Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Prosím o kontrolu logu.

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Milousek66
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 04 kvě 2012 15:45

Prosím o kontrolu logu.

#1 Příspěvek od Milousek66 »

Zdravím. Někde se mě, nebo zbytku rodinky "podařilo" natáhnout do počítače virus : ...Policie, máte zablokovaný počítač... Našel jsem na netu nějaké návody na odstranění toho šmejda a pokusil jsem se to odstranit. Ale vzhledem k tomu, že nejsem žádný expert přes IT, tak mi asi v počítači něco zůstalo. Občas mi na monitoru během surfování vyskočí okno, které je tmavé a nic tam není... :boxed: Prosím o kontorlu logu a případně i pomoc. Předem děkuji.
.....................................................................................................................................................................

Logfile of random's system information tool 1.08 (written by random/random)
Run by Milan at 2013-11-27 18:23:51
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 822 GB (86%) free of 954 GB
Total RAM: 6126 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:23:54, on 27.11.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16428)
Boot mode: Normal

Running processes:
C:\Windows\PixArt\PAP7501\GUCI_AVS.exe
C:\Windows\PixArt\PAP7501\PACTray.exe
C:\Program Files (x86)\Samsung\Kies\Kies.exe
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
C:\Program Files\trend micro\Milan.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/?clid=12454
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
O4 - HKCU\..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Users\Milan\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WebcamMaxAutoRun] "C:\Program Files (x86)\WebcamMax\wcmmon.exe" -a
O4 - HKCU\..\Run: [OfficeSyncProcess] "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9466 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-0ee282a3-5779-4217-85dd-81667f789364 -SystemEventPortName:HostProcess-d9d8c210-1dea-4f98-95e5-e18f463ab2bd -IoCancelEventPortName:HostProcess-ba775d56-1f9d-4db5-ad21-5ca5e6c7b390 -NonStateChangingEventPortName:HostProcess-0647ac67-1278-4314-a082-e554160e9bce -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:15be2482-b534-4847-bdee-af3374a7602b -DeviceGroupId:WpdFsGroup
"C:\Windows\system32\Dwm.exe"
"taskhost.exe"
C:\Windows\Explorer.EXE
"C:\Windows\System32\igfxtray.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Windows\PixArt\PAP7501\GUCI_AVS.exe"
"C:\Windows\PixArt\PAP7501\PACTray.exe"
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
"C:\Program Files (x86)\Samsung\Kies\Kies.exe" /preload
"C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe"
"C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
"C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" -r
"C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\system32\wbem\wmiprvse.exe
taskeng.exe {5EC23232-3D52-45D4-90D5-A8333297A99A}
taskeng.exe {59288C39-1BA1-437A-8A1A-B6071310B2DF}
"C:\Users\Milan\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-954854046-3235366559-1486098670-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-954854046-3235366559-1486098670-1000UA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2013-03-08 6669000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-03-08 4171464]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2011-03-26 167960]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2011-03-26 391704]
"Persistence"=C:\Windows\system32\igfxpers.exe [2011-03-26 418840]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2013-10-23 1266912]
"GUCI_AVS"=C:\Windows\PixArt\PAP7501\GUCI_AVS.exe [2007-12-10 323584]
"PACTray"=C:\Windows\PixArt\PAP7501\PACTray.exe [2009-07-10 319488]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"KiesPDLR"=C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2013-03-28 1106288]
"KiesPreload"=C:\Program Files (x86)\Samsung\Kies\Kies.exe [2013-03-28 1511792]
""=C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [2013-03-28 1106288]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-10-21 20549280]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-03-14 3672640]
"Google Update"=C:\Users\Milan\AppData\Local\Google\Update\GoogleUpdate.exe [2013-05-13 116648]
"WebcamMaxAutoRun"=C:\Program Files (x86)\WebcamMax\wcmmon.exe [2011-07-17 1038848]
"OfficeSyncProcess"=C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2013-04-22 720064]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"=C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2010-08-11 2472048]
"KiesTrayAgent"=C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [2013-03-28 310640]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-10-11 59280]
"seznam-listicka-distribuce"=C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [2013-03-21 1061960]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2013-05-01 421888]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2012-11-05 89184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-03-25 385024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2013-03-08 6669000]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-03-08 4171464]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2013-11-27 17:14:50 ----D---- C:\Windows\Migration
2013-11-13 13:59:02 ----D---- C:\Users\Milan\AppData\Roaming\Malwarebytes
2013-11-13 13:58:46 ----D---- C:\ProgramData\Malwarebytes
2013-11-13 13:57:33 ----A---- C:\TDSSKiller.2.8.16.0_13.11.2013_13.57.33_log.txt
2013-11-13 13:53:40 ----D---- C:\AdwCleaner
2013-11-13 10:21:25 ----A---- C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-11-13 10:21:23 ----A---- C:\Windows\SYSWOW64\wksprtPS.dll
2013-11-13 10:21:23 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2013-11-13 10:21:23 ----A---- C:\Windows\SYSWOW64\mstsc.exe
2013-11-13 10:21:23 ----A---- C:\Windows\SYSWOW64\MsRdpWebAccess.dll
2013-11-13 10:21:23 ----A---- C:\Windows\system32\wksprtPS.dll
2013-11-13 10:21:23 ----A---- C:\Windows\system32\wksprt.exe
2013-11-13 10:21:23 ----A---- C:\Windows\system32\TSWbPrxy.exe
2013-11-13 10:21:23 ----A---- C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-11-13 10:21:23 ----A---- C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-11-13 10:21:23 ----A---- C:\Windows\system32\tsgqec.dll
2013-11-13 10:21:23 ----A---- C:\Windows\system32\MsRdpWebAccess.dll
