Kontrola logu - BetterSurf

[Jjohny]

Zdravím, před pár dny na mě začali vyskakovat Pop-up okna, zobrazovat se reklamy "Ads by BetterSurf" a podtrhávat text, z kterého se dělají odkazy. Program jsem odinstaloval, ručně prohledal registry a smazal zbytky, také z logu poznáte, že jsem použil různé programy na odstranění havěti a stejně reklama nezmizela. Prosil bych tedy o kontrolu logu a radu, co dál.

• Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
  Ran by Jirka a Aneta (administrator) on JAHNOVI on 31-01-2014 09:24:12
  Running from C:\Users\Jirka a Aneta\Desktop
  Windows 7 Home Premium (X64) OS Language: Czech
  Internet Explorer Version 9
  Boot Mode: Normal
  
  The only official download link for FRST:
  Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
  Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
  Download link from any site other than Bleeping Computer is unpermitted or outdated.
  See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
  
  ==================== Processes (Whitelisted) =================
  
  (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
  (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
  (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
  (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
  (ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe
  (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
  (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
  (APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
  (ClanServers Hosting LLC) C:\Program Files (x86)\GameTracker\GSInGameService.exe
  () C:\Windows\SysWOW64\PnkBstrA.exe
  (Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
  (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
  (ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
  (ATK) C:\Program Files\P4G\BatteryLife.exe
  (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
  (ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
  () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
  (ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
  () C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
  (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
  (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
  (ASUS) C:\Windows\AsScrPro.exe
  (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
  (AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
  (Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
  (ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
  () C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
  (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
  (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
  (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
  () C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
  () C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe
  (APN LLC.) C:\Users\Jirka a Aneta\AppData\Local\VNT\vntldr.exe
  (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
  (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Pandora.TV) C:\Program Files (x86)\The KMPlayer\KMPlayer.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (forum.viry.cz) C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe
  
  
  ==================== Registry (Whitelisted) ==================
  
  HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-08-12] (AlcorMicro Co., Ltd.)
  HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [660360 2007-05-31] (Microsoft Corporation)
  HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [621440 2009-09-30] (ELAN Microelectronic Corp.)
  HKLM\...\Run: [EeeStorageBackup] - C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [1732608 2009-11-26] ()
  HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
  HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe [170624 2009-08-20] (ASUS)
  HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
  HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
  HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
  HKLM-x32\...\Run: [seznam-listicka-distribuce] - "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
  HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
  HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [195536 2014-01-06] (APN LLC.)
  HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
  HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation)
  HKCU\...\Run: [] - [x]
  HKCU\...\Run: [AdobeBridge] - [x]
  HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKCU\...\Run: [uTorrent] - C:\Program Files (x86)\uTorrent\uTorrent.exe [802136 2013-05-02] (BitTorrent Inc.)
  HKCU\...\Run: [cz.seznam.software.autoupdate] - C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
  HKCU\...\Run: [cz.seznam.software.szndesktop] - C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
  HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
  HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_9_900_170_Plugin.exe -update plugin [839560 2013-12-12] (Adobe Systems Incorporated)
  HKCU\...\Policies\Explorer\Run: [Piranha Games] - C:\Users\Jirka a Aneta\AppData\Roaming\A92E75\A92E75.exe [45128 2009-07-14] ( (Microsoft Corporation))
  Startup: C:\Users\Tata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
  ShortcutTarget: OpenOffice.org 3.0.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
  
  ==================== Internet (Whitelisted) ====================
  
  HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/?clid=16194
  HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.alawarhry.cz
  URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
  StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
  SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKCU - {3FFD3656-3884-4FDB-8935-E6A1B83AFAC8} URL = http://slovnik.seznam.cz/?q={searchTerm ... arch_16194
  SearchScopes: HKCU - {6D9B577E-0BA2-4CAA-9381-EBCEECD2F5F1} URL = http://slovnik.seznam.cz/?q={searchTerm ... arch_16194
  SearchScopes: HKCU - {7988364B-E115-4FD2-9CB2-DC67042BDFC9} URL = http://www.firmy.cz/?q={searchTerms}&so ... arch_16194
  SearchScopes: HKCU - {79CDD03F-56AA-4774-A4EF-E1EDD363ECAC} URL = http://www.mapy.cz/?query={searchTerms} ... arch_16194
  SearchScopes: HKCU - {89E8D30F-1080-4466-8C8F-6D36A547102A} URL = http://tv.seznam.cz/hledej?w={searchTer ... arch_16194
  SearchScopes: HKCU - {9051C4E3-9AC0-401A-980D-A14E0FBCCD41} URL = http://encyklopedie.seznam.cz/search?q= ... arch_16194
  SearchScopes: HKCU - {EB931DF8-5051-4FAE-9110-42274C835AA7} URL = http://www.zbozi.cz/?q={searchTerms}&r= ... arch_16194
  SearchScopes: HKCU - {EF2812D8-7E04-4D19-96A9-7F10F30BFBA5} URL = http://www.novinky.cz/hledej?w={searchT ... arch_16194
  BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
  BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
  BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
  BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
  BHO-x32: No Name - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - No File
  BHO-x32: No Name - {68DD98BF-9DE8-418C-89F0-E37AC61CC2D9} - No File
  BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
  BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
  BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
  BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
  Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
  Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
  Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
  Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
  Winsock: Catalog5 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
  Winsock: Catalog5 02 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
  Winsock: Catalog5-x64 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
  Winsock: Catalog5-x64 02 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
  Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
  Tcpip\Parameters: [DhcpNameServer] 10.132.12.33 10.132.12.1
  
  FireFox:
  ========
  FF ProfilePath: C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default
  FF SearchEngineOrder.1: Ask.com
  FF Homepage: hxxp://www.jobego.com/search/
  FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
  FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
  FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
  FF Plugin: @microsoft.com/GENUINE - disabled No File
  FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
  FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
  FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
  FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
  FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
  FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
  FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
  FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
  FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
  FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
  FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
  FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
  FF Plugin-x32: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll No File
  FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
  FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
  FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
  FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Jirka a Aneta\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
  FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jirka a Aneta\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
  FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
  FF SearchPlugin: C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\searchplugins\jobegocom.xml
  FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
  FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml
  FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
  FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
  FF Extension: Vagex Firefox Add-On - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\ffaddon@vagex.com [2013-03-29]
  FF Extension: VideoFileDownload - Download YouTube Videos - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\plugin@videofiledownload.com [2012-07-06]
  FF Extension: The Saloon Bar - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\saloonbar@ligny.org.uk [2011-02-18]
  FF Extension: Seznam lištička - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2013-05-17]
  FF Extension: Illimitux - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\illimitux@illimitux.net.xpi [2011-07-31]
  FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-03-11]
  FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-04-27]
  FF HKLM-x32\...\Firefox\Extensions: [xz123@ya456.com] - C:\Program Files (x86)\BetterSurf\ff
  FF HKLM-x32\...\Firefox\Extensions: [12x3q@3244516.com] - C:\Program Files (x86)\Better-Surf\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@bettersurfplus.com] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@WebexpEnhancedV1alpha510.net] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha510\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta63.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ff
  FF Extension: Video Player - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ff [2014-01-10]
  FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha142.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha142\ff
  FF Extension: Media Player - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha142\ff [2014-01-29]
  FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
  
  Chrome:
  =======
  CHR HomePage: https://www.google.cz/?gws_rd=cr
  CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
  CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
  CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
  CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File
  CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
  CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
  CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
  CHR Plugin: (Java(TM) Platform SE 6 U29) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
  CHR Plugin: (Windows Genuine Advantage) - C:\Program Files (x86)\Mozilla Firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
  CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
  CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
  CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll No File
  CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
  CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
  CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
  CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
  CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
  CHR Plugin: (Nexon Game Controller) - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
  CHR Plugin: (Unity Player) - C:\Users\Jirka a Aneta\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
  CHR Plugin: (Facebook Plugin) - C:\Users\Jirka a Aneta\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
  CHR Extension: (Angry Birds) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2012-03-01]
  CHR Extension: (YouTube) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-19]
  CHR Extension: (Media Player) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdmlifmcodeplijdlfnanamghkiidoij [2014-01-29]
  CHR Extension: (Vyhledávání Google) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-19]
  CHR Extension: (AdBlock) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-06-15]
  CHR Extension: (Peněženka Google) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
  CHR Extension: (Battlefield Play4Free) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2013-04-21]
  CHR Extension: (Video Player) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfekkhdmhmddhjhfmkmfhojbjlihbopc [2014-01-10]
  CHR Extension: (Gmail) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-19]
  CHR HKCU\...\Chrome\Extension: [bdkdmpigoicnmdhmhiafmpcfnfgpfnol] - C:\Users\Jirka a Aneta\AppData\Local\CRE\bdkdmpigoicnmdhmhiafmpcfnfgpfnol.crx [2011-12-19]
  CHR HKLM-x32\...\Chrome\Extension: [aaaajfocmnnhjaajccaelhippajhaeod] - C:\ProgramData\AskPartnerNetwork\Toolbar\ATU4-V7\CRX\ToolbarCR.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [bdkdmpigoicnmdhmhiafmpcfnfgpfnol] - C:\Users\Jirka a Aneta\AppData\Local\CRE\bdkdmpigoicnmdhmhiafmpcfnfgpfnol.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [egnimkioipookhfihpljiedpgjffibpa] - C:\Program Files (x86)\MyBrowserCash\MBC_chrome.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [mhfdcmehmjcclgopdodkjdicohagipid] - C:\Users\JIRKAA~1\AppData\Local\Temp\crxE74B.tmp [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [mmifolfpllfdhilecpdpmemhelmanajl] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [pfekkhdmhmddhjhfmkmfhojbjlihbopc] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ch\VideoPlayerV3beta63.crx [2014-01-07]
  CHR HKLM-x32\...\Chrome\Extension: [pjbnadgnhhkoohnkddbceoldfibijgpk] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha510\ch\WebexpEnhancedV1alpha510.crx [2014-01-07]
  CHR HKLM-x32\...\Chrome\Extension: [poheodfamflhhhdcmjfeggbgigeefaco] - C:\Program Files (x86)\Better-Surf\ch\Chrome.crx [2014-01-07]
  
  ==================== Services (Whitelisted) =================
  
  R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
  R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-11] (Avira Operations GmbH & Co. KG)
  R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-01-06] (APN LLC.)
  S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3849720 2012-09-02] (INCA Internet Co., Ltd.)
  R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-11-09] ()
  S3 SwitchBoard; "C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [x]
  U2 *etadpug; "C:\Program Files (x86)\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\ \...\???\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\GoogleUpdate.exe" < <==== ATTENTION (ZeroAccess)
  
  ==================== Drivers (Whitelisted) ====================
  
  R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-07-17] ()
  R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
  R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
  R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-11] (Avira Operations GmbH & Co. KG)
  R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2011-05-31] (DT Soft Ltd)
  R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
  R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-07-17] ()
  S3 M1000Srv; C:\Windows\System32\Drivers\M1000KNT.sys [506496 2012-03-05] ()
  S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2005-01-03] (INCA Internet Co., Ltd.)
  R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799680 2009-05-20] ()
  R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-01-23] ()
  S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
  S3 TS_AR5416; C:\Windows\System32\DRIVERS\ts_athwx.sys [2156872 2011-09-05] (TamoSoft)
  S3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
  S3 ALSysIO; \??\C:\Users\JIRKAA~1\AppData\Local\Temp\ALSysIO64.sys [x]
  U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
  S3 catchme; \??\C:\ComboFix\catchme.sys [x]
  S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [x]
  S3 dump_wmimmc; \??\D:\Jirka\GamesCampus\DriftCity\GameGuard\dump_wmimmc.sys [x]
  S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
  U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42840 2009-06-10] (Microsoft Corporation)
  U3 tmlwf;
  U3 tmwfp;
  S3 usbbus; system32\DRIVERS\lgx64bus.sys [x]
  S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [x]
  S3 USBModem; system32\DRIVERS\lgx64modem.sys [x]
  S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
  
