____D C:\Program Files (x86)\Google
2013-06-16 20:29 - 2013-06-16 20:29 - 00000000 ____D C:\Windows\SysWOW64\saves
2013-06-16 20:28 - 2013-06-06 19:56 - 00000000 ____D C:\Users\Matěj\Documents\Euro Truck Simulator 2
2013-06-15 16:38 - 2012-04-14 10:47 - 00000000 ____D C:\Users\Matěj\Downloads\.minecraft – kopie
2013-06-14 22:28 - 2013-06-14 22:28 - 02032700 ____A C:\Users\Matěj\Desktop\minecraftforge-universal-1.5.2-7.8.0.736.zip
2013-06-14 21:41 - 2012-04-12 19:41 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-14 21:41 - 2012-04-12 19:41 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-14 21:09 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\Podcasts
2013-06-14 21:09 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\Documents\Media Go
2013-06-14 21:09 - 2013-06-14 21:07 - 00000000 ____D C:\Users\Matěj\AppData\Local\Sony
2013-06-14 21:09 - 2013-06-14 21:04 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Sony
2013-06-14 21:09 - 2012-04-12 21:06 - 00000000 ____D C:\users\Matěj
2013-06-14 21:07 - 2013-06-14 21:07 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-06-14 21:07 - 2012-07-25 10:43 - 00000000 ____D C:\Program Files (x86)\Sony
2013-06-14 21:06 - 2013-06-14 21:06 - 00000000 ____D C:\Users\Matěj\AppData\Local\Downloaded Installations
2013-06-14 21:06 - 2013-06-14 21:04 - 00000000 ____D C:\Program Files (x86)\Sony Media Go Install
2013-06-14 16:43 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-13 17:39 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-13 00:20 - 2012-04-12 19:43 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 00:17 - 2013-03-09 16:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-11 15:44 - 2013-06-11 15:44 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_ssadadb_01005.Wdf
2013-06-11 00:21 - 2013-06-10 22:59 - 00000000 ____D C:\Users\Bal\Documents\Děják
2013-06-10 20:10 - 2013-05-30 19:36 - 00000045 ____A C:\Users\Matěj\Desktop\france.txt
2013-06-10 20:07 - 2012-04-14 19:03 - 00000000 ___RD C:\Users\Matěj\Desktop\Clone wars
2013-06-10 14:42 - 2013-06-10 14:42 - 00000000 ____D C:\Users\Default\AppData\Roaming\TuneUp Software
2013-06-10 14:42 - 2013-06-10 14:42 - 00000000 ____D C:\Users\Default User\AppData\Roaming\TuneUp Software
2013-06-10 14:42 - 2013-05-26 20:48 - 00000977 ____A C:\Users\Public\Desktop\AVG 2013.lnk
2013-06-09 23:24 - 2013-03-10 13:00 - 00000000 ____D C:\Users\Bal\Documents\Astrokurz
2013-06-09 16:01 - 2013-06-09 16:00 - 00001175 ____A C:\Users\Bal\Desktop\iw3sp – zástupce.lnk
2013-06-09 14:49 - 2013-06-09 14:49 - 00000000 ____D C:\Users\Bal\AppData\Local\Microsoft Games
2013-06-09 10:29 - 2013-06-09 10:29 - 00000282 ____A C:\SSUUpdater.log
2013-06-08 22:35 - 2012-09-19 17:14 - 00000000 ____D C:\Users\Bal\AppData\Roaming\Audacity
2013-06-08 22:20 - 2013-02-24 18:47 - 00007168 ____A C:\Users\Bal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-08 20:21 - 2013-06-08 20:13 - 00000000 ____D C:\Users\Bal\Documents\Euro Truck Simulator 2
2013-06-08 16:08 - 2013-06-15 08:46 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-15 08:46 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-15 08:46 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-15 08:46 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-15 08:46 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-15 08:46 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-15 08:46 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-15 08:46 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:40 - 2013-06-15 08:46 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-15 08:46 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-15 08:46 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:13 - 2013-06-15 08:46 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-07 16:02 - 2013-06-07 16:02 - 00001392 ____A C:\Users\Matěj\Desktop\Spustit Euro Truck Simulator 2.lnk
2013-06-06 20:09 - 2013-06-06 20:08 - 00000000 ____D C:\Program Files (x86)\Euro Truck Simulator 2
2013-06-06 20:00 - 2013-05-27 16:30 - 00000000 ____D C:\Users\Matěj\AppData\Local\Avg2013
2013-06-06 19:54 - 2013-06-06 19:11 - 00000000 ____D C:\Users\Matěj\Desktop\Euro Truck Simulator 2
2013-06-06 18:55 - 2013-06-06 16:37 - 1185251012 ____A C:\Users\Matěj\Desktop\euro-truck-simulator-2(cz-sk)plna-verzia-(verze).rar
2013-06-06 13:47 - 2013-04-22 17:25 - 00000000 ____D C:\Users\Bal\Documents\Nová složka
2013-06-06 13:28 - 2013-06-06 11:59 - 00000000 ____D C:\Users\Bal\Documents\Fyzika
2013-06-05 22:50 - 2013-03-01 22:20 - 00008704 ____A C:\Users\Matěj\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-05 20:42 - 2013-06-05 20:42 - 00000013 ____A C:\Users\Matěj\Desktop\sirka.txt
2013-06-03 16:15 - 2013-06-03 16:15 - 00000117 ____A C:\Users\Public\sdelevURL.tmp
2013-06-03 15:03 - 2013-06-03 15:03 - 00000000 ____D C:\Users\Matěj\Desktop\SCPContainmentBreachv021
2013-06-03 15:03 - 2013-06-03 15:01 - 31044328 ____A C:\Users\Matěj\Desktop\SCPContainmentBreachv021.zip
2013-06-02 17:34 - 2013-04-17 23:47 - 00000000 ____D C:\Users\Bal\Documents\Cemie
2013-06-02 17:33 - 2013-06-01 01:33 - 00001554 ____A C:\Users\Bal\Desktop\Terraria.lnk
2013-06-01 12:45 - 2013-03-06 10:08 - 01557320 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-06-01 01:40 - 2012-06-15 15:57 - 00000000 ____D C:\Users\Bal\Documents\My Games
2013-06-01 01:39 - 2013-06-01 01:39 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2013-05-31 15:31 - 2012-04-14 11:04 - 00000000 ____D C:\ProgramData\Skype
2013-05-31 15:31 - 2012-04-14 11:04 - 00000000 ____D C:\Program Files (x86)\Skype
2013-05-31 14:26 - 2013-05-28 19:56 - 00000000 ____D C:\Program Files (x86)\Opera Next
2013-05-30 16:20 - 2012-04-13 21:06 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Opera
2013-05-30 16:20 - 2012-04-13 21:06 - 00000000 ____D C:\Users\Matěj\AppData\Local\Opera
2013-05-29 00:14 - 2013-05-29 00:14 - 00001959 ____A C:\Users\Bal\Desktop\Opera Mail.lnk
2013-05-29 00:14 - 2013-05-29 00:14 - 00000000 ____D C:\Users\Bal\AppData\Roaming\Opera Mail
2013-05-29 00:14 - 2013-05-29 00:14 - 00000000 ____D C:\Users\Bal\AppData\Local\Opera Mail
2013-05-28 19:56 - 2012-04-12 19:38 - 00000000 ____D C:\Users\Bal\AppData\Roaming\Opera
2013-05-28 19:56 - 2012-04-12 19:38 - 00000000 ____D C:\Users\Bal\AppData\Local\Opera
2013-05-27 20:41 - 2013-05-20 20:16 - 00000000 ____D C:\Users\Matěj\Desktop\?oporno
2013-05-27 16:30 - 2013-05-27 16:30 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\AVG2013
2013-05-27 16:30 - 2013-05-27 16:30 - 00000000 ____D C:\Users\Matěj\AppData\Local\AVG Secure Search
2013-05-27 16:24 - 2013-05-26 20:45 - 00000000 ____D C:\Program Files (x86)\AVG

Files to move or delete:
====================
C:\ProgramData\rundll32.exe
C:\ProgramData\797je.dat
C:\ProgramData\7off.pad
C:\ProgramData\ej797.bat
C:\ProgramData\ej797.pad
C:\ProgramData\ej797.reg
C:\ProgramData\ffo7.dat

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== BCD ================================

Spr vce spouçtŘnˇ firmwaru
---------------------
identifik tor {fwbootmgr}
displayorder {bootmgr}
{bd1becec-7f16-11e1-b188-abff605d4282}
{bd1beced-7f16-11e1-b188-abff605d4282}
{bd1becee-7f16-11e1-b188-abff605d4282}
{b745145f-7f0f-11e1-ad51-806e6f6e6963}
timeout 1

Spr vce spouçtŘnˇ syst‚mu Windows
--------------------
identifik tor {bootmgr}
device partition=\Device\HarddiskVolume1
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale cs-CZ
inherit {globalsettings}
default {current}
resumeobject {bd1becf0-7f16-11e1-b188-abff605d4282}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30

Firmwarov  aplikace (101fffff)
-------------------------------
identifik tor {b745145f-7f0f-11e1-ad51-806e6f6e6963}
device partition=\Device\HarddiskVolume1
path \EFI\BOOT\BOOTX64.EFI
description UEFI: ST31000524AS

Firmwarov  aplikace (101fffff)
-------------------------------
identifik tor {bd1becec-7f16-11e1-b188-abff605d4282}
description Hard Drive

Firmwarov  aplikace (101fffff)
-------------------------------
identifik tor {bd1beced-7f16-11e1-b188-abff605d4282}
description Network Card

Firmwarov  aplikace (101fffff)
-------------------------------
identifik tor {bd1becee-7f16-11e1-b188-abff605d4282}
description CD/DVD Drive

Zav dŘcˇ program pro spouçtŘnˇ syst‚mu Windows
-------------------
identifik tor {current}
device partition=C:
path \Windows\system32\winload.efi
description Windows 7
locale cs-CZ
inherit {bootloadersettings}
recoverysequence {bd1becf2-7f16-11e1-b188-abff605d4282}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {bd1becf0-7f16-11e1-b188-abff605d4282}
nx OptIn