2013-11-13 10:21:23 ----A---- C:\Windows\system32\drivers\TsUsbFlt.sys
2013-11-13 10:21:22 ----A---- C:\Windows\SYSWOW64\rdvidcrl.dll
2013-11-13 10:21:22 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2013-11-13 10:21:22 ----A---- C:\Windows\system32\rdvidcrl.dll
2013-11-13 10:21:22 ----A---- C:\Windows\system32\mstscax.dll
2013-11-13 10:21:22 ----A---- C:\Windows\system32\mstsc.exe
2013-11-13 10:20:31 ----A---- C:\Windows\SYSWOW64\TSWorkspace.dll
2013-11-13 10:20:31 ----A---- C:\Windows\system32\TSWorkspace.dll
2013-11-13 10:14:37 ----A---- C:\Windows\system32\IEUDINIT.EXE
2013-11-13 10:11:44 ----A---- C:\Windows\SYSWOW64\elshyph.dll
2013-11-13 10:11:44 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\wextract.exe
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\url.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\pngfilt.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\msrating.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\msls31.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\licmgr10.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\jsIntl.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\inseng.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\iexpress.exe
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\icardie.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2013-11-13 10:11:41 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2013-11-13 10:11:41 ----A---- C:\Windows\system32\elshyph.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\SetIEInstalledDate.exe
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\occache.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\mshtmler.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\mshta.exe
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\msfeedssync.exe
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\msfeedsbs.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\imgutil.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\iepeers.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2013-11-13 10:11:40 ----A---- C:\Windows\SYSWOW64\IEAdvpack.dll
2013-11-13 10:11:40 ----A---- C:\Windows\system32\wininet.dll
2013-11-13 10:11:40 ----A---- C:\Windows\system32\urlmon.dll
2013-11-13 10:11:40 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-13 10:11:40 ----A---- C:\Windows\system32\msrating.dll
2013-11-13 10:11:40 ----A---- C:\Windows\system32\msls31.dll
2013-11-13 10:11:40 ----A---- C:\Windows\system32\msfeedssync.exe
2013-11-13 10:11:40 ----A---- C:\Windows\system32\msfeedsbs.dll
2013-11-13 10:11:40 ----A---- C:\Windows\system32\jsproxy.dll
2013-11-13 10:11:40 ----A---- C:\Windows\system32\jsIntl.dll
2013-11-13 10:11:40 ----A---- C:\Windows\system32\iertutil.dll
2013-11-13 10:11:40 ----A---- C:\Windows\system32\IEAdvpack.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\wextract.exe
2013-11-13 10:11:39 ----A---- C:\Windows\system32\webcheck.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\vbscript.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\url.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2013-11-13 10:11:39 ----A---- C:\Windows\system32\pngfilt.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\occache.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\mshtmlmedia.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\mshtmler.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\mshtmled.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\MshtmlDac.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\mshtml.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\mshta.exe
2013-11-13 10:11:39 ----A---- C:\Windows\system32\msfeeds.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\licmgr10.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\jscript9diag.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\jscript9.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\jscript.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\inseng.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\imgutil.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\iexpress.exe
2013-11-13 10:11:39 ----A---- C:\Windows\system32\ieUnatt.exe
2013-11-13 10:11:39 ----A---- C:\Windows\system32\ieui.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\iesysprep.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\iesetup.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\iernonce.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\iepeers.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\ieframe.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\ieetwproxystub.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\ieetwcollector.exe
2013-11-13 10:11:39 ----A---- C:\Windows\system32\iedkcs32.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\ieapfltr.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\ie4uinit.exe
2013-11-13 10:11:39 ----A---- C:\Windows\system32\icardie.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\dxtrans.dll
2013-11-13 10:11:39 ----A---- C:\Windows\system32\dxtmsft.dll
2013-11-13 10:00:43 ----A---- C:\Windows\system32\schannel.dll
2013-11-13 10:00:42 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2013-11-13 10:00:42 ----A---- C:\Windows\SYSWOW64\schannel.dll
2013-11-13 10:00:42 ----A---- C:\Windows\SYSWOW64\secur32.dll
2013-11-13 10:00:42 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2013-11-13 10:00:42 ----A---- C:\Windows\system32\sspisrv.dll
2013-11-13 10:00:42 ----A---- C:\Windows\system32\sspicli.dll
2013-11-13 10:00:42 ----A---- C:\Windows\system32\secur32.dll
2013-11-13 10:00:42 ----A---- C:\Windows\system32\ncrypt.dll
2013-11-13 10:00:42 ----A---- C:\Windows\system32\lsass.exe
2013-11-13 10:00:42 ----A---- C:\Windows\system32\lsasrv.dll
2013-11-13 10:00:42 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2013-11-13 10:00:42 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2013-11-13 10:00:42 ----A---- C:\Windows\system32\drivers\cng.sys
2013-11-13 10:00:41 ----A---- C:\Windows\SYSWOW64\SmartcardCredentialProvider.dll
2013-11-13 10:00:41 ----A---- C:\Windows\SYSWOW64\credui.dll
2013-11-13 10:00:41 ----A---- C:\Windows\SYSWOW64\authui.dll
2013-11-13 10:00:41 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 10:00:41 ----A---- C:\Windows\system32\credui.dll
2013-11-13 10:00:41 ----A---- C:\Windows\system32\authui.dll