  ==================== NetSvcs (Whitelisted) ===================
  
  
  ==================== One Month Created Files and Folders ========
  
  2014-01-31 09:24 - 2014-01-31 09:24 - 00029833 _____ C:\Users\Jirka a Aneta\Desktop\FRST.txt
  2014-01-31 09:24 - 2014-01-31 09:24 - 00000000 ____D C:\FRST
  2014-01-31 09:20 - 2014-01-31 09:20 - 00030014 _____ C:\Users\Jirka a Aneta\Desktop\Stargate-Universe-S01E11(0000152882).srt
  2014-01-31 09:19 - 2014-01-31 09:19 - 00112640 _____ (forum.viry.cz) C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe
  2014-01-31 09:17 - 2014-01-31 09:18 - 02079744 _____ (Farbar) C:\Users\Jirka a Aneta\Desktop\FRST64.exe
  2014-01-30 23:48 - 2014-01-30 23:48 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  2014-01-30 23:48 - 2014-01-30 23:48 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
  2014-01-30 23:48 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
  2014-01-30 23:43 - 2014-01-30 23:43 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Jirka a Aneta\Desktop\mbam-setup-1.75.0.1300.exe
  2014-01-30 15:33 - 2014-01-30 15:33 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
  2014-01-30 15:33 - 2014-01-30 15:33 - 00000764 _____ C:\Windows\system32\bootdelete.lst
  2014-01-30 15:18 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\HitmanPro
  2014-01-30 14:51 - 2014-01-30 14:51 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Malwarebytes
  2014-01-30 14:50 - 2014-01-30 14:50 - 00000000 ____D C:\ProgramData\Malwarebytes
  2014-01-30 14:39 - 2014-01-30 14:39 - 00000000 ____D C:\Windows\ERUNT
  2014-01-30 14:27 - 2014-01-30 14:31 - 00000000 ____D C:\AdwCleaner
  2014-01-29 23:48 - 2014-01-29 23:48 - 00000270 __RSH C:\ProgramData\ntuser.pol
  2014-01-29 23:48 - 2014-01-29 23:48 - 00000000 ____D C:\Program Files (x86)\MediaPlayerV1
  2014-01-26 09:35 - 2014-01-26 19:01 - 00000000 ____D C:\Users\Jirka a Aneta\Documents\ArcaniA - Gothic 4
  2014-01-26 09:35 - 2014-01-26 09:35 - 00000000 __SHD C:\ProgramData\SecuROM
  2014-01-24 21:59 - 2014-01-24 21:59 - 00000221 _____ C:\Users\Jirka a Aneta\Desktop\ArcaniA Gothic 4.url
  2014-01-23 21:45 - 2014-01-23 21:45 - 00001135 _____ C:\Users\Jirka a Aneta\Desktop\Nový textový dokument.TXT
  2014-01-19 16:16 - 2014-01-19 16:16 - 00000000 _____ C:\Windows\WindowsUpdate.log
  2014-01-18 18:08 - 2014-01-18 18:08 - 00000221 _____ C:\Users\Jirka a Aneta\Desktop\Arma 2.url
  2014-01-14 18:01 - 2014-01-14 18:01 - 00001016 _____ C:\Users\Public\Desktop\Mumble.lnk
  2014-01-13 18:46 - 2014-01-13 18:46 - 00001238 _____ C:\Users\Jirka a Aneta\Desktop\TeamSpeak 3 Client.lnk
  2014-01-13 18:46 - 2014-01-13 18:46 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
  2014-01-13 18:46 - 2014-01-13 18:46 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\TeamSpeak 3 Client
  2014-01-13 16:48 - 2014-01-13 17:22 - 590753870 _____ C:\Users\Jirka a Aneta\Desktop\Quiet-Rage---The-Stanford-Prison-Experiment.mov
  2014-01-11 14:50 - 2014-01-11 14:50 - 00000000 ____D C:\Users\Jirka a Aneta\Desktop\AS51
  2014-01-10 20:36 - 2014-01-10 20:36 - 00002996 _____ C:\Windows\System32\Tasks\{6F1413CC-D5A1-40D3-93F3-D4B4CADEB814}
  2014-01-10 20:35 - 2014-01-10 20:35 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\com.immersyve.Paladin.live
  2014-01-10 18:48 - 2014-01-10 18:48 - 00000000 ____D C:\Program Files (x86)\VideoPlayerV3
  2014-01-10 08:28 - 2014-01-10 08:28 - 00001082 _____ C:\Users\Jirka a Aneta\Desktop\Wow – zástupce.lnk
  2014-01-08 19:30 - 2014-01-30 15:09 - 00004652 _____ C:\Windows\PFRO.log
  2014-01-05 14:18 - 2014-01-05 14:18 - 00000770 _____ C:\Users\Public\Desktop\Game Dev Tycoon.lnk
  2014-01-01 14:40 - 2014-01-01 14:40 - 00000000 ____D C:\Users\Jirka a Aneta\Documents\SavedGames
  
  ==================== One Month Modified Files and Folders =======
  
  2014-01-31 09:24 - 2014-01-31 09:24 - 00029833 _____ C:\Users\Jirka a Aneta\Desktop\FRST.txt
  2014-01-31 09:24 - 2014-01-31 09:24 - 00000000 ____D C:\FRST
  2014-01-31 09:23 - 2010-02-02 17:52 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Skype
  2014-01-31 09:20 - 2014-01-31 09:20 - 00030014 _____ C:\Users\Jirka a Aneta\Desktop\Stargate-Universe-S01E11(0000152882).srt
  2014-01-31 09:19 - 2014-01-31 09:19 - 00112640 _____ (forum.viry.cz) C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe
  2014-01-31 09:18 - 2014-01-31 09:17 - 02079744 _____ (Farbar) C:\Users\Jirka a Aneta\Desktop\FRST64.exe
  2014-01-31 09:00 - 2011-03-15 19:04 - 00000966 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
  2014-01-31 08:59 - 2013-02-23 09:52 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
  2014-01-31 01:23 - 2012-08-23 21:20 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\uTorrent
  2014-01-30 23:48 - 2014-01-30 23:48 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  2014-01-30 23:48 - 2014-01-30 23:48 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
  2014-01-30 23:43 - 2014-01-30 23:43 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Jirka a Aneta\Desktop\mbam-setup-1.75.0.1300.exe
  2014-01-30 18:53 - 2012-02-10 08:29 - 00000000 ____D C:\Program Files (x86)\Steam
  2014-01-30 15:46 - 2011-03-15 19:04 - 00000962 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
  2014-01-30 15:34 - 2014-01-30 15:18 - 00000000 ____D C:\ProgramData\HitmanPro
  2014-01-30 15:33 - 2014-01-30 15:33 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
  2014-01-30 15:33 - 2014-01-30 15:33 - 00000764 _____ C:\Windows\system32\bootdelete.lst
  2014-01-30 15:19 - 2009-07-14 05:45 - 00010240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  2014-01-30 15:19 - 2009-07-14 05:45 - 00010240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  2014-01-30 15:16 - 2013-05-17 11:26 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz
  2014-01-30 15:09 - 2014-01-08 19:30 - 00004652 _____ C:\Windows\PFRO.log
  2014-01-30 15:09 - 2013-12-14 14:35 - 00004514 _____ C:\Windows\setupact.log
  2014-01-30 15:09 - 2009-12-26 21:30 - 00000000 ____D C:\ProgramData\NVIDIA
  2014-01-30 15:09 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
  2014-01-30 15:08 - 2013-10-07 18:14 - 00000000 __SHD C:\Users\Jirka a Aneta\fxiuy
  2014-01-30 14:51 - 2014-01-30 14:51 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Malwarebytes
  2014-01-30 14:50 - 2014-01-30 14:50 - 00000000 ____D C:\ProgramData\Malwarebytes
  2014-01-30 14:39 - 2014-01-30 14:39 - 00000000 ____D C:\Windows\ERUNT
  2014-01-30 14:31 - 2014-01-30 14:27 - 00000000 ____D C:\AdwCleaner
  2014-01-30 14:29 - 2010-01-23 14:31 - 00000000 ____D C:\ProgramData\ICQ
  2014-01-29 23:48 - 2014-01-29 23:48 - 00000270 __RSH C:\ProgramData\ntuser.pol
  2014-01-29 23:48 - 2014-01-29 23:48 - 00000000 ____D C:\Program Files (x86)\MediaPlayerV1
  2014-01-29 23:48 - 2010-01-21 18:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
  2014-01-29 23:48 - 2009-07-14 04:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
  2014-01-29 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
  2014-01-29 15:20 - 2012-10-05 12:22 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\PMB Files
  2014-01-28 23:31 - 2013-04-03 18:27 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\CrashDumps
  2014-01-28 13:25 - 2013-08-29 11:13 - 00000000 ____D C:\Users\Jirka a Aneta\Desktop\Přidat
  2014-01-26 19:01 - 2014-01-26 09:35 - 00000000 ____D C:\Users\Jirka a Aneta\Documents\ArcaniA - Gothic 4
  2014-01-26 09:35 - 2014-01-26 09:35 - 00000000 __SHD C:\ProgramData\SecuROM
  2014-01-26 09:34 - 2013-12-21 17:40 - 00052881 _____ C:\Windows\DirectX.log
  2014-01-24 21:59 - 2014-01-24 21:59 - 00000221 _____ C:\Users\Jirka a Aneta\Desktop\ArcaniA Gothic 4.url
  2014-01-24 21:02 - 2009-08-03 21:00 - 00672386 _____ C:\Windows\system32\perfh005.dat
  2014-01-24 21:02 - 2009-08-03 21:00 - 00142950 _____ C:\Windows\system32\perfc005.dat
  2014-01-24 21:02 - 2009-07-14 06:13 - 01592850 _____ C:\Windows\system32\PerfStringBackup.INI
  2014-01-23 21:45 - 2014-01-23 21:45 - 00001135 _____ C:\Users\Jirka a Aneta\Desktop\Nový textový dokument.TXT
  2014-01-22 19:49 - 2012-01-16 16:38 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\TS3Client
  2014-01-19 16:16 - 2014-01-19 16:16 - 00000000 _____ C:\Windows\WindowsUpdate.log
  2014-01-18 18:08 - 2014-01-18 18:08 - 00000221 _____ C:\Users\Jirka a Aneta\Desktop\Arma 2.url
  2014-01-16 18:49 - 2010-02-02 12:26 - 00000600 _____ C:\Users\Jirka a Aneta\AppData\Roaming\winscp.rnd
  2014-01-15 18:39 - 2011-05-26 17:20 - 06942208 ___SH C:\Users\Jirka a Aneta\Desktop\Thumbs.db
  2014-01-14 18:01 - 2014-01-14 18:01 - 00001016 _____ C:\Users\Public\Desktop\Mumble.lnk
  2014-01-14 18:01 - 2012-01-12 17:40 - 00000000 ____D C:\Program Files (x86)\Mumble
  2014-01-13 18:46 - 2014-01-13 18:46 - 00001238 _____ C:\Users\Jirka a Aneta\Desktop\TeamSpeak 3 Client.lnk
  2014-01-13 18:46 - 2014-01-13 18:46 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
  2014-01-13 18:46 - 2014-01-13 18:46 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\TeamSpeak 3 Client
  2014-01-13 17:22 - 2014-01-13 16:48 - 590753870 _____ C:\Users\Jirka a Aneta\Desktop\Quiet-Rage---The-Stanford-Prison-Experiment.mov
  2014-01-11 14:50 - 2014-01-11 14:50 - 00000000 ____D C:\Users\Jirka a Aneta\Desktop\AS51
  2014-01-10 20:57 - 2013-10-07 19:15 - 00045056 _____ C:\Windows\system32\acovcnt.exe
  2014-01-10 20:36 - 2014-01-10 20:36 - 00002996 _____ C:\Windows\System32\Tasks\{6F1413CC-D5A1-40D3-93F3-D4B4CADEB814}
  2014-01-10 20:35 - 2014-01-10 20:35 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\com.immersyve.Paladin.live
  2014-01-10 20:11 - 2012-11-21 15:24 - 00000000 __SHD C:\Users\Jirka a Aneta\Userdata
  2014-01-10 18:48 - 2014-01-10 18:48 - 00000000 ____D C:\Program Files (x86)\VideoPlayerV3
  2014-01-10 08:28 - 2014-01-10 08:28 - 00001082 _____ C:\Users\Jirka a Aneta\Desktop\Wow – zástupce.lnk
  2014-01-09 21:18 - 2013-05-17 11:42 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\Game Dev Tycoon
  2014-01-09 17:21 - 2013-07-23 16:58 - 00000000 ____D C:\Users\Jirka a Aneta\Desktop\Anet
  2014-01-09 17:19 - 2011-01-11 14:31 - 00000000 ___RD C:\Users\Jirka a Aneta\Desktop\Jjohny
  2014-01-06 14:11 - 2013-11-08 14:44 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\VNT
  2014-01-06 14:10 - 2013-11-08 14:44 - 00000000 ____D C:\Program Files (x86)\VNT
  2014-01-05 14:18 - 2014-01-05 14:18 - 00000770 _____ C:\Users\Public\Desktop\Game Dev Tycoon.lnk
  2014-01-01 20:47 - 2012-08-26 08:39 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\FalloutNV
  2014-01-01 14:40 - 2014-01-01 14:40 - 00000000 ____D C:\Users\Jirka a Aneta\Documents\SavedGames
  ZeroAccess:
  C:\Users\Jirka a Aneta\AppData\Local\Google\Desktop\Install
  ZeroAccess:
  C:\Program Files (x86)\Google\Desktop\Install
  
  Some content of TEMP:
  ====================
  C:\Users\Aňula\AppData\Local\Temp\NOSEventMessages.dll
  C:\Users\Jirka a Aneta\AppData\Local\Temp\avgnt.exe
  C:\Users\Jirka a Aneta\AppData\Local\Temp\HitmanPro.exe
  C:\Users\Jirka a Aneta\AppData\Local\Temp\Quarantine.exe
  C:\Users\Tata\AppData\Local\Temp\avgnt.exe
  C:\Users\Tata\AppData\Local\Temp\NOSEventMessages.dll
  
  
  ==================== Bamital & volsnap Check =================
  
  C:\Windows\System32\winlogon.exe => MD5 is legit
  C:\Windows\System32\wininit.exe => MD5 is legit
  C:\Windows\SysWOW64\wininit.exe => MD5 is legit
  C:\Windows\explorer.exe => MD5 is legit
  C:\Windows\SysWOW64\explorer.exe => MD5 is legit
  C:\Windows\System32\svchost.exe => MD5 is legit
  C:\Windows\SysWOW64\svchost.exe => MD5 is legit
  C:\Windows\System32\services.exe => MD5 is legit
  C:\Windows\System32\User32.dll => MD5 is legit
  C:\Windows\SysWOW64\User32.dll => MD5 is legit
  C:\Windows\System32\userinit.exe => MD5 is legit
  C:\Windows\SysWOW64\userinit.exe => MD5 is legit
  C:\Windows\System32\rpcss.dll => MD5 is legit
  C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
  
  
  LastRegBack: 2014-01-19 09:33
  
  
  
  
  ===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
  
  ==================== Drive and Memory info ===================
  
  Drive c: (OS) (Fixed) (Total:116.44 GB) (Free:13.81 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
  Drive d: (DATA) (Fixed) (Total:334.67 GB) (Free:56.03 GB) NTFS
  
  Available physical RAM: 1746.97 MB
  Total physical RAM: 4095.27 MB
  Percentage of memory in use: 57%
  
  ==================== MBR and Partition Table ==================
  
  Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 76692CA8)
  Partition 1: (Not Active) - (Size=15 GB) - (Type=1C)
  Partition 2: (Active) - (Size=116 GB) - (Type=07 NTFS)
  Partition 3: (Not Active) - (Size=335 GB) - (Type=OF Extended)
  
  ==================== Scheduled Tasks (whitelisted) ==================
  
  Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  
  ==================== Alternate Data Streams (whitelisted) ==================
  
  AlternateDataStreams: C:\Windows\System32:{4B9A1497-0817-47C4-9612-D6A1C53ACF57}
  AlternateDataStreams: C:\ProgramData\Temp:07F6D9E4
  AlternateDataStreams: C:\ProgramData\Temp:15024E60
  AlternateDataStreams: C:\ProgramData\Temp:4CF61E54
  AlternateDataStreams: C:\ProgramData\Temp:596E2371
  AlternateDataStreams: C:\ProgramData\Temp:68C295D4
  AlternateDataStreams: C:\ProgramData\Temp:734E442A
  AlternateDataStreams: C:\ProgramData\Temp:75D366A3
  AlternateDataStreams: C:\ProgramData\Temp:A724744F
  AlternateDataStreams: C:\ProgramData\Temp:A8ADE5D8
  AlternateDataStreams: C:\ProgramData\Temp:AB689DEA
  AlternateDataStreams: C:\ProgramData\Temp:B88E99C8
  AlternateDataStreams: C:\ProgramData\Temp:BB24555F
  AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1
  AlternateDataStreams: C:\ProgramData\Temp:DFC5A2B2
  
  ==================== Security Center ==================
  
  AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
  AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
  
  
  
  ===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
  Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
  Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
  
  
  ***** Velikost "Plochy" *****
  
  Velikost slozky "C:\Users\Jirka a Aneta\Desktop" je 4655 MB.
  