Zav dŘcˇ program pro spouçtŘnˇ syst‚mu Windows
-------------------
identifik tor {bd1becf2-7f16-11e1-b188-abff605d4282}
device ramdisk=[C:]\Recovery\bd1becf2-7f16-11e1-b188-abff605d4282\Winre.wim,{bd1becf3-7f16-11e1-b188-abff605d4282}
path \windows\system32\winload.efi
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\bd1becf2-7f16-11e1-b188-abff605d4282\Winre.wim,{bd1becf3-7f16-11e1-b188-abff605d4282}
systemroot \windows
nx OptIn
winpe Yes

Obnovenˇ z hibernace
---------------------
identifik tor {bd1becf0-7f16-11e1-b188-abff605d4282}
device partition=C:
path \Windows\system32\winresume.efi
description Windows Resume Application
locale cs-CZ
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No

Testov nˇ pamŘti syst‚mu Windows
---------------------
identifik tor {memdiag}
device partition=\Device\HarddiskVolume1
path \EFI\Microsoft\Boot\memtest.efi
description Diagnostika pamŘti syst‚mu Windows
locale cs-CZ
inherit {globalsettings}
badmemoryaccess Yes

Nastavenˇ slu§by EMS
------------
identifik tor {emssettings}
bootems Yes

Nastavenˇ ladicˇho programu
-----------------
identifik tor {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200

Chyby pamŘti RAM
-----------
identifik tor {badmemory}

Glob lnˇ nastavenˇ
---------------
identifik tor {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}

Nastavenˇ spouçtŘcˇho zavadŘźe
--------------------
identifik tor {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}

Nastavenˇ hypervisoru
-------------------
identifik tor {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200

Nastavenˇ zavadŘźe obnovenˇ
----------------------
identifik tor {resumeloadersettings}
inherit {globalsettings}

Parametry zaýˇzenˇ
--------------
identifik tor {bd1becf3-7f16-11e1-b188-abff605d4282}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\bd1becf2-7f16-11e1-b188-abff605d4282\boot.sdi



LastRegBack: 2013-06-23 12:56

==================== End Of Log ============================
Naposledy upravil(a) vyosek dne 26 Črv 2013 22:26, celkem upraveno 1 x.
Důvod: Oddeleni tematu
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: PČR opět v akci - Victimer

#2 Příspěvek od vyosek »

Zdravim :)

:arrow: Tema jsem oddelil, do cizich se nevstupuju

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    HKLM-x32\...\Run: [DATAMNGR] C:\PROGRA~2\WI3C8A~1\Datamngr\DATAMN~1.EXE [1694608 2012-03-06] (Bandoo Media, inc)
HKLM-x32\...\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [2236080 2013-06-26] ()
HKU\Matěj\...\Run: [Smart Driver Updater] C:\Program Files (x86)\Smart Driver Updater\SDULauncher.exe [338576 2012-09-20] (Avanquest Software)
HKU\Matěj\...\Run: [ctfmon32.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\797je.dat,XFG00 [131072 2013-06-26] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll [1791384 2012-03-06] (Bandoo Media, inc)
AppInit_DLLs-x32: C:\PROGRA~2\WI3C8A~1\Datamngr\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll [1233816 2012-03-06] (Bandoo Media, inc)
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\797je.dat (Microsoft Corporation)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
HKLM-x32 SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.mocaflix.com/?l=1&q={searchTerms}
HKCU SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
SearchScopes: HKCU - {1BE0EDCE-4B79-4E17-AED2-7147AD286174} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2549263&CUI=UN59978950911702299&UM=1
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={AE6DC3C3-A4CA-40E5-B9F8-E58A35E8F616}&mid=12d42df4f83147d39d66a138fa0c9a73-da647ecb9a0c3f7b4635f741d2e1c344c29f73e4&lang=cs&ds=AVG&pr=fr&d=2013-05-26 20:48:23&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.mocaflix.com/?l=1&q={searchTerms}
BHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - No File
BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc)
BHO-x32: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO-x32: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll ()
BHO-x32: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll ()
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll (AVG Secure Search)
S2 vToolbarUpdater15.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-26] (AVG Secure Search)
C:\Program Files (x86)\Common Files\AVG Secure Search
C:\Program Files (x86)\AVG Secure Search
C:\PROGRA~2\WI3C8A~1\Datamngr
2013-06-26 19:40 - 2013-06-26 20:12 - 95023320 ___AT C:\ProgramData\ej797.pad
2013-06-26 19:40 - 2013-06-26 20:09 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-06-26 19:40 - 2013-06-26 19:40 - 00131072 ____A (Microsoft Corporation) C:\ProgramData\797je.dat
2013-06-26 19:40 - 2013-06-26 19:40 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-06-26 19:40 - 2013-06-26 19:40 - 00000151 ____A C:\ProgramData\ej797.reg
2013-06-26 19:40 - 2013-06-26 19:40 - 00000056 ____A C:\ProgramData\ej797.bat
2013-06-26 17:51 - 2013-06-26 17:51 - 00000000 ____D C:\ProgramData\AVG Secure Search
C:\ProgramData\rundll32.exe
C:\ProgramData\797je.dat
C:\ProgramData\7off.pad
C:\ProgramData\ej797.bat
C:\ProgramData\ej797.pad
C:\ProgramData\ej797.reg
C:\ProgramData\ffo7.dat
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny log na flashku k FRST
:arrow: Spustte znovu FRST.exe na tom poskozenem PC
  • Kliknete na Fix
  • Probehne oprava a na flash disku se vytvori log Fixlog.txt
:arrow: Pokuste se nastartovat do bezneho rezimu
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Victimer
Návštěvník
Návštěvník
Příspěvky: 10
Registrován: 26 Črv 2013 20:32

Re: PČR opět v akci - Victimer

#3 Příspěvek od Victimer »

děkuju, už zase šlape jako hodinky :happy:
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: PČR opět v akci - Victimer

#4 Příspěvek od vyosek »

:arrow: Jenze to neni zdaleka vse

:arrow: Dejte mi sem log fixlog.txt, je umisten na flesce

:arrow: Dejte log z RSIT http://forum.viry.cz/viewtopic.php?f=24&t=130784
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Victimer
Návštěvník
Návštěvník
Příspěvky: 10
Registrován: 26 Črv 2013 20:32

Re: PČR opět v akci - Victimer

#5 Příspěvek od Victimer »

log z RSIT:
Logfile of random's system information tool 1.08 (written by random/random)
Run by Bal at 2013-06-27 16:16:05
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 653 GB (68%) free of 954 GB
Total RAM: 4003 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:16:19, on 27.6.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16611)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files (x86)\MagicDisc\MagicDisc.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files (x86)\Opera\opera.exe
C:\Program Files (x86)\BitLord 2\Bitlord files\bitlord.exe
C:\Program Files\trend micro\Bal.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: phpnuke Helper Object - {890CA547-B66C-48BF-9663-DBE0BFDC7D0C} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\bh\phpnuke.dll
O2 - BHO: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: DealPly - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files (x86)\DealPly\DealPlyIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MIF5BA~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: phpnuke Toolbar - {7B206A1E-933F-4A50-9E60-5167598BDB03} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\phpnukeTlbr.dll
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: MagicDisc.lnk = C:\Program Files (x86)\MagicDisc\MagicDisc.exe
O4 - Startup: OpenOffice.org 3.3.lnk = C:\FRST\Quarantine\quickstart.exe
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~2\MIF5BA~1\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do OneNotu - res://C:\PROGRA~2\MIF5BA~1\Office15\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Program Files (x86)\Edimax\Common\RaRegistry.exe
O23 - Service: Ralink Registry Writer 64 (RalinkRegistryWriter64) - Ralink Technology, Corp. - C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
O23 - Service: Splashtop® Remote Service (SplashtopRemoteService) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Splashtop Software Updater Service (SSUService) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11931 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
C:\PROGRA~2\AVG\AVG2013\avgrsa.exe /boot
C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe /pipeName=869a7449-763b-453b-ac49-6113afe5b00f /coreSdkOptions=4382 /logConfFile="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2013\temp\046a316a-b656-423c-abc4-190336f86304-1e4-oopp.tmp" /loggerName=AVG.RS.Core /binaryPath="C:\Program Files (x86)\AVG\AVG2013\" /registryPath="SYSTEM\CurrentControlSet\Services\Avg\Avg2013" /tempPath="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2013\temp\"
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe 23324640
\??\C:\Windows\system32\conhost.exe "16556669671831722046-1012413716-347855499818627516-1160478407504507128621180202
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe"
"C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe"
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files\Microsoft LifeCam\MSCamS64.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files (x86)\Edimax\Common\RaRegistry.exe"
"C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe"
"C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe"
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
"C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe"
WLIDSvcM.exe 2780
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe"
"C:\Program Files (x86)\AVG\AVG2013\avgemca.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"taskhost.exe"
-h
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"SRFeature.exe"
"C:\Program Files (x86)\Steam\Steam.exe" -silent
"C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
"C:\Program Files (x86)\MagicDisc\MagicDisc.exe"
"C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
"C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Common Files\Steam\SteamService.exe" /RunAsService
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Program Files (x86)\Opera\opera.exe"
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe /pipeName=bf15201b-e0de-427b-9517-ba6a3b79ea73 /coreSdkOptions=4114 /logConfFile="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2013\temp\fa3f0045-5e69-4462-a11b-265567679818-cf4-oopp.tmp" /loggerName=AVG.NS.Core /binaryPath="C:\Program Files (x86)\AVG\AVG2013\" /registryPath="SYSTEM\CurrentControlSet\Services\Avg\Avg2013" /tempPath="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2013\temp\"
"C:\Program Files (x86)\BitLord 2\Bitlord files\bitlord.exe" "magnet:?xt=urn:btih:5468e2402d1676f4f5a2c213f8a912f38c703f97&dn=DC+NEW+52+WEEK+95&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80&tr=udp%3A%2F%2Ftracker.istole.it%3A6969&tr=udp%3A%2F%2Ftracker.ccc.de%3A80&tr=udp%3A%2F%2Fopen.demonii.com%3A1337"
taskhost.exe $(Arg0)
taskeng.exe {52813C4A-AD1E-4EB9-B423-2F3369F476AA}
"C:\Users\Bal\Documents\Instalace\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01 205416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 529664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-05-14 6307960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL [2013-03-10 877760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL [2013-05-20 2328776]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2013-01-15 139344]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2013-01-15 330160]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{890CA547-B66C-48BF-9663-DBE0BFDC7D0C}]
phpnuke Helper Object - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\bh\phpnuke.dll [2013-02-14 271256]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení k účtu Microsoft - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}]
DealPly - C:\Program Files (x86)\DealPly\DealPlyIE.dll [2013-01-16 100048]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-05-14 4531320]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MIF5BA~1\Office15\URLREDIR.DLL [2013-03-09 704704]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MIF5BA~1\Office15\GROOVEEX.DLL [2013-05-20 1725128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2013-01-15 59824]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{7B206A1E-933F-4A50-9E60-5167598BDB03} - phpnuke Toolbar - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\phpnukeTlbr.dll [2013-02-14 344472]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Steam"=C:\Program Files (x86)\Steam\Steam.exe [2013-06-07 1641896]
"GoogleDriveSync"=C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2013-06-06 19676256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\Windows\system32\hkcmd.exe [2011-10-21 392472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\Windows\system32\igfxtray.exe [2011-10-21 167704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NUSB3MON]
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2011-09-16 115048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Optimizer Pro]
C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\Windows\system32\igfxpers.exe [2011-10-21 416024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDVCPL]
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-12-13 13374568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-04-19 18678376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files (x86)\Steam\Steam.exe [2013-06-07 1641896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-09-17 254896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Wireless Utility.lnk]
C:\PROGRA~2\Edimax\Common\RaUI.exe [2009-12-19 1638400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Matěj^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]
C:\PROGRA~2\OPENOF~1.ORG\program\QUICKS~1.EXE []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"LifeCam"=C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [2010-12-13 135536]
"AVG_UI"=C:\Program Files (x86)\AVG\AVG2013\avgui.exe [2013-04-29 4408368]

