
------
EDIT: Povedlo se mi spusti Rychlou kontrolu, nicmene nevidim vysledky, kvuli tomu co jsem psal... Proste nedokazu prepinat mezi programy - teda, dokazu, ale nic v nich nevidim.
Moderátor: Moderátoři
Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte. Jsou tam klasické zbytečnosti, vir nevidím žádný.Start
MountPoints2: J - "J:\setup.exe"
MountPoints2: {2cb7b61b-c3dc-11e2-be87-806e6f6e6963} - "J:\setup.exe"
MountPoints2: {6632c09d-340f-11e3-bee4-50b7c3507f40} - "E:\WD SmartWare.exe" autoplay=true
MountPoints2: {78df842e-1303-11e3-be88-50b7c3507f3f} - "E:\VTP_Manager.exe"
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252136 2011-05-04] (Sun Microsystems, Inc.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.ividi.org/?src=tbhp&id=06 ... f&affilt=3
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.qone8.com/?type=hp&ts=1382 ... J9BC915430
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.qone8.com/?type=hp&ts=1382 ... J9BC915430
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.qone8.com/?type=hp&ts=1382 ... J9BC915430
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.qone8.com/?type=hp&ts=1382 ... J9BC915430
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://start.qone8.com/?type=hp&ts=1382 ... J9BC915430
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://start.qone8.com/?type=sc&ts=1382 ... J9BC915430
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://start.qone8.com/web/?type=ds&ts= ... earchTerms}
SearchScopes: HKLM - {2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} URL = http://www.bing.com/search?q={searchTer ... &pc=MASMJS
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://start.qone8.com/web/?type=ds&ts= ... earchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://start.qone8.com/web/?type=ds&ts= ... earchTerms}
SearchScopes: HKLM-x32 - {2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} URL = http://www.bing.com/search?q={searchTer ... &pc=MASMJS
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://start.qone8.com/web/?type=ds&ts= ... earchTerms}
SearchScopes: HKCU - DefaultScope {2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} URL =
SearchScopes: HKCU - {2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} URL =
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://start.qone8.com/web/?type=ds&ts= ... earchTerms}
SearchScopes: HKCU - {F0065F31-652F-42B7-9172-8300D8EDD9BC} URL = http://search.ividi.org/?q={searchTerms ... ilt=3&r=15
FF ProfilePath: C:\Users\Gamer\AppData\Roaming\Mozilla\Firefox\Profiles\x7nmf58l.default
FF NewTab: hxxp://start.qone8.com/newtab/?type=nt&ts=1382804655&from=vtt&uid=ST1000LM024XHN-M101MBB_S2RQJ9BC915430
FF DefaultSearchEngine: Search
FF SearchEngineOrder.1: Search
FF SelectedSearchEngine: Search
FF Homepage: hxxp://search.ividi.org/?src=tbhp&id=0624aa44000000000000000000000000&affilt=3
FF Keyword.URL: hxxp://search.ividi.org/?src=tbsp&id=0624aa44000000000000000000000000&affilt=3&q=
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://start.qone8.com/?