  
  ***** Startup Programs *****
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADSMTray
  C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector
  C:\Windows\AsScrPro.exe
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer
  "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite
  "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate
  C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_Plugin.exe -update plugin [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPeerNexonEU
  C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui
  "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe
  C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
  "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl
  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Soluto
  c:\program files\soluto\soluto.exe /init [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam
  "C:\Program Files (x86)\Steam\steam.exe" -silent [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent
  "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED [x]
  
  HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ JCC - AutoClickerBot.lnk
  C:\JCC-AU~1\JCC-AU~1.EXE
  
  
  ***** Firewall rules *****
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
  
  
  ***** System Restore *****
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
  "Generalize_DisableSR"=dword:00000000
  
  
  ==================== End Of Log ==============================

[vyosek]

Zdravim

Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com

• Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane

  Rkill EXE:
  http://download.bleepingcomputer.com/grinler/rkill.exe
  
  Rkill iExplore.exe:
  http://download.bleepingcomputer.com/gr ... xplore.exe
  
  Rkill uSeRiNiT.exe:
  http://download.bleepingcomputer.com/gr ... eRiNiT.exe
  
  Rkill WiNlOgOn.exe:
  http://download.bleepingcomputer.com/gr ... NlOgOn.exe

• Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
• Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
• RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
• Na plose vznikne log Rkill.txt ten mi sem vlozte
• Ted nerestartujte PC - prisli byste o ucinek RKillu

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

• Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
• Pokud mate Win XP spustte pod uctem Spravce\Administratora
• Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
• Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
• Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
• Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
• Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
• Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
• Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

[Jjohny]

Rkill:

• Rkill 2.6.5 by Lawrence Abrams (Grinler)
  http://www.bleepingcomputer.com/
  Copyright 2008-2014 BleepingComputer.com
  More Information about Rkill can be found at this link:
  http://www.bleepingcomputer.com/forums/topic308364.html
  
  Program started at: 01/31/2014 10:23:19 AM in x64 mode.
  Windows Version: Windows 7 Home Premium
  
  Checking for Windows services to stop:
  
  * No malware services found to stop.
  
  Checking for processes to terminate:
  
  * No malware processes found to kill.
  
  Checking Registry for malware related settings:
  
  * No issues found in the Registry.
  
  Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
  
  Performing miscellaneous checks:
  
  * Windows Defender Disabled
  
  [HKLM\SOFTWARE\Microsoft\Windows Defender]
  "DisableAntiSpyware" = dword:00000001
  
  * ALERT: ZEROACCESS rootkit symptoms found!
  
  * C:\Program Files (x86)\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\ [ZA Dir]
  * C:\Program Files (x86)\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\ \ [ZA Dir]
  * C:\Program Files (x86)\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\ \...\ [ZA Dir]
  * C:\Program Files (x86)\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\ \...\ﯹ๛\ [ZA Dir]
  * C:\Program Files (x86)\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\ \...\ﯹ๛\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\ [ZA Dir]
  * C:\Users\Jirka a Aneta\AppData\Local\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\ [ZA Dir]
  * C:\Users\Jirka a Aneta\AppData\Local\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\❤≸⋙\ [ZA Dir]
  * C:\Users\Jirka a Aneta\AppData\Local\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\❤≸⋙\Ⱒ☠⍨\ [ZA Dir]
  * C:\Users\Jirka a Aneta\AppData\Local\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\❤≸⋙\Ⱒ☠⍨\ﯹ๛\ [ZA Dir]
  * C:\Users\Jirka a Aneta\AppData\Local\Google\Desktop\Install\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\❤≸⋙\Ⱒ☠⍨\ﯹ๛\{94b33d1b-8557-37a1-49e7-1f0e14014fb9}\ [ZA Dir]
  
  Checking Windows Service Integrity:
  
  * Brána Windows Firewall (MpsSvc) is not Running.
  Startup Type set to: Automatic
  
  * BITS [Missing Service]
  * iphlpsvc [Missing Service]
  * PcaSvc [Missing Service]
  * PolicyAgent [Missing Service]
  * RemoteAccess [Missing Service]
  * WinDefend [Missing Service]
  * wscsvc [Missing Service]
  * wuauserv [Missing Service]
  
  * SharedAccess [Missing ImagePath]
  
  Searching for Missing Digital Signatures:
  
  * No issues found.
  
  Checking HOSTS File:
  
  * HOSTS file entries found:
  
  127.0.0.1 localhost
  76.115.137.4 api1.thewarinc.com
  
  Program finished at: 01/31/2014 10:24:52 AM
  Execution time: 0 hours(s), 1 minute(s), and 33 seconds(s)

[vyosek]

Pokracujte ComboFixem, mate tam peknou mrchu

[Jjohny]

Mám ComboFix hotový, akorát se to sem nevleze skrze znaky, tak přikládám jako přílohu.

[vyosek]

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

• Ulozte nejlepe na plochu
• Ukoncete vsechny programy
• Kliknete na Scan a nasledne Clean
• Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

Stahnete Farbar Service Scanner http://download.bleepingcomputer.com/farbar/FSS.exe

• Ulozte nejlepe na Plochu
• U vsech polozek udelejte zatrzitko (tim je oznacite pro skenovani)
• Kliknete na Scan
• Po dokonceni skenu se objevi log FSS.txt ten sem vlozte

[Jjohny]

AdwCleaner byl použit už včera bez výsledků, ale stejně, zde je log:

• # AdwCleaner v3.018 - Report created 31/01/2014 at 11:34:37
  # Updated 28/01/2014 by Xplode
  # Operating System : Windows 7 Home Premium (64 bits)
  # Username : Jirka a Aneta - JAHNOVI
  # Running from : C:\Users\Jirka a Aneta\Desktop\adwcleaner.exe
  # Option : Clean
  
  ***** [ Services ] *****
  
  
  ***** [ Files / Folders ] *****
  
  
  ***** [ Shortcuts ] *****
  
  
  ***** [ Registry ] *****
  
  Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
  
  ***** [ Browsers ] *****
  
  -\\ Internet Explorer v9.0.8112.16457
  
  
  -\\ Mozilla Firefox v22.0 (cs)
  
  [ File : C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\prefs.js ]
  
  
  [ File : C:\Users\Aňula\AppData\Roaming\Mozilla\Firefox\Profiles\bzwk4i2s.default\prefs.js ]
  
  
  [ File : C:\Users\Tata\AppData\Roaming\Mozilla\Firefox\Profiles\fhfua0oe.default\prefs.js ]
  
  
  -\\ Google Chrome v32.0.1700.102
  
  [ File : C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\preferences ]
  
  
  [ File : C:\Users\Aňula\AppData\Local\Google\Chrome\User Data\Default\preferences ]
  
  
  [ File : C:\Users\Tata\AppData\Local\Google\Chrome\User Data\Default\preferences ]
  
  
  *************************
  
  AdwCleaner[R1].txt - [1358 octets] - [31/01/2014 11:31:09]
  AdwCleaner[S1].txt - [1281 octets] - [31/01/2014 11:34:37]
  
  ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1341 octets] ##########

Farbar byl až nějak moc rychlý (pár sekund):

• Farbar Service Scanner Version: 08-01-2014
  Ran by Jirka a Aneta (administrator) on 31-01-2014 at 11:43:13
  Running from "C:\Users\Jirka a Aneta\Desktop"
  Microsoft Windows 7 Home Premium (X64)
  Boot Mode: Normal
  ****************************************************************
  
  Internet Services:
  ============
  
  Connection Status:
  ==============
  Localhost is accessible.
  LAN connected.
  Google IP is accessible.
  Google.com is accessible.
  Yahoo.com is accessible.
  
  
  Windows Firewall:
  =============
  
  Firewall Disabled Policy:
  ==================
  
  
  System Restore:
  ============
  
  System Restore Disabled Policy:
  ========================
  
  
  Action Center:
  ============
  
  
  Windows Update:
  ============
  
  Windows Autoupdate Disabled Policy:
  ============================
  
  
  Windows Defender:
  ==============
  WinDefend Service is not running. Checking service configuration:
  The start type of WinDefend service is set to Demand. The default start type is Auto.
  The ImagePath of WinDefend service is OK.
  The ServiceDll of WinDefend service is OK.
  
  
  Windows Defender Disabled Policy:
  ==========================
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
  "DisableAntiSpyware"=DWORD:1
  
  
  Other Services:
  ==============
  Checking ServiceDll of RemoteAccess: ATTENTION!=====> Unable to open RemoteAccess registry key. The service key does not exist.
  
  
  
  File Check:
  ========
  C:\Windows\System32\nsisvc.dll => MD5 is legit
  C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
  C:\Windows\System32\dhcpcore.dll => MD5 is legit
  C:\Windows\System32\drivers\afd.sys => MD5 is legit
  C:\Windows\System32\drivers\tdx.sys => MD5 is legit
  C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
  C:\Windows\System32\dnsrslvr.dll => MD5 is legit
  C:\Windows\System32\mpssvc.dll => MD5 is legit
  C:\Windows\System32\bfe.dll => MD5 is legit
  C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
  C:\Windows\System32\SDRSVC.dll => MD5 is legit
  C:\Windows\System32\vssvc.exe => MD5 is legit
  C:\Windows\System32\wscsvc.dll => MD5 is legit
  C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
  C:\Windows\System32\wuaueng.dll => MD5 is legit
  C:\Windows\System32\qmgr.dll => MD5 is legit
  C:\Windows\System32\es.dll => MD5 is legit
  C:\Windows\System32\cryptsvc.dll => MD5 is legit
  C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
  C:\Windows\System32\ipnathlp.dll => MD5 is legit
  C:\Windows\System32\iphlpsvc.dll => MD5 is legit
  C:\Windows\System32\svchost.exe => MD5 is legit
  C:\Windows\System32\rpcss.dll => MD5 is legit
  
  
  **** End of log ****

[vyosek]

Stahnete Service Repair http://kb.eset.com/library/ESET/KB%20Te ... Repair.exe

• Ulozte nejlepe na Plochu
• Spustte a potvrdte Yes abyste potvrdil reinstalaci sluzeb
• Nasledne kliknutim na Yes potvrdte restart PC
• Na Plose vznikne slozka CC Support, najdete tam log SvcRepair.txt - mel by byt CC Support\Logs\SvcRepair.txt - vlozte mi jej sem

[Jjohny]

• Log Opened: 2014-01-31 @ 11:50:58
  11:50:58 - -----------------
  11:50:58 - | Begin Logging |
  11:50:58 - -----------------
  11:50:58 - Fix started on a WIN_7 X64 computer
  11:50:58 - Prep in progress. Please Wait.
  11:50:59 - Prep complete
  11:50:59 - Repairing Services Now. Please wait...
  INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
  INFORMATION: Input file for restore operation opened: '.\Win7\BFE.sddl'
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\SubLayer>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Provider>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Filter>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime\Filter>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE>
  
  SetACL finished successfully.
  INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
  INFORMATION: Input file for restore operation opened: '.\Win7\BITS.sddl'
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Security>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Performance>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Parameters>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS>
  
  SetACL finished successfully.
  INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
  INFORMATION: Input file for restore operation opened: '.\Win7\iphlpsvc.sddl'
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Teredo>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Teredo\{FA88062C-9A61-4C1E-AC45-7143F8F01AAD}>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Teredo>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Isatap\{8AD2FB26-F91E-44F1-9B24-3C0AE56C9CE0}>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Isatap>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\IPHTTPS>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Interfaces>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\config>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc>
  
  SetACL finished successfully.
  INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
  INFORMATION: Input file for restore operation opened: '.\Win7\MpsSvc.sddl'
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Security>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\Teredo>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\IPTLSOut>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\IPTLSIn>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\DHCP>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc>
  
  SetACL finished successfully.
  INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
  INFORMATION: Input file for restore operation opened: '.\Win7\SharedAccess.sddl'
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch2>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile\Logging>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile\Logging>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile\Logging>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess>
  
  SetACL finished successfully.
  INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
  INFORMATION: Input file for restore operation opened: '.\Win7\WinDefend.sddl'
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\TriggerInfo\0>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\TriggerInfo>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Security>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Parameters>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend>
  