2013-11-13 10:00:35 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2013-11-13 10:00:35 ----A---- C:\Windows\system32\crypt32.dll
2013-11-13 10:00:33 ----A---- C:\Windows\system32\drivers\afd.sys
2013-11-13 10:00:32 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2013-11-13 10:00:32 ----A---- C:\Windows\system32\gdi32.dll
2013-11-13 09:59:54 ----A---- C:\Windows\SYSWOW64\nshwfp.dll
2013-11-13 09:59:54 ----A---- C:\Windows\SYSWOW64\FWPUCLNT.DLL
2013-11-13 09:59:54 ----A---- C:\Windows\system32\nshwfp.dll
2013-11-13 09:59:54 ----A---- C:\Windows\system32\IKEEXT.DLL
2013-11-13 09:59:54 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2013-10-28 14:12:47 ----D---- C:\Users\Milan\AppData\Roaming\Wargaming.net
2013-10-28 13:45:22 ----A---- C:\Windows\SYSWOW64\XAudio2_7.dll
2013-10-28 13:45:22 ----A---- C:\Windows\SYSWOW64\XAPOFX1_5.dll
2013-10-28 13:45:22 ----A---- C:\Windows\system32\XAudio2_7.dll
2013-10-28 13:45:22 ----A---- C:\Windows\system32\XAPOFX1_5.dll
2013-10-28 13:45:21 ----A---- C:\Windows\SYSWOW64\xactengine3_7.dll
2013-10-28 13:45:21 ----A---- C:\Windows\SYSWOW64\d3dcsx_43.dll
2013-10-28 13:45:21 ----A---- C:\Windows\SYSWOW64\D3DCompiler_43.dll
2013-10-28 13:45:21 ----A---- C:\Windows\system32\xactengine3_7.dll
2013-10-28 13:45:21 ----A---- C:\Windows\system32\d3dcsx_43.dll
2013-10-28 13:45:21 ----A---- C:\Windows\system32\D3DCompiler_43.dll
2013-10-28 13:45:20 ----A---- C:\Windows\SYSWOW64\XAudio2_6.dll
2013-10-28 13:45:20 ----A---- C:\Windows\SYSWOW64\XAPOFX1_4.dll
2013-10-28 13:45:20 ----A---- C:\Windows\SYSWOW64\D3DX9_43.dll
2013-10-28 13:45:20 ----A---- C:\Windows\SYSWOW64\d3dx11_43.dll
2013-10-28 13:45:20 ----A---- C:\Windows\SYSWOW64\d3dx10_43.dll
2013-10-28 13:45:20 ----A---- C:\Windows\system32\XAudio2_6.dll
2013-10-28 13:45:20 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2013-10-28 13:45:20 ----A---- C:\Windows\system32\D3DX9_43.dll
2013-10-28 13:45:20 ----A---- C:\Windows\system32\d3dx11_43.dll
2013-10-28 13:45:20 ----A---- C:\Windows\system32\d3dx10_43.dll
2013-10-28 13:45:19 ----A---- C:\Windows\SYSWOW64\XAudio2_5.dll
2013-10-28 13:45:19 ----A---- C:\Windows\SYSWOW64\xactengine3_6.dll
2013-10-28 13:45:19 ----A---- C:\Windows\SYSWOW64\X3DAudio1_7.dll
2013-10-28 13:45:19 ----A---- C:\Windows\system32\XAudio2_5.dll
2013-10-28 13:45:19 ----A---- C:\Windows\system32\xactengine3_6.dll
2013-10-28 13:45:19 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2013-10-28 13:45:18 ----A---- C:\Windows\SYSWOW64\xactengine3_5.dll
2013-10-28 13:45:18 ----A---- C:\Windows\SYSWOW64\D3DCompiler_42.dll
2013-10-28 13:45:18 ----A---- C:\Windows\system32\xactengine3_5.dll
2013-10-28 13:45:18 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2013-10-28 13:45:17 ----A---- C:\Windows\SYSWOW64\d3dx11_42.dll
2013-10-28 13:45:17 ----A---- C:\Windows\SYSWOW64\d3dx10_42.dll
2013-10-28 13:45:17 ----A---- C:\Windows\SYSWOW64\d3dcsx_42.dll
2013-10-28 13:45:17 ----A---- C:\Windows\system32\d3dx11_42.dll
2013-10-28 13:45:17 ----A---- C:\Windows\system32\d3dx10_42.dll
2013-10-28 13:45:17 ----A---- C:\Windows\system32\d3dcsx_42.dll
2013-10-28 13:45:16 ----A---- C:\Windows\SYSWOW64\D3DX9_42.dll
2013-10-28 13:45:16 ----A---- C:\Windows\SYSWOW64\D3DX9_41.dll
2013-10-28 13:45:16 ----A---- C:\Windows\SYSWOW64\d3dx10_41.dll
2013-10-28 13:45:16 ----A---- C:\Windows\SYSWOW64\D3DCompiler_41.dll
2013-10-28 13:45:16 ----A---- C:\Windows\system32\D3DX9_42.dll
2013-10-28 13:45:16 ----A---- C:\Windows\system32\D3DX9_41.dll
2013-10-28 13:45:16 ----A---- C:\Windows\system32\d3dx10_41.dll
2013-10-28 13:45:16 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2013-10-28 13:45:15 ----A---- C:\Windows\SYSWOW64\XAudio2_4.dll
2013-10-28 13:45:15 ----A---- C:\Windows\SYSWOW64\XAPOFX1_3.dll
2013-10-28 13:45:15 ----A---- C:\Windows\SYSWOW64\xactengine3_4.dll
2013-10-28 13:45:15 ----A---- C:\Windows\SYSWOW64\X3DAudio1_6.dll
2013-10-28 13:45:15 ----A---- C:\Windows\system32\XAudio2_4.dll
2013-10-28 13:45:15 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2013-10-28 13:45:15 ----A---- C:\Windows\system32\xactengine3_4.dll
2013-10-28 13:45:15 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2013-10-28 13:45:14 ----A---- C:\Windows\SYSWOW64\D3DX9_40.dll
2013-10-28 13:45:14 ----A---- C:\Windows\SYSWOW64\d3dx10_40.dll
2013-10-28 13:45:14 ----A---- C:\Windows\SYSWOW64\D3DCompiler_40.dll
2013-10-28 13:45:14 ----A---- C:\Windows\system32\D3DX9_40.dll
2013-10-28 13:45:14 ----A---- C:\Windows\system32\d3dx10_40.dll
2013-10-28 13:45:14 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2013-10-28 13:45:13 ----A---- C:\Windows\SYSWOW64\XAudio2_3.dll
2013-10-28 13:45:13 ----A---- C:\Windows\SYSWOW64\XAPOFX1_2.dll
2013-10-28 13:45:13 ----A---- C:\Windows\system32\XAudio2_3.dll
2013-10-28 13:45:13 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2013-10-28 13:45:12 ----A---- C:\Windows\SYSWOW64\xactengine3_3.dll
2013-10-28 13:45:12 ----A---- C:\Windows\SYSWOW64\X3DAudio1_5.dll
2013-10-28 13:45:12 ----A---- C:\Windows\system32\xactengine3_3.dll
2013-10-28 13:45:12 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2013-10-28 13:45:11 ----A---- C:\Windows\SYSWOW64\XAudio2_2.dll
2013-10-28 13:45:11 ----A---- C:\Windows\SYSWOW64\XAPOFX1_1.dll
2013-10-28 13:45:11 ----A---- C:\Windows\SYSWOW64\xactengine3_2.dll
2013-10-28 13:45:11 ----A---- C:\Windows\system32\XAudio2_2.dll
2013-10-28 13:45:11 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2013-10-28 13:45:11 ----A---- C:\Windows\system32\xactengine3_2.dll
2013-10-28 13:45:10 ----A---- C:\Windows\SYSWOW64\XAudio2_1.dll
2013-10-28 13:45:10 ----A---- C:\Windows\SYSWOW64\XAPOFX1_0.dll
2013-10-28 13:45:10 ----A---- C:\Windows\SYSWOW64\D3DX9_39.dll
2013-10-28 13:45:10 ----A---- C:\Windows\SYSWOW64\d3dx10_39.dll
2013-10-28 13:45:10 ----A---- C:\Windows\SYSWOW64\D3DCompiler_39.dll
2013-10-28 13:45:10 ----A---- C:\Windows\system32\XAudio2_1.dll
2013-10-28 13:45:10 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2013-10-28 13:45:10 ----A---- C:\Windows\system32\D3DX9_39.dll
2013-10-28 13:45:10 ----A---- C:\Windows\system32\d3dx10_39.dll
2013-10-28 13:45:10 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2013-10-28 13:45:09 ----A---- C:\Windows\SYSWOW64\xactengine3_1.dll
2013-10-28 13:45:09 ----A---- C:\Windows\SYSWOW64\X3DAudio1_4.dll
2013-10-28 13:45:09 ----A---- C:\Windows\system32\xactengine3_1.dll
