Problém s malware

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Odpovědět
Zpráva
Autor
karelsoucek
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 25 Lis 2013 09:20

Problém s malware

#1 Příspěvek od karelsoucek »

Zdravím, prosím o kontrolu logu:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-11-2013
Ran by Karek (administrator) on KAREK-PC on 25-11-2013 09:15:59
Running from C:\Users\Karek\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Computer, Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(WebSparkle) C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe
(WebSparkle) C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Celartem, Inc., doing business as Extensis.) C:\Program Files (x86)\Extensis\Suitcase Fusion 4\FMCore.exe
(Dropbox, Inc.) C:\Users\Karek\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD64.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(forum.viry.cz) C:\Users\Karek\Desktop\FRSTLauncher.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\PING.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20551328 2013-10-21] (Skype Technologies S.A.)
HKCU\...\Run: [FMCore.exe] - C:\Program Files (x86)\Extensis\Suitcase Fusion 4\FMCore.exe [9504768 2013-07-25] (Celartem, Inc., doing business as Extensis.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Search Protection] - C:\ProgramData\Search Protection\SearchProtection.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Startup: C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Karek\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securedsearch2.lavasoft.com/inde ... 52726A7D54
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {B1621800-AC5C-4088-BDEB-332A51E18368} URL = http://search.us.com/serp?guid={BEBE9FA ... earchTerms}
SearchScopes: HKCU - {308B62F7-D79F-43D0-92BC-9038C1ABD37E} URL = http://search.yahoo.com/search?p={searc ... type=10511
SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = http://securedsearch2.lavasoft.com/resu ... earchTerms}
SearchScopes: HKCU - {62ED6765-EF63-4546-94FA-C2551C04DF8C} URL = http://search.yahoo.com/search?p={searc ... type=10513
SearchScopes: HKCU - {B1621800-AC5C-4088-BDEB-332A51E18368} URL = http://search.us.com/serp?guid={BEBE9FA ... earchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: WebSparkle - {9f56bab3-2739-40ed-a8d0-1451657a9742} - C:\Program Files (x86)\WebSparkle\WebSparkleBHO.dll (WebSparkle)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{5F31578C-0FBE-44BE-8993-69BBDF586BD9}: [NameServer]213.46.172.36,213.46.172.37

FireFox:
========
FF ProfilePath: C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default
FF NewTab: file:///C:\\Users\\Karek\\AppData\\Local\\TNT2\\Common\\pinnedSearch.htm
FF DefaultSearchEngine: SecureSearch
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: SecureSearch
FF Homepage: hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_6&idate=2013-10-31&ent=hp&u=66200B20AF84C8FB76DF8852726A7D54
FF Keyword.URL: hxxp://securedsearch2.lavasoft.com/results.php?pr=vmn&id=adawaretb&v=3_6&idate=__installtime__&hsimp=yhs-lavasoft&ent=bs&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tightropeinteractive.com/Plugin - C:\Users\Karek\AppData\Local\TNT2\2.0.0.1599\npTNT2.dll (Search.Us.com)
FF Plugin HKCU: @tnt2ghost.com/Plugin - C:\Users\Karek\AppData\Local\TNT2\2.0.0.1599\npTNT2ghost.dll (Search.Us.com)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\adawaretb.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: Seznam lištička - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
FF Extension: firebug - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: firefox - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\firefox@websparkle.biz.xpi
FF Extension: seo - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\seo@profesional.xpi
FF Extension: seostatus - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\seostatus@rubyweb.xpi
FF Extension: toolbar_ORJ-V7 - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\toolbar_ORJ-V7@apn.ask.com.xpi
FF HKCU\...\Firefox\Extensions: [sea-condensed@plugin.org] - C:\Program Files (x86)\The Sea App (Firefox)
FF Extension: The SEA App (C) - C:\Program Files (x86)\The Sea App (Firefox)
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s malware

#2 Příspěvek od vyosek »

Zdravim :)

:arrow: Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe
  • Ulozte nejlepe na plochu
  • Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
  • Probehne vytvoreni zalohy a nasledne prohledavani
  • Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte
:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Kliknete na Scan a nasledne Clean
  • Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
karelsoucek
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 25 Lis 2013 09:20

Re: Problém s malware

#3 Příspěvek od karelsoucek »

zatím log z Junkware:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Karek on po 25.11.2013 at 9:37:21,70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\search protection
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-1604048657-3569887421-881733268-1000\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dt soft\daemon tools toolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\adawarebp_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\adawarebp_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskPIP_FF__RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskPIP_FF__RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskPIP_FF__RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskPIP_FF__RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B1621800-AC5C-4088-BDEB-332A51E18368}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9f56bab3-2739-40ed-a8d0-1451657a9742}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{9f56bab3-2739-40ed-a8d0-1451657a9742}



~~~ Files



~~~ Folders

Failed to delete: [Folder] "C:\Program Files (x86)\websparkle"



~~~ FireFox

Successfully deleted the following from C:\Users\Karek\AppData\Roaming\mozilla\firefox\profiles\bo3ol8i2.default\prefs.js

user_pref("browser.search.defaultenginename", "SecureSearch");
user_pref("browser.search.selectedEngine", "SecureSearch");
user_pref("browser.startup.homepage", "hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_6&idate=2013-10-31&ent=hp&u=66200B20AF84C8FB76DF8852726A7D54");
user_pref("keyword.URL", "hxxp://securedsearch2.lavasoft.com/results.php?pr=vmn&id=adawaretb&v=3_6&idate=__installtime__&hsimp=yhs-lavasoft&ent=bs&q=");
Emptied folder: C:\Users\Karek\AppData\Roaming\mozilla\firefox\profiles\bo3ol8i2.default\minidumps [30 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on po 25.11.2013 at 9:42:56,14
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Nahoru
karelsoucek
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 25 Lis 2013 09:20

Re: Problém s malware

#4 Příspěvek od karelsoucek »

# AdwCleaner v3.013 - Report created 25/11/2013 at 09:56:58
# Updated 24/11/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Karek - KAREK-PC
# Running from : C:\Users\Karek\Desktop\adwcleaner(1).exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\adawaretb.xml

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Key Deleted : HKLM\Software\Uniblue
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.7601.17514


-\\ Mozilla Firefox v25.0.1 (cs)

[ File : C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [3311 octets] - [24/10/2013 08:32:00]
AdwCleaner[R1].txt - [1270 octets] - [25/11/2013 09:48:40]
AdwCleaner[S0].txt - [3284 octets] - [24/10/2013 08:34:44]
AdwCleaner[S1].txt - [1197 octets] - [25/11/2013 09:56:58]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1257 octets] ##########
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s malware

#5 Příspěvek od vyosek »

:arrow: Spuštění FRST
  • Po spuštění FRST odsouhlasíme licenční podmínky kliknutím na [Ano].
  • Dooznačíme položku Addition.txt - viz obrázek.
    Obrázek
  • Klikneme na tlačítko [Scan], čímž spustíme skenování.
  • Počkáme na dokončení skenování FRST
  • Otevře se nám textový soubor FRST.txt, což je požadovaný log a jehož obsah vložíme do svého tématu na fóru.
  • Na ploše nám zbyde utilita FRST a dva logy - FRST.txt a Addition.txt - nic z toho zatím nemažeme!
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
karelsoucek
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 25 Lis 2013 09:20

Re: Problém s malware

#6 Příspěvek od karelsoucek »

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-11-2013
Ran by Karek (administrator) on KAREK-PC on 25-11-2013 10:27:18
Running from C:\Users\Karek\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Computer, Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(WebSparkle) C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe
(WebSparkle) C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Celartem, Inc., doing business as Extensis.) C:\Program Files (x86)\Extensis\Suitcase Fusion 4\FMCore.exe
(Dropbox, Inc.) C:\Users\Karek\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20551328 2013-10-21] (Skype Technologies S.A.)