  SetACL finished successfully.
  INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
  INFORMATION: Input file for restore operation opened: '.\Win7\wscsvc.sddl'
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Security>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Parameters>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc>
  
  SetACL finished successfully.
  INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
  INFORMATION: Input file for restore operation opened: '.\Win7\wuauserv.sddl'
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Security>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Parameters>
  INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv>
  
  SetACL finished successfully.
  11:51:00 - Services Repair Complete.
  11:51:05 - Reboot Initiated

[vyosek]

Udelejte prosim novy log z FRST

[Jjohny]

• Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
  Ran by Jirka a Aneta (administrator) on JAHNOVI on 31-01-2014 12:28:26
  Running from C:\Users\Jirka a Aneta\Desktop
  Windows 7 Home Premium (X64) OS Language: Czech
  Internet Explorer Version 9
  Boot Mode: Normal
  
  The only official download link for FRST:
  Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
  Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
  Download link from any site other than Bleeping Computer is unpermitted or outdated.
  See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
  
  ==================== Processes (Whitelisted) =================
  
  (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
  (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
  (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
  (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
  (ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe
  (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
  (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
  (APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
  (ClanServers Hosting LLC) C:\Program Files (x86)\GameTracker\GSInGameService.exe
  () C:\Windows\SysWOW64\PnkBstrA.exe
  (ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
  (ATK) C:\Program Files\P4G\BatteryLife.exe
  () C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
  (ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
  () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
  (ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
  () C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
  (AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
  (Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
  (ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
  () C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
  (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
  (BitTorrent Inc.) C:\Program Files (x86)\uTorrent\uTorrent.exe
  () C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
  () C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe
  (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
  (Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
  (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
  (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
  (ASUS) C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
  (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
  (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
  (ASUS) C:\Windows\AsScrPro.exe
  (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
  (APN LLC.) C:\Users\Jirka a Aneta\AppData\Local\VNT\vntldr.exe
  (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Pandora.TV) C:\Program Files (x86)\The KMPlayer\KMPlayer.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  (forum.viry.cz) C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe
  (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
  (Microsoft Corporation) C:\Windows\SysWOW64\PING.EXE
  
  
  ==================== Registry (Whitelisted) ==================
  
  HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323072 2009-08-12] (AlcorMicro Co., Ltd.)
  HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [660360 2007-05-31] (Microsoft Corporation)
  HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [621440 2009-09-30] (ELAN Microelectronic Corp.)
  HKLM\...\Run: [EeeStorageBackup] - C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [1732608 2009-11-26] ()
  HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
  HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe [170624 2009-08-20] (ASUS)
  HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
  HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
  HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
  HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
  HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [195536 2014-01-06] (APN LLC.)
  HKCU\...\Run: [AdobeBridge] - [x]
  HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKCU\...\Run: [uTorrent] - C:\Program Files (x86)\uTorrent\uTorrent.exe [802136 2013-05-02] (BitTorrent Inc.)
  HKCU\...\Run: [cz.seznam.software.autoupdate] - C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
  HKCU\...\Run: [cz.seznam.software.szndesktop] - C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
  HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Aňula\...\Run: [MyWebSearch Email Plugin] - C:\PROGRA~2\MYWEBS~1\bar\1.bin\mwsoemon.exe
  HKU\Aňula\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Aňula\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKU\Aňula\...\Run: [Vagex] - C:\Users\Aňula\Desktop\Vagex\Vagex.exe
  HKU\Aňula\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe
  HKU\Aňula\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1815976 2014-01-27] (Valve Corporation)
  HKU\Aňula\...\Run: [] - [x]
  HKU\Aňula\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1088424 2012-10-13] (Nokia)
  HKU\Aňula\...\Run: [AdobeBridge] - [x]
  HKU\Aňula\...\Run: [cz.seznam.software.szndesktop] - C:\Users\Aňula\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
  HKU\Aňula\...\Run: [cz.seznam.software.autoupdate] - C:\Users\Aňula\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
  HKU\Guest\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
  HKU\Guest\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Guest\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKU\Guest\...\Run: [Vagex] - C:\Users\Guest\Desktop\Vagex\Vagex.exe
  HKU\Guest\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe
  HKU\Guest\...\Run: [uTorrent] - C:\Program Files (x86)\uTorrent\uTorrent.exe [802136 2013-05-02] (BitTorrent Inc.)
  HKU\Guest\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1815976 2014-01-27] (Valve Corporation)
  HKU\Guest\...\Run: [] - [x]
  HKU\Guest\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1088424 2012-10-13] (Nokia)
  HKU\Guest\...\Run: [LSVP] - C:\Program Files (x86)\LS\Vypnutí PC\vp.exe [155648 2005-05-18] (Ladislav SKOKAN, +420602507810, ladislav.skokan@seznam.cz)
  HKU\Guest\...\Run: [AdobeBridge] - [x]
  HKU\Guest\...\RunOnce: [LSVP] - C:\Program Files (x86)\LS\Vypnutí PC\vp.exe [155648 2005-05-18] (Ladislav SKOKAN, +420602507810, ladislav.skokan@seznam.cz)
  HKU\Tata\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Tata\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKU\Tata\...\Run: [Vagex] - C:\Users\Tata\Desktop\Vagex\Vagex.exe
  HKU\Tata\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe
  HKU\Tata\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1815976 2014-01-27] (Valve Corporation)
  HKU\Tata\...\Run: [] - [x]
  HKU\Tata\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1088424 2012-10-13] (Nokia)
  HKU\Tata\...\Run: [AdobeBridge] - [x]
  HKU\Tata\...\Run: [cz.seznam.software.szndesktop] - C:\Users\Tata\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
  HKU\Tata\...\Run: [cz.seznam.software.autoupdate] - C:\Users\Tata\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
  HKU\UpdatusUser\...\Run: [] - [x]
  HKU\UpdatusUser\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  Startup: C:\Users\Tata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
  ShortcutTarget: OpenOffice.org 3.0.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
  
  ==================== Internet (Whitelisted) ====================
  
  HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/?clid=16194
  HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.alawarhry.cz
  URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
  StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
  SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKCU - {3FFD3656-3884-4FDB-8935-E6A1B83AFAC8} URL = http://slovnik.seznam.cz/?q={searchTerm ... arch_16194
  SearchScopes: HKCU - {6D9B577E-0BA2-4CAA-9381-EBCEECD2F5F1} URL = http://slovnik.seznam.cz/?q={searchTerm ... arch_16194
  SearchScopes: HKCU - {7988364B-E115-4FD2-9CB2-DC67042BDFC9} URL = http://www.firmy.cz/?q={searchTerms}&so ... arch_16194
  SearchScopes: HKCU - {79CDD03F-56AA-4774-A4EF-E1EDD363ECAC} URL = http://www.mapy.cz/?query={searchTerms} ... arch_16194
  SearchScopes: HKCU - {89E8D30F-1080-4466-8C8F-6D36A547102A} URL = http://tv.seznam.cz/hledej?w={searchTer ... arch_16194
  SearchScopes: HKCU - {9051C4E3-9AC0-401A-980D-A14E0FBCCD41} URL = http://encyklopedie.seznam.cz/search?q= ... arch_16194
  SearchScopes: HKCU - {EB931DF8-5051-4FAE-9110-42274C835AA7} URL = http://www.zbozi.cz/?q={searchTerms}&r= ... arch_16194
  SearchScopes: HKCU - {EF2812D8-7E04-4D19-96A9-7F10F30BFBA5} URL = http://www.novinky.cz/hledej?w={searchT ... arch_16194
  BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
  BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
  BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
  BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
  BHO-x32: No Name - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - No File
  BHO-x32: No Name - {68DD98BF-9DE8-418C-89F0-E37AC61CC2D9} - No File
  BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
  BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
  BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
  BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
  Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
  Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
  Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
  Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
  Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
  Winsock: Catalog5 01 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
  Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [320000] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
  Tcpip\Parameters: [DhcpNameServer] 10.132.12.33 10.132.12.1
  
  FireFox:
  ========
  FF ProfilePath: C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default
  FF SearchEngineOrder.1: Ask.com
  FF Homepage: hxxp://www.jobego.com/search/
  FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
  FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
  FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
  FF Plugin: @microsoft.com/GENUINE - disabled No File
  FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
  FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
  FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
  FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
  FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
  FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
  FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
  FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
  FF Plugin-x32: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon)
  FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
  FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
  FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
  FF Plugin-x32: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll No File
  FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
  FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
  FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
  FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Jirka a Aneta\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
  FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jirka a Aneta\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
  FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
  FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
  FF SearchPlugin: C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\searchplugins\jobegocom.xml
  FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
  FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml
  FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
  FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
  FF Extension: Vagex Firefox Add-On - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\ffaddon@vagex.com [2013-03-29]
  FF Extension: VideoFileDownload - Download YouTube Videos - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\plugin@videofiledownload.com [2012-07-06]
  FF Extension: The Saloon Bar - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\saloonbar@ligny.org.uk [2011-02-18]
  FF Extension: Seznam lištička - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2013-05-17]
  FF Extension: Illimitux - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\illimitux@illimitux.net.xpi [2011-07-31]
  FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-03-11]
  FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-04-27]
  FF HKLM-x32\...\Firefox\Extensions: [xz123@ya456.com] - C:\Program Files (x86)\BetterSurf\ff
  FF HKLM-x32\...\Firefox\Extensions: [12x3q@3244516.com] - C:\Program Files (x86)\Better-Surf\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@bettersurfplus.com] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@WebexpEnhancedV1alpha510.net] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha510\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta63.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha142.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha142\ff
  FF Extension: Media Player - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha142\ff [2014-01-29]
  FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
  
  Chrome:
  =======
  CHR HomePage: https://www.google.cz/?gws_rd=cr
  CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
  CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
  CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
  CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File
  CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
  CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
  CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
  CHR Plugin: (Java(TM) Platform SE 6 U29) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
  CHR Plugin: (Windows Genuine Advantage) - C:\Program Files (x86)\Mozilla Firefox\plugins\npLegitCheckPlugin.dll (Microsoft Corporation)
  CHR Plugin: (2007 Microsoft Office system) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
  CHR Plugin: (Microsoft Office 2003) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
  CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
  CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll No File
  CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
  CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
  CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
  CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
  CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
  CHR Plugin: (Nexon Game Controller) - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
  CHR Plugin: (Unity Player) - C:\Users\Jirka a Aneta\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
  CHR Plugin: (Facebook Plugin) - C:\Users\Jirka a Aneta\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
  CHR Extension: (Angry Birds) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2012-03-01]
  CHR Extension: (YouTube) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-19]
  CHR Extension: (Media Player) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdmlifmcodeplijdlfnanamghkiidoij [2014-01-29]
  CHR Extension: (Vyhledávání Google) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-19]
  CHR Extension: (AdBlock) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-06-15]
  CHR Extension: (Peněženka Google) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
  CHR Extension: (Battlefield Play4Free) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiokahphinmbmakkehgelkmpolmnbkdh [2013-04-21]
  CHR Extension: (Gmail) - C:\Users\Jirka a Aneta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-19]
  CHR HKCU\...\Chrome\Extension: [bdkdmpigoicnmdhmhiafmpcfnfgpfnol] - C:\Users\Jirka a Aneta\AppData\Local\CRE\bdkdmpigoicnmdhmhiafmpcfnfgpfnol.crx [2011-12-19]
  CHR HKLM-x32\...\Chrome\Extension: [aaaajfocmnnhjaajccaelhippajhaeod] - C:\ProgramData\AskPartnerNetwork\Toolbar\ATU4-V7\CRX\ToolbarCR.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [bdkdmpigoicnmdhmhiafmpcfnfgpfnol] - C:\Users\Jirka a Aneta\AppData\Local\CRE\bdkdmpigoicnmdhmhiafmpcfnfgpfnol.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [egnimkioipookhfihpljiedpgjffibpa] - C:\Program Files (x86)\MyBrowserCash\MBC_chrome.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [mhfdcmehmjcclgopdodkjdicohagipid] - C:\Users\JIRKAA~1\AppData\Local\Temp\crxE74B.tmp [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [mmifolfpllfdhilecpdpmemhelmanajl] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [pfekkhdmhmddhjhfmkmfhojbjlihbopc] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ch\VideoPlayerV3beta63.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [pjbnadgnhhkoohnkddbceoldfibijgpk] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha510\ch\WebexpEnhancedV1alpha510.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [poheodfamflhhhdcmjfeggbgigeefaco] - C:\Program Files (x86)\Better-Surf\ch\Chrome.crx [2013-10-09]
  
  ==================== Services (Whitelisted) =================
  
  R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
  R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-11] (Avira Operations GmbH & Co. KG)
  R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-01-06] (APN LLC.)
  S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3849720 2012-09-02] (INCA Internet Co., Ltd.)
  R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-11-09] ()
  S4 RemoteAccess; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
  S3 SwitchBoard; "C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [x]
  
  ==================== Drivers (Whitelisted) ====================
  
  R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2010-07-17] ()
  R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
  R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
  R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-11] (Avira Operations GmbH & Co. KG)
  R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2011-05-31] (DT Soft Ltd)
  R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
  R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2010-07-17] ()
  S3 M1000Srv; C:\Windows\System32\Drivers\M1000KNT.sys [506496 2012-03-05] ()
  S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2005-01-03] (INCA Internet Co., Ltd.)
  R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799680 2009-05-20] ()
  R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-01-23] ()
  S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
  S3 TS_AR5416; C:\Windows\System32\DRIVERS\ts_athwx.sys [2156872 2011-09-05] (TamoSoft)
  S3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
  S3 ALSysIO; \??\C:\Users\JIRKAA~1\AppData\Local\Temp\ALSysIO64.sys [x]
  U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
  S3 catchme; \??\C:\ComboFix\catchme.sys [x]
  S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [x]
  S3 dump_wmimmc; \??\D:\Jirka\GamesCampus\DriftCity\GameGuard\dump_wmimmc.sys [x]
  S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
  U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42840 2009-06-10] (Microsoft Corporation)
  U3 tmlwf;
  U3 tmwfp;
  S3 usbbus; system32\DRIVERS\lgx64bus.sys [x]
  S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [x]
  S3 USBModem; system32\DRIVERS\lgx64modem.sys [x]
  S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
  