2013-10-28 13:45:09 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2013-10-28 13:45:08 ----A---- C:\Windows\SYSWOW64\D3DX9_38.dll
2013-10-28 13:45:08 ----A---- C:\Windows\SYSWOW64\d3dx10_38.dll
2013-10-28 13:45:08 ----A---- C:\Windows\SYSWOW64\D3DCompiler_38.dll
2013-10-28 13:45:08 ----A---- C:\Windows\system32\D3DX9_38.dll
2013-10-28 13:45:08 ----A---- C:\Windows\system32\d3dx10_38.dll
2013-10-28 13:45:08 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2013-10-28 13:45:07 ----A---- C:\Windows\SYSWOW64\XAudio2_0.dll
2013-10-28 13:45:07 ----A---- C:\Windows\SYSWOW64\xactengine3_0.dll
2013-10-28 13:45:07 ----A---- C:\Windows\SYSWOW64\X3DAudio1_3.dll
2013-10-28 13:45:07 ----A---- C:\Windows\system32\XAudio2_0.dll
2013-10-28 13:45:07 ----A---- C:\Windows\system32\xactengine3_0.dll
2013-10-28 13:45:07 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2013-10-28 13:45:06 ----A---- C:\Windows\SYSWOW64\D3DX9_37.dll
2013-10-28 13:45:06 ----A---- C:\Windows\SYSWOW64\d3dx10_37.dll
2013-10-28 13:45:06 ----A---- C:\Windows\SYSWOW64\D3DCompiler_37.dll
2013-10-28 13:45:06 ----A---- C:\Windows\system32\D3DX9_37.dll
2013-10-28 13:45:06 ----A---- C:\Windows\system32\d3dx10_37.dll
2013-10-28 13:45:06 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2013-10-28 13:45:05 ----A---- C:\Windows\SYSWOW64\xactengine2_10.dll
2013-10-28 13:45:05 ----A---- C:\Windows\SYSWOW64\d3dx10_36.dll
2013-10-28 13:45:05 ----A---- C:\Windows\SYSWOW64\D3DCompiler_36.dll
2013-10-28 13:45:05 ----A---- C:\Windows\system32\xactengine2_10.dll
2013-10-28 13:45:05 ----A---- C:\Windows\system32\d3dx10_36.dll
2013-10-28 13:45:05 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2013-10-28 13:45:04 ----A---- C:\Windows\SYSWOW64\d3dx9_36.dll
2013-10-28 13:45:04 ----A---- C:\Windows\system32\d3dx9_36.dll
2013-10-28 13:45:03 ----A---- C:\Windows\SYSWOW64\xactengine2_9.dll
2013-10-28 13:45:03 ----A---- C:\Windows\SYSWOW64\d3dx10_35.dll
2013-10-28 13:45:03 ----A---- C:\Windows\SYSWOW64\D3DCompiler_35.dll
2013-10-28 13:45:03 ----A---- C:\Windows\system32\xactengine2_9.dll
2013-10-28 13:45:03 ----A---- C:\Windows\system32\d3dx10_35.dll
2013-10-28 13:45:03 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2013-10-28 13:45:02 ----A---- C:\Windows\SYSWOW64\xactengine2_8.dll
2013-10-28 13:45:02 ----A---- C:\Windows\SYSWOW64\X3DAudio1_2.dll
2013-10-28 13:45:02 ----A---- C:\Windows\SYSWOW64\d3dx9_35.dll
2013-10-28 13:45:02 ----A---- C:\Windows\SYSWOW64\d3dx10_34.dll
2013-10-28 13:45:02 ----A---- C:\Windows\SYSWOW64\D3DCompiler_34.dll
2013-10-28 13:45:02 ----A---- C:\Windows\system32\xactengine2_8.dll
2013-10-28 13:45:02 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2013-10-28 13:45:02 ----A---- C:\Windows\system32\d3dx9_35.dll
2013-10-28 13:45:02 ----A---- C:\Windows\system32\d3dx10_34.dll
2013-10-28 13:45:02 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2013-10-28 13:45:01 ----A---- C:\Windows\SYSWOW64\xinput1_3.dll
2013-10-28 13:45:01 ----A---- C:\Windows\SYSWOW64\d3dx9_34.dll
2013-10-28 13:45:01 ----A---- C:\Windows\system32\xinput1_3.dll
2013-10-28 13:45:01 ----A---- C:\Windows\system32\d3dx9_34.dll
2013-10-28 13:45:00 ----A---- C:\Windows\SYSWOW64\xactengine2_7.dll
2013-10-28 13:45:00 ----A---- C:\Windows\SYSWOW64\d3dx9_33.dll
2013-10-28 13:45:00 ----A---- C:\Windows\SYSWOW64\d3dx10_33.dll
2013-10-28 13:45:00 ----A---- C:\Windows\SYSWOW64\D3DCompiler_33.dll
2013-10-28 13:45:00 ----A---- C:\Windows\system32\xactengine2_7.dll
2013-10-28 13:45:00 ----A---- C:\Windows\system32\d3dx9_33.dll
2013-10-28 13:45:00 ----A---- C:\Windows\system32\d3dx10_33.dll
2013-10-28 13:45:00 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2013-10-28 13:44:59 ----A---- C:\Windows\SYSWOW64\xactengine2_6.dll
2013-10-28 13:44:59 ----A---- C:\Windows\system32\xactengine2_6.dll
2013-10-28 13:44:58 ----A---- C:\Windows\SYSWOW64\xactengine2_5.dll
2013-10-28 13:44:58 ----A---- C:\Windows\SYSWOW64\xactengine2_4.dll
2013-10-28 13:44:58 ----A---- C:\Windows\SYSWOW64\x3daudio1_1.dll
2013-10-28 13:44:58 ----A---- C:\Windows\SYSWOW64\d3dx10.dll
2013-10-28 13:44:58 ----A---- C:\Windows\system32\xactengine2_5.dll
2013-10-28 13:44:58 ----A---- C:\Windows\system32\xactengine2_4.dll
2013-10-28 13:44:58 ----A---- C:\Windows\system32\x3daudio1_1.dll
2013-10-28 13:44:58 ----A---- C:\Windows\system32\d3dx10.dll
2013-10-28 13:44:57 ----A---- C:\Windows\SYSWOW64\xinput1_2.dll
2013-10-28 13:44:57 ----A---- C:\Windows\SYSWOW64\xactengine2_3.dll
2013-10-28 13:44:57 ----A---- C:\Windows\SYSWOW64\d3dx9_31.dll
2013-10-28 13:44:57 ----A---- C:\Windows\system32\xinput1_2.dll
2013-10-28 13:44:57 ----A---- C:\Windows\system32\xactengine2_3.dll
2013-10-28 13:44:57 ----A---- C:\Windows\system32\d3dx9_31.dll
2013-10-28 13:44:56 ----A---- C:\Windows\SYSWOW64\xinput1_1.dll
2013-10-28 13:44:56 ----A---- C:\Windows\SYSWOW64\xactengine2_2.dll
2013-10-28 13:44:56 ----A---- C:\Windows\system32\xinput1_1.dll
2013-10-28 13:44:56 ----A---- C:\Windows\system32\xactengine2_2.dll
2013-10-28 13:44:55 ----A---- C:\Windows\SYSWOW64\xactengine2_1.dll
2013-10-28 13:44:55 ----A---- C:\Windows\system32\xactengine2_1.dll
2013-10-28 13:44:52 ----A---- C:\Windows\SYSWOW64\d3dx9_30.dll
2013-10-28 13:44:52 ----A---- C:\Windows\system32\d3dx9_30.dll
2013-10-28 13:44:51 ----A---- C:\Windows\SYSWOW64\xactengine2_0.dll
2013-10-28 13:44:51 ----A---- C:\Windows\SYSWOW64\x3daudio1_0.dll
2013-10-28 13:44:51 ----A---- C:\Windows\SYSWOW64\d3dx9_29.dll
2013-10-28 13:44:51 ----A---- C:\Windows\system32\xactengine2_0.dll
2013-10-28 13:44:51 ----A---- C:\Windows\system32\x3daudio1_0.dll
2013-10-28 13:44:51 ----A---- C:\Windows\system32\d3dx9_29.dll
2013-10-28 13:44:50 ----A---- C:\Windows\SYSWOW64\d3dx9_28.dll
2013-10-28 13:44:50 ----A---- C:\Windows\SYSWOW64\d3dx9_27.dll
2013-10-28 13:44:50 ----A---- C:\Windows\SYSWOW64\d3dx9_26.dll
2013-10-28 13:44:50 ----A---- C:\Windows\system32\d3dx9_28.dll
2013-10-28 13:44:50 ----A---- C:\Windows\system32\d3dx9_27.dll
2013-10-28 13:44:50 ----A---- C:\Windows\system32\d3dx9_26.dll
2013-10-28 13:44:49 ----A---- C:\Windows\SYSWOW64\d3dx9_25.dll
2013-10-28 13:44:49 ----A---- C:\Windows\SYSWOW64\d3dx9_24.dll
2013-10-28 13:44:49 ----A---- C:\Windows\system32\d3dx9_25.dll
2013-10-28 13:44:49 ----A---- C:\Windows\system32\d3dx9_24.dll
2013-10-28 13:43:50 ----HD---- C:\Windows\msdownld.tmp
2013-10-28 13:43:49 ----D---- C:\Windows\SYSWOW64\directx
2013-10-28 13:43:44 ----D---- C:\Games