C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MagicDisc.lnk - C:\Program Files (x86)\MagicDisc\MagicDisc.exe
OpenOffice.org 3.3.lnk - C:\FRST\Quarantine\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-10-21 390144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2013-06-27 16:16:05 ----D---- C:\rsit
2013-06-27 16:16:05 ----D---- C:\Program Files\trend micro
2013-06-26 21:14:19 ----A---- C:\ProgramData\ej797.js
2013-06-26 21:06:56 ----D---- C:\FRST
2013-06-26 20:22:44 ----A---- C:\Windows\ntbtlog.txt
2013-06-26 19:40:42 ----A---- C:\ProgramData\g252qs.txt
2013-06-23 11:24:02 ----D---- C:\ProgramData\InstallShield
2013-06-16 20:29:35 ----D---- C:\Windows\SYSWOW64\saves
2013-06-16 20:29:35 ----D---- C:\Windows\SYSWOW64\logs
2013-06-16 20:29:35 ----A---- C:\Windows\SYSWOW64\system.log.txt
2013-06-15 08:46:37 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-06-15 08:46:36 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-06-15 08:46:36 ----A---- C:\Windows\system32\urlmon.dll
2013-06-15 08:46:36 ----A---- C:\Windows\system32\iertutil.dll
2013-06-15 08:46:35 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-06-15 08:46:35 ----A---- C:\Windows\system32\ieui.dll
2013-06-15 08:46:34 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-06-15 08:46:34 ----A---- C:\Windows\system32\ieframe.dll
2013-06-15 08:46:33 ----A---- C:\Windows\system32\mshtml.dll
2013-06-15 08:46:32 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-06-14 21:07:44 ----D---- C:\ProgramData\Sony Corporation
2013-06-14 21:04:40 ----D---- C:\Program Files (x86)\Sony Media Go Install
2013-06-13 00:19:53 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2013-06-13 00:19:53 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2013-06-13 00:19:53 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2013-06-13 00:19:53 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2013-06-13 00:19:53 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-06-13 00:19:53 ----A---- C:\Windows\system32\iesysprep.dll
2013-06-13 00:19:53 ----A---- C:\Windows\system32\iesetup.dll
2013-06-13 00:19:53 ----A---- C:\Windows\system32\iernonce.dll
2013-06-13 00:19:53 ----A---- C:\Windows\system32\ie4uinit.exe
2013-06-13 00:19:52 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-06-13 00:19:52 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-06-13 00:19:52 ----A---- C:\Windows\system32\msfeeds.dll
2013-06-13 00:19:52 ----A---- C:\Windows\system32\jscript9.dll
2013-06-13 00:19:52 ----A---- C:\Windows\system32\jscript.dll
2013-06-13 00:19:51 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-06-13 00:19:50 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-06-13 00:19:50 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-06-13 00:19:50 ----A---- C:\Windows\system32\wininet.dll
2013-06-13 00:19:50 ----A---- C:\Windows\system32\jsproxy.dll
2013-06-12 16:58:44 ----A---- C:\Windows\SYSWOW64\cryptdlg.dll
2013-06-12 16:58:44 ----A---- C:\Windows\system32\cryptdlg.dll
2013-06-12 16:58:36 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2013-06-12 16:58:36 ----A---- C:\Windows\system32\win32spl.dll
2013-06-12 16:58:33 ----A---- C:\Windows\system32\drivers\tcpip.sys
2013-06-12 16:58:31 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2013-06-12 16:58:31 ----A---- C:\Windows\system32\WindowsCodecs.dll
2013-06-12 16:58:29 ----A---- C:\Windows\SYSWOW64\cryptsvc.dll
2013-06-12 16:58:29 ----A---- C:\Windows\SYSWOW64\cryptnet.dll
2013-06-12 16:58:29 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2013-06-12 16:58:29 ----A---- C:\Windows\SYSWOW64\certutil.exe
2013-06-12 16:58:29 ----A---- C:\Windows\SYSWOW64\certenc.dll
2013-06-12 16:58:29 ----A---- C:\Windows\system32\cryptsvc.dll
2013-06-12 16:58:29 ----A---- C:\Windows\system32\cryptnet.dll
2013-06-12 16:58:29 ----A---- C:\Windows\system32\crypt32.dll
2013-06-12 16:58:29 ----A---- C:\Windows\system32\certutil.exe
2013-06-12 16:58:29 ----A---- C:\Windows\system32\certenc.dll
2013-06-12 16:58:21 ----A---- C:\Windows\SYSWOW64\d3d11.dll
2013-06-12 16:58:21 ----A---- C:\Windows\system32\d3d11.dll
2013-06-06 20:08:55 ----D---- C:\Program Files (x86)\Euro Truck Simulator 2
2013-06-01 01:39:41 ----D---- C:\Program Files (x86)\Microsoft XNA
2013-05-29 00:14:40 ----D---- C:\Users\Bal\AppData\Roaming\Opera Mail
2013-05-28 19:56:41 ----D---- C:\Program Files (x86)\Opera Next

======List of files/folders modified in the last 1 months======

2013-06-27 16:16:19 ----D---- C:\Windows\Prefetch
2013-06-27 16:16:05 ----RD---- C:\Program Files
2013-06-27 16:13:17 ----D---- C:\Windows\Temp
2013-06-27 16:10:28 ----A---- C:\Users\Bal\AppData\Roaming\bitlord_log.txt
2013-06-27 16:02:32 ----D---- C:\Windows\System32
2013-06-27 16:02:32 ----D---- C:\Windows\inf
2013-06-27 16:02:32 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-06-27 16:00:26 ----A---- C:\Windows\SYSWOW64\log.txt
2013-06-27 16:00:15 ----D---- C:\Program Files (x86)\Steam
2013-06-27 15:23:14 ----D---- C:\Windows\system32\config
2013-06-27 08:30:50 ----D---- C:\ProgramData\MFAData
2013-06-27 01:22:41 ----HD---- C:\ProgramData
2013-06-27 01:22:04 ----D---- C:\Program Files (x86)\Windows iLivid Toolbar
2013-06-27 01:22:03 ----RD---- C:\Program Files (x86)
2013-06-27 01:22:02 ----D---- C:\Program Files (x86)\Common Files
2013-06-27 01:13:22 ----D---- C:\Users\Bal\AppData\Roaming\vlc
2013-06-26 22:09:56 ----SHD---- C:\System Volume Information
2013-06-26 21:06:57 ----D---- C:\Windows
2013-06-26 12:30:01 ----D---- C:\Program Files (x86)\DealPly
2013-06-26 11:03:44 ----D---- C:\Users\Bal\AppData\Roaming\.technic
2013-06-26 10:56:42 ----SHD---- C:\Windows\Installer
2013-06-23 11:40:42 ----RSD---- C:\Windows\assembly
2013-06-23 11:29:33 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2013-06-22 13:29:13 ----D---- C:\Windows\system32\catroot2
2013-06-21 15:44:19 ----D---- C:\Users\Bal\AppData\Roaming\SoftGrid Client
2013-06-21 15:44:02 ----RSD---- C:\Windows\Fonts
2013-06-19 16:46:46 ----D---- C:\Users\Bal\AppData\Roaming\BitLord
2013-06-17 08:22:49 ----D---- C:\Program Files (x86)\Google
2013-06-16 20:29:35 ----D---- C:\Windows\SysWOW64
2013-06-16 20:29:23 ----D---- C:\Windows\system32\Tasks
2013-06-15 09:55:18 ----D---- C:\Windows\winsxs
2013-06-15 09:54:44 ----D---- C:\Program Files (x86)\Internet Explorer
2013-06-15 09:54:43 ----D---- C:\Program Files\Internet Explorer
2013-06-15 08:46:52 ----D---- C:\Windows\system32\catroot
2013-06-14 21:41:39 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-06-14 21:07:57 ----D---- C:\Program Files (x86)\Sony
2013-06-14 16:43:59 ----D---- C:\Windows\rescache
2013-06-13 20:34:13 ----D---- C:\Windows\Microsoft.NET
2013-06-13 15:58:02 ----D---- C:\Windows\system32\drivers
2013-06-13 15:57:58 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-06-13 15:57:58 ----D---- C:\Windows\system32\cs-CZ
2013-06-13 00:20:25 ----A---- C:\Windows\system32\MRT.exe
2013-06-13 00:17:58 ----D---- C:\ProgramData\Microsoft Help
2013-06-11 15:44:34 ----D---- C:\Windows\system32\DriverStore
2013-06-08 22:35:53 ----D---- C:\Users\Bal\AppData\Roaming\Audacity
2013-06-01 12:45:36 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2013-06-01 01:34:16 ----D---- C:\Windows\SoftwareDistribution
2013-05-31 15:31:59 ----D---- C:\ProgramData\Skype
2013-05-31 15:31:58 ----D---- C:\Program Files (x86)\Skype
2013-05-28 19:56:44 ----D---- C:\Users\Bal\AppData\Roaming\Opera