  ==================== NetSvcs (Whitelisted) ===================
  
  
  ==================== One Month Created Files and Folders ========
  
  2014-01-31 12:28 - 2014-01-31 12:28 - 00031323 _____ C:\Users\Jirka a Aneta\Desktop\FRST.txt
  2014-01-31 12:28 - 2014-01-31 12:28 - 00029696 _____ C:\Users\Jirka a Aneta\AppData\Local\MSGBOX.EXE
  2014-01-31 12:28 - 2014-01-31 12:28 - 00015327 _____ C:\Users\Jirka a Aneta\Desktop\LM.bat
  2014-01-31 12:27 - 2014-01-31 12:27 - 00052510 _____ C:\Users\Jirka a Aneta\Desktop\FRST3.txt
  2014-01-31 12:18 - 2014-01-31 12:18 - 00051795 _____ C:\Users\Jirka a Aneta\Desktop\Stargate-Universe-S01E13(0000153920).srt
  2014-01-31 11:50 - 2014-01-31 11:50 - 04009167 _____ C:\Users\Jirka a Aneta\Desktop\ServicesRepair.exe
  2014-01-31 11:50 - 2014-01-31 11:50 - 00000000 ____D C:\Users\Public\Desktop\CC Support
  2014-01-31 11:43 - 2014-01-31 11:43 - 00002614 _____ C:\Users\Jirka a Aneta\Desktop\FSS.txt
  2014-01-31 11:30 - 2014-01-31 11:35 - 00000000 ____D C:\AdwCleaner
  2014-01-31 11:28 - 2014-01-31 11:28 - 00361185 _____ (Farbar) C:\Users\Jirka a Aneta\Desktop\FSS.exe
  2014-01-31 11:26 - 2014-01-31 11:26 - 01166132 _____ C:\Users\Jirka a Aneta\Desktop\adwcleaner.exe
  2014-01-31 11:05 - 2014-01-31 11:05 - 00038118 _____ C:\Users\Jirka a Aneta\Desktop\Stargate-Universe-S01E12(0000153390).srt
  2014-01-31 11:02 - 2014-01-31 11:02 - 00008667 _____ C:\ComboFix.rar
  2014-01-31 10:55 - 2014-01-31 10:55 - 00104485 _____ C:\ComboFix.txt
  2014-01-31 10:25 - 2014-01-31 10:25 - 05177551 ____R (Swearware) C:\Users\Jirka a Aneta\Desktop\ComboFix.exe
  2014-01-31 10:22 - 2014-01-31 10:24 - 00005670 _____ C:\Users\Jirka a Aneta\Desktop\Rkill.txt
  2014-01-31 10:22 - 2014-01-31 10:22 - 01057016 _____ (Bleeping Computer, LLC) C:\Users\Jirka a Aneta\Desktop\rkill64.com
  2014-01-31 10:21 - 2014-01-31 10:22 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Jirka a Aneta\Desktop\rkill.com
  2014-01-31 09:36 - 2014-01-31 09:36 - 00016563 _____ C:\Users\Jirka a Aneta\Desktop\[CzT]Vdana_snoubenka_Accidental_Husband_2008_.torrent
  2014-01-31 09:24 - 2014-01-31 12:28 - 00000000 ____D C:\FRST
  2014-01-31 09:20 - 2014-01-31 09:20 - 00030014 _____ C:\Users\Jirka a Aneta\Desktop\Stargate-Universe-S01E11(0000152882).srt
  2014-01-31 09:19 - 2014-01-31 09:19 - 00112640 _____ (forum.viry.cz) C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe
  2014-01-31 09:17 - 2014-01-31 09:18 - 02079744 _____ (Farbar) C:\Users\Jirka a Aneta\Desktop\FRST64.exe
  2014-01-30 23:48 - 2014-01-30 23:48 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  2014-01-30 23:48 - 2014-01-30 23:48 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
  2014-01-30 23:48 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
  2014-01-30 23:43 - 2014-01-30 23:43 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Jirka a Aneta\Desktop\mbam-setup-1.75.0.1300.exe
  2014-01-30 15:33 - 2014-01-30 15:33 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
  2014-01-30 15:18 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\HitmanPro
  2014-01-30 14:51 - 2014-01-30 14:51 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Malwarebytes
  2014-01-30 14:50 - 2014-01-30 14:50 - 00000000 ____D C:\ProgramData\Malwarebytes
  2014-01-30 14:39 - 2014-01-30 14:39 - 00000000 ____D C:\Windows\ERUNT
  2014-01-29 23:48 - 2014-01-31 10:45 - 00000270 __RSH C:\ProgramData\ntuser.pol
  2014-01-29 23:48 - 2014-01-29 23:48 - 00000000 ____D C:\Program Files (x86)\MediaPlayerV1
  2014-01-26 09:35 - 2014-01-26 19:01 - 00000000 ____D C:\Users\Jirka a Aneta\Documents\ArcaniA - Gothic 4
  2014-01-26 09:35 - 2014-01-26 09:35 - 00000000 __SHD C:\ProgramData\SecuROM
  2014-01-24 21:59 - 2014-01-24 21:59 - 00000221 _____ C:\Users\Jirka a Aneta\Desktop\ArcaniA Gothic 4.url
  2014-01-23 21:45 - 2014-01-23 21:45 - 00001135 _____ C:\Users\Jirka a Aneta\Desktop\Nový textový dokument.TXT
  2014-01-19 16:16 - 2014-01-31 11:58 - 00010905 _____ C:\Windows\WindowsUpdate.log
  2014-01-18 18:08 - 2014-01-18 18:08 - 00000221 _____ C:\Users\Jirka a Aneta\Desktop\Arma 2.url
  2014-01-14 18:01 - 2014-01-14 18:01 - 00001016 _____ C:\Users\Public\Desktop\Mumble.lnk
  2014-01-13 18:46 - 2014-01-13 18:46 - 00001238 _____ C:\Users\Jirka a Aneta\Desktop\TeamSpeak 3 Client.lnk
  2014-01-13 18:46 - 2014-01-13 18:46 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
  2014-01-13 18:46 - 2014-01-13 18:46 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\TeamSpeak 3 Client
  2014-01-13 16:48 - 2014-01-13 17:22 - 590753870 _____ C:\Users\Jirka a Aneta\Desktop\Quiet-Rage---The-Stanford-Prison-Experiment.mov
  2014-01-11 14:50 - 2014-01-11 14:50 - 00000000 ____D C:\Users\Jirka a Aneta\Desktop\AS51
  2014-01-10 20:36 - 2014-01-10 20:36 - 00002996 _____ C:\Windows\System32\Tasks\{6F1413CC-D5A1-40D3-93F3-D4B4CADEB814}
  2014-01-10 20:35 - 2014-01-10 20:35 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\com.immersyve.Paladin.live
  2014-01-10 08:28 - 2014-01-10 08:28 - 00001082 _____ C:\Users\Jirka a Aneta\Desktop\Wow – zástupce.lnk
  2014-01-08 19:30 - 2014-01-31 10:45 - 00011398 _____ C:\Windows\PFRO.log
  2014-01-05 14:18 - 2014-01-05 14:18 - 00000770 _____ C:\Users\Public\Desktop\Game Dev Tycoon.lnk
  2014-01-01 14:40 - 2014-01-01 14:40 - 00000000 ____D C:\Users\Jirka a Aneta\Documents\SavedGames
  
  ==================== One Month Modified Files and Folders =======
  
  2014-01-31 12:28 - 2014-01-31 12:28 - 00031323 _____ C:\Users\Jirka a Aneta\Desktop\FRST.txt
  2014-01-31 12:28 - 2014-01-31 12:28 - 00029696 _____ C:\Users\Jirka a Aneta\AppData\Local\MSGBOX.EXE
  2014-01-31 12:28 - 2014-01-31 12:28 - 00015327 _____ C:\Users\Jirka a Aneta\Desktop\LM.bat
  2014-01-31 12:28 - 2014-01-31 09:24 - 00000000 ____D C:\FRST
  2014-01-31 12:28 - 2012-08-23 21:20 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\uTorrent
  2014-01-31 12:27 - 2014-01-31 12:27 - 00052510 _____ C:\Users\Jirka a Aneta\Desktop\FRST3.txt
  2014-01-31 12:18 - 2014-01-31 12:18 - 00051795 _____ C:\Users\Jirka a Aneta\Desktop\Stargate-Universe-S01E13(0000153920).srt
  2014-01-31 12:08 - 2009-08-03 21:00 - 00672386 _____ C:\Windows\system32\perfh005.dat
  2014-01-31 12:08 - 2009-08-03 21:00 - 00142950 _____ C:\Windows\system32\perfc005.dat
  2014-01-31 12:08 - 2009-07-14 06:13 - 01593024 _____ C:\Windows\system32\PerfStringBackup.INI
  2014-01-31 12:02 - 2009-07-14 05:45 - 00010240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  2014-01-31 12:02 - 2009-07-14 05:45 - 00010240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  2014-01-31 11:58 - 2014-01-19 16:16 - 00010905 _____ C:\Windows\WindowsUpdate.log
  2014-01-31 11:57 - 2013-05-17 11:26 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz
  2014-01-31 11:53 - 2010-02-02 17:52 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Skype
  2014-01-31 11:52 - 2013-12-14 14:35 - 00004682 _____ C:\Windows\setupact.log
  2014-01-31 11:52 - 2011-03-15 19:04 - 00000962 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
  2014-01-31 11:52 - 2009-12-26 21:30 - 00000000 ____D C:\ProgramData\NVIDIA
  2014-01-31 11:52 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
  2014-01-31 11:50 - 2014-01-31 11:50 - 04009167 _____ C:\Users\Jirka a Aneta\Desktop\ServicesRepair.exe
  2014-01-31 11:50 - 2014-01-31 11:50 - 00000000 ____D C:\Users\Public\Desktop\CC Support
  2014-01-31 11:46 - 2011-03-15 19:04 - 00000966 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
  2014-01-31 11:43 - 2014-01-31 11:43 - 00002614 _____ C:\Users\Jirka a Aneta\Desktop\FSS.txt
  2014-01-31 11:36 - 2013-10-07 19:15 - 00045056 _____ C:\Windows\system32\acovcnt.exe
  2014-01-31 11:35 - 2014-01-31 11:30 - 00000000 ____D C:\AdwCleaner
  2014-01-31 11:33 - 2013-02-23 09:52 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
  2014-01-31 11:28 - 2014-01-31 11:28 - 00361185 _____ (Farbar) C:\Users\Jirka a Aneta\Desktop\FSS.exe
  2014-01-31 11:26 - 2014-01-31 11:26 - 01166132 _____ C:\Users\Jirka a Aneta\Desktop\adwcleaner.exe
  2014-01-31 11:05 - 2014-01-31 11:05 - 00038118 _____ C:\Users\Jirka a Aneta\Desktop\Stargate-Universe-S01E12(0000153390).srt
  2014-01-31 11:02 - 2014-01-31 11:02 - 00008667 _____ C:\ComboFix.rar
  2014-01-31 10:55 - 2014-01-31 10:55 - 00104485 _____ C:\ComboFix.txt
  2014-01-31 10:55 - 2011-12-23 10:10 - 00000000 ____D C:\Qoobox
  2014-01-31 10:47 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
  2014-01-31 10:45 - 2014-01-29 23:48 - 00000270 __RSH C:\ProgramData\ntuser.pol
  2014-01-31 10:45 - 2014-01-08 19:30 - 00011398 _____ C:\Windows\PFRO.log
  2014-01-31 10:27 - 2009-07-14 06:08 - 00032576 _____ C:\Windows\Tasks\SCHEDLGU.TXT
  2014-01-31 10:25 - 2014-01-31 10:25 - 05177551 ____R (Swearware) C:\Users\Jirka a Aneta\Desktop\ComboFix.exe
  2014-01-31 10:24 - 2014-01-31 10:22 - 00005670 _____ C:\Users\Jirka a Aneta\Desktop\Rkill.txt
  2014-01-31 10:22 - 2014-01-31 10:22 - 01057016 _____ (Bleeping Computer, LLC) C:\Users\Jirka a Aneta\Desktop\rkill64.com
  2014-01-31 10:22 - 2014-01-31 10:21 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Jirka a Aneta\Desktop\rkill.com
  2014-01-31 09:36 - 2014-01-31 09:36 - 00016563 _____ C:\Users\Jirka a Aneta\Desktop\[CzT]Vdana_snoubenka_Accidental_Husband_2008_.torrent
  2014-01-31 09:20 - 2014-01-31 09:20 - 00030014 _____ C:\Users\Jirka a Aneta\Desktop\Stargate-Universe-S01E11(0000152882).srt
  2014-01-31 09:19 - 2014-01-31 09:19 - 00112640 _____ (forum.viry.cz) C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe
  2014-01-31 09:18 - 2014-01-31 09:17 - 02079744 _____ (Farbar) C:\Users\Jirka a Aneta\Desktop\FRST64.exe
  2014-01-30 23:48 - 2014-01-30 23:48 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
  2014-01-30 23:48 - 2014-01-30 23:48 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
  2014-01-30 23:43 - 2014-01-30 23:43 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Jirka a Aneta\Desktop\mbam-setup-1.75.0.1300.exe
  2014-01-30 18:53 - 2012-02-10 08:29 - 00000000 ____D C:\Program Files (x86)\Steam
  2014-01-30 15:34 - 2014-01-30 15:18 - 00000000 ____D C:\ProgramData\HitmanPro
  2014-01-30 15:33 - 2014-01-30 15:33 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
  2014-01-30 15:08 - 2013-10-07 18:14 - 00000000 __SHD C:\Users\Jirka a Aneta\fxiuy
  2014-01-30 14:51 - 2014-01-30 14:51 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Malwarebytes
  2014-01-30 14:50 - 2014-01-30 14:50 - 00000000 ____D C:\ProgramData\Malwarebytes
  2014-01-30 14:39 - 2014-01-30 14:39 - 00000000 ____D C:\Windows\ERUNT
  2014-01-30 14:29 - 2010-01-23 14:31 - 00000000 ____D C:\ProgramData\ICQ
  2014-01-29 23:48 - 2014-01-29 23:48 - 00000000 ____D C:\Program Files (x86)\MediaPlayerV1
  2014-01-29 23:48 - 2010-01-21 18:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
  2014-01-29 23:48 - 2009-07-14 04:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
  2014-01-29 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
  2014-01-29 15:20 - 2012-10-05 12:22 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\PMB Files
  2014-01-28 23:31 - 2013-04-03 18:27 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\CrashDumps
  2014-01-28 13:25 - 2013-08-29 11:13 - 00000000 ____D C:\Users\Jirka a Aneta\Desktop\Přidat
  2014-01-26 19:01 - 2014-01-26 09:35 - 00000000 ____D C:\Users\Jirka a Aneta\Documents\ArcaniA - Gothic 4
  2014-01-26 09:35 - 2014-01-26 09:35 - 00000000 __SHD C:\ProgramData\SecuROM
  2014-01-26 09:34 - 2013-12-21 17:40 - 00052881 _____ C:\Windows\DirectX.log
  2014-01-24 21:59 - 2014-01-24 21:59 - 00000221 _____ C:\Users\Jirka a Aneta\Desktop\ArcaniA Gothic 4.url
  2014-01-23 21:45 - 2014-01-23 21:45 - 00001135 _____ C:\Users\Jirka a Aneta\Desktop\Nový textový dokument.TXT
  2014-01-22 19:49 - 2012-01-16 16:38 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\TS3Client
  2014-01-18 18:08 - 2014-01-18 18:08 - 00000221 _____ C:\Users\Jirka a Aneta\Desktop\Arma 2.url
  2014-01-16 18:49 - 2010-02-02 12:26 - 00000600 _____ C:\Users\Jirka a Aneta\AppData\Roaming\winscp.rnd
  2014-01-15 18:39 - 2011-05-26 17:20 - 06942208 ___SH C:\Users\Jirka a Aneta\Desktop\Thumbs.db
  2014-01-14 18:01 - 2014-01-14 18:01 - 00001016 _____ C:\Users\Public\Desktop\Mumble.lnk
  2014-01-14 18:01 - 2012-01-12 17:40 - 00000000 ____D C:\Program Files (x86)\Mumble
  2014-01-13 18:46 - 2014-01-13 18:46 - 00001238 _____ C:\Users\Jirka a Aneta\Desktop\TeamSpeak 3 Client.lnk
  2014-01-13 18:46 - 2014-01-13 18:46 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
  2014-01-13 18:46 - 2014-01-13 18:46 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\TeamSpeak 3 Client
  2014-01-13 17:22 - 2014-01-13 16:48 - 590753870 _____ C:\Users\Jirka a Aneta\Desktop\Quiet-Rage---The-Stanford-Prison-Experiment.mov
  2014-01-11 14:50 - 2014-01-11 14:50 - 00000000 ____D C:\Users\Jirka a Aneta\Desktop\AS51
  2014-01-10 20:36 - 2014-01-10 20:36 - 00002996 _____ C:\Windows\System32\Tasks\{6F1413CC-D5A1-40D3-93F3-D4B4CADEB814}
  2014-01-10 20:35 - 2014-01-10 20:35 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Roaming\com.immersyve.Paladin.live
  2014-01-10 20:11 - 2012-11-21 15:24 - 00000000 __SHD C:\Users\Jirka a Aneta\Userdata
  2014-01-10 08:28 - 2014-01-10 08:28 - 00001082 _____ C:\Users\Jirka a Aneta\Desktop\Wow – zástupce.lnk
  2014-01-09 21:18 - 2013-05-17 11:42 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\Game Dev Tycoon
  2014-01-09 17:21 - 2013-07-23 16:58 - 00000000 ____D C:\Users\Jirka a Aneta\Desktop\Anet
  2014-01-09 17:19 - 2011-01-11 14:31 - 00000000 ___RD C:\Users\Jirka a Aneta\Desktop\Jjohny
  2014-01-06 14:11 - 2013-11-08 14:44 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\VNT
  2014-01-06 14:10 - 2013-11-08 14:44 - 00000000 ____D C:\Program Files (x86)\VNT
  2014-01-05 14:18 - 2014-01-05 14:18 - 00000770 _____ C:\Users\Public\Desktop\Game Dev Tycoon.lnk
  2014-01-01 20:47 - 2012-08-26 08:39 - 00000000 ____D C:\Users\Jirka a Aneta\AppData\Local\FalloutNV
  2014-01-01 14:40 - 2014-01-01 14:40 - 00000000 ____D C:\Users\Jirka a Aneta\Documents\SavedGames
  