======List of files/folders modified in the last 1 months======

2013-11-27 18:23:52 ----D---- C:\Program Files\trend micro
2013-11-27 18:22:48 ----D---- C:\Windows\Temp
2013-11-27 18:22:48 ----D---- C:\Windows\inf
2013-11-27 18:22:48 ----D---- C:\Windows
2013-11-27 17:33:36 ----D---- C:\Windows\system32\config
2013-11-27 17:25:44 ----D---- C:\Windows\System32
2013-11-27 17:25:44 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-11-27 17:20:26 ----D---- C:\Users\Milan\AppData\Roaming\Skype
2013-11-27 17:19:28 ----SHD---- C:\Config.Msi
2013-11-27 17:18:26 ----SHD---- C:\Windows\Installer
2013-11-27 17:18:25 ----D---- C:\Windows\Microsoft.NET
2013-11-27 17:17:11 ----RSD---- C:\Windows\assembly
2013-11-27 17:16:47 ----D---- C:\Windows\Prefetch
2013-11-27 17:16:08 ----D---- C:\Windows\SysWOW64
2013-11-27 17:16:08 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2013-11-27 17:14:58 ----D---- C:\Windows\SYSWOW64\en-US
2013-11-27 17:14:58 ----D---- C:\Windows\system32\en-US
2013-11-27 17:14:50 ----SD---- C:\ProgramData\Microsoft
2013-11-27 17:13:26 ----SHD---- C:\System Volume Information
2013-11-27 09:31:46 ----D---- C:\Windows\system32\drivers
2013-11-27 09:22:21 ----D---- C:\Windows\SoftwareDistribution
2013-11-19 11:21:41 ----N---- C:\Windows\system32\MpSigStub.exe
2013-11-18 06:25:31 ----D---- C:\Windows\system32\catroot2
2013-11-18 06:23:40 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-17 09:14:08 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-11-17 09:12:11 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-11-14 08:19:02 ----D---- C:\Users\Milan\AppData\Roaming\Media Player Classic
2013-11-13 19:18:09 ----D---- C:\ProgramData\Skype
2013-11-13 19:18:07 ----RD---- C:\Program Files (x86)\Skype
2013-11-13 14:10:23 ----RD---- C:\Program Files (x86)
2013-11-13 13:58:46 ----HD---- C:\ProgramData
2013-11-13 10:52:37 ----D---- C:\Windows\rescache
2013-11-13 10:28:43 ----D---- C:\Users\Milan\AppData\Roaming\Seznam.cz
2013-11-13 10:26:36 ----D---- C:\Windows\Panther
2013-11-13 10:26:34 ----D---- C:\Windows\Logs
2013-11-13 10:26:34 ----D---- C:\Windows\debug
2013-11-13 10:25:39 ----D---- C:\Program Files\CCleaner
2013-11-13 10:23:34 ----D---- C:\Windows\winsxs
2013-11-13 10:21:47 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-11-13 10:21:46 ----D---- C:\Windows\SYSWOW64\wbem
2013-11-13 10:21:46 ----D---- C:\Windows\system32\wbem
2013-11-13 10:21:46 ----D---- C:\Windows\system32\DriverStore
2013-11-13 10:21:46 ----D---- C:\Windows\system32\drivers\en-US
2013-11-13 10:21:46 ----D---- C:\Windows\system32\cs-CZ
2013-11-13 10:21:31 ----D---- C:\Windows\system32\catroot
2013-11-13 10:18:48 ----D---- C:\Users\Milan\AppData\Roaming\Mozilla
2013-11-13 10:15:05 ----D---- C:\Program Files (x86)\Internet Explorer
2013-11-13 10:15:04 ----D---- C:\Windows\SYSWOW64\migration
2013-11-13 10:15:04 ----D---- C:\Program Files\Internet Explorer
2013-11-13 10:15:03 ----D---- C:\Windows\system32\migration
2013-11-13 10:15:03 ----D---- C:\Windows\PolicyDefinitions
2013-11-13 10:10:33 ----D---- C:\Program Files\Microsoft Security Client
2013-11-13 10:10:32 ----D---- C:\Program Files (x86)\Microsoft Security Client
2013-11-13 10:04:53 ----D---- C:\ProgramData\Microsoft Help
2013-11-13 10:03:08 ----D---- C:\Windows\system32\MRT
2013-11-13 10:01:55 ----A---- C:\Windows\system32\MRT.exe
2013-11-13 09:53:24 ----D---- C:\Windows\Tasks
2013-11-13 09:53:24 ----D---- C:\Windows\system32\wfp
2013-11-13 09:52:22 ----D---- C:\Windows\AppCompat
2013-11-13 09:52:20 ----D---- C:\Windows\registration