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHA;AVGIDSHA; C:\Windows\system32\DRIVERS\avgidsha.sys [2013-02-08 71480]
R0 Avgloga;AVG Logging Driver; C:\Windows\system32\DRIVERS\avgloga.sys [2013-02-08 311096]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx64.sys [2013-02-08 116536]
R0 Avgrkx64;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx64.sys [2013-02-08 45880]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\avgidsdrivera.sys [2013-03-29 246072]
R1 Avgldx64;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx64.sys [2013-02-08 206136]
R1 Avgtdia;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdia.sys [2013-03-21 240952]
R1 avgtp;avgtp; \??\C:\Windows\system32\drivers\avgtpx64.sys [2013-06-26 45856]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2012-01-11 360624]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2011-10-21 12310112]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-12-13 4718952]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2011-08-23 317440]
R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\Windows\system32\DRIVERS\mcdbus.sys [2009-02-24 255552]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver; C:\Windows\System32\Drivers\nx6000.sys [2010-12-13 36720]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver; C:\Windows\system32\DRIVERS\netr28x.sys [2009-10-06 737792]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2011-10-25 96768]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2011-10-25 213504]
R3 Sftfs;Sftfs; C:\Windows\system32\DRIVERS\Sftfswin7.sys [2011-10-01 765288]
R3 Sftplay;Sftplay; C:\Windows\system32\DRIVERS\Sftplaywin7.sys [2011-10-01 268648]
R3 Sftredir;Sftredir; C:\Windows\system32\DRIVERS\Sftredirwin7.sys [2011-10-01 25960]
R3 Sftvol;Sftvol; C:\Windows\system32\DRIVERS\Sftvolwin7.sys [2011-10-01 22376]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S1 hola_net;Hola Fast Internet Adapter; C:\Windows\system32\DRIVERS\hola_net.sys [2013-04-06 86512]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver; C:\Windows\System32\Drivers\ssadadb.sys [2011-05-13 36328]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2012-09-12 57856]
S3 ggflt;SEMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2012-09-28 14448]
S3 ggsemc;SEMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsemc.sys [2012-09-28 27760]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\Windows\system32\DRIVERS\s0016bus.sys [2008-05-16 115240]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 19496]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 158760]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 137256]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\Windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 34344]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s0016obex.sys [2008-05-16 136744]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\Windows\system32\DRIVERS\s0016unic.sys [2008-05-16 151592]
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM); C:\Windows\system32\DRIVERS\s1039bus.sys [2010-03-15 127600]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s1039mdfl.sys [2010-03-15 19568]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s1039mdm.sys [2010-03-15 161904]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s1039mgmt.sys [2010-03-15 141424]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS); C:\Windows\system32\DRIVERS\s1039nd5.sys [2010-03-15 34416]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s1039obex.sys [2010-03-15 137328]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM); C:\Windows\system32\DRIVERS\s1039unic.sys [2010-03-15 158320]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-05-13 157672]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 16872]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 177640]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2011-05-13 146920]
S3 taphss;Anchorfree HSS Adapter; C:\Windows\system32\DRIVERS\taphss.sys [2012-01-05 37888]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-10 65640]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2013-05-14 4937264]
R2 avgwd;AVG WatchDog; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2013-04-18 283136]
R2 cvhsvc;Client Virtualization Handler; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-02-07 822624]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2011-11-09 189608]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2011-08-08 325912]
R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamS64.exe [2010-12-13 194416]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2013-03-25 76888]
R2 RalinkRegistryWriter;Ralink Registry Writer; C:\Program Files (x86)\Edimax\Common\RaRegistry.exe [2009-10-06 185632]
R2 RalinkRegistryWriter64;Ralink Registry Writer 64; C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe [2009-10-06 212256]
R2 sftlist;Application Virtualization Client; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
R2 Skype C2C Service;Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-05-14 3289208]
R2 SplashtopRemoteService;Splashtop® Remote Service; C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe [2013-04-03 551264]
R2 SSUService;Splashtop Software Updater Service; C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [2013-05-08 583968]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-08-08 2656536]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2012-07-17 2292480]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
R3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-06-07 543656]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-12 136176]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-14 256904]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-09-12 1512448]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-12 136176]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 150600]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]
S3 Sony PC Companion;Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [2012-01-18 155320]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-04-06 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------


fixlog.txt:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-06-2013 02
Ran by Bal at 2013-06-27 01:22:01 Run:1
Running from F:\
Boot Mode: Normal
==============================================

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\DATAMNGR => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\vProt => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\Smart Driver Updater => Value not found.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon32.exe => Value not found.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe => Moved successfully.
C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk => Moved successfully.
C:\PROGRA~3\797je.dat => Moved successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1BE0EDCE-4B79-4E17-AED2-7147AD286174} => Key deleted successfully.
HKCR\CLSID\{1BE0EDCE-4B79-4E17-AED2-7147AD286174} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key deleted successfully.
HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} => Key deleted successfully.
HKCR\CLSID\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908} => Key deleted successfully.
HKCR\CLSID\{3706EE7C-3CAD-445D-8A43-03EBC3B75908} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0} => Key deleted successfully.
HKCR\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{95B7759C-8C7F-4BF1-B163-73684A933233} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key not found.
HKCR\Wow6432Node\PROTOCOLS\Handler\viprotocol => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9} => Key deleted successfully.
vToolbarUpdater15.3.0 => Service deleted successfully.
C:\Program Files (x86)\Common Files\AVG Secure Search => Moved successfully.
C:\Program Files (x86)\AVG Secure Search => Moved successfully.
C:\PROGRA~2\WI3C8A~1\Datamngr => Moved successfully.
C:\ProgramData\ej797.pad => Moved successfully.
Could not move C:\ProgramData\g252qs.txt. => Scheduled to move on reboot.
C:\ProgramData\797je.dat => File/Directory not found.
C:\ProgramData\sdaksda.txt => Moved successfully.
C:\ProgramData\ej797.reg => Moved successfully.
C:\ProgramData\ej797.bat => Moved successfully.
C:\ProgramData\AVG Secure Search => Moved successfully.
C:\ProgramData\rundll32.exe => Moved successfully.
C:\ProgramData\797je.dat => File/Directory not found.
C:\ProgramData\7off.pad => Moved successfully.
C:\ProgramData\ej797.bat => File/Directory not found.
C:\ProgramData\ej797.pad => File/Directory not found.
C:\ProgramData\ej797.reg => File/Directory not found.
C:\ProgramData\ffo7.dat => Moved successfully.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: PČR opět v akci - Victimer

#6 Příspěvek od vyosek »

:arrow: Trvate na antiviru AVG - u nas neni moc obliben - vysoka zatez systemu, slabsi detekce :?:

:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Kliknete na Prohledat
  • Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Victimer
Návštěvník
Návštěvník
Příspěvky: 10
Registrován: 26 Črv 2013 20:32

Re: PČR opět v akci - Victimer

#7 Příspěvek od Victimer »

na AVG netrvám, jen mi byl dopuručen kolegou. Jakoukoliv radu vítám :)

ADwCleaner log:

# AdwCleaner v2.303 - Log vytvooen 27/06/2013 v 21:59:28
# Aktualizováno 08/06/2013 Xplode
# Operaení systém : Windows 7 Home Premium Service Pack 1 (64 bits)
# Uživatel : Bal - BAL-PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\Bal\Desktop\adwcleaner.exe
# Volba [Prohledat]


***** [Služby] *****


***** [Soubory / Složky] *****

Složka Nalezeno : C:\Program Files (x86)\Conduit
Složka Nalezeno : C:\Program Files (x86)\DealPly
Složka Nalezeno : C:\Program Files (x86)\MocaFlix
Složka Nalezeno : C:\Program Files (x86)\Smart Driver Updater
Složka Nalezeno : C:\Program Files (x86)\Windows iLivid Toolbar
Složka Nalezeno : C:\ProgramData\Babylon
Složka Nalezeno : C:\ProgramData\boost_interprocess
Složka Nalezeno : C:\ProgramData\clsoft ltd
Složka Nalezeno : C:\ProgramData\InstallMate
Složka Nalezeno : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly
Složka Nalezeno : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Driver Updater
Složka Nalezeno : C:\ProgramData\Premium
Složka Nalezeno : C:\Users\Bal\AppData\Local\AVG Secure Search
Složka Nalezeno : C:\Users\Bal\AppData\Local\Conduit
Složka Nalezeno : C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Složka Nalezeno : C:\Users\Bal\AppData\Local\Ilivid Player
Složka Nalezeno : C:\Users\Bal\AppData\Local\PackageAware
Složka Nalezeno : C:\Users\Bal\AppData\LocalLow\AVG Secure Search
Složka Nalezeno : C:\Users\Bal\AppData\LocalLow\Conduit
Složka Nalezeno : C:\Users\Bal\AppData\LocalLow\PriceGong
Složka Nalezeno : C:\Users\Bal\AppData\LocalLow\Searchqutoolbar
Složka Nalezeno : C:\Users\Bal\AppData\Roaming\DealPly
Složka Nalezeno : C:\Users\Matěj\AppData\Local\AVG Secure Search
Složka Nalezeno : C:\Users\Matěj\AppData\LocalLow\AVG Secure Search
Složka Nalezeno : C:\Users\Matěj\AppData\Roaming\Babylon
Složka Nalezeno : C:\Users\Matěj\AppData\Roaming\DealPly
Složka Nalezeno : C:\Users\Matěj\AppData\Roaming\Smart Driver Updater
Soubor Nalezeno : C:\user.js