HKCU\...\Run: [FMCore.exe] - C:\Program Files (x86)\Extensis\Suitcase Fusion 4\FMCore.exe [9504768 2013-07-25] (Celartem, Inc., doing business as Extensis.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Startup: C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Karek\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {308B62F7-D79F-43D0-92BC-9038C1ABD37E} URL = http://search.yahoo.com/search?p={searc ... type=10511
SearchScopes: HKCU - {62ED6765-EF63-4546-94FA-C2551C04DF8C} URL = http://search.yahoo.com/search?p={searc ... type=10513
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: WebSparkle - {9f56bab3-2739-40ed-a8d0-1451657a9742} - C:\Program Files (x86)\WebSparkle\WebSparkleBHO.dll (WebSparkle)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{5F31578C-0FBE-44BE-8993-69BBDF586BD9}: [NameServer]213.46.172.36,213.46.172.37

FireFox:
========
FF ProfilePath: C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default
FF NewTab: file:///C:\\Users\\Karek\\AppData\\Local\\TNT2\\Common\\pinnedSearch.htm
FF DefaultSearchEngine: SecureSearch
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: SecureSearch
FF Homepage: hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_6&idate=2013-10-31&ent=hp&u=66200B20AF84C8FB76DF8852726A7D54
FF Keyword.URL: hxxp://securedsearch2.lavasoft.com/results.php?pr=vmn&id=adawaretb&v=3_6&idate=__installtime__&hsimp=yhs-lavasoft&ent=bs&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tightropeinteractive.com/Plugin - C:\Users\Karek\AppData\Local\TNT2\2.0.0.1599\npTNT2.dll (Search.Us.com)
FF Plugin HKCU: @tnt2ghost.com/Plugin - C:\Users\Karek\AppData\Local\TNT2\2.0.0.1599\npTNT2ghost.dll (Search.Us.com)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: Seznam lištička - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
FF Extension: firebug - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: firefox - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\firefox@websparkle.biz.xpi
FF Extension: seo - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\seo@profesional.xpi
FF Extension: seostatus - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\seostatus@rubyweb.xpi
FF Extension: toolbar_ORJ-V7 - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\toolbar_ORJ-V7@apn.ask.com.xpi
FF HKCU\...\Firefox\Extensions: [sea-condensed@plugin.org] - C:\Program Files (x86)\The Sea App (Firefox)
FF Extension: The SEA App (C) - C:\Program Files (x86)\The Sea App (Firefox)

==================== Services (Whitelisted) =================

R2 Update WebSparkle; C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe [65312 2013-10-04] (WebSparkle)
R2 Util WebSparkle; C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe [65312 2013-10-17] (WebSparkle)
S2 Update LinkSwift; "C:\Program Files (x86)\LinkSwift\updateLinkSwift.exe" [x]
S2 Util LinkSwift; "C:\Program Files (x86)\LinkSwift\bin\utilLinkSwift.exe" [x]

==================== Drivers (Whitelisted) ====================

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2013-08-31] ()
U3 a32k4fqh; C:\Windows\System32\Drivers\a32k4fqh.sys [0 ] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-25 09:46 - 2013-11-25 09:45 - 01091882 _____ C:\Users\Karek\Desktop\adwcleaner(1).exe
2013-11-25 09:42 - 2013-11-25 09:42 - 00003662 _____ C:\Users\Karek\Desktop\JRT.txt
2013-11-25 09:37 - 2013-11-25 09:37 - 00000000 ____D C:\Windows\ERUNT
2013-11-25 09:37 - 2013-11-25 09:36 - 01034531 _____ (Thisisu) C:\Users\Karek\Desktop\JRT.exe
2013-11-25 09:15 - 2013-11-25 10:27 - 00010029 _____ C:\Users\Karek\Desktop\FRST.txt
2013-11-25 09:15 - 2013-11-25 09:15 - 00000000 ____D C:\FRST
2013-11-25 09:14 - 2013-11-25 09:13 - 00112128 _____ (forum.viry.cz) C:\Users\Karek\Desktop\FRSTLauncher.exe
2013-11-25 08:44 - 2013-11-25 08:41 - 01958440 _____ (Farbar) C:\Users\Karek\Desktop\FRST64.exe
2013-11-22 16:20 - 2013-11-22 16:20 - 00001103 _____ C:\Users\Karek\Desktop\SEO Administrator.lnk
2013-11-22 16:20 - 2013-06-05 10:45 - 00938496 _____ C:\Windows\SysWOW64\semtempl.dll
2013-11-22 16:20 - 2005-05-20 04:26 - 00343040 _____ C:\Windows\SysWOW64\arcdll.dll
2013-11-22 16:20 - 2004-06-14 16:19 - 00003072 _____ C:\Windows\SysWOW64\hashfunc.dll
2013-11-22 10:55 - 2013-11-22 10:56 - 00000000 ____D C:\OutputFolder
2013-11-22 10:52 - 2013-11-22 10:54 - 00000000 ____D C:\Program Files (x86)\Ultra Video Splitter
2013-11-22 10:52 - 2013-11-22 10:52 - 00001151 _____ C:\Users\Public\Desktop\Ultra Video Splitter.lnk
2013-11-22 10:52 - 2007-04-12 14:19 - 00129024 _____ C:\Windows\SysWOW64\AVERM.dll
2013-11-22 10:52 - 2006-09-26 13:57 - 00028672 _____ C:\Windows\SysWOW64\AVEQT.dll
2013-11-21 17:35 - 2013-11-21 17:35 - 00000000 ____D C:\Windows\CD95F661A5C444F5A6AAECDD91C240DB.TMP
2013-11-21 17:35 - 2013-11-21 17:35 - 00000000 ____D C:\Users\Karek\Documents\Add-in Express
2013-11-21 17:34 - 2013-11-22 10:33 - 00000000 ____D C:\FFOutput
2013-11-21 17:34 - 2013-11-21 17:34 - 00001198 _____ C:\Users\Karek\Desktop\Format Factory.lnk
2013-11-21 17:34 - 2013-11-21 17:34 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
2013-11-21 17:33 - 2013-11-21 17:33 - 00000000 ____D C:\Program Files (x86)\FreeTime
2013-11-19 09:14 - 2013-11-19 09:14 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Malwarebytes
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-19 09:14 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-18 08:45 - 2013-11-18 08:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 15:05 - 2013-11-14 15:05 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-11-14 14:58 - 2013-11-14 14:58 - 00004746 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-14 14:58 - 2013-11-14 14:58 - 00000000 ____D C:\ProgramData\Oracle
2013-11-14 14:58 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-14 14:58 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-14 14:58 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-14 14:58 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-31 17:01 - 2013-10-31 17:01 - 00000000 ____D C:\Users\Karek\AppData\Roaming\LavasoftStatistics
2013-10-31 15:48 - 2013-10-31 15:48 - 00000000 ____D C:\ProgramData\BitDefender
2013-10-31 15:35 - 2013-10-31 15:35 - 00000000 ____D C:\Program Files\Lavasoft
2013-10-31 15:34 - 2013-11-25 09:07 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2013-10-31 15:33 - 2013-10-31 15:33 - 00000000 ____D C:\ProgramData\Lavasoft

==================== One Month Modified Files and Folders =======

2013-11-25 10:27 - 2013-11-25 09:15 - 00010029 _____ C:\Users\Karek\Desktop\FRST.txt
2013-11-25 10:05 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-25 10:05 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-25 10:02 - 2011-04-12 09:34 - 00634308 _____ C:\Windows\system32\perfh005.dat
2013-11-25 10:02 - 2011-04-12 09:34 - 00122898 _____ C:\Windows\system32\perfc005.dat
2013-11-25 10:02 - 2009-07-14 06:13 - 01478586 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-25 10:01 - 2013-08-31 15:42 - 01667315 _____ C:\Windows\WindowsUpdate.log
2013-11-25 10:00 - 2013-08-31 14:44 - 00000000 ____D C:\Users\Karek\Documents\Soubory aplikace Outlook
2013-11-25 09:59 - 2013-08-31 15:13 - 00000010 _____ C:\Users\Karek\AppData\Local\.HG88C586-G30G-2HE2-DGDE-8H3E1D530D30
2013-11-25 09:59 - 2013-08-31 15:13 - 00000010 _____ C:\ProgramData\.F464B91F-G49F-3G3D-CFCD-9G7D2C141C96
2013-11-25 09:58 - 2013-09-24 13:30 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Skype
2013-11-25 09:58 - 2013-09-13 13:06 - 00000000 ___RD C:\Users\Karek\Dropbox
2013-11-25 09:58 - 2013-09-13 12:13 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Dropbox
2013-11-25 09:58 - 2013-08-31 16:04 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-25 09:58 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-25 09:58 - 2009-07-14 05:51 - 00031274 _____ C:\Windows\setupact.log
2013-11-25 09:56 - 2013-10-24 08:31 - 00000000 ____D C:\AdwCleaner
2013-11-25 09:52 - 2013-09-03 09:12 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-25 09:45 - 2013-11-25 09:46 - 01091882 _____ C:\Users\Karek\Desktop\adwcleaner(1).exe