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-09-27 248240]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 SiFilter;SATALink driver accelerator; C:\Windows\system32\drivers\SiWinAcc.sys [2007-10-03 22056]
R0 SiRemFil;SATALink External Device Filter; C:\Windows\system32\drivers\SiRemFil.sys [2007-10-03 17448]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-05-22 283200]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-09-27 134944]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-11-10 10567680]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-11-10 325632]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2011-06-06 231440]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service; C:\Windows\system32\drivers\viahduaa.sys [2010-08-04 1342064]
S3 cpuz130;cpuz130; \??\C:\Users\Milan\AppData\Local\Temp\cpuz130\cpuz_x64.sys []
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2013-02-22 102936]
S3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\SysWOW64\FsUsbExDisk.SYS [2013-03-20 37344]
S3 ggflt;SEMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2012-11-25 14448]
S3 ggsemc;SEMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsemc.sys [2012-11-25 27760]
S3 GUCI_AVS;Generic USB Controller Interface (AVS); C:\Windows\system32\DRIVERS\GUCI_AVS.sys [2009-11-06 597504]
S3 iaStor;iaStor; C:\Windows\system32\drivers\iaStor.sys [2010-09-13 437272]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2011-03-26 12262336]
S3 itecir;ITECIR Infrared Receiver; C:\Windows\system32\drivers\itecir.sys [2009-06-11 60416]
S3 JRAID;JRAID; C:\Windows\system32\drivers\jraid.sys [2010-09-07 121432]
S3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\drivers\ASACPI.sys [2009-07-16 15416]
S3 mv91cons;mv91cons; C:\Windows\system32\drivers\mv91cons.sys [2010-11-22 24880]
S3 mv91xx;mv91xx; C:\Windows\system32\drivers\mv91xx.sys [2010-11-22 303408]
S3 mv91xxr;mv91xxr; C:\Windows\system32\drivers\mv91xxr.sys [2010-10-21 302120]
S3 NmPar;MosChip PCI Parallel Port; C:\Windows\system32\drivers\NmPar.sys []
S3 nmserial;MosChip PCI Serial Port; C:\Windows\system32\drivers\nmserial.sys []
S3 nvsmu;nvsmu; C:\Windows\system32\drivers\nvsmu.sys [2010-03-22 29800]
S3 OxSer;OxSer; C:\Windows\system32\drivers\OxSer.sys [2009-05-26 98352]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-10-29 250984]
S3 SI3112;SI3112; C:\Windows\system32\drivers\SI3112.sys [2007-06-28 83496]
S3 SI3114;SI3114; C:\Windows\system32\drivers\SI3114.sys [2008-04-14 82984]
S3 Si3114r5;Si3114r5; C:\Windows\system32\drivers\Si3114r5.sys [2008-11-24 329256]
S3 SI3124;SI3124; C:\Windows\system32\drivers\SI3124.sys [2009-10-30 92200]
S3 Si3124r5;Si3124r5; C:\Windows\system32\drivers\Si3124r5.sys [2010-04-13 340008]
S3 SI3132;SI3132; C:\Windows\system32\drivers\SI3132.sys [2007-10-03 90664]
S3 Si3132r5;Si3132r5; C:\Windows\system32\drivers\Si3132r5.sys [2008-10-30 340520]
S3 Si3531;Si3531; C:\Windows\system32\drivers\Si3531.sys [2009-02-09 333864]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2013-02-22 203544]
S3 ssudobex;SAMSUNG Mobile USB OBEX Serial Port(DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudobex.sys [2013-08-20 204568]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 WinUSB;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-10 65640]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-11-10 204288]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-10-23 23808]
R2 Skype C2C Service;Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-10-09 3275136]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2013-10-23 348376]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-20 136176]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-09-05 171680]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-17 257416]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-20 136176]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2013-11-13 111616]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2013-03-08 30798512]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 Sony PC Companion;Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [2013-02-04 155824]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-09-08 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S4 BBSvc;Bing Bar Update Service; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
S4 BBUpdate;BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
S4 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-11-17 119408]
S4 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-10-13 935208]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119531
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Prosím o kontrolu logu.

#2 Příspěvek od Rudy »

Zdravím!
Dejte log ComboFix:
Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Milousek66
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 04 kvě 2012 15:45

Re: Prosím o kontrolu logu.

#3 Příspěvek od Milousek66 »

Log Combo Fix :
................................................

ComboFix 13-11-27.01 - Milan 28.11.2013 18:31:53.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.6126.4673 [GMT 1:00]
Spuštěný z: c:\users\Milan\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Milan\AppData\Roaming\Microsoft\Windows\Recent\Jak zbalyt kluka.URL
c:\windows\msvcr71.dll
c:\windows\SysWow64\FlashPlayerApp.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-10-28 do 2013-11-28 )))))))))))))))))))))))))))))))
.
.
2013-11-27 16:20 . 2013-11-08 03:12 10285968 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1F1F968B-88A9-4D71-BC0B-759E89070D94}\mpengine.dll
2013-11-27 16:14 . 2013-11-27 16:14 -------- d-----w- c:\windows\Migration
2013-11-27 16:13 . 2013-11-08 03:12 10285968 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-11-26 15:09 . 2013-11-27 08:20 -------- d-----w- c:\users\Milan\AppData\Local\CrashDumps
2013-11-13 12:59 . 2013-11-13 12:59 -------- d-----w- c:\users\Milan\AppData\Roaming\Malwarebytes
2013-11-13 12:58 . 2013-11-13 12:58 -------- d-----w- c:\programdata\Malwarebytes
2013-11-13 12:58 . 2013-11-13 12:58 -------- d-----w- c:\users\Milan\AppData\Local\Programs
2013-11-13 12:53 . 2013-11-13 12:54 -------- d-----w- C:\AdwCleaner
2013-11-13 09:20 . 2013-09-25 02:23 1030144 ----a-w- c:\windows\system32\TSWorkspace.dll
2013-11-13 09:20 . 2013-09-25 01:57 792576 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2013-11-13 09:14 . 2013-10-14 17:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-11-13 09:00 . 2013-09-25 02:22 340992 ----a-w- c:\windows\system32\schannel.dll
2013-11-13 08:59 . 2013-10-12 02:30 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-11-13 08:59 . 2013-10-12 02:29 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-11-13 08:59 . 2013-10-12 02:29 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-11-13 08:59 . 2013-10-12 02:03 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-11-13 08:59 . 2013-10-12 02:01 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-11-13 08:56 . 2013-10-18 12:12 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EBF11C41-B370-49C7-8FDC-095260989B77}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-19 10:21 . 2010-11-21 03:27 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-17 08:14 . 2012-04-21 12:40 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-13 09:01 . 2011-09-08 10:03 82896128 ----a-w- c:\windows\system32\MRT.exe
2013-10-18 12:12 . 2013-03-12 11:18 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-09-27 08:53 . 2013-09-27 08:53 248240 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2013-09-27 08:53 . 2012-08-30 21:03 134944 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2013-09-25 02:22 . 2013-11-13 09:00 340992 ----a-w- c:\windows\system32\schannel.dll
2013-09-25 01:57 . 2013-11-13 09:00 247808 ----a-w- c:\windows\SysWow64\schannel.dll
2013-09-11 20:21 . 2013-09-11 20:21 863344 ----a-w- c:\windows\SysWow64\msvcr110_clr0400.dll
2013-09-11 20:21 . 2013-09-11 20:21 501872 ----a-w- c:\windows\SysWow64\msvcp110_clr0400.dll
2013-09-11 20:21 . 2013-09-11 20:21 28776 ----a-w- c:\windows\SysWow64\aspnet_counters.dll
2013-09-11 20:21 . 2013-09-11 20:21 18000 ----a-w- c:\windows\SysWow64\msvcr100_clr0400.dll
2013-09-11 18:39 . 2013-09-11 18:39 855664 ----a-w- c:\windows\system32\msvcr110_clr0400.dll
2013-09-11 18:39 . 2013-09-11 18:39 614000 ----a-w- c:\windows\system32\msvcp110_clr0400.dll
2013-09-11 18:39 . 2013-09-11 18:39 30312 ----a-w- c:\windows\system32\aspnet_counters.dll
2013-09-11 18:39 . 2013-09-11 18:39 18000 ----a-w- c:\windows\system32\msvcr100_clr0400.dll
2013-09-08 02:30 . 2013-10-09 04:42 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-09-08 02:27 . 2013-10-09 04:42 327168 ----a-w- c:\windows\system32\mswsock.dll
2013-09-08 02:03 . 2013-10-09 04:42 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2013-09-04 12:12 . 2013-10-09 04:42 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-09-04 12:11 . 2013-10-09 04:42 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-09-04 12:11 . 2013-10-09 04:42 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-09-04 12:11 . 2013-10-09 04:42 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-09-04 12:11 . 2013-10-09 04:42 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-09-04 12:11 . 2013-10-09 04:42 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-09-04 12:11 . 2013-10-09 04:42 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2013-03-28 1106288]
"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2013-03-28 1511792]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-10-21 20549280]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
"WebcamMaxAutoRun"="c:\program files (x86)\WebcamMax\wcmmon.exe" [2011-07-17 1038848]
"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2013-04-22 720064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2010-08-11 2472048]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-03-28 310640]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2013-03-21 1061960]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 cpuz130;cpuz130;c:\users\Milan\AppData\Local\Temp\cpuz130\cpuz_x64.sys;c:\users\Milan\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 GUCI_AVS;Generic USB Controller Interface (AVS);c:\windows\system32\DRIVERS\GUCI_AVS.sys;c:\windows\SYSNATIVE\DRIVERS\GUCI_AVS.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 mv91cons;mv91cons;c:\windows\system32\drivers\mv91cons.sys;c:\windows\SYSNATIVE\drivers\mv91cons.sys [x]
R3 mv91xx;mv91xx;c:\windows\system32\drivers\mv91xx.sys;c:\windows\SYSNATIVE\drivers\mv91xx.sys [x]
R3 mv91xxr;mv91xxr;c:\windows\system32\drivers\mv91xxr.sys;c:\windows\SYSNATIVE\drivers\mv91xxr.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 NmPar;MosChip PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys;c:\windows\SYSNATIVE\drivers\NmPar.sys [x]
R3 nmserial;MosChip PCI Serial Port;c:\windows\system32\drivers\nmserial.sys;c:\windows\SYSNATIVE\drivers\nmserial.sys [x]
R3 OxSer;OxSer;c:\windows\system32\drivers\OxSer.sys;c:\windows\SYSNATIVE\drivers\OxSer.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 SI3114;SI3114;c:\windows\system32\drivers\SI3114.sys;c:\windows\SYSNATIVE\drivers\SI3114.sys [x]
R3 SI3124;SI3124;c:\windows\system32\drivers\SI3124.sys;c:\windows\SYSNATIVE\drivers\SI3124.sys [x]
R3 Si3124r5;Si3124r5;c:\windows\system32\drivers\Si3124r5.sys;c:\windows\SYSNATIVE\drivers\Si3124r5.sys [x]
R3 Si3531;Si3531;c:\windows\system32\drivers\Si3531.sys;c:\windows\SYSNATIVE\drivers\Si3531.sys [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 ssudobex;SAMSUNG Mobile USB OBEX Serial Port(DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudobex.sys;c:\windows\SYSNATIVE\DRIVERS\ssudobex.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R4 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-11-16 19:24 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.57\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-11-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 08:14]
.
2013-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-20 12:35]
.
2013-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-20 12:35]
.
2013-11-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-954854046-3235366559-1486098670-1000Core.job
- c:\users\Milan\AppData\Local\Google\Update\GoogleUpdate.exe [2013-06-21 12:03]
.
2013-11-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-954854046-3235366559-1486098670-1000UA.job
- c:\users\Milan\AppData\Local\Google\Update\GoogleUpdate.exe [2013-06-21 12:03]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-25 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-25 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-25 418840]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
"GUCI_AVS"="c:\windows\PixArt\PAP7501\GUCI_AVS.exe" [2007-12-10 323584]
"PACTray"="c:\windows\PixArt\PAP7501\PACTray.exe" [2009-07-10 319488]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/?clid=12454
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 85.193.0.1 85.193.0.8
FF - ProfilePath - c:\users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\fsgux8fo.default-1368289942419\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
.
**************************************************************************
.
Celkový čas: 2013-11-28 18:39:55 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-11-28 17:39
.
Před spuštěním: Volných bajtů: 861 325 418 496
Po spuštění: Volných bajtů: 860 943 593 472
.
- - End Of File - - 2EFBA0A86CF3F91029BADC4A5CFC2DA3
A36C5E4F47E84449FF07ED3517B43A31
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119531
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Prosím o kontrolu logu.

#4 Příspěvek od Rudy »

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:
KillAll::

Driver::
BBSvc
BBUpdate
Skype C2C Service

File::
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-954854046-3235366559-1486098670-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-954854046-3235366559-1486098670-1000UA.job

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::
Uložte na plochu jako CFScript.txt. Pak jej myší přetáhněte nad ikonu ComboFix a pusťte. CF se spistí a vykoná příkazy ze skriptu.

Obrázek
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Milousek66
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 04 kvě 2012 15:45

Re: Prosím o kontrolu logu.

#5 Příspěvek od Milousek66 »

Provedeno. :)
......................................