  Some content of TEMP:
  ====================
  C:\Users\Jirka a Aneta\AppData\Local\Temp\avgnt.exe
  C:\Users\Jirka a Aneta\AppData\Local\Temp\Quarantine.exe
  
  
  ==================== Bamital & volsnap Check =================
  
  C:\Windows\System32\winlogon.exe => MD5 is legit
  C:\Windows\System32\wininit.exe => MD5 is legit
  C:\Windows\SysWOW64\wininit.exe => MD5 is legit
  C:\Windows\explorer.exe => MD5 is legit
  C:\Windows\SysWOW64\explorer.exe => MD5 is legit
  C:\Windows\System32\svchost.exe => MD5 is legit
  C:\Windows\SysWOW64\svchost.exe => MD5 is legit
  C:\Windows\System32\services.exe => MD5 is legit
  C:\Windows\System32\User32.dll => MD5 is legit
  C:\Windows\SysWOW64\User32.dll => MD5 is legit
  C:\Windows\System32\userinit.exe => MD5 is legit
  C:\Windows\SysWOW64\userinit.exe => MD5 is legit
  C:\Windows\System32\rpcss.dll => MD5 is legit
  C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
  
  
  LastRegBack: 2014-01-19 09:33
  
  ==================== End Of Log ============================

[vyosek]

Udelam si kafe a mrknu na to, jelikoz je tam cela zoo i babkou pokladni

[vyosek]

Tvorba fixlistu pro FRST

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  Start
  HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
  HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
  HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
  HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [195536 2014-01-06] (APN LLC.)
  HKCU\...\Run: [AdobeBridge] - [x]
  HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKCU\...\Run: [uTorrent] - C:\Program Files (x86)\uTorrent\uTorrent.exe [802136 2013-05-02] (BitTorrent Inc.)
  HKCU\...\Run: [cz.seznam.software.autoupdate] - C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
  HKCU\...\Run: [cz.seznam.software.szndesktop] - C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
  HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Aňula\...\Run: [MyWebSearch Email Plugin] - C:\PROGRA~2\MYWEBS~1\bar\1.bin\mwsoemon.exe
  HKU\Aňula\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Aňula\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKU\Aňula\...\Run: [Vagex] - C:\Users\Aňula\Desktop\Vagex\Vagex.exe
  HKU\Aňula\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe
  HKU\Aňula\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1815976 2014-01-27] (Valve Corporation)
  HKU\Aňula\...\Run: [] - [x]
  HKU\Aňula\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1088424 2012-10-13] (Nokia)
  HKU\Aňula\...\Run: [AdobeBridge] - [x]
  HKU\Aňula\...\Run: [cz.seznam.software.szndesktop] - C:\Users\Aňula\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
  HKU\Aňula\...\Run: [cz.seznam.software.autoupdate] - C:\Users\Aňula\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
  HKU\Guest\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
  HKU\Guest\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Guest\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKU\Guest\...\Run: [Vagex] - C:\Users\Guest\Desktop\Vagex\Vagex.exe
  HKU\Guest\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe
  HKU\Guest\...\Run: [uTorrent] - C:\Program Files (x86)\uTorrent\uTorrent.exe [802136 2013-05-02] (BitTorrent Inc.)
  HKU\Guest\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1815976 2014-01-27] (Valve Corporation)
  HKU\Guest\...\Run: [] - [x]
  HKU\Guest\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1088424 2012-10-13] (Nokia)
  HKU\Guest\...\Run: [LSVP] - C:\Program Files (x86)\LS\Vypnutí PC\vp.exe [155648 2005-05-18] (Ladislav SKOKAN, +420602507810, ladislav.skokan@seznam.cz)
  HKU\Guest\...\Run: [AdobeBridge] - [x]
  HKU\Guest\...\RunOnce: [LSVP] - C:\Program Files (x86)\LS\Vypnutí PC\vp.exe [155648 2005-05-18] (Ladislav SKOKAN, +420602507810, ladislav.skokan@seznam.cz)
  HKU\Tata\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Tata\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKU\Tata\...\Run: [Vagex] - C:\Users\Tata\Desktop\Vagex\Vagex.exe
  HKU\Tata\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe
  HKU\Tata\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1815976 2014-01-27] (Valve Corporation)
  HKU\Tata\...\Run: [] - [x]
  HKU\Tata\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1088424 2012-10-13] (Nokia)
  HKU\Tata\...\Run: [AdobeBridge] - [x]
  HKU\Tata\...\Run: [cz.seznam.software.szndesktop] - C:\Users\Tata\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
  HKU\Tata\...\Run: [cz.seznam.software.autoupdate] - C:\Users\Tata\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
  HKU\UpdatusUser\...\Run: [] - [x]
  HKU\UpdatusUser\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  Startup: C:\Users\Tata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
  
  HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.alawarhry.cz
  URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
  SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  
  FF SearchEngineOrder.1: Ask.com
  FF Homepage: hxxp://www.jobego.com/search/
  FF Plugin-x32: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll No File
  FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
  FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Jirka a Aneta\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
  FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  FF SearchPlugin: C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\searchplugins\jobegocom.xml
  FF Extension: Vagex Firefox Add-On - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\ffaddon@vagex.com [2013-03-29]
  FF Extension: VideoFileDownload - Download YouTube Videos - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\plugin@videofiledownload.com [2012-07-06]
  FF Extension: The Saloon Bar - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\saloonbar@ligny.org.uk [2011-02-18]
  FF Extension: Seznam lištička - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2013-05-17]
  FF Extension: Illimitux - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\illimitux@illimitux.net.xpi [2011-07-31]
  FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-03-11]
  FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-04-27]
  FF HKLM-x32\...\Firefox\Extensions: [xz123@ya456.com] - C:\Program Files (x86)\BetterSurf\ff
  FF HKLM-x32\...\Firefox\Extensions: [12x3q@3244516.com] - C:\Program Files (x86)\Better-Surf\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@bettersurfplus.com] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@WebexpEnhancedV1alpha510.net] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha510\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta63.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha142.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha142\ff
  FF Extension: Media Player - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha142\ff [2014-01-29]
  FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
  
  CHR HKCU\...\Chrome\Extension: [bdkdmpigoicnmdhmhiafmpcfnfgpfnol] - C:\Users\Jirka a Aneta\AppData\Local\CRE\bdkdmpigoicnmdhmhiafmpcfnfgpfnol.crx [2011-12-19]
  CHR HKLM-x32\...\Chrome\Extension: [aaaajfocmnnhjaajccaelhippajhaeod] - C:\ProgramData\AskPartnerNetwork\Toolbar\ATU4-V7\CRX\ToolbarCR.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [bdkdmpigoicnmdhmhiafmpcfnfgpfnol] - C:\Users\Jirka a Aneta\AppData\Local\CRE\bdkdmpigoicnmdhmhiafmpcfnfgpfnol.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [egnimkioipookhfihpljiedpgjffibpa] - C:\Program Files (x86)\MyBrowserCash\MBC_chrome.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [mhfdcmehmjcclgopdodkjdicohagipid] - C:\Users\JIRKAA~1\AppData\Local\Temp\crxE74B.tmp [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [mmifolfpllfdhilecpdpmemhelmanajl] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [pfekkhdmhmddhjhfmkmfhojbjlihbopc] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ch\VideoPlayerV3beta63.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [pjbnadgnhhkoohnkddbceoldfibijgpk] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha510\ch\WebexpEnhancedV1alpha510.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [poheodfamflhhhdcmjfeggbgigeefaco] - C:\Program Files (x86)\Better-Surf\ch\Chrome.crx [2013-10-09]
  
  R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-01-06] (APN LLC.)
  U3 tmlwf;
  U3 tmwfp;
  S3 usbbus; system32\DRIVERS\lgx64bus.sys [x]
  S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [x]
  S3 USBModem; system32\DRIVERS\lgx64modem.sys [x]
  S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
  