2013-11-25 09:42 - 2013-11-25 09:42 - 00003662 _____ C:\Users\Karek\Desktop\JRT.txt
2013-11-25 09:42 - 2013-10-16 14:06 - 00000000 ____D C:\Program Files (x86)\WebSparkle
2013-11-25 09:37 - 2013-11-25 09:37 - 00000000 ____D C:\Windows\ERUNT
2013-11-25 09:36 - 2013-11-25 09:37 - 01034531 _____ (Thisisu) C:\Users\Karek\Desktop\JRT.exe
2013-11-25 09:15 - 2013-11-25 09:15 - 00000000 ____D C:\FRST
2013-11-25 09:13 - 2013-11-25 09:14 - 00112128 _____ (forum.viry.cz) C:\Users\Karek\Desktop\FRSTLauncher.exe
2013-11-25 09:11 - 2010-11-21 04:47 - 00013280 _____ C:\Windows\PFRO.log
2013-11-25 09:07 - 2013-10-31 15:34 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2013-11-25 08:41 - 2013-11-25 08:44 - 01958440 _____ (Farbar) C:\Users\Karek\Desktop\FRST64.exe
2013-11-25 08:36 - 2013-09-24 13:29 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-25 08:36 - 2013-09-24 13:29 - 00000000 ____D C:\ProgramData\Skype
2013-11-22 16:51 - 2013-09-24 08:54 - 00000000 ____D C:\seo projects
2013-11-22 16:20 - 2013-11-22 16:20 - 00001103 _____ C:\Users\Karek\Desktop\SEO Administrator.lnk
2013-11-22 16:20 - 2013-09-02 08:18 - 00000000 ____D C:\ProgramData\SeoAdministrator
2013-11-22 16:20 - 2013-09-02 08:18 - 00000000 ____D C:\Program Files (x86)\seoadministrator
2013-11-22 16:10 - 2013-09-02 13:34 - 00001480 _____ C:\Users\Karek\AppData\Local\Adobe Uložit pro web 13.0 Prefs
2013-11-22 10:57 - 2013-10-23 15:21 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Applian FLV and Media Player
2013-11-22 10:56 - 2013-11-22 10:55 - 00000000 ____D C:\OutputFolder
2013-11-22 10:54 - 2013-11-22 10:52 - 00000000 ____D C:\Program Files (x86)\Ultra Video Splitter
2013-11-22 10:52 - 2013-11-22 10:52 - 00001151 _____ C:\Users\Public\Desktop\Ultra Video Splitter.lnk
2013-11-22 10:33 - 2013-11-21 17:34 - 00000000 ____D C:\FFOutput
2013-11-21 17:35 - 2013-11-21 17:35 - 00000000 ____D C:\Windows\CD95F661A5C444F5A6AAECDD91C240DB.TMP
2013-11-21 17:35 - 2013-11-21 17:35 - 00000000 ____D C:\Users\Karek\Documents\Add-in Express
2013-11-21 17:34 - 2013-11-21 17:34 - 00001198 _____ C:\Users\Karek\Desktop\Format Factory.lnk
2013-11-21 17:34 - 2013-11-21 17:34 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
2013-11-21 17:33 - 2013-11-21 17:33 - 00000000 ____D C:\Program Files (x86)\FreeTime
2013-11-20 14:40 - 2013-09-02 08:25 - 00000000 ____D C:\Users\Karek\.ScreamingFrogSEOSpider
2013-11-20 08:24 - 2013-08-31 14:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-19 09:14 - 2013-11-19 09:14 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Malwarebytes
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-18 08:45 - 2013-11-18 08:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 16:28 - 2009-07-14 05:45 - 04190696 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-15 15:25 - 2013-08-31 14:41 - 00135992 _____ C:\Users\Karek\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-15 14:13 - 2013-08-31 14:37 - 00000000 ____D C:\Users\Karek\AppData\Local\Microsoft Help
2013-11-15 08:10 - 2013-08-31 15:12 - 00000000 ____D C:\Users\Karek\AppData\Local\Extensis
2013-11-14 15:05 - 2013-11-14 15:05 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-11-14 14:58 - 2013-11-14 14:58 - 00004746 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-14 14:58 - 2013-11-14 14:58 - 00000000 ____D C:\ProgramData\Oracle
2013-11-14 14:58 - 2013-09-02 08:25 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-31 17:01 - 2013-10-31 17:01 - 00000000 ____D C:\Users\Karek\AppData\Roaming\LavasoftStatistics
2013-10-31 15:48 - 2013-10-31 15:48 - 00000000 ____D C:\ProgramData\BitDefender
2013-10-31 15:35 - 2013-10-31 15:35 - 00000000 ____D C:\Program Files\Lavasoft
2013-10-31 15:33 - 2013-10-31 15:33 - 00000000 ____D C:\ProgramData\Lavasoft
2013-10-29 10:36 - 2013-08-31 15:21 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Adobe

Some content of TEMP:
====================
C:\Users\Karek\AppData\Local\Temp\04016ceb-d861-48ef-b5f7-5a10f233f36b.exe
C:\Users\Karek\AppData\Local\Temp\4b7f0143-219e-4ac7-afd2-564bc83b9869.exe
C:\Users\Karek\AppData\Local\Temp\AskPIP_FF_.exe
C:\Users\Karek\AppData\Local\Temp\Quarantine.exe
C:\Users\Karek\AppData\Local\Temp\Suitcase Fusion 4 v15.0.6.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-15 12:35

==================== End Of Log ============================


a pak vyskočilo hned toto:


Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-11-2013
Ran by Karek at 2013-11-25 10:27:39
Running from C:\Users\Karek\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe AIR (x32 Version: 3.1.0.4880)
Adobe Creative Suite 6 Master Collection (x32 Version: 6)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Adobe Help Manager (x32 Version: 4.0.244)
Adobe Reader XI (11.0.05) - Czech (x32 Version: 11.0.05)
Adobe Widget Browser (x32 Version: 2.0 Build 348)
Adobe Widget Browser (x32 Version: 2.0.348)
Aktualizace NVIDIA 1.11.3 (Version: 1.11.3)
Applian FLV and Media Player 3.1.1.12 (x32 Version: 3.1.1.12)
Ask Toolbar (x32 Version: 12.6.0.12)
bl (x32 Version: 1.0.0)
Dropbox (HKCU Version: 2.0.26)
Extensis Suitcase Fusion 4 (x32 Version: 15.0.6)
FormatFactory 3.2.1.0 (x32 Version: 3.2.1.0)
FreeMind (x32 Version: 0.9.0)
IrfanView (remove only) (x32)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Malwarebytes Anti-Malware verze 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office Access MUI (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office Excel MUI (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office Groove MUI (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office InfoPath MUI (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.4763.1000)
Microsoft Office OneNote MUI (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office Outlook MUI (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office PowerPoint MUI (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Proof (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Proof (Slovak) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office Proofing (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office Publisher MUI (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office Shared 64-bit MUI (Czech) 2010 (Version: 14.0.4763.1011)
Microsoft Office Shared MUI (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Office Word MUI (Czech) 2010 (x32 Version: 14.0.4763.1011)
Microsoft Silverlight (x32 Version: 4.0.60310.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30411 (Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000)
Mozilla Firefox 25.0.1 (x86 cs) (x32 Version: 25.0.1)
Mozilla Maintenance Service (x32 Version: 25.0.1)
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA Ovladač 3D Vision 311.06 (Version: 311.06)
NVIDIA Ovladače grafiky 311.06 (Version: 311.06)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106)
NVIDIA Update Components (Version: 1.11.3)
Ovládací panel NVIDIA 311.06 (Version: 311.06)
PDF Settings CS6 (x32 Version: 11.0)
ph (x32 Version: 1.0.0)
Poedit (x32 Version: 1.4.6)
Screaming Frog SEO Spider (x32 Version: 0.01)
Search.us.com (HKCU)
SEO Administrator 5.1 (x32)
Skype™ 6.10 (x32 Version: 6.10.104)
Smart PC Cleaner v3.2 (x32 Version: 3.2)
The Sea App (Firefox) (x32)
Total Commander 64-bit (Remove or Repair) (Version: 8.01)
Total Commander 8.01 Final (x64,x86) full version for Windows (x32 Version: for Windows)
Ultra Video Splitter 6.2.0409 (x32)
WebSparkle 1.0.0 (Version: 1.0.0)
WinRAR 4.20 (64-bit) (Version: 4.20.0)

==================== Restore Points =========================

08-10-2013 11:46:06 Removed Adobe Acrobat X Pro - Eastern European (Group 1).
08-10-2013 11:51:39 Installed Adobe Reader XI - Czech.
15-10-2013 14:54:56 Naplánovaný kontrolní bod
16-10-2013 13:06:39 Uniblue DriverScanner installation
31-10-2013 14:33:41 AA11
14-11-2013 13:57:47 Installed Java 7 Update 45
14-11-2013 14:02:52 Nainstalováno: Microsoft Visual C++ 2005 Redistributable
14-11-2013 14:03:39 Installed Extensis Suitcase Fusion 4.