ComboFix 13-11-27.01 - Milan 28.11.2013 20:09:32.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.6126.4735 [GMT 1:00]
Spuštěný z: c:\users\Milan\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Milan\Desktop\CFScript.txt.txt
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\Tasks\GoogleUpdateTaskMachineCore.job"
"c:\windows\Tasks\GoogleUpdateTaskMachineUA.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-954854046-3235366559-1486098670-1000Core.job"
"c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-954854046-3235366559-1486098670-1000UA.job"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-954854046-3235366559-1486098670-1000Core.job
c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-954854046-3235366559-1486098670-1000UA.job
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_BBSvc
-------\Service_BBUpdate
-------\Service_Skype C2C Service
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2013-10-28 do 2013-11-28 )))))))))))))))))))))))))))))))
.
.
2013-11-28 19:12 . 2013-11-28 19:12 -------- d-----w- c:\users\TEMP\AppData\Local\temp
2013-11-28 19:12 . 2013-11-28 19:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-28 19:12 . 2013-11-28 19:12 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2013-11-28 17:50 . 2013-11-08 03:12 10285968 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{198DD662-4F25-4D48-A029-A9FA67FF37AB}\mpengine.dll
2013-11-27 16:14 . 2013-11-27 16:14 -------- d-----w- c:\windows\Migration
2013-11-27 16:13 . 2013-11-08 03:12 10285968 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-11-26 15:09 . 2013-11-27 08:20 -------- d-----w- c:\users\Milan\AppData\Local\CrashDumps
2013-11-13 12:59 . 2013-11-13 12:59 -------- d-----w- c:\users\Milan\AppData\Roaming\Malwarebytes
2013-11-13 12:58 . 2013-11-13 12:58 -------- d-----w- c:\programdata\Malwarebytes
2013-11-13 12:58 . 2013-11-13 12:58 -------- d-----w- c:\users\Milan\AppData\Local\Programs
2013-11-13 12:53 . 2013-11-13 12:54 -------- d-----w- C:\AdwCleaner
2013-11-13 09:20 . 2013-09-25 02:23 1030144 ----a-w- c:\windows\system32\TSWorkspace.dll
2013-11-13 09:20 . 2013-09-25 01:57 792576 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2013-11-13 09:14 . 2013-10-14 17:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2013-11-13 09:00 . 2013-09-25 02:22 340992 ----a-w- c:\windows\system32\schannel.dll
2013-11-13 08:59 . 2013-10-12 02:30 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-11-13 08:59 . 2013-10-12 02:29 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-11-13 08:59 . 2013-10-12 02:29 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-11-13 08:59 . 2013-10-12 02:03 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-11-13 08:59 . 2013-10-12 02:01 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-11-13 08:56 . 2013-10-18 12:12 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EBF11C41-B370-49C7-8FDC-095260989B77}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-19 10:21 . 2010-11-21 03:27 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-17 08:14 . 2012-04-21 12:40 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-13 09:01 . 2011-09-08 10:03 82896128 ----a-w- c:\windows\system32\MRT.exe
2013-10-18 12:12 . 2013-03-12 11:18 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-09-27 08:53 . 2013-09-27 08:53 248240 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2013-09-27 08:53 . 2012-08-30 21:03 134944 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2013-09-25 02:22 . 2013-11-13 09:00 340992 ----a-w- c:\windows\system32\schannel.dll
2013-09-25 01:57 . 2013-11-13 09:00 247808 ----a-w- c:\windows\SysWow64\schannel.dll
2013-09-11 20:21 . 2013-09-11 20:21 863344 ----a-w- c:\windows\SysWow64\msvcr110_clr0400.dll
2013-09-11 20:21 . 2013-09-11 20:21 501872 ----a-w- c:\windows\SysWow64\msvcp110_clr0400.dll
2013-09-11 20:21 . 2013-09-11 20:21 28776 ----a-w- c:\windows\SysWow64\aspnet_counters.dll
2013-09-11 20:21 . 2013-09-11 20:21 18000 ----a-w- c:\windows\SysWow64\msvcr100_clr0400.dll
2013-09-11 18:39 . 2013-09-11 18:39 855664 ----a-w- c:\windows\system32\msvcr110_clr0400.dll
2013-09-11 18:39 . 2013-09-11 18:39 614000 ----a-w- c:\windows\system32\msvcp110_clr0400.dll
2013-09-11 18:39 . 2013-09-11 18:39 30312 ----a-w- c:\windows\system32\aspnet_counters.dll
2013-09-11 18:39 . 2013-09-11 18:39 18000 ----a-w- c:\windows\system32\msvcr100_clr0400.dll
2013-09-08 02:30 . 2013-10-09 04:42 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-09-08 02:27 . 2013-10-09 04:42 327168 ----a-w- c:\windows\system32\mswsock.dll
2013-09-08 02:03 . 2013-10-09 04:42 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2013-09-04 12:12 . 2013-10-09 04:42 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-09-04 12:11 . 2013-10-09 04:42 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-09-04 12:11 . 2013-10-09 04:42 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-09-04 12:11 . 2013-10-09 04:42 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-09-04 12:11 . 2013-10-09 04:42 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-09-04 12:11 . 2013-10-09 04:42 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-09-04 12:11 . 2013-10-09 04:42 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2013-03-28 1106288]
"KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2013-03-28 1511792]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-10-21 20549280]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
"WebcamMaxAutoRun"="c:\program files (x86)\WebcamMax\wcmmon.exe" [2011-07-17 1038848]
"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2013-04-22 720064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2010-08-11 2472048]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2013-03-28 310640]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2013-03-21 1061960]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 cpuz130;cpuz130;c:\users\Milan\AppData\Local\Temp\cpuz130\cpuz_x64.sys;c:\users\Milan\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 GUCI_AVS;Generic USB Controller Interface (AVS);c:\windows\system32\DRIVERS\GUCI_AVS.sys;c:\windows\SYSNATIVE\DRIVERS\GUCI_AVS.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 mv91cons;mv91cons;c:\windows\system32\drivers\mv91cons.sys;c:\windows\SYSNATIVE\drivers\mv91cons.sys [x]
R3 mv91xx;mv91xx;c:\windows\system32\drivers\mv91xx.sys;c:\windows\SYSNATIVE\drivers\mv91xx.sys [x]
R3 mv91xxr;mv91xxr;c:\windows\system32\drivers\mv91xxr.sys;c:\windows\SYSNATIVE\drivers\mv91xxr.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 NmPar;MosChip PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys;c:\windows\SYSNATIVE\drivers\NmPar.sys [x]
R3 nmserial;MosChip PCI Serial Port;c:\windows\system32\drivers\nmserial.sys;c:\windows\SYSNATIVE\drivers\nmserial.sys [x]
R3 OxSer;OxSer;c:\windows\system32\drivers\OxSer.sys;c:\windows\SYSNATIVE\drivers\OxSer.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 SI3114;SI3114;c:\windows\system32\drivers\SI3114.sys;c:\windows\SYSNATIVE\drivers\SI3114.sys [x]
R3 SI3124;SI3124;c:\windows\system32\drivers\SI3124.sys;c:\windows\SYSNATIVE\drivers\SI3124.sys [x]
R3 Si3124r5;Si3124r5;c:\windows\system32\drivers\Si3124r5.sys;c:\windows\SYSNATIVE\drivers\Si3124r5.sys [x]
R3 Si3531;Si3531;c:\windows\system32\drivers\Si3531.sys;c:\windows\SYSNATIVE\drivers\Si3531.sys [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 ssudobex;SAMSUNG Mobile USB OBEX Serial Port(DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudobex.sys;c:\windows\SYSNATIVE\DRIVERS\ssudobex.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-11-16 19:24 1210320 ----a-w- c:\program files (x86)\Google\Chrome\Application\31.0.1650.57\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2013-11-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 08:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-25 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-25 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-25 418840]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
"GUCI_AVS"="c:\windows\PixArt\PAP7501\GUCI_AVS.exe" [2007-12-10 323584]
"PACTray"="c:\windows\PixArt\PAP7501\PACTray.exe" [2009-07-10 319488]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.seznam.cz/?clid=12454
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 85.193.0.1 85.193.0.8
FF - ProfilePath - c:\users\Milan\AppData\Roaming\Mozilla\Firefox\Profiles\fsgux8fo.default-1368289942419\
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
.
**************************************************************************
.
Celkový čas: 2013-11-28 20:17:19 - počítač byl restartován
ComboFix-quarantined-files.txt 2013-11-28 19:17
ComboFix2.txt 2013-11-28 17:39
.
Před spuštěním: Volných bajtů: 861 007 421 440
Po spuštění: Volných bajtů: 860 724 428 800
.
- - End Of File - - 81C52D4F587F3F539C01B3F06AA17C6C
A36C5E4F47E84449FF07ED3517B43A31
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119531
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Prosím o kontrolu logu.

#6 Příspěvek od Rudy »

Smazáno. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Milousek66
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 04 kvě 2012 15:45

Re: Prosím o kontrolu logu.

#7 Příspěvek od Milousek66 »

Nic nepozoruji, vše jde jak má. Jinak, uctivě děkuji za pomoc...
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119531
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Prosím o kontrolu logu.

#8 Příspěvek od Rudy »

Rádo se stalo! :)
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“