C:\Users\Gamer\AppData\Local\Temp
End
Kód: Vybrat vše
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-11-2013
Ran by Gamer at 2013-11-16 20:50:54 Run:1
Running from C:\Users\Gamer\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
Start
MountPoints2: J - "J:\setup.exe"
MountPoints2: {2cb7b61b-c3dc-11e2-be87-806e6f6e6963} - "J:\setup.exe"
MountPoints2: {6632c09d-340f-11e3-bee4-50b7c3507f40} - "E:\WD SmartWare.exe" autoplay=true
MountPoints2: {78df842e-1303-11e3-be88-50b7c3507f3f} - "E:\VTP_Manager.exe"
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252136 2011-05-04] (Sun Microsystems, Inc.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.ividi.org/?src=tbhp&id=06 ... f&affilt=3
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.qone8.com/?type=hp&ts=1382 ... J9BC915430
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.qone8.com/?type=hp&ts=1382 ... J9BC915430
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.qone8.com/?type=hp&ts=1382 ... J9BC915430
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.qone8.com/?type=hp&ts=1382 ... J9BC915430
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://start.qone8.com/?type=hp&ts=1382 ... J9BC915430
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://start.qone8.com/?type=sc&ts=1382 ... J9BC915430
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://start.qone8.com/web/?type=ds&ts= ... C915430&q={searchTerms}
SearchScopes: HKLM - {2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://start.qone8.com/web/?type=ds&ts= ... C915430&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://start.qone8.com/web/?type=ds&ts= ... C915430&q={searchTerms}
SearchScopes: HKLM-x32 - {2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://start.qone8.com/web/?type=ds&ts= ... C915430&q={searchTerms}
SearchScopes: HKCU - DefaultScope {2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} URL =
SearchScopes: HKCU - {2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} URL =
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://start.qone8.com/web/?type=ds&ts= ... C915430&q={searchTerms}
SearchScopes: HKCU - {F0065F31-652F-42B7-9172-8300D8EDD9BC} URL = http://search.ividi.org/?q={searchTerms}&src=tbsp&id=0624aa4400000000000052b7c3507f3f&affilt=3&r=15
FF ProfilePath: C:\Users\Gamer\AppData\Roaming\Mozilla\Firefox\Profiles\x7nmf58l.default
FF NewTab: hxxp://start.qone8.com/newtab/?type=nt& ... J9BC915430
FF DefaultSearchEngine: Search
FF SearchEngineOrder.1: Search
FF SelectedSearchEngine: Search
FF Homepage: hxxp://search.ividi.org/?src=tbhp&id=06 ... 0&affilt=3
FF Keyword.URL: hxxp://search.ividi.org/?src=tbsp&id=06 ... ffilt=3&q=
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe http://start.qone8.com/?
C:\Users\Gamer\AppData\Local\Temp
End
*****************
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J => Key deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2cb7b61b-c3dc-11e2-be87-806e6f6e6963} => Key deleted successfully.
HKCR\CLSID\{2cb7b61b-c3dc-11e2-be87-806e6f6e6963} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6632c09d-340f-11e3-bee4-50b7c3507f40} => Key deleted successfully.
HKCR\CLSID\{6632c09d-340f-11e3-bee4-50b7c3507f40} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{78df842e-1303-11e3-be88-50b7c3507f3f} => Key deleted successfully.
HKCR\CLSID\{78df842e-1303-11e3-be88-50b7c3507f3f} => Key not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} => Key deleted successfully.
HKCR\CLSID\{2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully.
HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} => Key deleted successfully.
HKCR\CLSID\{2503424F-FAE7-4F3D-9CC8-0479F4EF9F54} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key deleted successfully.
HKCR\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F0065F31-652F-42B7-9172-8300D8EDD9BC} => Key deleted successfully.
HKCR\CLSID\{F0065F31-652F-42B7-9172-8300D8EDD9BC} => Key not found.
=> Should not be moved.
Firefox newtab deleted successfully.
Firefox DefaultSearchEngine deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox homepage deleted successfully.
Firefox Keyword.URL deleted successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\\Default => Value was restored successfully.
"C:\Users\Gamer\AppData\Local\Temp" directory move:
C:\Users\Gamer\AppData\Local\Temp\.challenge_plain => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\0848A25F-E1D9-4D95-9B90-D63E9979779A.Diagnose.3.etl => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\11102907-AE15-4F87-9B28-561B0D409F57.Diagnose.0.etl => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\11102907-AE15-4F87-9B28-561B0D409F57.Repair.1.etl => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\11102907-AE15-4F87-9B28-561B0D409F57.Verify.2.etl => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\1C2B.tmp => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\1C2C.tmp => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\293244E6-74C7-4321-A08A-AB983DEC3F30.Diagnose.3.etl => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\2AC2.tmp => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\2D36.tmp => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\3517.tmp => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\3CE8.tmp => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\41nohh3x344.jpg => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\44B9.tmp => Moved successfully.
C:\Users\Gamer\AppData\Local\Temp\47182347.exe => Moved successfully.
Tím definitivně vyloučíme, nebo potvrdíme vir. Pokud problém nezpůsobuje vir (já předpokládám, že ne) bude to problém systému a pak bude nutná jeho oprava.Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
pote spustte aplikaci pod uctem s administratorskym opravnenim
hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.
v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se
jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine
aplikace ani nic jineho
behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)
upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,
pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k
nezadoucim kolizim s rezidentem antispyware.
Kód: Vybrat vše
ComboFix 13-11-16.01 - Gamer . 11. 2013 21:19:28.1.8 - x64
Microsoft Windows 8 6.2.9200.0.1250.420.1029.18.6036.4345 [GMT 1:00]
Spuštěný z: c:\users\Gamer\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
AV: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Gamer\AppData\Local\MSGBOX.EXE
c:\users\Gamer\AppData\Roaming\apachesrvin.vbs
c:\windows\SysWow64\tmpB366.tmp
c:\windows\SysWow64\tmpB376.tmp
c:\programdata\VodafoneConnectorService.log . . . . nemohl být smazán
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_WsysSvc
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-10-16 do 2013-11-16 )))))))))))))))))))))))))))))))
.
.
2013-11-17 04:47 . 2013-11-17 04:48 -------- d-----w- C:\$SysReset
2013-11-16 20:29 . 2013-11-16 20:00 -------- d-----w- c:\program files (x86)\UEFI WinFlash
2013-11-16 20:28 . 2013-11-16 20:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-16 20:24 . 2013-11-16 20:24 -------- d-----w- C:\FRST
2013-11-16 20:06 . 2013-11-16 20:06 -------- d-----w- c:\users\Gamer\AppData\Roaming\LolClient
2013-11-16 19:56 . 2013-11-16 19:56 96856 ----a-w- c:\windows\system32\drivers\SMR410.SYS
2013-11-16 19:55 . 2013-11-16 19:49 -------- d-----w- c:\users\Gamer\AppData\Local\NPE
2013-11-16 19:29 . 2013-11-16 19:29 -------- d-----w- c:\program files (x86)\PANDORA.TV
2013-11-16 16:36 . 2008-07-31 09:41 68616 ----a-w- c:\windows\SysWow64\XAPOFX1_1.dll
2013-11-16 16:36 . 2008-07-31 09:40 509448 ----a-w- c:\windows\SysWow64\XAudio2_2.dll
2013-11-16 16:36 . 2008-07-12 07:18 467984 ----a-w- c:\windows\SysWow64\d3dx10_39.dll
2013-11-16 16:36 . 2008-07-12 07:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll
2013-11-16 16:36 . 2008-07-12 07:18 1493528 ----a-w- c:\windows\SysWow64\D3DCompiler_39.dll
2013-11-16 16:36 . 2013-11-16 16:36 -------- d-sh--w- c:\windows\SysWow64\AI_RecycleBin
2013-11-16 16:36 . 2013-11-16 16:36 -------- d-----w- C:\Riot Games
2013-11-16 16:35 . 2013-11-16 20:21 -------- d-----w- c:\users\Gamer\AppData\Local\PMB Files
2013-11-16 16:35 . 2013-11-16 20:00 -------- d-----w- c:\programdata\PMB Files
2013-11-16 16:35 . 2013-11-16 16:35 -------- d-----w- c:\program files (x86)\Pando Networks
2013-11-16 16:34 . 2013-11-16 16:35 -------- d-----w- c:\users\Gamer\AppData\Roaming\Riot Games
2013-11-16 15:56 . 2013-11-16 15:56 -------- d-----w- c:\users\Gamer\AppData\Roaming\Skype
2013-11-16 10:00 . 2013-11-16 10:00 67964928 ----a-w- c:\windows\system32\imageres.dll
2013-11-16 10:00 . 2013-11-16 10:00 67485184 ----a-w- c:\windows\system32\imageres1611201311019.ssc
2013-11-16 09:57 . 2013-11-16 09:57 -------- d-----w- c:\programdata\StartupSoundChanger
2013-11-16 09:56 . 2013-11-16 09:56 -------- d-----w- c:\program files (x86)\Startup Sound Changer
2013-11-16 09:56 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll
2013-11-16 09:56 . 2010-05-26 10:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
2013-11-16 09:44 . 2013-11-16 11:15 -------- d-----w- c:\program files (x86)\RailWorks
2013-11-16 09:09 . 2013-11-16 09:09 177752 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2013-11-16 09:09 . 2013-11-16 09:09 -------- d-----w- c:\program files\Common Files\Symantec Shared
2013-11-16 09:07 . 2013-11-16 09:07 -------- d-----w- c:\windows\system32\drivers\NISx64
2013-11-16 09:07 . 2013-11-16 09:07 -------- d-----w- c:\program files (x86)\Norton Internet Security
2013-11-16 09:01 . 2013-11-16 09:01 -------- d-----w- c:\windows\system32\drivers\NSTx64
2013-11-16 09:01 . 2013-11-16 09:01 -------- d-----w- c:\program files (x86)\Norton Identity Safe
2013-11-15 23:03 . 2013-11-15 23:03 -------- d-----w- c:\program files (x86)\Microsoft Synchronization Services
2013-11-15 23:03 . 2013-11-15 23:03 -------- d-----w- c:\program files (x86)\Microsoft Sync Framework
2013-11-15 23:01 . 2013-11-15 23:01 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2013-11-15 23:00 . 2013-11-15 23:00 -------- d-----w- c:\program files\Microsoft Office
2013-11-15 22:59 . 2013-11-15 22:59 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services
2013-11-15 22:59 . 2013-11-15 22:59 -------- d-----w- c:\users\Gamer\AppData\Local\Microsoft Help
2013-11-15 22:58 . 2013-11-15 23:07 -------- d-----w- c:\programdata\Microsoft Help
2013-11-15 22:58 . 2013-11-15 22:58 -------- d-----r- C:\MSOCache
2013-11-12 18:53 . 2013-11-12 19:37 -------- d-----w- C:\ThrottleStop_600
2013-11-09 12:02 . 2013-11-09 12:02 -------- d-----w- c:\windows\Luna Stargazing Uninstaller
2013-11-09 12:02 . 2013-03-08 07:43 1125346 ----a-w- c:\windows\Luna Stargazing.scr
2013-11-09 12:00 . 2013-11-09 12:00 -------- d-----w- c:\windows\WalkingTwilight Uninstaller
2013-11-09 12:00 . 2013-06-20 20:20 738587 ----a-w- c:\windows\WalkingTwilight.scr
2013-11-06 21:11 . 2013-11-06 21:16 -------- d-----w- c:\program files (x86)\Cheat Engine 6.2
2013-10-26 16:30 . 2013-10-26 15:48 -------- d-----w- c:\program files (x86)\R.G. Mechanics
2013-10-26 16:26 . 2013-11-16 19:46 -------- d-----w- c:\users\Gamer\AppData\Roaming\BitTorrent
2013-10-26 16:26 . 2013-10-26 16:27 -------- d-----w- c:\program files (x86)\Rolimno
2013-10-26 16:26 . 2013-10-26 15:35 -------- d-----w- c:\programdata\eSafe
2013-10-26 16:25 . 2013-10-26 16:25 -------- d-----w- c:\program files (x86)\VideoLAN
2013-10-26 16:24 . 2013-10-26 15:41 -------- d-----w- c:\program files (x86)\Seznam.cz
2013-10-26 16:24 . 2013-10-26 15:41 -------- d-----w- c:\users\Gamer\AppData\Roaming\Seznam.cz
2013-10-26 16:23 . 2013-10-26 16:23 -------- d-----w- c:\users\Gamer\AppData\Local\SwvUpdater
2013-10-26 16:23 . 2013-10-26 16:10 88 ----a-w- c:\users\Gamer\AppData\Roaming\die.bat
2013-10-26 16:19 . 2013-10-26 16:19 -------- d-----w- c:\programdata\Steam
2013-10-26 16:17 . 2013-10-26 16:17 -------- d-----w- c:\users\Gamer\AppData\Local\Opera Software
2013-10-26 16:17 . 2013-10-26 16:17 -------- d-----w- c:\users\Gamer\AppData\Roaming\Opera Software
2013-10-26 16:16 . 2013-10-26 16:16 -------- d-----w- c:\program files\CPUID
2013-10-26 16:15 . 2013-10-26 16:15 -------- d-sh--w- c:\users\Gamer\AppData\Local\ms-drivers
2013-10-26 16:15 . 2013-10-26 16:15 -------- d-----w- c:\users\Gamer\AppData\Local\MetaGeek,_LLC
2013-10-26 16:15 . 2013-10-26 16:15 -------- d-----w- c:\users\Gamer\AppData\Local\IsolatedStorage
2013-10-26 16:15 . 2013-10-26 16:15 -------- d-----w- c:\program files (x86)\MetaGeek
2013-10-26 16:12 . 2013-10-26 16:12 -------- d-----w- c:\program files (x86)\OperaBackup
2013-10-26 16:12 . 2013-10-26 16:12 -------- d-----w- c:\users\Gamer\AppData\Roaming\DmC - Devil May Cry
2013-10-26 16:11 . 2013-10-26 16:11 -------- d-----w- c:\users\Gamer\AppData\Roaming\Milestone
2013-10-26 16:10 . 2013-10-26 16:11 -------- d-----w- c:\users\Gamer\AppData\Roaming\DeltaBin
2013-10-26 16:02 . 2013-10-26 16:02 -------- d-----w- c:\users\Gamer\AppData\Roaming\Transformice
2013-10-26 16:02 . 2013-11-15 21:43 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2013-10-26 16:02 . 2013-10-26 16:02 -------- d-----w- c:\program files (x86)\Transformice
2013-10-26 16:01 . 2013-10-26 16:01 -------- d-----w- c:\program files (x86)\MagicISO
2013-10-26 15:58 . 2013-11-16 09:08 -------- d-----w- c:\program files (x86)\WRC 4 FIA World Rally Championship
2013-10-26 15:58 . 2013-10-26 15:58 -------- d-----w- c:\users\Gamer\AppData\Local\Programs
2013-10-26 15:54 . 2013-10-26 15:54 -------- d-----w- c:\users\Gamer\AppData\Roaming\PowerISO
2013-10-26 15:52 . 2013-10-26 15:52 -------- d-----w- c:\users\Gamer\AppData\Local\RailSimulator.com
2013-10-26 15:40 . 2013-10-26 15:40 -------- d-----w- c:\users\Gamer\AppData\Roaming\vlc
2013-10-26 15:38 . 2013-10-26 15:38 -------- d-----w- c:\users\Gamer\AppData\Local\Google
2013-10-26 15:38 . 2013-10-26 15:38 -------- d-----w- c:\program files (x86)\Unitech LLC
2013-10-26 15:38 . 2013-10-26 15:38 -------- d-----w- c:\program files (x86)\GetPrivate
2013-10-26 15:07 . 2013-10-26 15:07 -------- d-----w- c:\users\Gamer\AppData\Roaming\Unity
2013-10-26 14:58 . 2013-10-26 14:58 -------- d-----w- c:\users\Gamer\AppData\Roaming\InstallShield
2013-10-26 14:53 . 2013-10-26 14:53 -------- d-----w- c:\users\Gamer\AppData\Local\Unity
2013-10-26 14:43 . 2013-10-26 14:42 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-10-26 14:39 . 2013-10-26 16:27 -------- d-----w- C:\Steam_GreenLuma
2013-10-26 14:28 . 2013-11-16 20:04 -------- d-----w- C:\LegitSteam
2013-10-24 20:39 . 2013-10-24 20:39 -------- d-----w- c:\windows\3F5C371F8EA24F259D3DD0B4526E3AEA.TMP
2013-10-24 20:39 . 2013-10-24 20:39 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2013-10-24 20:17 . 2013-10-24 20:19 -------- d-----w- C:\TS2014
2013-10-24 19:57 . 2013-10-24 21:09 -------- d-----w- c:\program files (x86)\TrackMania Sunrise
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-26 14:42 . 2013-09-04 06:53 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-10-13 14:28 . 2013-10-13 14:28 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-09-10 17:27 . 2013-09-10 17:27 108968 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2013-09-10 17:27 . 2013-09-10 17:44 973736 ----a-w- c:\windows\system32\deployJava1.dll
2013-09-10 17:27 . 2013-09-10 17:44 1095080 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-09-10 17:27 . 2013-09-10 17:27 312744 ----a-w- c:\windows\system32\javaws.exe
2013-09-10 17:27 . 2013-09-10 17:27 189352 ----a-w- c:\windows\system32\javaw.exe
2013-09-10 17:27 . 2013-09-10 17:27 189352 ----a-w- c:\windows\system32\java.exe
2013-09-10 17:26 . 2013-09-10 17:26 544656 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-09-06 23:23 . 2013-09-06 23:23 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2013-09-06 23:23 . 2013-09-06 23:23 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2013-09-06 23:23 . 2013-09-06 23:23 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2013-09-06 23:23 . 2013-09-06 23:23 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2013-09-04 06:52 . 2013-09-04 06:52 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-09-02 15:22 . 2012-07-26 08:13 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-09-02 11:01 . 2013-09-02 11:01 17536 ----a-w- c:\programdata\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{8B8B2E80-1444-451D-AC8E-EB9A847F3887}]
2013-07-25 06:32 301464 ----a-w- c:\program files (x86)\Unitech LLC\ividi\1.8.23.0\bh\ividi.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-11-06 3673728]
"Clownfish"="c:\program files (x86)\Clownfish\Clownfish.exe" [2013-08-21 1277688]
"Steam"="c:\legitsteam\Steam.exe" [2013-10-30 1820584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-08-06 642216]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-07-16 56128]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2012-07-10 2995904]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-04-04 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2012-08-15 97392]
"CLMLServer_For_P2G8"="c:\program files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe" [2012-06-08 111120]
"CLVirtualDrive"="c:\program files (x86)\CyberLink\Power2Go8\VirtualDrive.exe" [2012-07-12 491120]
"Intel AppUp(SM) center"="c:\program files (x86)\Intel\IntelAppStore\bin\ismagent.exe" [2012-07-13 155488]
"GetPrivate"="c:\program files (x86)\GetPrivate\GetPrivate.exe" [2013-08-15 481704]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"midi2"=wdmaud.drv
.
R0 SymELAM;Symantec ELAM Driver;c:\windows\system32\drivers\NISx64\1501000.012\SymELAM.sys;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\SymELAM.sys [x]
R3 GPU-Z;GPU-Z;c:\users\Gamer\AppData\Local\Temp\GPU-Z.sys;c:\users\Gamer\AppData\Local\Temp\GPU-Z.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.6;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 vmicheartbeat;Služba prezenčního signálu technologie Hyper-V;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S0 amdkmpfd;AMD PCI Root Bus Lower Filter;c:\windows\System32\drivers\amdkmpfd.sys;c:\windows\SYSNATIVE\drivers\amdkmpfd.sys [x]
S0 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys;c:\windows\SYSNATIVE\drivers\sfdrv01a.sys [x]
S0 SMR410;Symantec SMR Utility Service 4.1.0;c:\windows\System32\drivers\SMR410.SYS;c:\windows\SYSNATIVE\drivers\SMR410.SYS [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1501000.012\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1501000.012\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\program files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20131101.003\BHDrvx64.sys;c:\program files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20131101.003\BHDrvx64.sys [x]
S1 ccSet_NARA;NARA Settings Manager;c:\windows\system32\drivers\NARAx64\0401000.00B\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NARAx64\0401000.00B\ccSetx64.sys [x]
S1 ccSet_NIS;NIS Settings Manager;c:\windows\system32\drivers\NISx64\1501000.012\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\ccSetx64.sys [x]
S1 ccSet_NST;Norton Identity Safe Settings Manager;c:\windows\system32\drivers\NSTx64\7DE06000.01B\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NSTx64\7DE06000.01B\ccSetx64.sys [x]
S1 CLVirtualDrive;CLVirtualDrive;c:\windows\system32\DRIVERS\CLVirtualDrive.sys;c:\windows\SYSNATIVE\DRIVERS\CLVirtualDrive.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\System32\drivers\dtsoftbus01.sys;c:\windows\SYSNATIVE\drivers\dtsoftbus01.sys [x]
S1 IDSVia64;IDSVia64;c:\program files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20131115.001\IDSvia64.sys;c:\program files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20131115.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1501000.012\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1501000.012\SYMNETS.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1501000.012\SYMNETS.SYS [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 Easy Launcher;Easy Launcher;c:\program files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe;c:\program files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NCO;Norton Identity Safe;c:\program files (x86)\Norton Identity Safe\Engine\2014.6.0.27\NST.exe;c:\program files (x86)\Norton Identity Safe\Engine\2014.6.0.27\NST.exe [x]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe;c:\program files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 OfficeSvc;Služba Microsoft Office;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe;c:\program files\Microsoft Office 15\ClientX64\integratedoffice.exe [x]
S2 PanService;PandoraService;c:\program files (x86)\PANDORA.TV\PanService\KMPService.exe;c:\program files (x86)\PANDORA.TV\PanService\KMPService.exe [x]
S2 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VodafoneConnectorService;Vodafone Connector Service;c:\program files (x86)\Vodafone\Via The Phone\VodafoneConnectorService.exe;c:\program files (x86)\Vodafone\Via The Phone\VodafoneConnectorService.exe [x]
S2 ZAtheros Bt and Wlan Coex Agent;ZAtheros Bt and Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]