25-11-2013 08:07:28 AA11

==================== Hosts content: ==========================

2009-07-14 03:34 - 2013-10-16 13:46 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {9E71B060-41F9-478C-B859-E39D78A06F6E} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {E8CF9BEA-C9F2-4B49-93F4-6D188F0D18E0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-11] (Adobe

Systems Incorporated)
Task: {F6C2A660-409B-46B7-B4F4-3DDF9332A936} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2010-01-30 01:40 - 2010-01-30 01:40 - 04254560 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-30 01:41 - 2010-01-30 01:41 - 04254560 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-07-25 12:41 - 2013-07-25 12:41 - 01007616 _____ () C:\Program Files (x86)\Extensis\Suitcase Fusion 4\libxml2.2.6.24.dll
2013-07-25 12:41 - 2013-07-25 12:41 - 00901120 _____ () C:\Program Files (x86)\Extensis\Suitcase Fusion 4\iconv-1.9.2.dll
2013-07-25 12:41 - 2013-07-25 12:41 - 00007168 _____ () C:\Program Files (x86)\Extensis\Suitcase Fusion 4\libcharset.dll
2013-03-13 21:48 - 2013-03-13 21:48 - 24978944 _____ () C:\Users\Karek\AppData\Roaming\Dropbox\bin\libcef.dll
2013-11-18 08:45 - 2013-11-18 08:45 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-09-11 08:52 - 2013-09-11 08:52 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll
2010-01-30 01:41 - 2010-01-30 01:41 - 04254560 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2010-02-28 01:55 - 2010-02-28 01:55 - 01040736 _____ () C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Karek\Local Settings:IosHsoDjFJa6bx3Bw8MWLlMC
AlternateDataStreams: C:\Users\Karek\AppData\Local:IosHsoDjFJa6bx3Bw8MWLlMC
AlternateDataStreams: C:\Users\Karek\AppData\Local\Data aplikací:IosHsoDjFJa6bx3Bw8MWLlMC
AlternateDataStreams: C:\Users\Karek\AppData\Local\Temporary Internet Files:PiLQST2Urskr3a0c9vwpXsDW

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/25/2013 09:59:48 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (11/25/2013 09:58:08 AM) (Source: Service Control Manager) (User: )
Description: Služba Util LinkSwift neuspěla při spuštění v důsledku následující chyby:
%%2

Error: (11/25/2013 09:58:06 AM) (Source: Service Control Manager) (User: )
Description: Služba Update LinkSwift neuspěla při spuštění v důsledku následující chyby:
%%2


Microsoft Office Sessions:
=========================
Error: (11/25/2013 09:59:48 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
Date: 2013-10-16 14:46:31.978
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A

recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2013-10-16 14:46:31.968
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A

recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Percentage of memory in use: 40%
Total physical RAM: 4094.49 MB
Available physical RAM: 2416.54 MB
Total Pagefile: 8187.18 MB
Available Pagefile: 6356.48 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:368.01 GB) (Free:324.62 GB) NTFS
Drive d: (decko) (Fixed) (Total:97.66 GB) (Free:95.89 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: A859C709)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=368 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=98 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s malware

#7 Příspěvek od vyosek »

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20551328 2013-10-21] (Skype Technologies S.A.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

SearchScopes: HKCU - {308B62F7-D79F-43D0-92BC-9038C1ABD37E} URL = http://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10511
SearchScopes: HKCU - {62ED6765-EF63-4546-94FA-C2551C04DF8C} URL = http://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10513
FF NewTab: file:///C:\\Users\\Karek\\AppData\\Local\\TNT2\\Common\\pinnedSearch.htm
FF DefaultSearchEngine: SecureSearch
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: SecureSearch
FF Homepage: hxxp://securedsearch2.lavasoft.com/inde ... 52726A7D54
FF Keyword.URL: hxxp://securedsearch2.lavasoft.com/resu ... &ent=bs&q=

R2 Update WebSparkle; C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe [65312 2013-10-04] (WebSparkle)
R2 Util WebSparkle; C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe [65312 2013-10-17] (WebSparkle)
S2 Update LinkSwift; "C:\Program Files (x86)\LinkSwift\updateLinkSwift.exe" [x]
S2 Util LinkSwift; "C:\Program Files (x86)\LinkSwift\bin\utilLinkSwift.exe" [x]

C:\Program Files (x86)\WebSparkle
C:\Program Files (x86)\LinkSwif
2013-11-25 09:13 - 2013-11-25 09:14 - 00112128 _____ (forum.viry.cz) C:\Users\Karek\Desktop\FRSTLauncher.exe
2013-11-25 09:45 - 2013-11-25 09:46 - 01091882 _____ C:\Users\Karek\Desktop\adwcleaner(1).exe
2013-11-25 09:42 - 2013-11-25 09:42 - 00003662 _____ C:\Users\Karek\Desktop\JRT.txt
2013-11-25 09:56 - 2013-10-24 08:31 - 00000000 ____D C:\AdwCleaner
C:\Users\Karek\AppData\Local\Temp\04016ceb-d861-48ef-b5f7-5a10f233f36b.exe
C:\Users\Karek\AppData\Local\Temp\4b7f0143-219e-4ac7-afd2-564bc83b9869.exe
C:\Users\Karek\AppData\Local\Temp\AskPIP_FF_.exe
C:\Users\Karek\AppData\Local\Temp\Quarantine.exe
C:\Users\Karek\AppData\Local\Temp\Suitcase Fusion 4 v15.0.6.exe

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

AlternateDataStreams: C:\Users\Karek\Local Settings:IosHsoDjFJa6bx3Bw8MWLlMC
AlternateDataStreams: C:\Users\Karek\AppData\Local:IosHsoDjFJa6bx3Bw8MWLlMC
AlternateDataStreams: C:\Users\Karek\AppData\Local\Data aplikací:IosHsoDjFJa6bx3Bw8MWLlMC
AlternateDataStreams: C:\Users\Karek\AppData\Local\Temporary Internet Files:PiLQST2Urskr3a0c9vwpXsDW

Hosts:
CMD: shutdown /r /f /t 2

End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
karelsoucek
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 25 Lis 2013 09:20

Re: Problém s malware

#8 Příspěvek od karelsoucek »

Chtěl bych se zeptat, jestli má symsl pokračovat v započatém hledání problému s vyskakujícími reklamami ve FF, viz předchozí logy, nebo jestli mám začít znovu?
díky. K.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s malware

#9 Příspěvek od vyosek »

Zdravim,

udelejte novy log :)
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
karelsoucek
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 25 Lis 2013 09:20

Re: Problém s malware

#10 Příspěvek od karelsoucek »

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-11-2013
Ran by Karek (administrator) on KAREK-PC on 12-12-2013 11:25:40
Running from C:\Users\Karek\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Apple Computer, Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(WebSparkle) C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe
(WebSparkle) C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Celartem, Inc., doing business as Extensis.) C:\Program Files (x86)\Extensis\Suitcase Fusion 4\FMCore.exe
(Dropbox, Inc.) C:\Users\Karek\AppData\Roaming\Dropbox\bin\Dropbox.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD64.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(forum.viry.cz) C:\Users\Karek\Desktop\FRSTLauncher.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\PING.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20551328 2013-10-21] (Skype Technologies S.A.)
HKCU\...\Run: [FMCore.exe] - C:\Program Files (x86)\Extensis\Suitcase Fusion 4\FMCore.exe [9504768 2013-07-25] (Celartem, Inc., doing business as Extensis.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [747712 2013-11-26] ()
Startup: C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Karek\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
SearchScopes: HKCU - {308B62F7-D79F-43D0-92BC-9038C1ABD37E} URL = http://search.yahoo.com/search?p={searc ... type=10511
SearchScopes: HKCU - {62ED6765-EF63-4546-94FA-C2551C04DF8C} URL = http://search.yahoo.com/search?p={searc ... type=10513
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: WebSparkle - {9f56bab3-2739-40ed-a8d0-1451657a9742} - C:\Program Files (x86)\WebSparkle\WebSparkleBHO.dll (WebSparkle)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{5F31578C-0FBE-44BE-8993-69BBDF586BD9}: [NameServer]213.46.172.36,213.46.172.37

FireFox:
========
FF ProfilePath: C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default
FF NewTab: file:///C:\\Users\\Karek\\AppData\\Local\\TNT2\\Common\\pinnedSearch.htm
FF DefaultSearchEngine: SecureSearch
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: SecureSearch
FF Homepage: hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_6&idate=2013-10-31&ent=hp&u=66200B20AF84C8FB76DF8852726A7D54
FF Keyword.URL: hxxp://securedsearch2.lavasoft.com/results.php?pr=vmn&id=adawaretb&v=3_6&idate=__installtime__&hsimp=yhs-lavasoft&ent=bs&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tightropeinteractive.com/Plugin - C:\Users\Karek\AppData\Local\TNT2\2.0.0.1599\npTNT2.dll (Search.Us.com)
FF Plugin HKCU: @tnt2ghost.com/Plugin - C:\Users\Karek\AppData\Local\TNT2\2.0.0.1599\npTNT2ghost.dll (Search.Us.com)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: Seznam lištička - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
FF Extension: firebug - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: firefox - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\firefox@websparkle.biz.xpi
FF Extension: seo - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\seo@profesional.xpi
FF Extension: seostatus - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\seostatus@rubyweb.xpi
FF Extension: toolbar_ORJ-V7 - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\toolbar_ORJ-V7@apn.ask.com.xpi
FF HKCU\...\Firefox\Extensions: [sea-condensed@plugin.org] - C:\Program Files (x86)\The Sea App (Firefox)
FF Extension: The SEA App (C) - C:\Program Files (x86)\The Sea App (Firefox)

Chrome:
=======
CHR Extension: (Docs) - C:\Users\Karek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Karek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Karek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Karek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Google Wallet) - C:\Users\Karek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Karek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [ikgojpdbiniccokkgadmdheobjfdbbcg] - C:\Program Files (x86)\WebSparkle\ikgojpdbiniccokkgadmdheobjfdbbcg.crx

==================== Services (Whitelisted) =================

R2 Update WebSparkle; C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe [65312 2013-10-04] (WebSparkle)
R2 Util WebSparkle; C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe [65312 2013-10-17] (WebSparkle)
S2 Update LinkSwift; "C:\Program Files (x86)\LinkSwift\updateLinkSwift.exe" [x]
S2 Util LinkSwift; "C:\Program Files (x86)\LinkSwift\bin\utilLinkSwift.exe" [x]

==================== Drivers (Whitelisted) ====================

R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2013-08-31] ()
U3 aggdbkn3; C:\Windows\System32\Drivers\aggdbkn3.sys [0 ] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-12 11:25 - 2013-12-12 11:25 - 00011535 _____ C:\Users\Karek\Desktop\FRST.txt
2013-12-12 11:24 - 2013-11-25 08:44 - 01958440 _____ (Farbar) C:\Users\Karek\Desktop\FRST64(1).exe
2013-12-12 11:24 - 2013-11-25 08:41 - 01958440 _____ (Farbar) C:\Users\Karek\Desktop\FRST64.exe
2013-12-02 13:53 - 2013-12-02 13:54 - 17121597 _____ C:\Users\Karek\Downloads\Chemie, 31. říjen 2013.zip
2013-11-28 08:47 - 2013-11-28 08:47 - 00001393 _____ C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-27 16:18 - 2013-02-17 01:40 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-11-27 16:15 - 2013-11-27 16:15 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-27 16:15 - 2013-11-27 16:15 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-27 16:15 - 2013-11-27 16:15 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-27 16:15 - 2013-11-27 16:15 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-27 16:15 - 2013-11-27 16:15 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-27 16:15 - 2013-11-27 16:15 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-27 16:15 - 2013-11-27 16:15 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00523264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-27 16:15 - 2013-11-27 16:15 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-27 16:15 - 2013-11-27 16:15 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-27 16:15 - 2013-11-27 16:15 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-27 16:15 - 2013-11-27 16:15 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-27 16:14 - 2013-11-27 16:14 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 05559152 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 03968368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 03913584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 01162240 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-11-27 16:12 - 2013-11-27 16:12 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-27 16:11 - 2013-11-27 16:11 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-27 16:11 - 2013-11-27 16:11 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-27 16:10 - 2013-11-27 16:19 - 00013308 _____ C:\Windows\IE10_main.log
2013-11-27 16:08 - 2013-11-27 16:08 - 00002255 _____ C:\Users\Public\Desktop\Google Chrome 31.lnk
2013-11-27 16:07 - 2013-12-12 11:17 - 00000950 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-27 16:07 - 2013-12-12 08:17 - 00000946 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-27 16:07 - 2013-12-10 13:12 - 00003946 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-11-27 16:07 - 2013-12-10 13:12 - 00003694 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-11-27 16:07 - 2013-11-27 16:08 - 00000000 ____D C:\Users\Karek\AppData\Local\Google
2013-11-27 16:07 - 2013-11-27 16:08 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-27 16:06 - 2013-11-27 16:06 - 00001409 _____ C:\Users\Karek\Desktop\Internet Explorer 11.lnk
2013-11-27 16:00 - 2013-11-27 16:02 - 00004098 _____ C:\Windows\IE9_main.log
2013-11-27 15:59 - 2013-11-27 15:59 - 00001129 _____ C:\Users\Public\Desktop\Opera 18.lnk
2013-11-27 15:59 - 2013-11-27 15:59 - 00000786 _____ C:\Windows\ie8_main.log
2013-11-27 15:59 - 2013-11-27 15:59 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Opera Software
2013-11-27 15:59 - 2013-11-27 15:59 - 00000000 ____D C:\Users\Karek\AppData\Local\Opera Software
2013-11-27 15:59 - 2013-11-27 15:59 - 00000000 ____D C:\Program Files (x86)\Opera
2013-11-27 09:30 - 2013-11-27 09:35 - 00000000 ____D C:\Users\Karek\AppData\Roaming\HandBrake
2013-11-27 09:29 - 2013-11-27 09:29 - 00000824 _____ C:\Users\UpdatusUser\Desktop\Handbrake.lnk
2013-11-27 09:29 - 2013-11-27 09:29 - 00000824 _____ C:\Users\Karek\Desktop\Handbrake.lnk
2013-11-27 09:29 - 2013-11-27 09:29 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Handbrake
2013-11-27 09:29 - 2013-11-27 09:29 - 00000000 ____D C:\Program Files\Handbrake
2013-11-26 17:20 - 2013-12-11 17:12 - 00000822 _____ C:\Users\Karek\daemonprocess.txt
2013-11-26 17:20 - 2013-11-27 09:06 - 00000000 ____D C:\Users\Karek\AppData\Local\Mobogenie
2013-11-26 17:20 - 2013-11-26 17:21 - 00000000 ____D C:\Users\Karek\AppData\Local\cache
2013-11-26 17:20 - 2013-11-26 17:20 - 00000000 ____D C:\Users\Karek\Documents\Mobogenie
2013-11-26 17:20 - 2013-11-26 17:20 - 00000000 ____D C:\Users\Karek\.android
2013-11-26 17:19 - 2013-11-26 17:21 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2013-11-26 17:19 - 2013-11-26 17:20 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
2013-11-26 17:19 - 2013-11-26 17:19 - 00001031 _____ C:\Users\Karek\Desktop\MediaCoder.lnk
2013-11-26 17:19 - 2013-11-26 17:19 - 00001019 _____ C:\Users\Karek\Desktop\Mobogenie.lnk
2013-11-26 17:19 - 2013-11-26 17:19 - 00000000 ____D C:\Users\Karek\AppData\Roaming\OpenCandy
2013-11-26 17:19 - 2013-11-26 17:19 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MediaCoder
2013-11-26 17:19 - 2013-11-26 17:19 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Broad Intelligence
2013-11-26 17:19 - 2013-11-26 17:19 - 00000000 ____D C:\Program Files (x86)\MediaCoder
2013-11-25 14:11 - 2013-11-25 14:11 - 00000032 RSHOT C:\Users\Karek\AppData\Local\t65s2tb.dat
2013-11-25 14:11 - 2013-11-25 14:11 - 00000000 ____D C:\Users\Karek\Documents\My Axure RP Libraries
2013-11-25 14:11 - 2013-11-25 14:11 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Axure
2013-11-25 14:11 - 2013-11-25 14:11 - 00000000 ____D C:\Users\Karek\AppData\Local\IsolatedStorage
2013-11-25 14:11 - 2013-11-25 14:11 - 00000000 ____D C:\Users\Karek\AppData\Local\Axure
2013-11-25 14:11 - 2013-11-25 14:11 - 00000000 ____D C:\ProgramData\Axure
2013-11-25 14:10 - 2013-11-25 14:10 - 00001140 _____ C:\Users\Public\Desktop\Axure RP 6.5.lnk
2013-11-25 14:10 - 2013-11-25 14:10 - 00000000 __HDC C:\ProgramData\{6F65EB2A-399B-4CEE-BE43-10BE3B64F86C}
2013-11-25 14:10 - 2013-11-25 14:10 - 00000000 ____D C:\Users\Karek\AppData\Local\PackageAware
2013-11-25 14:10 - 2013-11-25 14:10 - 00000000 ____D C:\Program Files (x86)\Axure
2013-11-25 09:42 - 2013-11-25 09:42 - 00003662 _____ C:\Users\Karek\Desktop\JRT.txt
2013-11-25 09:37 - 2013-11-25 09:37 - 00000000 ____D C:\Windows\ERUNT
2013-11-25 09:37 - 2013-11-25 09:36 - 01034531 _____ (Thisisu) C:\Users\Karek\Desktop\JRT.exe
2013-11-25 09:15 - 2013-11-25 09:15 - 00000000 ____D C:\FRST
2013-11-25 09:14 - 2013-11-25 09:13 - 00112128 _____ (forum.viry.cz) C:\Users\Karek\Desktop\FRSTLauncher.exe
2013-11-22 16:20 - 2013-11-26 18:29 - 00987136 _____ C:\Windows\SysWOW64\semtempl.dll
2013-11-22 16:20 - 2013-11-22 16:20 - 00001103 _____ C:\Users\Karek\Desktop\SEO Administrator.lnk
2013-11-22 16:20 - 2005-05-20 04:26 - 00343040 _____ C:\Windows\SysWOW64\arcdll.dll
2013-11-22 16:20 - 2004-06-14 16:19 - 00003072 _____ C:\Windows\SysWOW64\hashfunc.dll
2013-11-22 10:55 - 2013-11-22 10:56 - 00000000 ____D C:\OutputFolder
2013-11-22 10:52 - 2013-11-22 10:54 - 00000000 ____D C:\Program Files (x86)\Ultra Video Splitter
2013-11-22 10:52 - 2013-11-22 10:52 - 00001151 _____ C:\Users\Public\Desktop\Ultra Video Splitter.lnk
2013-11-22 10:52 - 2007-04-12 14:19 - 00129024 _____ C:\Windows\SysWOW64\AVERM.dll
2013-11-22 10:52 - 2006-09-26 13:57 - 00028672 _____ C:\Windows\SysWOW64\AVEQT.dll
2013-11-21 17:35 - 2013-11-21 17:35 - 00000000 ____D C:\Windows\CD95F661A5C444F5A6AAECDD91C240DB.TMP
2013-11-21 17:35 - 2013-11-21 17:35 - 00000000 ____D C:\Users\Karek\Documents\Add-in Express
2013-11-21 17:34 - 2013-11-22 10:33 - 00000000 ____D C:\FFOutput
2013-11-21 17:34 - 2013-11-21 17:34 - 00001198 _____ C:\Users\Karek\Desktop\Format Factory.lnk
2013-11-21 17:34 - 2013-11-21 17:34 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
2013-11-21 17:33 - 2013-11-21 17:33 - 00000000 ____D C:\Program Files (x86)\FreeTime
2013-11-19 09:14 - 2013-11-19 09:14 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Malwarebytes
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-19 09:14 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-18 08:45 - 2013-11-18 08:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 15:05 - 2013-11-14 15:05 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-11-14 14:58 - 2013-11-14 14:58 - 00004746 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-14 14:58 - 2013-11-14 14:58 - 00000000 ____D C:\ProgramData\Oracle
2013-11-14 14:58 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-14 14:58 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-14 14:58 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-14 14:58 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

==================== One Month Modified Files and Folders =======

2013-12-12 11:25 - 2013-12-12 11:25 - 00011535 _____ C:\Users\Karek\Desktop\FRST.txt
2013-12-12 11:17 - 2013-11-27 16:07 - 00000950 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-12 11:17 - 2013-09-24 13:30 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Skype
2013-12-12 10:52 - 2013-09-03 09:12 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-12 08:39 - 2011-04-12 09:34 - 00634308 _____ C:\Windows\system32\perfh005.dat
2013-12-12 08:39 - 2011-04-12 09:34 - 00122898 _____ C:\Windows\system32\perfc005.dat
2013-12-12 08:39 - 2009-07-14 06:13 - 01478586 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-12 08:38 - 2013-11-26 17:20 - 00000822 _____ C:\Users\Karek\daemonprocess.txt
2013-12-12 08:37 - 2009-07-14 05:51 - 00033690 _____ C:\Windows\setupact.log
2013-12-12 08:24 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-12 08:24 - 2009-07-14 05:45 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-12 08:18 - 2013-09-13 12:13 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Dropbox
2013-12-12 08:17 - 2013-11-27 16:07 - 00000946 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-12 08:17 - 2013-09-13 13:06 - 00000000 ___RD C:\Users\Karek\Dropbox
2013-12-12 08:17 - 2013-08-31 16:04 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-12 08:17 - 2013-08-31 15:13 - 00000010 _____ C:\Users\Karek\AppData\Local\.HG88C586-G30G-2HE2-DGDE-8H3E1D530D30
2013-12-12 08:17 - 2013-08-31 15:13 - 00000010 _____ C:\ProgramData\.F464B91F-G49F-3G3D-CFCD-9G7D2C141C96
2013-12-12 08:17 - 2013-08-31 14:44 - 00000000 ____D C:\Users\Karek\Documents\Soubory aplikace Outlook
2013-12-12 08:17 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-11 17:12 - 2013-08-31 15:42 - 01357507 _____ C:\Windows\WindowsUpdate.log
2013-12-11 09:45 - 2013-09-02 13:34 - 00001480 _____ C:\Users\Karek\AppData\Local\Adobe Uložit pro web 13.0 Prefs
2013-12-10 13:12 - 2013-11-27 16:07 - 00003946 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-10 13:12 - 2013-11-27 16:07 - 00003694 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-10 09:19 - 2013-10-24 08:31 - 00000000 ____D C:\AdwCleaner
2013-12-09 13:39 - 2013-09-02 08:18 - 00000000 ____D C:\ProgramData\SeoAdministrator
2013-12-02 13:54 - 2013-12-02 13:53 - 17121597 _____ C:\Users\Karek\Downloads\Chemie, 31. říjen 2013.zip
2013-11-28 12:46 - 2013-10-16 14:06 - 00000000 ____D C:\Program Files (x86)\WebSparkle
2013-11-28 08:47 - 2013-11-28 08:47 - 00001393 _____ C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-28 08:45 - 2010-11-21 04:47 - 00014202 _____ C:\Windows\PFRO.log
2013-11-28 08:45 - 2009-07-14 05:45 - 04193880 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-27 17:29 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-11-27 17:29 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-11-27 17:29 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\zh-HK
2013-11-27 17:29 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\tr-TR
2013-11-27 17:29 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-27 16:19 - 2013-11-27 16:10 - 00013308 _____ C:\Windows\IE10_main.log
2013-11-27 16:15 - 2013-11-27 16:15 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-27 16:15 - 2013-11-27 16:15 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-27 16:15 - 2013-11-27 16:15 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-27 16:15 - 2013-11-27 16:15 - 01441280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-27 16:15 - 2013-11-27 16:15 - 01400416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-27 16:15 - 2013-11-27 16:15 - 01400416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-27 16:15 - 2013-11-27 16:15 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 01054720 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00905728 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00523264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-27 16:15 - 2013-11-27 16:15 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-27 16:15 - 2013-11-27 16:15 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00242200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00232960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00204800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00185344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00150528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00138752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00137216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00125440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00110592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00079872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-27 16:15 - 2013-11-27 16:15 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-27 16:15 - 2013-11-27 16:15 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00038400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-27 16:15 - 2013-11-27 16:15 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-27 16:15 - 2013-11-27 16:15 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-27 16:14 - 2013-11-27 16:14 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 05559152 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 03968368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 03913584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 01162240 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-11-27 16:13 - 2013-11-27 16:13 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-11-27 16:13 - 2013-11-27 16:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-11-27 16:12 - 2013-11-27 16:12 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-27 16:12 - 2013-11-27 16:12 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-27 16:11 - 2013-11-27 16:11 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-27 16:11 - 2013-11-27 16:11 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-27 16:08 - 2013-11-27 16:08 - 00002255 _____ C:\Users\Public\Desktop\Google Chrome 31.lnk
2013-11-27 16:08 - 2013-11-27 16:07 - 00000000 ____D C:\Users\Karek\AppData\Local\Google
2013-11-27 16:08 - 2013-11-27 16:07 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-27 16:06 - 2013-11-27 16:06 - 00001409 _____ C:\Users\Karek\Desktop\Internet Explorer 11.lnk
2013-11-27 16:04 - 2013-08-31 16:00 - 00001443 _____ C:\Users\Karek\Desktop\Internet Explorer 9.lnk
2013-11-27 16:02 - 2013-11-27 16:00 - 00004098 _____ C:\Windows\IE9_main.log
2013-11-27 15:59 - 2013-11-27 15:59 - 00001129 _____ C:\Users\Public\Desktop\Opera 18.lnk
2013-11-27 15:59 - 2013-11-27 15:59 - 00000786 _____ C:\Windows\ie8_main.log
2013-11-27 15:59 - 2013-11-27 15:59 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Opera Software
2013-11-27 15:59 - 2013-11-27 15:59 - 00000000 ____D C:\Users\Karek\AppData\Local\Opera Software
2013-11-27 15:59 - 2013-11-27 15:59 - 00000000 ____D C:\Program Files (x86)\Opera
2013-11-27 10:50 - 2013-10-23 15:21 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Applian FLV and Media Player
2013-11-27 09:35 - 2013-11-27 09:30 - 00000000 ____D C:\Users\Karek\AppData\Roaming\HandBrake
2013-11-27 09:29 - 2013-11-27 09:29 - 00000824 _____ C:\Users\UpdatusUser\Desktop\Handbrake.lnk
2013-11-27 09:29 - 2013-11-27 09:29 - 00000824 _____ C:\Users\Karek\Desktop\Handbrake.lnk
2013-11-27 09:29 - 2013-11-27 09:29 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Handbrake
2013-11-27 09:29 - 2013-11-27 09:29 - 00000000 ____D C:\Program Files\Handbrake
2013-11-27 09:06 - 2013-11-26 17:20 - 00000000 ____D C:\Users\Karek\AppData\Local\Mobogenie
2013-11-26 18:29 - 2013-11-22 16:20 - 00987136 _____ C:\Windows\SysWOW64\semtempl.dll
2013-11-26 17:21 - 2013-11-26 17:20 - 00000000 ____D C:\Users\Karek\AppData\Local\cache
2013-11-26 17:21 - 2013-11-26 17:19 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2013-11-26 17:20 - 2013-11-26 17:20 - 00000000 ____D C:\Users\Karek\Documents\Mobogenie
2013-11-26 17:20 - 2013-11-26 17:20 - 00000000 ____D C:\Users\Karek\.android
2013-11-26 17:20 - 2013-11-26 17:19 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
2013-11-26 17:20 - 2013-08-31 16:00 - 00000000 ____D C:\Users\Karek
2013-11-26 17:19 - 2013-11-26 17:19 - 00001031 _____ C:\Users\Karek\Desktop\MediaCoder.lnk
2013-11-26 17:19 - 2013-11-26 17:19 - 00001019 _____ C:\Users\Karek\Desktop\Mobogenie.lnk
2013-11-26 17:19 - 2013-11-26 17:19 - 00000000 ____D C:\Users\Karek\AppData\Roaming\OpenCandy
2013-11-26 17:19 - 2013-11-26 17:19 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MediaCoder
2013-11-26 17:19 - 2013-11-26 17:19 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Broad Intelligence
2013-11-26 17:19 - 2013-11-26 17:19 - 00000000 ____D C:\Program Files (x86)\MediaCoder
2013-11-25 14:11 - 2013-11-25 14:11 - 00000032 RSHOT C:\Users\Karek\AppData\Local\t65s2tb.dat
2013-11-25 14:11 - 2013-11-25 14:11 - 00000000 ____D C:\Users\Karek\Documents\My Axure RP Libraries
2013-11-25 14:11 - 2013-11-25 14:11 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Axure
2013-11-25 14:11 - 2013-11-25 14:11 - 00000000 ____D C:\Users\Karek\AppData\Local\IsolatedStorage
2013-11-25 14:11 - 2013-11-25 14:11 - 00000000 ____D C:\Users\Karek\AppData\Local\Axure
2013-11-25 14:11 - 2013-11-25 14:11 - 00000000 ____D C:\ProgramData\Axure
2013-11-25 14:11 - 2013-08-31 14:41 - 00106192 _____ C:\Users\Karek\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-25 14:10 - 2013-11-25 14:10 - 00001140 _____ C:\Users\Public\Desktop\Axure RP 6.5.lnk
2013-11-25 14:10 - 2013-11-25 14:10 - 00000000 __HDC C:\ProgramData\{6F65EB2A-399B-4CEE-BE43-10BE3B64F86C}
2013-11-25 14:10 - 2013-11-25 14:10 - 00000000 ____D C:\Users\Karek\AppData\Local\PackageAware
2013-11-25 14:10 - 2013-11-25 14:10 - 00000000 ____D C:\Program Files (x86)\Axure
2013-11-25 09:42 - 2013-11-25 09:42 - 00003662 _____ C:\Users\Karek\Desktop\JRT.txt
2013-11-25 09:37 - 2013-11-25 09:37 - 00000000 ____D C:\Windows\ERUNT
2013-11-25 09:36 - 2013-11-25 09:37 - 01034531 _____ (Thisisu) C:\Users\Karek\Desktop\JRT.exe
2013-11-25 09:15 - 2013-11-25 09:15 - 00000000 ____D C:\FRST
2013-11-25 09:13 - 2013-11-25 09:14 - 00112128 _____ (forum.viry.cz) C:\Users\Karek\Desktop\FRSTLauncher.exe
2013-11-25 09:07 - 2013-10-31 15:34 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2013-11-25 08:44 - 2013-12-12 11:24 - 01958440 _____ (Farbar) C:\Users\Karek\Desktop\FRST64(1).exe
2013-11-25 08:41 - 2013-12-12 11:24 - 01958440 _____ (Farbar) C:\Users\Karek\Desktop\FRST64.exe
2013-11-25 08:36 - 2013-09-24 13:29 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-25 08:36 - 2013-09-24 13:29 - 00000000 ____D C:\ProgramData\Skype
2013-11-22 16:51 - 2013-09-24 08:54 - 00000000 ____D C:\seo projects
2013-11-22 16:20 - 2013-11-22 16:20 - 00001103 _____ C:\Users\Karek\Desktop\SEO Administrator.lnk
2013-11-22 16:20 - 2013-09-02 08:18 - 00000000 ____D C:\Program Files (x86)\seoadministrator
2013-11-22 10:56 - 2013-11-22 10:55 - 00000000 ____D C:\OutputFolder
2013-11-22 10:54 - 2013-11-22 10:52 - 00000000 ____D C:\Program Files (x86)\Ultra Video Splitter
2013-11-22 10:52 - 2013-11-22 10:52 - 00001151 _____ C:\Users\Public\Desktop\Ultra Video Splitter.lnk
2013-11-22 10:33 - 2013-11-21 17:34 - 00000000 ____D C:\FFOutput
2013-11-21 17:35 - 2013-11-21 17:35 - 00000000 ____D C:\Windows\CD95F661A5C444F5A6AAECDD91C240DB.TMP
2013-11-21 17:35 - 2013-11-21 17:35 - 00000000 ____D C:\Users\Karek\Documents\Add-in Express
2013-11-21 17:34 - 2013-11-21 17:34 - 00001198 _____ C:\Users\Karek\Desktop\Format Factory.lnk
2013-11-21 17:34 - 2013-11-21 17:34 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
2013-11-21 17:33 - 2013-11-21 17:33 - 00000000 ____D C:\Program Files (x86)\FreeTime
2013-11-20 14:40 - 2013-09-02 08:25 - 00000000 ____D C:\Users\Karek\.ScreamingFrogSEOSpider
2013-11-20 08:24 - 2013-08-31 14:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-19 09:14 - 2013-11-19 09:14 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\Users\Karek\AppData\Roaming\Malwarebytes
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-19 09:14 - 2013-11-19 09:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-18 08:45 - 2013-11-18 08:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 14:13 - 2013-08-31 14:37 - 00000000 ____D C:\Users\Karek\AppData\Local\Microsoft Help
2013-11-15 08:10 - 2013-08-31 15:12 - 00000000 ____D C:\Users\Karek\AppData\Local\Extensis
2013-11-14 15:05 - 2013-11-14 15:05 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-11-14 14:58 - 2013-11-14 14:58 - 00004746 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-11-14 14:58 - 2013-11-14 14:58 - 00000000 ____D C:\ProgramData\Oracle
2013-11-14 14:58 - 2013-09-02 08:25 - 00000000 ____D C:\Program Files (x86)\Java

Some content of TEMP:
====================