***** [Registry] *****

Hodnota Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Hodnota Nalezeno : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\Conduit
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\PriceGong
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\SmartBar
Klíe Nalezeno : HKCU\Software\AppDataLow\SProtector
Klíe Nalezeno : HKCU\Software\AVG Secure Search
Klíe Nalezeno : HKCU\Software\Conduit
Klíe Nalezeno : HKCU\Software\DataMngr
Klíe Nalezeno : HKCU\Software\DataMngr_Toolbar
Klíe Nalezeno : HKCU\Software\DealPly
Klíe Nalezeno : HKCU\Software\ilivid
Klíe Nalezeno : HKCU\Software\InstallCore
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Klíe Nalezeno : HKCU\Software\Smart Driver Updater
Klíe Nalezeno : HKLM\Software\AVG Secure Search
Klíe Nalezeno : HKLM\Software\AVG Security Toolbar
Klíe Nalezeno : HKLM\Software\Babylon
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\DNSBHO.dll
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\BrowserConnection.Loader
Klíe Nalezeno : HKLM\SOFTWARE\Classes\BrowserConnection.Loader.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\DnsBHO.BHO
Klíe Nalezeno : HKLM\SOFTWARE\Classes\DnsBHO.BHO.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\escort.escortIEPane
Klíe Nalezeno : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Prod.cap
Klíe Nalezeno : HKLM\SOFTWARE\Classes\S
Klíe Nalezeno : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Klíe Nalezeno : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Klíe Nalezeno : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Toolbar.CT2549263
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Klíe Nalezeno : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Klíe Nalezeno : HKLM\Software\Conduit
Klíe Nalezeno : HKLM\Software\DataMngr
Klíe Nalezeno : HKLM\Software\DealPly
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Klíe Nalezeno : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Klíe Nalezeno : HKLM\Software\SearchquMediabarTb
Klíe Nalezeno : HKLM\Software\SP Global
Klíe Nalezeno : HKLM\Software\SProtector
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Smart Driver Updater_is1
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SP_8e4eb48d
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Klíe Nalezeno : HKLM\SOFTWARE\DataMngr
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Klíe Nalezeno : HKU\S-1-5-21-2909710318-1461308629-1340934368-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Registry jsou eisté.

-\\ Google Chrome v27.0.1453.116

Soubor : C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Soubor je eistý.

Soubor : C:\Users\Matěj\AppData\Local\Google\Chrome\User Data\Default\Preferences

Nalezeno [l.29] : icon_url = "hxxp://www.babylon.com/favicon.ico",
Nalezeno [l.32] : keyword = "babylon.com",
Nalezeno [l.36] : search_url = "hxxp://search.babylon.com/?q={searchTerms}&affID=117064&tt=0413_2&babsrc=SP_ss&mntrId=e27dc7e0000000000000001f1fbdd2fc",
Nalezeno [l.2223] : homepage = "hxxp://search.babylon.com/?affID=117064&tt=0413_2&babsrc=HP_ss&mntrId=e27dc7e0000000000000001f1fbdd2fc",

-\\ Opera v12.15.1748.0

Soubor : C:\Users\Bal\AppData\Roaming\Opera\Opera\operaprefs.ini

Nalezeno : Home URL=hxxp://www.searchnu.com/406

Soubor : C:\Users\Matěj\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Soubor je eistý.

*************************

AdwCleaner[R1].txt - [12552 octets] - [27/06/2013 21:59:28]

########## EOF - C:\AdwCleaner[R1].txt - [12613 octets] ##########
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: PČR opět v akci - Victimer

#8 Příspěvek od vyosek »

:arrow: Avg je spise parodie na antivir :arcisit:

:arrow: Odinstalujte Avg a pak pouzijte jeste http://download.avg.com/filedir/util/av ... 3_2706.exe

:arrow: Nainstalujte Avast Free http://www.avast.com/get/gWR5mo92

:arrow: Spustte znovu AdwCleaner
  • Pokud pouzivate Win Vista ci W7, kliknete na AdwCleaner pravym a dejte Run As Administrator ci Spustit jako spravce
  • Kliknete na Smazat
  • PC provede opravu, restartuje se a da Vam log (C:\AdwCleaner [S1].txt) , jeho obsah vlozte sem
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Victimer
Návštěvník
Návštěvník
Příspěvky: 10
Registrován: 26 Črv 2013 20:32

Re: PČR opět v akci - Victimer

#9 Příspěvek od Victimer »

pardon byl jsem teď několik měsíců mimo svůj počítač...

AVG jsem odstranil a nainstaloval jsem Avast

ale když otevřu AdwCleaner (jako administrátor) tak nemohu najít funkci "smazat"....
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: PČR opět v akci - Victimer

#10 Příspěvek od vyosek »

Zdravicko :)

:arrow: AdwCleaner byl aktualizovan :James008:

:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Kliknete na Scan a nasledne Clean
  • Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Victimer
Návštěvník
Návštěvník
Příspěvky: 10
Registrován: 26 Črv 2013 20:32

Re: PČR opět v akci - Victimer

#11 Příspěvek od Victimer »

# AdwCleaner v3.003 - Report created 14/09/2013 at 22:36:12
# Updated 07/09/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Bal - BAL-PC
# Running from : C:\Users\Bal\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : SSUService

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\ProgramData\clsoft ltd
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\ProgramData\Splashtop
Folder Deleted : C:\ProgramData\wxDownload
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Driver Updater
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\DealPly
Folder Deleted : C:\Program Files (x86)\MocaFlix
Folder Deleted : C:\Program Files (x86)\Smart Driver Updater
Folder Deleted : C:\Program Files (x86)\Splashtop
Folder Deleted : C:\Program Files (x86)\Windows iLivid Toolbar
Folder Deleted : C:\Users\Bal\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Bal\AppData\Local\Conduit
Folder Deleted : C:\Users\Bal\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Bal\AppData\Local\PackageAware
Folder Deleted : C:\Users\Bal\AppData\Local\Splashtop
Folder Deleted : C:\Users\Bal\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Bal\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Bal\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Bal\AppData\LocalLow\Searchqutoolbar
Folder Deleted : C:\Users\Bal\AppData\Roaming\DealPly
Folder Deleted : C:\Users\Matěj\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Matěj\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Matěj\AppData\Roaming\Babylon
Folder Deleted : C:\Users\Matěj\AppData\Roaming\DealPly
Folder Deleted : C:\Users\Matěj\AppData\Roaming\Smart Driver Updater
Folder Deleted : C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Folder Deleted : C:\Users\Matěj\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Folder Deleted : C:\Users\Matěj\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmghpknhmhbfgbfdnijjmnfdbjdbaehb
File Deleted : C:\Windows\System32\Tasks\Dealply
File Deleted : C:\Windows\System32\Tasks\DealPlyUpdate

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
Key Deleted : HKLM\SOFTWARE\Classes\AppID\DNSBHO.dll
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\BrowserConnection.Loader
Key Deleted : HKLM\SOFTWARE\Classes\BrowserConnection.Loader.1
Key Deleted : HKLM\SOFTWARE\Classes\DnsBHO.BHO
Key Deleted : HKLM\SOFTWARE\Classes\DnsBHO.BHO.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_8e4eb48d
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2549263
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_city-life_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_city-life_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\DealPly
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\Smart Driver Updater
Key Deleted : HKCU\Software\Splashtop Inc.
Key Deleted : HKCU\Software\AppDataLow\SProtector
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\DealPly
Key Deleted : HKLM\Software\SearchquMediabarTb
Key Deleted : HKLM\Software\SP Global
Key Deleted : HKLM\Software\Splashtop Inc.
Key Deleted : HKLM\Software\SProtector
Key Deleted : HKLM\Software\systweak
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Driver Updater_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Splashtop Software Updater
Key Deleted : [x64] HKLM\SOFTWARE\DataMngr

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16686


-\\ Google Chrome v29.0.1547.66

[ File : C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage
Deleted : urls_to_restore_on_startup
Deleted : search_url

[ File : C:\Users\Matěj\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage
Deleted : icon_url
Deleted : search_url
Deleted : keyword

*************************

AdwCleaner[R0].txt - [12778 octets] - [14/09/2013 21:05:28]
AdwCleaner[R1].txt - [12827 octets] - [14/09/2013 22:35:40]
AdwCleaner[S0].txt - [12496 octets] - [14/09/2013 22:36:12]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [12557 octets] ##########
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: PČR opět v akci - Victimer

#12 Příspěvek od vyosek »

Poprosim o FRSTL http://forum.viry.cz/viewtopic.php?f=13&t=132519
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Victimer
Návštěvník
Návštěvník
Příspěvky: 10
Registrován: 26 Črv 2013 20:32

Re: PČR opět v akci - Victimer

#13 Příspěvek od Victimer »

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-09-2013 04
Ran by Bal (administrator) on BAL-PC on 14-09-2013 22:57:08
Running from C:\Users\Bal\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Edimax\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(MagicISO, Inc.) C:\Program Files (x86)\MagicDisc\MagicDisc.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

==================== Registry (Whitelisted) ==================

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1811880 2013-08-28] (Valve Corporation)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20097696 2013-06-27] (Google)
MountPoints2: {b9bebbb5-c475-11e1-952a-7071bce87380} - F:\Startme.exe
MountPoints2: {c5292759-0948-11e2-a99b-7071bce87380} - F:\Startme.exe
MountPoints2: {dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} - E:\INSTALL.EXE
HKLM-x32\...\Run: [LifeCam] - C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [135536 2010-12-13] (Microsoft Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-05-23] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKU\Matěj\...\Run: [Smart Driver Updater] - C:\Program Files (x86)\Smart Driver Updater\SDULauncher.exe
HKU\Matěj\...\Run: [ctfmon32.exe] - C:\PROGRA~3\rundll32.exe C:\PROGRA~3\797je.dat,XFG00 <===== ATTENTION
HKU\Matěj\...\Run: [Sony PC Companion] - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449248 2013-05-29] (Sony)
HKU\Matěj\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1561968 2013-05-23] (Samsung)
HKU\Matěj\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Matěj\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-05-23] (Samsung)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\FRST\Quarantine\quickstart.exe ()

==================== Internet (Whitelisted) ====================

SearchScopes: HKLM - DefaultScope value is missing.
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: phpnuke Helper Object - {890CA547-B66C-48BF-9663-DBE0BFDC7D0C} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\bh\phpnuke.dll (PHPNuke.org)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - phpnuke Toolbar - {7B206A1E-933F-4A50-9E60-5167598BDB03} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\phpnukeTlbr.dll (PHPNuke.org)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: (Search Results) - http://www.google.com
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File
CHR Plugin: (Skype Click to Call) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.11.0.9874_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Extension: (Google Drive) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1
CHR Extension: (Google Search) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1
CHR Extension: (Skype Click to Call) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [cngompmodgafkkffefbfbghhciijojjh] - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\phpnuke.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-03-25] ()

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-09-14] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-09-14] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-09-14] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-06-26] (AVG Technologies)
S1 hola_net; C:\Windows\System32\DRIVERS\hola_net.sys [86512 2013-04-06] (Hola Networks Ltd.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation)
R3 Sftfs; C:\Windows\System32\DRIVERS\Sftfswin7.sys [768680 2013-06-26] (Microsoft Corporation)
R3 Sftplay; C:\Windows\System32\DRIVERS\Sftplaywin7.sys [273576 2013-06-26] (Microsoft Corporation)
R3 Sftredir; C:\Windows\System32\DRIVERS\Sftredirwin7.sys [29352 2013-06-26] (Microsoft Corporation)
R3 Sftvol; C:\Windows\System32\DRIVERS\Sftvolwin7.sys [23208 2013-06-26] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-14 22:56 - 2013-09-14 22:56 - 00000000 ____D C:\Users\Bal\AppData\Local\qb1118AE.F0
2013-09-14 22:56 - 2013-09-13 21:11 - 01950312 _____ (Farbar) C:\Users\Bal\Desktop\FRST64.exe
2013-09-14 22:55 - 2013-09-14 22:55 - 00000000 ____D C:\Users\Bal\AppData\Local\qb105D6B.C0
2013-09-14 22:35 - 2013-09-14 22:35 - 01037278 _____ C:\Users\Bal\Desktop\adwcleaner.exe
2013-09-14 21:04 - 2013-09-14 22:36 - 00000000 ____D C:\AdwCleaner
2013-09-14 20:56 - 2013-09-14 20:56 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-09-14 20:56 - 2013-09-14 20:56 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-09-14 20:56 - 2013-09-14 20:56 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-09-14 20:56 - 2013-09-14 20:56 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-09-14 20:56 - 2013-05-09 10:59 - 00080816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-09-14 20:56 - 2013-05-09 10:59 - 00072016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-09-14 20:56 - 2013-05-09 10:59 - 00065336 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-09-14 20:56 - 2013-05-09 10:59 - 00064288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-09-14 20:56 - 2013-05-09 10:59 - 00033400 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
2013-09-14 20:56 - 2013-05-09 10:58 - 00041664 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-09-14 20:35 - 2013-09-14 22:39 - 00197229 _____ C:\Users\Bal\Desktop\avgremover.log
2013-09-14 20:27 - 2013-09-14 20:27 - 03222280 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Bal\Desktop\avg_remover_stf_x64_2013_2706.exe
2013-09-12 23:04 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 23:04 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 23:03 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 23:03 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 23:03 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 23:03 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 23:03 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 23:03 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 23:03 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 23:03 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 23:03 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 23:03 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 16:22 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 16:22 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 16:22 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 16:22 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 16:22 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 16:22 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 16:22 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 16:22 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 16:22 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 16:22 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 16:22 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 16:22 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 16:22 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 16:22 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 16:22 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 16:22 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 16:22 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 16:22 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 16:22 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 16:22 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 16:22 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 16:22 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 16:22 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 16:22 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 16:22 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 16:22 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 23:39 - 2013-09-11 23:39 - 00021645 _____ C:\Users\Bal\Desktop\[kickass.to]dc.universe.52.week.107.darkhomr.kat.torrent
2013-09-07 09:47 - 2013-09-07 09:48 - 18826828 _____ C:\Users\Bal\Desktop\Sphax_Hexxit _32x(a0.6).zip
2013-09-06 15:33 - 2013-09-06 15:35 - 32565948 _____ C:\Users\Bal\Desktop\Sphax_Hexxit _64x(a0.6).zip
2013-09-06 15:32 - 2013-09-06 15:47 - 43557158 _____ C:\Users\Bal\Desktop\Sphax PureBDcraft 64x MC15.zip
2013-09-03 20:00 - 2013-09-03 20:03 - 00000000 ____D C:\Users\Matěj\Desktop\Editor
2013-09-01 15:09 - 2013-09-01 15:09 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dungeon Keeper 2 CZ ver.1.0
2013-08-31 22:54 - 2013-08-31 22:54 - 00003162 _____ C:\Windows\System32\Tasks\{BC1FF4BF-93A5-44C0-879E-C4A8D12408B4}
2013-08-31 22:51 - 2013-08-31 22:51 - 00003126 _____ C:\Windows\System32\Tasks\{00B2ED70-26B9-4FA2-9B55-A9E8AA45A02A}
2013-08-31 22:45 - 2013-08-31 22:45 - 00000000 ____D C:\Program Files (x86)\Bullfrog
2013-08-31 14:25 - 2013-08-31 14:25 - 00000000 ____D C:\Program Files (x86)\GOGcom
2013-08-18 18:35 - 2013-08-18 18:45 - 179916454 _____ C:\Users\Bal\Desktop\Avengers.Assemble.S01E01.The.Avengers.Protocol.Pt.1.WEB-DL.XviD.MP3.avi
2013-08-18 16:11 - 2013-08-18 16:11 - 00000218 _____ C:\Users\Bal\AppData\Local\recently-used.xbel
2013-08-18 14:48 - 2013-08-18 14:48 - 00000000 ____D C:\Users\Bal\AppData\Roaming\dvdcss
2013-08-17 14:32 - 2013-08-17 17:56 - 4270387200 _____ C:\Users\Bal\Desktop\psig-skyfall.2012.720p.brrip.xvid.avi
2013-08-15 00:58 - 2013-09-12 23:03 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 00:34 - 2013-08-15 00:35 - 00000000 ____D C:\Users\Bal\Desktop\week 102