S3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
S3 btath_avdt;Qualcomm Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
S3 BTATH_BUS;Qualcomm Atheros Bluetooth Bus;c:\windows\System32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\System32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\System32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
S3 BthLEEnum;Ovladač úspory energie technologie Bluetooth;c:\windows\system32\DRIVERS\BthLEEnum.sys;c:\windows\SYSNATIVE\DRIVERS\BthLEEnum.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 RadioHIDMini;Radio HID Mini-driver;c:\windows\System32\drivers\RadioHIDMini.sys;c:\windows\SYSNATIVE\drivers\RadioHIDMini.sys [x]
S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
S3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2013-11-16 c:\windows\Tasks\AmiUpdXp.job
- c:\users\Gamer\AppData\Local\SwvUpdater\Updater.exe [2013-10-26 16:23]
.
2013-11-16 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16 02:54]
.
2013-11-16 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-04-16 02:54]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-08-10 13191824]
"BtTray"="c:\program files (x86)\Bluetooth Suite\BtTray.exe" [2012-09-14 764544]
"BtvStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2012-09-14 127616]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-07-20 170304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-07-20 398656]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-07-20 440640]
"IntelTBRunOnce"="wscript.exe" [2012-07-26 160256]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 10.0.254.1 10.0.0.1
TCP: Interfaces\{7C73F059-7153-4131-98E7-4561D988E22D}: NameServer = 203.109.129.67,203.109.129.68
FF - ProfilePath - c:\users\Gamer\AppData\Roaming\Mozilla\Firefox\Profiles\x7nmf58l.default\
FF - ExtSQL: 2013-10-26 17:04; {e4a8a97b-f2ed-450b-b12d-ee082ba24781}; c:\users\Gamer\AppData\Roaming\Mozilla\Firefox\Profiles\x7nmf58l.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF - ExtSQL: 2013-10-26 18:02; {bb6bc1bb-f824-4702-90cd-35e2fb24f25d}; c:\users\Gamer\AppData\Roaming\Mozilla\Firefox\Profiles\x7nmf58l.default\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25d}
FF - user.js: extensions.ividi.tlbrSrchUrl - hxxp://search.ividi.org/?src=tbsp&id=0624aa44000000000000000000000000&affilt=3&q=
FF - user.js: extensions.ividi.id - 0624aa44000000000000000000000000
FF - user.js: extensions.ividi.appId - {685F23D9-FCFD-475C-B56A-362645945C5A}
FF - user.js: extensions.ividi.instlDay - 16004
FF - user.js: extensions.ividi.vrsn - 1.8.23.0
FF - user.js: extensions.ividi.vrsni - 1.8.23.0
FF - user.js: extensions.ividi.vrsnTs - 1.8.23.017:38
FF - user.js: extensions.ividi.prtnrId - ividi
FF - user.js: extensions.ividi.prdct - ividi
FF - user.js: extensions.ividi.aflt - 3
FF - user.js: extensions.ividi.smplGrp - none
FF - user.js: extensions.ividi.tlbrId - base
FF - user.js: extensions.ividi.instlRef -
FF - user.js: extensions.ividi.dfltLng -
FF - user.js: extensions.ividi.excTlbr - true
FF - user.js: extensions.ividi.ffxUnstlRst - false
FF - user.js: extensions.ividi.admin - false
FF - user.js: extensions.ividi.autoRvrt - false
FF - user.js: extensions.ividi.rvrt - false
FF - user.js: extensions.ividi.hmpg - true
FF - user.js: extensions.ividi.hmpgUrl - hxxp://search.ividi.org/?src=tbhp&id=0624aa44000000000000000000000000&affilt=3
FF - user.js: extensions.ividi.hpOld0 - hxxp://start.qone8.com/?type=hp&ts=1382804655&from=vtt&uid=ST1000LM024XHN-M101MBB_S2RQJ9BC915430
FF - user.js: extensions.ividi.dfltSrch - true
FF - user.js: extensions.ividi.srchPrvdr - Search
FF - user.js: extensions.ividi.kw_url - hxxp://search.ividi.org/?src=tbsp&id=0624aa44000000000000000000000000&affilt=3&q=
FF - user.js: extensions.ividi.dnsErr - true
FF - user.js: extensions.ividi.newTab - true
FF - user.js: extensions.ividi.newTabUrl - hxxp://search.ividi.org/?q={searchTerms}&src=tbnt&id=0624aa44000000000000000000000000&affilt=3
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
AddRemove-WsysControl - c:\programdata\eSafe\eGdpSvc.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NCO]
"ImagePath"="\"c:\program files (x86)\Norton Identity Safe\Engine\2014.6.0.27\NST.exe\" /s \"NCO\" /m \"c:\program files (x86)\Norton Identity Safe\Engine\2014.6.0.27\diMaster.dll\" /prefetch:1"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\21.1.0.18\diMaster.dll\" /prefetch:1"
"ImagePath"="\SystemRoot\system32\drivers\NISx64\1501000.012\SYMNETS.SYS"
"TrustedImagePaths"="c:\program files (x86)\Norton Internet Security\Engine\21.1.0.18;c:\program files (x86)\Norton Internet Security\Engine64\21.1.0.18"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{34A0FF07-F11A-4157-84A3-92F8AD688CBF}]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
c:\program files (x86)\Samsung\Settings\sSettings.exe
c:\program files (x86)\Samsung\SW Update\SWMAgent.exe
c:\program files (x86)\PANDORA.TV\PanService\KMPProcess.exe
c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
c:\program files (x86)\Common Files\Steam\SteamService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Celkový čas: 2013-11-16 20:55:17 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-11-16 19:55
.
Před spuštěním: 616 182 583 296 bytes free
Po spuštění: 615 543 705 600 bytes free
.
- - End Of File - - BFBC74344A267245A9A8AB895F9E8DB1
Kód: Vybrat vše
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 8 x64
Ran by Gamer on so 16. 11. 2013 at 20:51:22,37
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\escort.escortiepane
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\escort.escortiepane.1
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\AppID\escort.dll
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\AppID\escortapp.dll
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\AppID\escorteng.dll
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\AppID\esrv.exe
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\esafeseccontrol
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\escort.escortiepane
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\escort.escortiepane.1
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\i
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\updater.amiupd
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\updater.amiupd.1
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\wsyscontrol
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{99c91fc5-db5b-4aa0-bb70-5d89c5a4df96}
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\wsyscontrol
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{99c91fc5-db5b-4aa0-bb70-5d89c5a4df96}
Successfully deleted: [Registry Key] "hkey_current_user\software\apn pip"
~~~ Files
Failed to delete: [File] C:\windows\Tasks\amiupdxp.job
~~~ Folders
Failed to delete: [Folder] "C:\ProgramData\boost_interprocess"
Failed to delete: [Folder] "C:\ProgramData\esafe"
Successfully deleted: [Folder] "C:\Users\Gamer\appdata\local\swvupdater"
Failed to delete: [Folder] "C:\Program Files (x86)\rolimno"
Failed to delete: [Folder] "C:\windows\syswow64\ai_recyclebin"
~~~ FireFox
Successfully deleted: [File] C:\Users\Gamer\AppData\Roaming\mozilla\firefox\profiles\x7nmf58l.default\user.js
Emptied folder: C:\Users\Gamer\AppData\Roaming\mozilla\firefox\profiles\x7nmf58l.default\minidumps [1 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on so 16. 11. 2013 at 20:58:21,67
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~