C:\Users\Karek\AppData\Local\Temp\04016ceb-d861-48ef-b5f7-5a10f233f36b.exe
C:\Users\Karek\AppData\Local\Temp\4b7f0143-219e-4ac7-afd2-564bc83b9869.exe
C:\Users\Karek\AppData\Local\Temp\AskPIP_FF_.exe
C:\Users\Karek\AppData\Local\Temp\Suitcase Fusion 4 v15.0.6.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-26 12:22

==================== End Of Log ============================
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s malware

#11 Příspěvek od vyosek »

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20551328 2013-10-21] (Skype Technologies S.A.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
SearchScopes: HKCU - {308B62F7-D79F-43D0-92BC-9038C1ABD37E} URL = http://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10511
SearchScopes: HKCU - {62ED6765-EF63-4546-94FA-C2551C04DF8C} URL = http://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10513
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

FF NewTab: file:///C:\\Users\\Karek\\AppData\\Local\\TNT2\\Common\\pinnedSearch.htm
FF DefaultSearchEngine: SecureSearch
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: SecureSearch
FF Homepage: hxxp://securedsearch2.lavasoft.com/inde ... 52726A7D54
FF Keyword.URL: hxxp://securedsearch2.lavasoft.com/resu ... &ent=bs&q=
FF Extension: toolbar_ORJ-V7 - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\toolbar_ORJ-V7@apn.ask.com.xpi

CHR HKLM-x32\...\Chrome\Extension: [ikgojpdbiniccokkgadmdheobjfdbbcg] - C:\Program Files (x86)\WebSparkle\ikgojpdbiniccokkgadmdheobjfdbbcg.crx

R2 Update WebSparkle; C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe [65312 2013-10-04] (WebSparkle)
R2 Util WebSparkle; C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe [65312 2013-10-17] (WebSparkle)
S2 Update LinkSwift; "C:\Program Files (x86)\LinkSwift\updateLinkSwift.exe" [x]
S2 Util LinkSwift; "C:\Program Files (x86)\LinkSwift\bin\utilLinkSwift.exe" [x]

C:\Program Files (x86)\WebSparkle
C:\Program Files (x86)\LinkSwift
2013-12-12 11:24 - 2013-11-25 08:44 - 01958440 _____ (Farbar) C:\Users\Karek\Desktop\FRST64(1).exe
C:\Users\Karek\AppData\Local\Temp\04016ceb-d861-48ef-b5f7-5a10f233f36b.exe
C:\Users\Karek\AppData\Local\Temp\4b7f0143-219e-4ac7-afd2-564bc83b9869.exe
C:\Users\Karek\AppData\Local\Temp\AskPIP_FF_.exe
C:\Users\Karek\AppData\Local\Temp\Suitcase Fusion 4 v15.0.6.exe

Hosts:
CMD: shutdown /r /f /t 2

End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
karelsoucek
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 25 Lis 2013 09:20

Re: Problém s malware

#12 Příspěvek od karelsoucek »

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-11-2013
Ran by Karek at 2013-12-12 13:07:35 Run:1
Running from C:\Users\Karek\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20551328 2013-10-21] (Skype Technologies S.A.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
SearchScopes: HKCU - {308B62F7-D79F-43D0-92BC-9038C1ABD37E} URL = http://search.yahoo.com/search?p={searc ... type=10511
SearchScopes: HKCU - {62ED6765-EF63-4546-94FA-C2551C04DF8C} URL = http://search.yahoo.com/search?p={searc ... type=10513
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

FF NewTab: file:///C:\\Users\\Karek\\AppData\\Local\\TNT2\\Common\\pinnedSearch.htm
FF DefaultSearchEngine: SecureSearch
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: SecureSearch
FF Homepage: hxxp://securedsearch2.lavasoft.com/inde ... 52726A7D54
FF Keyword.URL: hxxp://securedsearch2.lavasoft.com/resu ... &ent=bs&q=
FF Extension: toolbar_ORJ-V7 - C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\toolbar_ORJ-V7@apn.ask.com.xpi

CHR HKLM-x32\...\Chrome\Extension: [ikgojpdbiniccokkgadmdheobjfdbbcg] - C:\Program Files (x86)\WebSparkle\ikgojpdbiniccokkgadmdheobjfdbbcg.crx

R2 Update WebSparkle; C:\Program Files (x86)\WebSparkle\updateWebSparkle.exe [65312 2013-10-04] (WebSparkle)
R2 Util WebSparkle; C:\Program Files (x86)\WebSparkle\bin\utilWebSparkle.exe [65312 2013-10-17] (WebSparkle)
S2 Update LinkSwift; "C:\Program Files (x86)\LinkSwift\updateLinkSwift.exe" [x]
S2 Util LinkSwift; "C:\Program Files (x86)\LinkSwift\bin\utilLinkSwift.exe" [x]

C:\Program Files (x86)\WebSparkle
C:\Program Files (x86)\LinkSwift
2013-12-12 11:24 - 2013-11-25 08:44 - 01958440 _____ (Farbar) C:\Users\Karek\Desktop\FRST64(1).exe
C:\Users\Karek\AppData\Local\Temp\04016ceb-d861-48ef-b5f7-5a10f233f36b.exe
C:\Users\Karek\AppData\Local\Temp\4b7f0143-219e-4ac7-afd2-564bc83b9869.exe
C:\Users\Karek\AppData\Local\Temp\AskPIP_FF_.exe
C:\Users\Karek\AppData\Local\Temp\Suitcase Fusion 4 v15.0.6.exe

Hosts:
CMD: shutdown /r /f /t 2

End
*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeAAMUpdater-1.0 => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Skype => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\BCSSync => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SwitchBoard => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\AdobeCS6ServiceManager => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{308B62F7-D79F-43D0-92BC-9038C1ABD37E} => Key deleted successfully.
HKCR\CLSID\{308B62F7-D79F-43D0-92BC-9038C1ABD37E} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{62ED6765-EF63-4546-94FA-C2551C04DF8C} => Key deleted successfully.
HKCR\CLSID\{62ED6765-EF63-4546-94FA-C2551C04DF8C} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => Value deleted successfully.
HKCR\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => Key not found.
Firefox newtab deleted successfully.

========================= FF NewTab: file:///C:\\Users\\Karek\\AppData\\Local\\TNT2\\Common\\pinnedSearch.htm ========================

"FF NewTab: ///C:\\Users\\Karek\\AppData\\Local\\TNT2\\Common\\pinnedSearch.htm" not found.
====== End Of File: ======

Firefox DefaultSearchEngine deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox homepage deleted successfully.
Firefox Keyword.URL deleted successfully.
C:\Users\Karek\AppData\Roaming\Mozilla\Firefox\Profiles\bo3ol8i2.default\Extensions\toolbar_ORJ-V7@apn.ask.com.xpi => Moved successfully.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ikgojpdbiniccokkgadmdheobjfdbbcg => Key deleted successfully.
C:\Program Files (x86)\WebSparkle\ikgojpdbiniccokkgadmdheobjfdbbcg.crx => Moved successfully.
Update WebSparkle => Service deleted successfully.
Util WebSparkle => Service deleted successfully.
Update LinkSwift => Service deleted successfully.
Util LinkSwift => Service deleted successfully.
C:\Program Files (x86)\WebSparkle => Moved successfully.
"C:\Program Files (x86)\LinkSwift" => File/Directory not found.
C:\Users\Karek\Desktop\FRST64(1).exe => Moved successfully.
C:\Users\Karek\AppData\Local\Temp\04016ceb-d861-48ef-b5f7-5a10f233f36b.exe => Moved successfully.
C:\Users\Karek\AppData\Local\Temp\4b7f0143-219e-4ac7-afd2-564bc83b9869.exe => Moved successfully.
C:\Users\Karek\AppData\Local\Temp\AskPIP_FF_.exe => Moved successfully.
C:\Users\Karek\AppData\Local\Temp\Suitcase Fusion 4 v15.0.6.exe => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

========= shutdown /r /f /t 2 =========


========= End of CMD: =========



The system needs a manual reboot.

==== End of Fixlog ====
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s malware

#13 Příspěvek od vyosek »

Jak se chova PC :???:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
karelsoucek
Návštěvník
Návštěvník
Příspěvky: 20
Registrován: 25 Lis 2013 09:20

Re: Problém s malware

#14 Příspěvek od karelsoucek »

problém pořád přetrvává - jen když jsem v pátek provedl všechny úkony, tak mi ze dvou vyskakujících oken reklamy přestalo jedno okno vyskakovat.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Problém s malware

#15 Příspěvek od vyosek »

:arrow: Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
:arrow: Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
  • Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
  • Pokud mate Win XP spustte pod uctem Spravce\Administratora
  • Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
  • Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
  • Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
  • Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
  • Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
  • Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
  • Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Odpovědět

Vrátit se na „Řešení problémů, logy“