==================== One Month Modified Files and Folders =======

2013-09-14 22:56 - 2013-09-14 22:56 - 00000000 ____D C:\Users\Bal\AppData\Local\qb1118AE.F0
2013-09-14 22:56 - 2012-04-12 19:38 - 00000000 ____D C:\Program Files (x86)\Opera
2013-09-14 22:55 - 2013-09-14 22:55 - 00000000 ____D C:\Users\Bal\AppData\Local\qb105D6B.C0
2013-09-14 22:55 - 2013-06-26 21:06 - 00000000 ____D C:\FRST
2013-09-14 22:45 - 2009-07-14 06:45 - 00021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-14 22:45 - 2009-07-14 06:45 - 00021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-14 22:42 - 2012-04-05 13:14 - 01347211 _____ C:\Windows\WindowsUpdate.log
2013-09-14 22:41 - 2012-04-12 19:49 - 00000946 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-14 22:41 - 2012-04-12 19:41 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-14 22:39 - 2013-09-14 20:35 - 00197229 _____ C:\Users\Bal\Desktop\avgremover.log
2013-09-14 22:39 - 2013-06-17 08:25 - 00000000 ___RD C:\Users\Bal\Disk Google
2013-09-14 22:39 - 2012-06-15 18:15 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-14 22:38 - 2012-04-12 19:49 - 00000942 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-14 22:37 - 2013-05-27 14:28 - 00014412 _____ C:\Windows\setupact.log
2013-09-14 22:37 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-14 22:36 - 2013-09-14 21:04 - 00000000 ____D C:\AdwCleaner
2013-09-14 22:35 - 2013-09-14 22:35 - 01037278 _____ C:\Users\Bal\Desktop\adwcleaner.exe
2013-09-14 21:04 - 2012-08-21 10:44 - 00000000 ____D C:\Users\Bal\Documents\Instalace
2013-09-14 20:56 - 2013-09-14 20:56 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-09-14 20:56 - 2013-09-14 20:56 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-09-14 20:56 - 2013-09-14 20:56 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-09-14 20:56 - 2013-09-14 20:56 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-09-14 20:56 - 2013-03-03 22:30 - 00000175 _____ C:\Windows\system32\Drivers\aswvmm.sys.sum
2013-09-14 20:56 - 2012-04-12 19:48 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-09-14 20:55 - 2012-04-12 19:48 - 00000000 ____D C:\ProgramData\AVAST Software
2013-09-14 20:55 - 2012-04-12 19:48 - 00000000 ____D C:\Program Files\AVAST Software
2013-09-14 20:40 - 2011-04-12 10:34 - 00666874 _____ C:\Windows\system32\perfh005.dat
2013-09-14 20:40 - 2011-04-12 10:34 - 00140312 _____ C:\Windows\system32\perfc005.dat
2013-09-14 20:40 - 2009-07-14 07:13 - 01579034 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-14 20:34 - 2013-06-15 07:59 - 00009146 _____ C:\Windows\PFRO.log
2013-09-14 20:27 - 2013-09-14 20:27 - 03222280 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Bal\Desktop\avg_remover_stf_x64_2013_2706.exe
2013-09-14 17:56 - 2013-03-26 21:27 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-09-14 17:56 - 2012-05-07 19:10 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-14 11:17 - 2012-05-07 19:10 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-09-13 23:08 - 2012-04-14 11:04 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Skype
2013-09-13 21:11 - 2013-09-14 22:56 - 01950312 _____ (Farbar) C:\Users\Bal\Desktop\FRST64.exe
2013-09-13 19:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 18:30 - 2012-04-12 21:06 - 00000000 ___RD C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 18:30 - 2012-04-12 21:06 - 00000000 ___RD C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 17:41 - 2012-04-12 19:41 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-13 17:41 - 2012-04-12 19:41 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 17:41 - 2012-04-12 19:41 - 00003852 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-13 15:41 - 2012-04-14 18:54 - 00000000 ____D C:\Users\Bal\AppData\Roaming\vlc
2013-09-13 11:56 - 2012-04-05 13:15 - 00000000 ___RD C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 11:56 - 2012-04-05 13:15 - 00000000 ___RD C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 11:56 - 2009-07-14 06:45 - 00500280 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 23:03 - 2013-08-15 00:58 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 23:03 - 2013-03-06 10:08 - 01603194 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-12 23:03 - 2013-03-06 10:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-12 23:02 - 2012-04-12 19:43 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 23:00 - 2013-03-09 16:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 23:39 - 2013-09-11 23:39 - 00021645 _____ C:\Users\Bal\Desktop\[kickass.to]dc.universe.52.week.107.darkhomr.kat.torrent
2013-09-11 23:39 - 2013-04-20 00:03 - 00000000 ____D C:\Users\Bal\Documents\BitLord
2013-09-11 17:23 - 2013-04-17 23:47 - 00000000 ____D C:\Users\Bal\Documents\Cemie
2013-09-11 16:45 - 2012-04-14 18:55 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\vlc
2013-09-10 22:26 - 2012-04-14 10:24 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-09-10 21:27 - 2012-04-14 11:04 - 00000000 ____D C:\Program Files (x86)\Skype
2013-09-10 21:26 - 2012-04-14 11:04 - 00000000 ____D C:\ProgramData\Skype
2013-09-10 15:41 - 2013-07-01 19:41 - 00183872 _____ C:\Windows\DPINST.LOG
2013-09-10 15:41 - 2012-07-25 10:43 - 00002026 _____ C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2013-09-10 15:41 - 2012-04-05 20:01 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-08 22:55 - 2013-04-30 14:01 - 00000000 ____D C:\Users\Matěj\Desktop\mobil
2013-09-07 20:40 - 2013-02-24 18:47 - 00006656 _____ C:\Users\Bal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-07 18:44 - 2012-07-31 23:48 - 00225792 ___SH C:\Users\Bal\Documents\Thumbs.db
2013-09-07 09:48 - 2013-09-07 09:47 - 18826828 _____ C:\Users\Bal\Desktop\Sphax_Hexxit _32x(a0.6).zip
2013-09-06 15:47 - 2013-09-06 15:32 - 43557158 _____ C:\Users\Bal\Desktop\Sphax PureBDcraft 64x MC15.zip
2013-09-06 15:35 - 2013-09-06 15:33 - 32565948 _____ C:\Users\Bal\Desktop\Sphax_Hexxit _64x(a0.6).zip
2013-09-06 15:23 - 2013-05-07 20:47 - 00000000 ____D C:\Users\Bal\AppData\Roaming\.technic
2013-09-04 18:04 - 2012-04-14 10:48 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\.minecraft
2013-09-03 20:03 - 2013-09-03 20:00 - 00000000 ____D C:\Users\Matěj\Desktop\Editor
2013-09-03 19:42 - 2013-08-11 17:41 - 00000000 ____D C:\Users\Matěj\Documents\BitLord
2013-09-01 15:09 - 2013-09-01 15:09 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dungeon Keeper 2 CZ ver.1.0
2013-08-31 22:57 - 2013-04-01 22:10 - 00000000 ____D C:\Users\Matěj\Desktop\LOTR
2013-08-31 22:54 - 2013-08-31 22:54 - 00003162 _____ C:\Windows\System32\Tasks\{BC1FF4BF-93A5-44C0-879E-C4A8D12408B4}
2013-08-31 22:51 - 2013-08-31 22:51 - 00003126 _____ C:\Windows\System32\Tasks\{00B2ED70-26B9-4FA2-9B55-A9E8AA45A02A}
2013-08-31 22:45 - 2013-08-31 22:45 - 00000000 ____D C:\Program Files (x86)\Bullfrog
2013-08-31 22:32 - 2013-04-20 00:03 - 00000000 ____D C:\Users\Bal\AppData\Roaming\BitLord
2013-08-31 14:25 - 2013-08-31 14:25 - 00000000 ____D C:\Program Files (x86)\GOGcom
2013-08-31 13:27 - 2013-04-01 14:42 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-08-31 13:26 - 2013-06-06 19:56 - 00000000 ____D C:\Users\Matěj\Documents\Euro Truck Simulator 2
2013-08-31 13:26 - 2012-11-18 12:49 - 00000000 ____D C:\Program Files (x86)\Shmehao.com
2013-08-18 23:49 - 2012-09-19 17:14 - 00000000 ____D C:\Users\Bal\AppData\Roaming\Audacity
2013-08-18 18:45 - 2013-08-18 18:35 - 179916454 _____ C:\Users\Bal\Desktop\Avengers.Assemble.S01E01.The.Avengers.Protocol.Pt.1.WEB-DL.XviD.MP3.avi
2013-08-18 16:11 - 2013-08-18 16:11 - 00000218 _____ C:\Users\Bal\AppData\Local\recently-used.xbel
2013-08-18 14:48 - 2013-08-18 14:48 - 00000000 ____D C:\Users\Bal\AppData\Roaming\dvdcss
2013-08-17 17:56 - 2013-08-17 14:32 - 4270387200 _____ C:\Users\Bal\Desktop\psig-skyfall.2012.720p.brrip.xvid.avi
2013-08-15 01:05 - 2009-07-14 04:34 - 00000512 _____ C:\Windows\win.ini
2013-08-15 00:35 - 2013-08-15 00:34 - 00000000 ____D C:\Users\Bal\Desktop\week 102

Some content of TEMP:
====================
C:\Users\Bal\AppData\Local\Temp\BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Bal\AppData\Local\Temp\ICReinstall_BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\oi_{65C2992E-132D-48AE-88B8-5D1FB162A3F5}.exe
C:\Users\Bal\AppData\Local\Temp\Quarantine.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.24opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Matěj\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel1.exe
C:\Users\Matěj\AppData\Local\Temp\ouoilddqiyjedlyhnwq.bfg
C:\Users\Matěj\AppData\Local\Temp\SecuExp.exe
C:\Users\Matěj\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Matěj\AppData\Local\Temp\Tsu67742048.dll
C:\Users\Matěj\AppData\Local\Temp\webyeryb3460vavaw.exe
C:\Users\Matěj\AppData\Local\Temp\wervwyuu0.exe
C:\Users\Matěj\AppData\Local\Temp\_is38BB.exe
C:\Users\Matěj\AppData\Local\Temp\_is67F5.exe
C:\Users\Matěj\AppData\Local\Temp\_is6FF1.exe
C:\Users\Matěj\AppData\Local\Temp\_is7BE4.exe
C:\Users\Matěj\AppData\Local\Temp\_is9BB2.exe
C:\Users\Matěj\AppData\Local\Temp\_isB59A.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit



==================== Alternate Data Streams (whitelisted) ====

AlternateDataStreams: C:\ProgramData\TEMP:05EE1EEF

==================== Loaded Modules (whitelisted) ============

2013-02-24 18:38 - 2013-02-24 18:38 - 00244696 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00661448 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\MSVCP110.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00828872 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\MSVCR110.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 02436608 _____ (Python Software Foundation) C:\Users\Bal\AppData\Local\Temp\_MEI48122\python27.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00110080 _____ () C:\Users\Bal\AppData\Local\Temp\_MEI48122\pywintypes27.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00364544 _____ () C:\Users\Bal\AppData\Local\Temp\_MEI48122\pythoncom27.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 01985024 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxbase294u_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00154112 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxbase294u_net_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 04598272 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxmsw294u_core_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 01234944 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxmsw294u_adv_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00595968 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxmsw294u_html_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00091648 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxmsw294u_webview_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00421200 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Temp\_MEI48122\MSVCP100.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00773968 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Temp\_MEI48122\MSVCR100.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 16192864 _____ (Opera Software) C:\Program Files (x86)\Opera\Opera.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00220632 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00534480 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\MSVCP110.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00862664 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\MSVCR110.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00537560 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\Telemetry.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00038360 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\logging.dll
2013-09-10 23:41 - 2013-09-10 23:41 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00835584 _____ () C:\Program Files (x86)\Opera\gstreamer\gstreamer.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00093696 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioconvert.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00094208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioresample.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00057344 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstautodetect.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00096256 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstcoreplugins.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00062976 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdecodebin2.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00067072 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdirectsound.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00158208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00312832 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstoggdec.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00038912 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwaveform.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00073728 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwavparse.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00101888 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwebmdec.dll

==================== Scheduled Tasks (whitelisted) ===========

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Supplementary Scan (All) ================

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds
C:\Windows\system32\hkcmd.exe [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
C:\Windows\system32\igfxtray.exe [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NUSB3MON
"C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Optimizer Pro
C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence
C:\Windows\system32\igfxpers.exe [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDVCPL
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam
"C:\Program Files (x86)\Steam\Steam.exe" -silent [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Wireless Utility.lnk
C:\PROGRA~2\Edimax\Common\RaUI.exe -s [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Mat�j^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk
C:\PROGRA~2\OPENOF~1.ORG\program\QUICKS~1.EXE [x]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000001
"EnableSecureUIAPaths"=dword:00000001
"EnableUIADesktopToggle"=dword:00000000
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"scforceoption"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"FilterAdministratorToken"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=dword:00000001
"NoActiveDesktopChanges"=dword:00000001
"ForceActiveDesktopOn"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval"=dword:00000001
"AntiVirusOverride"=dword:00000000
"AntiSpywareOverride"=dword:00000000
"FirewallOverride"=dword:00000000

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"="msrle32.dll"
"vidc.msvc"="msvidc32.dll"
"msacm.imaadpcm"="imaadp32.acm"
"msacm.msg711"="msg711.acm"
"msacm.msgsm610"="msgsm32.acm"
"msacm.msadpcm"="msadp32.acm"
"midimapper"="midimap.dll"
"wavemapper"="msacm32.drv"
"VIDC.UYVY"="msyuv.dll"
"VIDC.YUY2"="msyuv.dll"
"VIDC.YVYU"="msyuv.dll"
"VIDC.IYUV"="iyuv_32.dll"
"vidc.i420"="iyuv_32.dll"
"VIDC.YVU9"="tsbyuv.dll"
"msacm.l3acm"="C:\\Windows\\System32\\l3codeca.acm"
"wave1"="wdmaud.drv"
"midi1"="wdmaud.drv"
"mixer1"="wdmaud.drv"
"aux1"="wdmaud.drv"
"wave"="wdmaud.drv"
"midi"="wdmaud.drv"
"mixer"="wdmaud.drv"
"aux"="wdmaud.drv"
"VIDC.FPS1"="frapsv64.dll"
"MSVideo8"="VfWWDM32.dll"
"wave2"="wdmaud.drv"
"mixer2"="wdmaud.drv"


==================== Drive and Memory info ===================

Drive c: () (Fixed) (Total:931.29 GB) (Free:614.68 GB) NTFS
Drive d: (GAMBIT) (CDROM) (Total:5.89 GB) (Free:0 GB) UDF
Drive e: (SKYRIM_EN) (CDROM) (Total:5.12 GB) (Free:0 GB) UDF

Available physical RAM: 1750.36 MB
Total physical RAM: 4003.41 MB
Percentage of memory in use: 56%

==================== MBR and Partition Table =================

Disk: 0 (Size: 932 GB) (Disk ID: BA507B0A)

LastRegBack: 2013-09-11 21:17

==================== End Of Log ==============================
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: PČR opět v akci - Victimer

#14 Příspěvek od vyosek »

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1811880 2013-08-28] (Valve Corporation)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20097696 2013-06-27] (Google)
MountPoints2: {b9bebbb5-c475-11e1-952a-7071bce87380} - F:\Startme.exe
MountPoints2: {c5292759-0948-11e2-a99b-7071bce87380} - F:\Startme.exe
MountPoints2: {dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} - E:\INSTALL.EXE
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-05-23] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\Matěj\...\Run: [ctfmon32.exe] - C:\PROGRA~3\rundll32.exe C:\PROGRA~3\797je.dat,XFG00 <===== ATTENTION
HKU\Matěj\...\Run: [Sony PC Companion] - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449248 2013-05-29] (Sony)
HKU\Matěj\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1561968 2013-05-23] (Samsung)
HKU\Matěj\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Matěj\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-05-23] (Samsung)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

SearchScopes: HKLM - DefaultScope value is missing.

2013-09-14 20:35 - 2013-09-14 22:39 - 00197229 _____ C:\Users\Bal\Desktop\avgremover.log
2013-09-14 20:27 - 2013-09-14 20:27 - 03222280 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Bal\Desktop\avg_remover_stf_x64_2013_2706.exe

C:\Users\Bal\AppData\Local\Temp\BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Bal\AppData\Local\Temp\ICReinstall_BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\oi_{65C2992E-132D-48AE-88B8-5D1FB162A3F5}.exe
C:\Users\Bal\AppData\Local\Temp\Quarantine.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.24opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Matěj\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel1.exe
C:\Users\Matěj\AppData\Local\Temp\ouoilddqiyjedlyhnwq.bfg
C:\Users\Matěj\AppData\Local\Temp\SecuExp.exe
C:\Users\Matěj\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Matěj\AppData\Local\Temp\Tsu67742048.dll
C:\Users\Matěj\AppData\Local\Temp\webyeryb3460vavaw.exe
C:\Users\Matěj\AppData\Local\Temp\wervwyuu0.exe
C:\Users\Matěj\AppData\Local\Temp\_is38BB.exe
C:\Users\Matěj\AppData\Local\Temp\_is67F5.exe
C:\Users\Matěj\AppData\Local\Temp\_is6FF1.exe
C:\Users\Matěj\AppData\Local\Temp\_is7BE4.exe
C:\Users\Matěj\AppData\Local\Temp\_is9BB2.exe
C:\Users\Matěj\AppData\Local\Temp\_isB59A.exe
C:\PROGRA~3\797je.dat

AlternateDataStreams: C:\ProgramData\TEMP:05EE1EEF

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Optimizer Pro" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched" /f

Hosts:
CMD: shutdown /r /f /t 2
End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Victimer
Návštěvník
Návštěvník
Příspěvky: 10
Registrován: 26 Črv 2013 20:32

Re: PČR opět v akci - Victimer

#15 Příspěvek od Victimer »

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-09-2013 04
Ran by Bal at 2013-09-14 23:07:54 Run:2
Running from C:\Users\Bal\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1811880 2013-08-28] (Valve Corporation)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20097696 2013-06-27] (Google)
MountPoints2: {b9bebbb5-c475-11e1-952a-7071bce87380} - F:\Startme.exe
MountPoints2: {c5292759-0948-11e2-a99b-7071bce87380} - F:\Startme.exe
MountPoints2: {dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} - E:\INSTALL.EXE
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-05-23] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\Matěj\...\Run: [ctfmon32.exe] - C:\PROGRA~3\rundll32.exe C:\PROGRA~3\797je.dat,XFG00 <===== ATTENTION
HKU\Matěj\...\Run: [Sony PC Companion] - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449248 2013-05-29] (Sony)
HKU\Matěj\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1561968 2013-05-23] (Samsung)
HKU\Matěj\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Matěj\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-05-23] (Samsung)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

SearchScopes: HKLM - DefaultScope value is missing.

2013-09-14 20:35 - 2013-09-14 22:39 - 00197229 _____ C:\Users\Bal\Desktop\avgremover.log
2013-09-14 20:27 - 2013-09-14 20:27 - 03222280 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Bal\Desktop\avg_remover_stf_x64_2013_2706.exe

C:\Users\Bal\AppData\Local\Temp\BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Bal\AppData\Local\Temp\ICReinstall_BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\oi_{65C2992E-132D-48AE-88B8-5D1FB162A3F5}.exe
C:\Users\Bal\AppData\Local\Temp\Quarantine.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.24opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Matěj\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel1.exe
C:\Users\Matěj\AppData\Local\Temp\ouoilddqiyjedlyhnwq.bfg
C:\Users\Matěj\AppData\Local\Temp\SecuExp.exe
C:\Users\Matěj\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Matěj\AppData\Local\Temp\Tsu67742048.dll
C:\Users\Matěj\AppData\Local\Temp\webyeryb3460vavaw.exe
C:\Users\Matěj\AppData\Local\Temp\wervwyuu0.exe
C:\Users\Matěj\AppData\Local\Temp\_is38BB.exe
C:\Users\Matěj\AppData\Local\Temp\_is67F5.exe
C:\Users\Matěj\AppData\Local\Temp\_is6FF1.exe
C:\Users\Matěj\AppData\Local\Temp\_is7BE4.exe
C:\Users\Matěj\AppData\Local\Temp\_is9BB2.exe
C:\Users\Matěj\AppData\Local\Temp\_isB59A.exe
C:\PROGRA~3\797je.dat

AlternateDataStreams: C:\ProgramData\TEMP:05EE1EEF

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Optimizer Pro" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched" /f

Hosts:
CMD: shutdown /r /f /t 2
End
*****************

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Steam => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleDriveSync => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b9bebbb5-c475-11e1-952a-7071bce87380} => Key deleted successfully.
HKCR\CLSID\{b9bebbb5-c475-11e1-952a-7071bce87380} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c5292759-0948-11e2-a99b-7071bce87380} => Key deleted successfully.
HKCR\CLSID\{c5292759-0948-11e2-a99b-7071bce87380} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} => Key deleted successfully.
HKCR\CLSID\{dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} => Key not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\KiesTrayAgent => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon32.exe => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\Sony PC Companion => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\KiesPreload => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\KiesAirMessage => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk => Moved successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
C:\Users\Bal\Desktop\avgremover.log => Moved successfully.
C:\Users\Bal\Desktop\avg_remover_stf_x64_2013_2706.exe => Moved successfully.
C:\Users\Bal\AppData\Local\Temp\BitLord_Installer.exe => Moved successfully.
C:\Users\Bal\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe => Moved successfully.
C:\Users\Bal\AppData\Local\Temp\ICReinstall_BitLord_Installer.exe => Moved successfully.
C:\Users\Bal\AppData\Local\Temp\oi_{65C2992E-132D-48AE-88B8-5D1FB162A3F5}.exe => Moved successfully.
C:\Users\Bal\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.24opera_autoupdate.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\drm_dialogs.dll => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\drm_dyndata_7340014.dll => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr.dll => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr0.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\i4jdel0.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\i4jdel1.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\ouoilddqiyjedlyhnwq.bfg => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\SecuExp.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\Tsu67742048.dll => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\webyeryb3460vavaw.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\wervwyuu0.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_is38BB.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_is67F5.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_is6FF1.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_is7BE4.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_is9BB2.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_isB59A.exe => Moved successfully.
"C:\PROGRA~3\797je.dat" => File/Directory not found.
C:\ProgramData\TEMP => ":05EE1EEF" ADS removed successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Optimizer Pro" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

========= shutdown /r /f /t 2 =========


========= End of CMD: =========


==== End of Fixlog ====
Nahoru
Zamčeno

Vrátit se na „Řešení problémů, logy“