  2014-01-31 12:28 - 2014-01-31 12:28 - 00031323 _____ C:\Users\Jirka a Aneta\Desktop\FRST.txt
  2014-01-31 12:28 - 2014-01-31 12:28 - 00029696 _____ C:\Users\Jirka a Aneta\AppData\Local\MSGBOX.EXE
  2014-01-31 12:28 - 2014-01-31 12:28 - 00015327 _____ C:\Users\Jirka a Aneta\Desktop\LM.bat
  2014-01-31 12:27 - 2014-01-31 12:27 - 00052510 _____ C:\Users\Jirka a Aneta\Desktop\FRST3.txt
  2014-01-31 11:50 - 2014-01-31 11:50 - 04009167 _____ C:\Users\Jirka a Aneta\Desktop\ServicesRepair.exe
  2014-01-31 11:50 - 2014-01-31 11:50 - 00000000 ____D C:\Users\Public\Desktop\CC Support
  2014-01-31 11:43 - 2014-01-31 11:43 - 00002614 _____ C:\Users\Jirka a Aneta\Desktop\FSS.txt
  2014-01-31 11:28 - 2014-01-31 11:28 - 00361185 _____ (Farbar) C:\Users\Jirka a Aneta\Desktop\FSS.exe
  2014-01-31 11:26 - 2014-01-31 11:26 - 01166132 _____ C:\Users\Jirka a Aneta\Desktop\adwcleaner.exe
  2014-01-31 11:02 - 2014-01-31 11:02 - 00008667 _____ C:\ComboFix.rar
  2014-01-31 10:55 - 2014-01-31 10:55 - 00104485 _____ C:\ComboFix.txt
  2014-01-31 10:22 - 2014-01-31 10:24 - 00005670 _____ C:\Users\Jirka a Aneta\Desktop\Rkill.txt
  2014-01-31 10:22 - 2014-01-31 10:22 - 01057016 _____ (Bleeping Computer, LLC) C:\Users\Jirka a Aneta\Desktop\rkill64.com
  2014-01-31 10:21 - 2014-01-31 10:22 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Jirka a Aneta\Desktop\rkill.com
  2014-01-31 09:19 - 2014-01-31 09:19 - 00112640 _____ (forum.viry.cz) C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe
  2014-01-30 23:43 - 2014-01-30 23:43 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Jirka a Aneta\Desktop\mbam-setup-1.75.0.1300.exe
  2014-01-30 15:33 - 2014-01-30 15:33 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
  C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe
  2014-01-30 15:18 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\HitmanPro
  2014-01-29 23:48 - 2014-01-29 23:48 - 00000000 ____D C:\Program Files (x86)\MediaPlayerV1
  C:\Users\Jirka a Aneta\AppData\Local\Temp\avgnt.exe
  C:\Users\Jirka a Aneta\AppData\Local\Temp\Quarantine.exe
  C:\ProgramData\AskPartnerNetwork
  C:\Program Files (x86)\BetterSurf
  C:\Program Files (x86)\WebexpEnhancedV1
  C:\Program Files (x86)\MediaPlayerV1
  C:\Program Files (x86)\AskPartnerNetwork
  
  Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  
  AlternateDataStreams: C:\Windows\System32:{4B9A1497-0817-47C4-9612-D6A1C53ACF57}
  AlternateDataStreams: C:\ProgramData\Temp:07F6D9E4
  AlternateDataStreams: C:\ProgramData\Temp:15024E60
  AlternateDataStreams: C:\ProgramData\Temp:4CF61E54
  AlternateDataStreams: C:\ProgramData\Temp:596E2371
  AlternateDataStreams: C:\ProgramData\Temp:68C295D4
  AlternateDataStreams: C:\ProgramData\Temp:734E442A
  AlternateDataStreams: C:\ProgramData\Temp:75D366A3
  AlternateDataStreams: C:\ProgramData\Temp:A724744F
  AlternateDataStreams: C:\ProgramData\Temp:A8ADE5D8
  AlternateDataStreams: C:\ProgramData\Temp:AB689DEA
  AlternateDataStreams: C:\ProgramData\Temp:B88E99C8
  AlternateDataStreams: C:\ProgramData\Temp:BB24555F
  AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1
  AlternateDataStreams: C:\ProgramData\Temp:DFC5A2B2
  
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPeerNexonEU" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Soluto" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ JCC - AutoClickerBot.lnk" /f
  
  CMD: shutdown /r /f /t 2
  
  End

• Ulozte vytvoreny TXT jako fixlist.txt
• Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

• Kliknete na Fix
• Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

[Jjohny]

Fixlog se objevil, NTB se nerestartoval. Resetnu manuálně.

• Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 29-01-2014 01
  Ran by Jirka a Aneta at 2014-01-31 13:00:17 Run:1
  Running from C:\Users\Jirka a Aneta\Desktop
  Boot Mode: Normal
  ==============================================
  
  Content of fixlist:
  *****************
  Start
  HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
  HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
  HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
  HKLM-x32\...\Run: [VNT] - C:\Program Files (x86)\VNT\vntldr.exe [195536 2014-01-06] (APN LLC.)
  HKCU\...\Run: [AdobeBridge] - [x]
  HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKCU\...\Run: [uTorrent] - C:\Program Files (x86)\uTorrent\uTorrent.exe [802136 2013-05-02] (BitTorrent Inc.)
  HKCU\...\Run: [cz.seznam.software.autoupdate] - C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
  HKCU\...\Run: [cz.seznam.software.szndesktop] - C:\Users\Jirka a Aneta\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
  HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Aňula\...\Run: [MyWebSearch Email Plugin] - C:\PROGRA~2\MYWEBS~1\bar\1.bin\mwsoemon.exe
  HKU\Aňula\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Aňula\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKU\Aňula\...\Run: [Vagex] - C:\Users\Aňula\Desktop\Vagex\Vagex.exe
  HKU\Aňula\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe
  HKU\Aňula\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1815976 2014-01-27] (Valve Corporation)
  HKU\Aňula\...\Run: [] - [x]
  HKU\Aňula\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1088424 2012-10-13] (Nokia)
  HKU\Aňula\...\Run: [AdobeBridge] - [x]
  HKU\Aňula\...\Run: [cz.seznam.software.szndesktop] - C:\Users\Aňula\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
  HKU\Aňula\...\Run: [cz.seznam.software.autoupdate] - C:\Users\Aňula\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
  HKU\Guest\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
  HKU\Guest\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Guest\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKU\Guest\...\Run: [Vagex] - C:\Users\Guest\Desktop\Vagex\Vagex.exe
  HKU\Guest\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe
  HKU\Guest\...\Run: [uTorrent] - C:\Program Files (x86)\uTorrent\uTorrent.exe [802136 2013-05-02] (BitTorrent Inc.)
  HKU\Guest\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1815976 2014-01-27] (Valve Corporation)
  HKU\Guest\...\Run: [] - [x]
  HKU\Guest\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1088424 2012-10-13] (Nokia)
  HKU\Guest\...\Run: [LSVP] - C:\Program Files (x86)\LS\Vypnutí PC\vp.exe [155648 2005-05-18] (Ladislav SKOKAN, +420602507810, ladislav.skokan@seznam.cz)
  HKU\Guest\...\Run: [AdobeBridge] - [x]
  HKU\Guest\...\RunOnce: [LSVP] - C:\Program Files (x86)\LS\Vypnutí PC\vp.exe [155648 2005-05-18] (Ladislav SKOKAN, +420602507810, ladislav.skokan@seznam.cz)
  HKU\Tata\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\Tata\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  HKU\Tata\...\Run: [Vagex] - C:\Users\Tata\Desktop\Vagex\Vagex.exe
  HKU\Tata\...\Run: [KPeerNexonEU] - C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe
  HKU\Tata\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1815976 2014-01-27] (Valve Corporation)
  HKU\Tata\...\Run: [] - [x]
  HKU\Tata\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1088424 2012-10-13] (Nokia)
  HKU\Tata\...\Run: [AdobeBridge] - [x]
  HKU\Tata\...\Run: [cz.seznam.software.szndesktop] - C:\Users\Tata\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
  HKU\Tata\...\Run: [cz.seznam.software.autoupdate] - C:\Users\Tata\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
  HKU\UpdatusUser\...\Run: [] - [x]
  HKU\UpdatusUser\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
  Startup: C:\Users\Tata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
  
  HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.alawarhry.cz
  URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
  SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  
  FF SearchEngineOrder.1: Ask.com
  FF Homepage: hxxp://www.jobego.com/search/
  FF Plugin-x32: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll No File
  FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  FF Plugin-x32: @videolan.org/vlc,version=2.1.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
  FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Jirka a Aneta\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
  FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
  FF SearchPlugin: C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\searchplugins\jobegocom.xml
  FF Extension: Vagex Firefox Add-On - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\ffaddon@vagex.com [2013-03-29]
  FF Extension: VideoFileDownload - Download YouTube Videos - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\plugin@videofiledownload.com [2012-07-06]
  FF Extension: The Saloon Bar - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\saloonbar@ligny.org.uk [2011-02-18]
  FF Extension: Seznam lištička - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2013-05-17]
  FF Extension: Illimitux - C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\illimitux@illimitux.net.xpi [2011-07-31]
  FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-03-11]
  FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-04-27]
  FF HKLM-x32\...\Firefox\Extensions: [xz123@ya456.com] - C:\Program Files (x86)\BetterSurf\ff
  FF HKLM-x32\...\Firefox\Extensions: [12x3q@3244516.com] - C:\Program Files (x86)\Better-Surf\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@bettersurfplus.com] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@WebexpEnhancedV1alpha510.net] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha510\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@VideoPlayerV3beta63.net] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ff
  FF HKLM-x32\...\Firefox\Extensions: [ext@MediaPlayerV1alpha142.net] - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha142\ff
  FF Extension: Media Player - C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha142\ff [2014-01-29]
  FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
  
  CHR HKCU\...\Chrome\Extension: [bdkdmpigoicnmdhmhiafmpcfnfgpfnol] - C:\Users\Jirka a Aneta\AppData\Local\CRE\bdkdmpigoicnmdhmhiafmpcfnfgpfnol.crx [2011-12-19]
  CHR HKLM-x32\...\Chrome\Extension: [aaaajfocmnnhjaajccaelhippajhaeod] - C:\ProgramData\AskPartnerNetwork\Toolbar\ATU4-V7\CRX\ToolbarCR.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [bdkdmpigoicnmdhmhiafmpcfnfgpfnol] - C:\Users\Jirka a Aneta\AppData\Local\CRE\bdkdmpigoicnmdhmhiafmpcfnfgpfnol.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [egnimkioipookhfihpljiedpgjffibpa] - C:\Program Files (x86)\MyBrowserCash\MBC_chrome.crx [2014-01-06]
  CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [mhfdcmehmjcclgopdodkjdicohagipid] - C:\Users\JIRKAA~1\AppData\Local\Temp\crxE74B.tmp [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [mmifolfpllfdhilecpdpmemhelmanajl] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [pfekkhdmhmddhjhfmkmfhojbjlihbopc] - C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ch\VideoPlayerV3beta63.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [pjbnadgnhhkoohnkddbceoldfibijgpk] - C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha510\ch\WebexpEnhancedV1alpha510.crx [2013-10-09]
  CHR HKLM-x32\...\Chrome\Extension: [poheodfamflhhhdcmjfeggbgigeefaco] - C:\Program Files (x86)\Better-Surf\ch\Chrome.crx [2013-10-09]
  
  R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-01-06] (APN LLC.)
  U3 tmlwf;
  U3 tmwfp;
  S3 usbbus; system32\DRIVERS\lgx64bus.sys [x]
  S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [x]
  S3 USBModem; system32\DRIVERS\lgx64modem.sys [x]
  S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
  
  2014-01-31 12:28 - 2014-01-31 12:28 - 00031323 _____ C:\Users\Jirka a Aneta\Desktop\FRST.txt
  2014-01-31 12:28 - 2014-01-31 12:28 - 00029696 _____ C:\Users\Jirka a Aneta\AppData\Local\MSGBOX.EXE
  2014-01-31 12:28 - 2014-01-31 12:28 - 00015327 _____ C:\Users\Jirka a Aneta\Desktop\LM.bat
  2014-01-31 12:27 - 2014-01-31 12:27 - 00052510 _____ C:\Users\Jirka a Aneta\Desktop\FRST3.txt
  2014-01-31 11:50 - 2014-01-31 11:50 - 04009167 _____ C:\Users\Jirka a Aneta\Desktop\ServicesRepair.exe
  2014-01-31 11:50 - 2014-01-31 11:50 - 00000000 ____D C:\Users\Public\Desktop\CC Support
  2014-01-31 11:43 - 2014-01-31 11:43 - 00002614 _____ C:\Users\Jirka a Aneta\Desktop\FSS.txt
  2014-01-31 11:28 - 2014-01-31 11:28 - 00361185 _____ (Farbar) C:\Users\Jirka a Aneta\Desktop\FSS.exe
  2014-01-31 11:26 - 2014-01-31 11:26 - 01166132 _____ C:\Users\Jirka a Aneta\Desktop\adwcleaner.exe
  2014-01-31 11:02 - 2014-01-31 11:02 - 00008667 _____ C:\ComboFix.rar
  2014-01-31 10:55 - 2014-01-31 10:55 - 00104485 _____ C:\ComboFix.txt
  2014-01-31 10:22 - 2014-01-31 10:24 - 00005670 _____ C:\Users\Jirka a Aneta\Desktop\Rkill.txt
  2014-01-31 10:22 - 2014-01-31 10:22 - 01057016 _____ (Bleeping Computer, LLC) C:\Users\Jirka a Aneta\Desktop\rkill64.com
  2014-01-31 10:21 - 2014-01-31 10:22 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Jirka a Aneta\Desktop\rkill.com
  2014-01-31 09:19 - 2014-01-31 09:19 - 00112640 _____ (forum.viry.cz) C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe
  2014-01-30 23:43 - 2014-01-30 23:43 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Jirka a Aneta\Desktop\mbam-setup-1.75.0.1300.exe
  2014-01-30 15:33 - 2014-01-30 15:33 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
  C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe
  2014-01-30 15:18 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\HitmanPro
  2014-01-29 23:48 - 2014-01-29 23:48 - 00000000 ____D C:\Program Files (x86)\MediaPlayerV1
  C:\Users\Jirka a Aneta\AppData\Local\Temp\avgnt.exe
  C:\Users\Jirka a Aneta\AppData\Local\Temp\Quarantine.exe
  C:\ProgramData\AskPartnerNetwork
  C:\Program Files (x86)\BetterSurf
  C:\Program Files (x86)\WebexpEnhancedV1
  C:\Program Files (x86)\MediaPlayerV1
  C:\Program Files (x86)\AskPartnerNetwork
  
  Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  
  AlternateDataStreams: C:\Windows\System32:{4B9A1497-0817-47C4-9612-D6A1C53ACF57}
  AlternateDataStreams: C:\ProgramData\Temp:07F6D9E4
  AlternateDataStreams: C:\ProgramData\Temp:15024E60
  AlternateDataStreams: C:\ProgramData\Temp:4CF61E54
  AlternateDataStreams: C:\ProgramData\Temp:596E2371
  AlternateDataStreams: C:\ProgramData\Temp:68C295D4
  AlternateDataStreams: C:\ProgramData\Temp:734E442A
  AlternateDataStreams: C:\ProgramData\Temp:75D366A3
  AlternateDataStreams: C:\ProgramData\Temp:A724744F
  AlternateDataStreams: C:\ProgramData\Temp:A8ADE5D8
  AlternateDataStreams: C:\ProgramData\Temp:AB689DEA
  AlternateDataStreams: C:\ProgramData\Temp:B88E99C8
  AlternateDataStreams: C:\ProgramData\Temp:BB24555F
  AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1
  AlternateDataStreams: C:\ProgramData\Temp:DFC5A2B2
  
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPeerNexonEU" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Soluto" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent" /f
  REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ JCC - AutoClickerBot.lnk" /f
  
  CMD: shutdown /r /f /t 2
  
  End
  *****************
  
  HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\GrooveMonitor => Value deleted successfully.
  HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\avgnt => Value deleted successfully.
  HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value deleted successfully.
  HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\VNT => Value deleted successfully.
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => Value deleted successfully.
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Skype => Value deleted successfully.
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\uTorrent => Value deleted successfully.
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\cz.seznam.software.autoupdate => Value deleted successfully.
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\cz.seznam.software.szndesktop => Value deleted successfully.
  HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\MyWebSearch Email Plugin => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\Skype => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\Vagex => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\KPeerNexonEU => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\Steam => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\NokiaSuite.exe => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\cz.seznam.software.szndesktop => Value deleted successfully.
  HKU\Aňula\Software\Microsoft\Windows\CurrentVersion\Run\\cz.seznam.software.autoupdate => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\Skype => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\Vagex => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\KPeerNexonEU => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\uTorrent => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\Steam => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\NokiaSuite.exe => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\LSVP => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => Value deleted successfully.
  HKU\Guest\Software\Microsoft\Windows\CurrentVersion\RunOnce\\LSVP => Value deleted successfully.
  HKU\Tata\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => Value deleted successfully.
  HKU\Tata\Software\Microsoft\Windows\CurrentVersion\Run\\Skype => Value deleted successfully.
  HKU\Tata\Software\Microsoft\Windows\CurrentVersion\Run\\Vagex => Value deleted successfully.
  HKU\Tata\Software\Microsoft\Windows\CurrentVersion\Run\\KPeerNexonEU => Value deleted successfully.
  HKU\Tata\Software\Microsoft\Windows\CurrentVersion\Run\\Steam => Value deleted successfully.
  HKU\Tata\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
  HKU\Tata\Software\Microsoft\Windows\CurrentVersion\Run\\NokiaSuite.exe => Value deleted successfully.
  HKU\Tata\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => Value deleted successfully.
  HKU\Tata\Software\Microsoft\Windows\CurrentVersion\Run\\cz.seznam.software.szndesktop => Value deleted successfully.
  HKU\Tata\Software\Microsoft\Windows\CurrentVersion\Run\\cz.seznam.software.autoupdate => Value deleted successfully.
  HKU\UpdatusUser\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
  HKU\UpdatusUser\Software\Microsoft\Windows\CurrentVersion\Run\\Skype => Value deleted successfully.
  C:\Users\Tata\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk => Moved successfully.
  HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks\\ => Value deleted successfully.
  HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
  HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
  Firefox SearchEngineOrder.1 deleted successfully.
  Firefox homepage deleted successfully.
  HKLM\Software\Wow6432Node\MozillaPlugins\@ogplanet.com/npOGPPlugin => Key deleted successfully.
  C:\Windows\system32\npOGPPlugin.dll not found.
  HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin => Key deleted successfully.
  C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => Moved successfully.
  HKLM\Software\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.0 => Key deleted successfully.
  C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll not found.
  HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3 => Key deleted successfully.
  C:\Users\Jirka a Aneta\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll => Moved successfully.
  HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin => Key deleted successfully.
  C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll not found.
  C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\searchplugins\jobegocom.xml => Moved successfully.
  C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\ffaddon@vagex.com => Moved successfully.
  C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\plugin@videofiledownload.com => Moved successfully.
  C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\saloonbar@ligny.org.uk => Moved successfully.
  C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} => Moved successfully.
  C:\Users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\Extensions\illimitux@illimitux.net.xpi => Moved successfully.
  C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} => Moved successfully.
  C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} => Moved successfully.
  HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\xz123@ya456.com => Value deleted successfully.
  HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\12x3q@3244516.com => Value deleted successfully.
  HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\ext@bettersurfplus.com => Value deleted successfully.
  HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\ext@WebexpEnhancedV1alpha510.net => Value deleted successfully.
  HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\ext@VideoPlayerV3beta63.net => Value deleted successfully.
  HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\ext@MediaPlayerV1alpha142.net => Value deleted successfully.
  C:\Program Files (x86)\MediaPlayerV1\MediaPlayerV1alpha142\ff => Moved successfully.
  HKLM\Software\Wow6432Node\Mozilla\Thunderbird\Extensions\\eplgTb@eset.com => Value deleted successfully.
  HKCU\SOFTWARE\Google\Chrome\Extensions\bdkdmpigoicnmdhmhiafmpcfnfgpfnol => Key deleted successfully.
  "C:\Users\Jirka a Aneta\AppData\Local\CRE\bdkdmpigoicnmdhmhiafmpcfnfgpfnol.crx" => File/Directory not found.
  HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\aaaajfocmnnhjaajccaelhippajhaeod => Key deleted successfully.
  C:\ProgramData\AskPartnerNetwork\Toolbar\ATU4-V7\CRX\ToolbarCR.crx => Moved successfully.
  HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\bdkdmpigoicnmdhmhiafmpcfnfgpfnol => Key deleted successfully.
  "C:\Users\Jirka a Aneta\AppData\Local\CRE\bdkdmpigoicnmdhmhiafmpcfnfgpfnol.crx" => File/Directory not found.
  HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\egnimkioipookhfihpljiedpgjffibpa => Key deleted successfully.
  "C:\Program Files (x86)\MyBrowserCash\MBC_chrome.crx" => File/Directory not found.
  HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl => Key deleted successfully.
  C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx => Moved successfully.
  HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\mhfdcmehmjcclgopdodkjdicohagipid => Key deleted successfully.
  "C:\Users\JIRKAA~1\AppData\Local\Temp\crxE74B.tmp" => File/Directory not found.
  HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\mmifolfpllfdhilecpdpmemhelmanajl => Key deleted successfully.
  "C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx" => File/Directory not found.
  HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pfekkhdmhmddhjhfmkmfhojbjlihbopc => Key deleted successfully.
  "C:\Program Files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ch\VideoPlayerV3beta63.crx" => File/Directory not found.
  HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pjbnadgnhhkoohnkddbceoldfibijgpk => Key deleted successfully.
  "C:\Program Files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha510\ch\WebexpEnhancedV1alpha510.crx" => File/Directory not found.
  HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\poheodfamflhhhdcmjfeggbgigeefaco => Key deleted successfully.
  "C:\Program Files (x86)\Better-Surf\ch\Chrome.crx" => File/Directory not found.
  APNMCP => Service deleted successfully.
  tmlwf => Service deleted successfully.
  tmwfp => Service deleted successfully.
  usbbus => Service deleted successfully.
  UsbDiag => Service deleted successfully.
  USBModem => Service deleted successfully.
  X6va012 => Service deleted successfully.
  "C:\Users\Jirka a Aneta\Desktop\FRST.txt" => File/Directory not found.
  C:\Users\Jirka a Aneta\AppData\Local\MSGBOX.EXE => Moved successfully.
  C:\Users\Jirka a Aneta\Desktop\LM.bat => Moved successfully.
  "C:\Users\Jirka a Aneta\Desktop\FRST3.txt" => File/Directory not found.
  C:\Users\Jirka a Aneta\Desktop\ServicesRepair.exe => Moved successfully.
  C:\Users\Public\Desktop\CC Support => Moved successfully.
  C:\Users\Jirka a Aneta\Desktop\FSS.txt => Moved successfully.
  C:\Users\Jirka a Aneta\Desktop\FSS.exe => Moved successfully.
  C:\Users\Jirka a Aneta\Desktop\adwcleaner.exe => Moved successfully.
  C:\ComboFix.rar => Moved successfully.
  C:\ComboFix.txt => Moved successfully.
  C:\Users\Jirka a Aneta\Desktop\Rkill.txt => Moved successfully.
  C:\Users\Jirka a Aneta\Desktop\rkill64.com => Moved successfully.
  C:\Users\Jirka a Aneta\Desktop\rkill.com => Moved successfully.
  C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe => Moved successfully.
  C:\Users\Jirka a Aneta\Desktop\mbam-setup-1.75.0.1300.exe => Moved successfully.
  C:\Windows\system32\bootdelete.exe => Moved successfully.
  "C:\Users\Jirka a Aneta\Desktop\FRSTLauncher (2).exe" => File/Directory not found.
  C:\ProgramData\HitmanPro => Moved successfully.
  C:\Program Files (x86)\MediaPlayerV1 => Moved successfully.
  C:\Users\Jirka a Aneta\AppData\Local\Temp\avgnt.exe => Moved successfully.
  C:\Users\Jirka a Aneta\AppData\Local\Temp\Quarantine.exe => Moved successfully.
  C:\ProgramData\AskPartnerNetwork => Moved successfully.
  "C:\Program Files (x86)\BetterSurf" => File/Directory not found.
  "C:\Program Files (x86)\WebexpEnhancedV1" => File/Directory not found.
  "C:\Program Files (x86)\MediaPlayerV1" => File/Directory not found.
  C:\Program Files (x86)\AskPartnerNetwork => Moved successfully.
  C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully.
  C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
  C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
  C:\Windows\System32 => ":{4B9A1497-0817-47C4-9612-D6A1C53ACF57}" ADS removed successfully.
  C:\ProgramData\Temp => ":07F6D9E4" ADS removed successfully.
  C:\ProgramData\Temp => ":15024E60" ADS removed successfully.
  C:\ProgramData\Temp => ":4CF61E54" ADS removed successfully.
  C:\ProgramData\Temp => ":596E2371" ADS removed successfully.
  C:\ProgramData\Temp => ":68C295D4" ADS removed successfully.
  C:\ProgramData\Temp => ":734E442A" ADS removed successfully.
  C:\ProgramData\Temp => ":75D366A3" ADS removed successfully.
  C:\ProgramData\Temp => ":A724744F" ADS removed successfully.
  C:\ProgramData\Temp => ":A8ADE5D8" ADS removed successfully.
  C:\ProgramData\Temp => ":AB689DEA" ADS removed successfully.
  C:\ProgramData\Temp => ":B88E99C8" ADS removed successfully.
  C:\ProgramData\Temp => ":BB24555F" ADS removed successfully.
  C:\ProgramData\Temp => ":D1B5B4F1" ADS removed successfully.
  C:\ProgramData\Temp => ":DFC5A2B2" ADS removed successfully.
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashPlayerUpdate" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPeerNexonEU" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaSuite.exe" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Soluto" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ JCC - AutoClickerBot.lnk" /f =========
  
  Operace byla dokonźena ŁspŘçnŘ.
  
  
  
  ========= End of Reg: =========
  
  
  ========= shutdown /r /f /t 2 =========
  
  
  ========= End of CMD: =========
  
  
  
  The system needs a manual reboot.
  
  ==== End of Fixlog ====

[vyosek]

Vyyyborne, jdeme dale

Pokud nemate, tak presunte Combofix na plochu

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  KillAll::
  
  Folder::
  c:\program files (x86)\MediaPlayerV1
  c:\program files (x86)\IObit
  
  Registry::
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusOverride"=dword:00000000
  "FirewallOverride"=dword:00000000
  
  Driver::
  WinRing0_1_2_0
  X6va012
  
  DDS::
  Trusted Zone: clonewarsadventures.com
  Trusted Zone: freerealms.com
  Trusted Zone: soe.com
  Trusted Zone: sony.com
  
  Firefox::
  FF - ProfilePath - c:\users\Jirka a Aneta\AppData\Roaming\Mozilla\Firefox\Profiles\sz0rqy03.default\
  FF - prefs.js: browser.startup.homepage - hxxp://www.jobego.com/search/
  FF - ExtSQL: 2013-12-20 18:48; ext@WebexpEnhancedV1alpha510.net; c:\program files (x86)\WebexpEnhancedV1\WebexpEnhancedV1alpha510\ff
  FF - ExtSQL: 2014-01-10 18:48; ext@VideoPlayerV3beta63.net; c:\program files (x86)\VideoPlayerV3\VideoPlayerV3beta63\ff
  FF - ExtSQL: 2014-01-29 23:48; ext@MediaPlayerV1alpha142.net; c:\program files (x86)\MediaPlayerV1\MediaPlayerV1alpha142\ff
  
  RegLock::
  [HKEY_USERS\S-1-5-21-3908090792-2955568676-2883752157-1001_Classes\CLSID]
  
  ClearJavaCache::
  
  Reboot::

• Ulozte vytvoreny TXT jako CFScript.txt
• Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
  
• Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte

Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit

Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci