USB Virus

Zpráva

BigGuava69 · #1 Příspěvek od **BigGuava69** » 14 bře 2014 12:44

Dobrý den potřebuji pomoct s odstraněním USB Viru z mého počítače s Win 7 Pro 64 bit. Vir vytvoří na USB zástupce všech souborů+svůj program (název je změt číslic a písmen.exe) a skryje původní soubory. Po kliknuti se zástupce otevře přes příazový řádek v novém okně.

#2 Příspěvek od **vyosek** » 14 bře 2014 15:53

Zdravim

Zapojte do PC vsechny USB klice (flashky, ext. disky apod.)

Stahne a ulozte na plochu UsbFix http://www.viry.cz/forum/viewtopic.php?f=24&t=102308
Spustte a kliknete na Deletion
Po dokonceni sem vlozte log, pokud na Vas nevyskoci, najdete jej zde C:\UsbFix.txt

BigGuava69 · #3 Příspěvek od **BigGuava69** » 14 bře 2014 16:59

Děkuji za pomoc

Potom co software dokončil svou právi vyskočil mi tento log:

############################## | UsbFix V 7.134 | [Deletion]

User: Walley (Administrator) # WALLEY-PC
Updated 06/09/2013 by El Desaparecido
Started at 16:58:55 | 14/03/2014

Website: http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: eldesaparecido@sosvirus.net

PC: Gigabyte Technology Co., Ltd. (To be filled by O.E.M.) (x64-based PC)
CPU: AMD FX(tm)-4300 Quad-Core Processor (3800)
RAM -> [Total : 8153 | Free : 5618]
BIOS: BIOS Date: 02/04/13 20:56:34 Ver: 04.06.05
BOOT: Normal boot

OS: Microsoft Windows 7 Professional (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 11.0.9600.16518

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: AVG AntiVirus Free Edition 2014 [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Fixed drive # 112 Gb (13 Mb free - 12%) [] # NTFS
D:\ -> CD-ROM
E:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> Removable drive # 4 Gb (3 Mb free - 72%) [] # FAT32
H:\ -> Removable drive # 4 Gb (1 Mb free - 40%) [] # FAT32
I:\ -> CD-ROM

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [Dolby Home Theater v4] - "C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart
HKLM\SOFTWARE | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [AVG_UI] - "C:\Program Files (x86)\AVG\AVG2014\avgui.exe" /TRAYONLY
HKLM\SOFTWARE | Run : [8e3bc91142bd8d798a10a1667ae4d2be] - "C:\Users\Walley\AppData\Local\Temp\Skype.exe" ..
HKLM\SOFTWARE | Run : [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
HKLM\SOFTWARE\wow6432Node | Run : [Dolby Home Theater v4] - "C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart
HKLM\SOFTWARE\wow6432Node | Run : [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE\wow6432Node | Run : [AVG_UI] - "C:\Program Files (x86)\AVG\AVG2014\avgui.exe" /TRAYONLY
HKLM\SOFTWARE\wow6432Node | Run : [8e3bc91142bd8d798a10a1667ae4d2be] - "C:\Users\Walley\AppData\Local\Temp\Skype.exe" ..
HKLM\SOFTWARE\wow6432Node | Run : [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\SOFTWARE | Run : [8e3bc91142bd8d798a10a1667ae4d2be] - "C:\Users\Walley\AppData\Local\Temp\Skype.exe" ..
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\SOFTWARE | Run : [AVG-Secure-Search-Update_0214c] - C:\Users\Walley\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=92410166976d47d2b227a59d73ed4bf3-e534b542cddaedde88e441ef4900a4c701768105 /CMPID=0214c
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\SOFTWARE | Run : [7373dc185322d0eaea29dbca58a3a300] - "C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe" ..
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

################## | Stopped processes |

Stopped! C:\PROGRA~2\AVG\AVG2014\avgrsa.exe (512)
Stopped! C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe (552)
Stopped! C:\Windows\system32\nvvsvc.exe (496)
Stopped! C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (1028)
Stopped! c:\Program Files\Microsoft Security Client\MsMpEng.exe (1148)
Stopped! C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (1612)
Stopped! C:\Windows\system32\nvvsvc.exe (1632)
Stopped! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (1992)
Stopped! C:\Windows\System32\spoolsv.exe (2060)
Stopped! C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (2160)
Stopped! C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (2204)
Stopped! C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe (2232)
Stopped! C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe (2260)
Stopped! C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe (2304)
Stopped! C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (2444)
Stopped! C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (2488)
Stopped! C:\Windows\system32\rundll32.exe (2668)
Stopped! C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe (2892)
Stopped! C:\Program Files (x86)\AVG\AVG2014\avgemca.exe (2904)
Stopped! C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe (2112)
Stopped! C:\Program Files (x86)\Surftastic\updateSurftastic.exe (2916)
Stopped! c:\Program Files\Microsoft Security Client\NisSrv.exe (3532)
Stopped! C:\Windows\system32\taskhost.exe (3900)
Stopped! C:\Program Files (x86)\Surftastic\bin\utilSurftastic.exe (4248)
Stopped! C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (4300)
Stopped! C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (4396)
Stopped! C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (4444)
Stopped! C:\Program Files\Microsoft Security Client\msseces.exe (4488)
Stopped! C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe (4604)
Stopped! C:\Users\Walley\AppData\Local\Temp\Skype.exe (4704)
Stopped! C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe (4776)
Stopped! C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe (4860)
Stopped! C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (4992)
Stopped! C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (5004)
Stopped! C:\Program Files (x86)\AVG\AVG2014\avgui.exe (5088)
Stopped! C:\Program Files\AVAST Software\Avast\AvastUI.exe (4576)
Stopped! C:\Windows\system32\SearchIndexer.exe (4820)
Stopped! C:\Program Files\Windows Media Player\wmpnetwk.exe (5256)
Stopped! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (5272)
Stopped! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (4764)
Stopped! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (6000)
Stopped! C:\Windows\servicing\TrustedInstaller.exe (6168)
Stopped! C:\Program Files (x86)\Internet Explorer\IELowutil.exe (6640)
Stopped! C:\Windows\System32\WUDFHost.exe (1764)
Stopped! C:\Windows\System32\WUDFHost.exe (1224)
Stopped! C:\Windows\system32\sppsvc.exe (1592)

################## | Files # Infected Folders |

Deleted ! C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe
Deleted ! C:\Users\Walley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7373dc185322d0eaea29dbca58a3a300.exe

(!) Temporary files deleted.

################## | Registry |

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{84545ed4-9f29-11e3-95d1-74d43509a200}
Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{c9f8cc7f-8919-11e3-b34d-806e6f6e6963}

################## | Listing |

[01/03/2014 - 16:31:05 | D ] C:\$AVG
[29/01/2014 - 20:21:10 | SHD ] C:\$Recycle.Bin
[29/01/2014 - 13:31:53 | N | 10] C:\csb.log
[14/07/2009 - 06:08:56 | SHD ] C:\Documents and Settings
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.1028.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.1031.txt
[07/11/2007 - 08:00:40 | N | 10134] C:\eula.1033.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.1036.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.1040.txt
[07/11/2007 - 08:00:40 | N | 118] C:\eula.1041.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.1042.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.2052.txt
[07/11/2007 - 08:00:40 | N | 17734] C:\eula.3082.txt
[15/02/2014 - 20:35:26 | D ] C:\Games
[07/11/2007 - 08:00:40 | N | 1110] C:\globdata.ini
[14/03/2014 - 16:38:22 | ASH | 6411583488] C:\hiberfil.sys
[07/11/2007 - 08:03:18 | N | 562688] C:\install.exe
[07/11/2007 - 08:00:40 | N | 843] C:\install.ini
[07/11/2007 - 08:03:18 | N | 76304] C:\install.res.1028.dll
[07/11/2007 - 08:03:18 | N | 96272] C:\install.res.1031.dll
[07/11/2007 - 08:03:18 | N | 91152] C:\install.res.1033.dll
[07/11/2007 - 08:03:18 | N | 97296] C:\install.res.1036.dll
[07/11/2007 - 08:03:18 | N | 95248] C:\install.res.1040.dll
[07/11/2007 - 08:03:18 | N | 81424] C:\install.res.1041.dll
[07/11/2007 - 08:03:18 | N | 79888] C:\install.res.1042.dll
[07/11/2007 - 08:03:18 | N | 75792] C:\install.res.2052.dll
[07/11/2007 - 08:03:18 | N | 96272] C:\install.res.3082.dll
[14/03/2014 - 16:38:22 | ASH | 8548782080] C:\pagefile.sys
[14/07/2009 - 04:20:08 | D ] C:\PerfLogs
[11/03/2014 - 21:57:51 | D ] C:\Program Files
[13/03/2014 - 20:05:32 | D ] C:\Program Files (x86)
[13/03/2014 - 20:05:50 | HD ] C:\ProgramData
[29/01/2014 - 20:21:03 | SHD ] C:\Recovery
[13/03/2014 - 20:10:31 | SHD ] C:\System Volume Information
[11/03/2014 - 22:12:22 | D ] C:\Temp
[14/03/2014 - 16:59:45 | D ] C:\UsbFix
[14/03/2014 - 17:00:21 | A | 9581] C:\UsbFix [Clean 1] WALLEY-PC.txt
[30/01/2014 - 01:16:17 | D ] C:\Users
[07/11/2007 - 08:00:40 | N | 5686] C:\vcredist.bmp
[07/11/2007 - 08:09:22 | N | 1442522] C:\VC_RED.cab
[07/11/2007 - 08:12:28 | N | 232960] C:\VC_RED.MSI
[13/03/2014 - 20:04:56 | D ] C:\Windows

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

################## | E.O.F | http://www.sosvirus.net |

#4 Příspěvek od **vyosek** » 14 bře 2014 17:01

Poprosim o log z RSIT http://forum.viry.cz/viewtopic.php?f=13&t=130786

BigGuava69 · #5 Příspěvek od **BigGuava69** » 14 bře 2014 17:43

Zde je log z RSIT :

Logfile of random's system information tool 1.09 (written by random/random)
Run by Walley at 2014-03-14 17:46:38
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 14 GB (12%) free of 114 GB
Total RAM: 8153 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:47:24, on 14.3.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16518)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Walley.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\Windows\SysWOW64\Userinit.exe,
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\IPS\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\coIEPlg.dll
O4 - HKLM\..\Run: [Dolby Home Theater v4] "C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [AVG-Secure-Search-Update_0214c] C:\Users\Walley\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=92410166976d47d2b227a59d73ed4bf3-e534b542cddaedde88e441ef4900a4c701768105 /CMPID=0214c
O4 - HKCU\..\Run: [7373dc185322d0eaea29dbca58a3a300] "C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe" ..
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: TP-LINK Wireless Configuration Utility.lnk = C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HTCMonitorService - Nero AG - C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LiveUpdate (LiveUpdateSvc) - IObit - C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: OpenVPN Service (OpenVPNService) - The OpenVPN Project - C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe
O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Update Surftastic - Unknown owner - C:\Program Files (x86)\Surftastic\updateSurftastic.exe
O23 - Service: Util Surftastic - Unknown owner - C:\Program Files (x86)\Surftastic\bin\utilSurftastic.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10141 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\AUDIODG.EXE 0x2dc
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe"
"C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe" /s "N360" /m "C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\diMaster.dll" /prefetch:1
"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe"
"C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Surftastic\updateSurftastic.exe"
"C:\Program Files (x86)\Surftastic\bin\utilSurftastic.exe"
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\wbem\wmiprvse.exe
taskeng.exe {414DA7E6-A622-4D0A-9C41-9FFF33BF6216}
"taskhost.exe"
"C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe" /c /a /s UserSession
taskeng.exe {133956E4-CCF5-4788-8457-9D3E598A7F9F}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" serviceapp
\??\C:\Windows\system32\conhost.exe "-1592062209425749554-6671654201848944441099907365-764020712-18827360692139910806
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
adb fork-server server
"C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe" -autostart
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="1452.0.479254834\826659936" --disable-image-transport-surface --supports-dual-gpus=false --gpu-driver-bug-workarounds=0,1,14,27,33 --gpu-vendor-id=0x10de --gpu-device-id=0x104a --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.3523 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group1 pct:10a stable:r1/ExtensionInstallVerification/None/OmniboxBundledExperimentV1/StableReorderHoldbackR2/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_13/UMA-Uniformity-Trial-1-Percent/group_51/UMA-Uniformity-Trial-10-Percent/default/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_15/UMA-Uniformity-Trial-50-Percent/default/" --enable-threaded-compositing --enable-delegated-renderer --enable-deadline-scheduling --extension-process --renderer-print-preview --enable-software-compositing --channel="1452.2.1926494964\611562303" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group1 pct:10a stable:r1/ExtensionInstallVerification/None/OmniboxBundledExperimentV1/StableReorderHoldbackR2/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_13/UMA-Uniformity-Trial-1-Percent/group_51/UMA-Uniformity-Trial-10-Percent/default/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_15/UMA-Uniformity-Trial-50-Percent/default/" --enable-threaded-compositing --enable-delegated-renderer --enable-deadline-scheduling --renderer-print-preview --enable-software-compositing --channel="1452.4.354347355\1792312619" /prefetch:673131151
"C:\Users\Walley\Downloads\RSITx64.exe"
"c:\Program Files\Microsoft Security Client\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey 662B2849-B727-D2F6-356E-0142357F9A54 -Reinvoke
C:\Windows\System32\svchost.exe -k WerSvcGroup

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\AmiUpdXp.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Walley\AppData\Roaming\Mozilla\Firefox\Profiles\w4ti787z.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.51.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.3]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
ExplorerWnd Helper - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll [2014-03-01 2471744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Norton Identity Protection - C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\coIEPlg.dll [2013-10-06 769360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-03-11 1390368]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
Norton Identity Protection - C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\coIEPlg.dll [2013-10-06 526672]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
Norton Vulnerability Protection - C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\IPS\IPSBHO.DLL [2013-09-29 388504]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-01-29 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-03-11 1143168]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-01-29 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-03-11 1390368]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\coIEPlg.dll [2013-10-06 769360]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-03-11 1143168]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\coIEPlg.dll [2013-10-06 526672]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2012-10-26 13213840]
"RtHDVBg_Dolby"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2012-10-29 1234064]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2013-12-10 2279712]
"ShadowPlay"=C:\Windows\system32\nvspcap64.dll [2013-12-10 1100248]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2013-10-23 1266912]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-10-28 3675352]
"AVG-Secure-Search-Update_0214c"=C:\Users\Walley\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=92410166976d47d2b227a59d73ed4bf3-e534b542cddaedde88e441ef4900a4c701768105 /CMPID=0214c []
"7373dc185322d0eaea29dbca58a3a300"=C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe .. []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"Dolby Home Theater v4"=C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [2012-04-23 507744]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-08-06 642216]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-03-11 3767096]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
TP-LINK Wireless Configuration Utility.lnk - C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=3
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveAutoRun"=3
"NoDriveTypeAutoRun"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw64.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv

======File associations======

.js - edit -
.js - open -

======List of files/folders created in the last 1 month======

2014-03-14 17:46:38 ----D---- C:\rsit
2014-03-14 17:46:38 ----D---- C:\Program Files\trend micro
2014-03-14 17:43:45 ----A---- C:\Windows\system32\drivers\SMR410.SYS
2014-03-14 17:43:45 ----A---- C:\Windows\system32\drivers\SMR410.dat
2014-03-14 17:17:30 ----A---- C:\Windows\system32\drivers\SYMEVENT64x86.SYS
2014-03-14 17:17:29 ----D---- C:\Program Files\Common Files\Symantec Shared
2014-03-14 17:16:52 ----D---- C:\Windows\system32\drivers\N360x64
2014-03-14 17:16:51 ----D---- C:\Program Files (x86)\Norton 360
2014-03-14 17:16:50 ----D---- C:\ProgramData\Norton
2014-03-14 17:16:24 ----D---- C:\ProgramData\NortonInstaller
2014-03-14 17:16:24 ----D---- C:\Program Files (x86)\NortonInstaller
2014-03-14 17:11:33 ----SHD---- C:\Config.Msi
2014-03-14 17:00:21 ----RASHD---- C:\Autorun.inf
2014-03-14 16:58:55 ----A---- C:\UsbFix [Clean 1] WALLEY-PC.txt
2014-03-14 16:43:03 ----D---- C:\UsbFix
2014-03-13 20:05:50 ----D---- C:\ProgramData\Macromedia
2014-03-13 20:05:32 ----D---- C:\Program Files (x86)\Macromedia
2014-03-13 20:04:56 ----D---- C:\Windows\Downloaded Installations
2014-03-13 19:32:09 ----D---- C:\Users\Walley\AppData\Roaming\Nvu
2014-03-11 23:21:28 ----D---- C:\Users\Walley\AppData\Roaming\Jpeg Resampler
2014-03-11 23:14:38 ----D---- C:\Users\Walley\AppData\Roaming\FastStone
2014-03-11 22:11:48 ----A---- C:\Windows\SYSWOW64\nvStreaming.exe
2014-03-11 22:08:05 ----A---- C:\Windows\SYSWOW64\nvwgf2um.dll
2014-03-11 22:08:05 ----A---- C:\Windows\SYSWOW64\nvumdshim.dll
2014-03-11 22:08:04 ----A---- C:\Windows\SYSWOW64\nvopencl.dll
2014-03-11 22:08:04 ----A---- C:\Windows\SYSWOW64\nvoglv32.dll
2014-03-11 22:08:04 ----A---- C:\Windows\SYSWOW64\nvoglshim32.dll
2014-03-11 22:08:04 ----A---- C:\Windows\SYSWOW64\nvinit.dll
2014-03-11 22:08:04 ----A---- C:\Windows\SYSWOW64\NvIFR.dll
2014-03-11 22:08:04 ----A---- C:\Windows\SYSWOW64\NvFBC.dll
2014-03-11 22:08:04 ----A---- C:\Windows\SYSWOW64\nvcuvid.dll
2014-03-11 22:08:04 ----A---- C:\Windows\SYSWOW64\nvcuvenc.dll
2014-03-11 22:08:04 ----A---- C:\Windows\SYSWOW64\nvcuda.dll
2014-03-11 22:08:04 ----A---- C:\Windows\SYSWOW64\nvcompiler.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvopencl.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvoglv64.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvoglshim64.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvinitx.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\NvIFR64.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\NvFBC64.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvdispgenco6433523.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvdispco6433523.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvd3dumx.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvcuvid.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvcuvenc.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvcuda.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\nvcompiler.dll
2014-03-11 22:08:04 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2014-03-11 22:01:41 ----D---- C:\Users\Walley\AppData\Roaming\AVAST Software
2014-03-11 22:01:10 ----A---- C:\Windows\system32\drivers\aswStm.sys
2014-03-11 22:01:09 ----A---- C:\Windows\system32\drivers\aswVmm.sys
2014-03-11 22:01:09 ----A---- C:\Windows\system32\drivers\aswSP.sys
2014-03-11 22:01:09 ----A---- C:\Windows\system32\drivers\aswSnx.sys
2014-03-11 22:01:09 ----A---- C:\Windows\system32\drivers\aswRvrt.sys
2014-03-11 22:01:09 ----A---- C:\Windows\system32\drivers\aswRdr2.sys
2014-03-11 22:01:09 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2014-03-11 22:01:08 ----A---- C:\Windows\system32\aswBoot.exe
2014-03-11 22:01:06 ----A---- C:\Windows\avastSS.scr
2014-03-11 21:57:51 ----D---- C:\Program Files\AVAST Software
2014-03-06 18:26:14 ----D---- C:\Program Files (x86)\Drakensang Online
2014-03-02 00:03:00 ----D---- C:\Users\Walley\AppData\Roaming\Flashmedia
2014-03-01 16:31:13 ----D---- C:\Users\Walley\AppData\Roaming\TuneUp Software
2014-03-01 16:31:05 ----D---- C:\ProgramData\AVG2014
2014-03-01 16:29:27 ----HD---- C:\ProgramData\Common Files
2014-03-01 16:29:27 ----D---- C:\ProgramData\MFAData
2014-03-01 14:51:42 ----D---- C:\Users\Walley\AppData\Roaming\Skype
2014-03-01 14:51:38 ----RD---- C:\Program Files (x86)\Skype
2014-03-01 14:51:37 ----D---- C:\ProgramData\Skype
2014-03-01 14:43:34 ----A---- C:\Windows\SYSWOW64\NCTAudioVisualization2.dll
2014-03-01 14:43:34 ----A---- C:\Windows\SYSWOW64\NCTAudioRecord2.dll
2014-03-01 14:43:34 ----A---- C:\Windows\SYSWOW64\NCTAudioFile2.dll
2014-03-01 14:43:34 ----A---- C:\Windows\SYSWOW64\msvcr70.dll
2014-03-01 14:30:49 ----D---- C:\Users\Walley\AppData\Roaming\ProductData
2014-03-01 14:29:45 ----D---- C:\Users\Walley\AppData\Roaming\IObit
2014-03-01 14:29:45 ----D---- C:\ProgramData\IObit
2014-03-01 14:29:43 ----D---- C:\ProgramData\ProductData
2014-03-01 14:29:40 ----D---- C:\Program Files (x86)\IObit
2014-03-01 10:06:59 ----D---- C:\Program Files (x86)\MSXML 4.0
2014-03-01 04:25:47 ----D---- C:\Users\Walley\AppData\Roaming\HTC
2014-03-01 04:25:37 ----D---- C:\Users\Walley\AppData\Roaming\Apple Computer
2014-03-01 04:25:31 ----D---- C:\ProgramData\HTC
2014-03-01 04:24:53 ----D---- C:\Program Files (x86)\Spirent Communications
2014-03-01 04:24:53 ----D---- C:\Program Files (x86)\HTC
2014-02-27 17:28:04 ----D---- C:\Program Files (x86)\MediaViewV1
2014-02-26 22:26:29 ----D---- C:\Program Files (x86)\AGEIA Technologies
2014-02-26 22:23:49 ----A---- C:\Windows\system32\nvdispgenco6433489.dll
2014-02-26 22:23:49 ----A---- C:\Windows\system32\nvdispco6433489.dll
2014-02-26 22:16:29 ----D---- C:\Temp
2014-02-26 02:28:35 ----D---- C:\Windows\Migration
2014-02-24 15:16:01 ----D---- C:\Program Files (x86)\MediaViewerV1
2014-02-16 01:26:39 ----D---- C:\Users\Walley\AppData\Roaming\vlc
2014-02-16 01:26:25 ----D---- C:\Program Files (x86)\VideoLAN
2014-02-15 20:37:30 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2014-02-15 20:37:30 ----A---- C:\Windows\system32\vbscript.dll
2014-02-15 20:37:02 ----A---- C:\Windows\SYSWOW64\msrating.dll
2014-02-15 20:37:02 ----A---- C:\Windows\SYSWOW64\ieui.dll
2014-02-15 20:37:02 ----A---- C:\Windows\system32\msrating.dll
2014-02-15 20:37:02 ----A---- C:\Windows\system32\ieui.dll
2014-02-15 20:37:01 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2014-02-15 20:37:01 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2014-02-15 20:37:01 ----A---- C:\Windows\system32\msfeeds.dll
2014-02-15 20:37:01 ----A---- C:\Windows\system32\jsproxy.dll
2014-02-15 20:37:01 ----A---- C:\Windows\system32\iernonce.dll
2014-02-15 20:37:01 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-02-15 20:37:01 ----A---- C:\Windows\system32\ie4uinit.exe
2014-02-15 20:37:00 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2014-02-15 20:37:00 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2014-02-15 20:37:00 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2014-02-15 20:37:00 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2014-02-15 20:37:00 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2014-02-15 20:37:00 ----A---- C:\Windows\system32\mshtml.dll
2014-02-15 20:37:00 ----A---- C:\Windows\system32\jscript9diag.dll
2014-02-15 20:37:00 ----A---- C:\Windows\system32\ieUnatt.exe
2014-02-15 20:37:00 ----A---- C:\Windows\system32\iesetup.dll
2014-02-15 20:37:00 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-02-15 20:37:00 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-02-15 20:36:59 ----A---- C:\Windows\SYSWOW64\wininet.dll
2014-02-15 20:36:59 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2014-02-15 20:36:59 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2014-02-15 20:36:59 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2014-02-15 20:36:59 ----A---- C:\Windows\system32\wininet.dll
2014-02-15 20:36:59 ----A---- C:\Windows\system32\urlmon.dll
2014-02-15 20:36:59 ----A---- C:\Windows\system32\iertutil.dll
2014-02-15 20:36:59 ----A---- C:\Windows\system32\ieapfltr.dll
2014-02-15 20:36:58 ----A---- C:\Windows\system32\ieframe.dll
2014-02-15 20:36:57 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2014-02-15 20:36:57 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2014-02-15 20:36:57 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2014-02-15 20:36:57 ----A---- C:\Windows\system32\jscript9.dll
2014-02-15 14:27:38 ----D---- C:\Program Files (x86)\Microsoft Security Client
2014-02-15 14:27:37 ----D---- C:\Program Files\Microsoft Security Client
2014-02-15 12:58:42 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2014-02-15 12:58:42 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2014-02-15 12:58:42 ----A---- C:\Windows\system32\msxml3r.dll
2014-02-15 12:58:42 ----A---- C:\Windows\system32\msxml3.dll
2014-02-15 12:58:34 ----A---- C:\Windows\SYSWOW64\secproc_isv.dll
2014-02-15 12:58:34 ----A---- C:\Windows\SYSWOW64\secproc.dll
2014-02-15 12:58:34 ----A---- C:\Windows\SYSWOW64\RMActivate_ssp_isv.exe
2014-02-15 12:58:34 ----A---- C:\Windows\SYSWOW64\RMActivate_ssp.exe
2014-02-15 12:58:34 ----A---- C:\Windows\SYSWOW64\RMActivate_isv.exe
2014-02-15 12:58:34 ----A---- C:\Windows\SYSWOW64\RMActivate.exe
2014-02-15 12:58:34 ----A---- C:\Windows\SYSWOW64\msdrm.dll
2014-02-15 12:58:34 ----A---- C:\Windows\system32\secproc_ssp.dll
2014-02-15 12:58:34 ----A---- C:\Windows\system32\secproc_isv.dll
2014-02-15 12:58:34 ----A---- C:\Windows\system32\secproc.dll
2014-02-15 12:58:34 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-15 12:58:34 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2014-02-15 12:58:34 ----A---- C:\Windows\system32\RMActivate_isv.exe
2014-02-15 12:58:34 ----A---- C:\Windows\system32\RMActivate.exe
2014-02-15 12:58:34 ----A---- C:\Windows\system32\msdrm.dll
2014-02-15 12:58:33 ----A---- C:\Windows\SYSWOW64\secproc_ssp_isv.dll
2014-02-15 12:58:33 ----A---- C:\Windows\SYSWOW64\secproc_ssp.dll
2014-02-15 12:58:33 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2014-02-15 12:58:25 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2014-02-15 12:58:24 ----A---- C:\Windows\SYSWOW64\d2d1.dll
2014-02-15 12:58:24 ----A---- C:\Windows\system32\d3d10warp.dll
2014-02-15 12:58:24 ----A---- C:\Windows\system32\d2d1.dll

======List of files/folders modified in the last 1 month======

2014-03-14 17:46:38 ----D---- C:\Program Files
2014-03-14 17:46:15 ----D---- C:\Windows\Temp
2014-03-14 17:43:46 ----HD---- C:\ProgramData
2014-03-14 17:43:45 ----D---- C:\Windows\system32\drivers
2014-03-14 17:43:28 ----D---- C:\Windows\System32
2014-03-14 17:43:28 ----D---- C:\Windows\inf
2014-03-14 17:43:28 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-03-14 17:40:23 ----SHD---- C:\System Volume Information
2014-03-14 17:39:08 ----D---- C:\ProgramData\NVIDIA
2014-03-14 17:38:20 ----D---- C:\Windows
2014-03-14 17:37:22 ----D---- C:\Program Files (x86)\Surftastic
2014-03-14 17:37:03 ----D---- C:\Program Files (x86)\Common Files
2014-03-14 17:36:55 ----D---- C:\Windows\system32\config
2014-03-14 17:18:41 ----D---- C:\Windows\system32\Tasks
2014-03-14 17:17:29 ----D---- C:\Program Files\Common Files
2014-03-14 17:16:51 ----D---- C:\Program Files (x86)
2014-03-14 17:14:50 ----SHD---- C:\Windows\Installer
2014-03-14 16:42:53 ----D---- C:\Windows\winsxs
2014-03-14 16:42:53 ----D---- C:\Windows\system32\catroot
2014-03-14 16:42:33 ----D---- C:\Windows\system32\catroot2
2014-03-13 23:26:06 ----D---- C:\Program Files (x86)\Steam
2014-03-13 20:10:09 ----D---- C:\Users\Walley\AppData\Roaming\Macromedia
2014-03-11 23:23:02 ----D---- C:\Windows\SysWOW64
2014-03-11 22:11:58 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2014-03-11 22:11:43 ----D---- C:\Windows\system32\DriverStore
2014-03-11 21:57:09 ----D---- C:\ProgramData\AVAST Software
2014-03-11 19:35:01 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2014-03-07 16:36:54 ----D---- C:\Users\Walley\AppData\Roaming\newnext.me
2014-03-04 15:35:23 ----A---- C:\Windows\SYSWOW64\nvd3dum.dll
2014-03-04 15:35:23 ----A---- C:\Windows\SYSWOW64\nvapi.dll
2014-03-04 15:35:23 ----A---- C:\Windows\system32\nvwgf2umx.dll
2014-03-04 15:35:23 ----A---- C:\Windows\system32\nvumdshimx.dll
2014-03-04 15:35:23 ----A---- C:\Windows\system32\nvapi64.dll
2014-03-04 14:06:00 ----A---- C:\Windows\system32\nvsvc64.dll
2014-03-04 14:06:00 ----A---- C:\Windows\system32\nvcpl.dll
2014-03-04 14:05:58 ----A---- C:\Windows\system32\nvvsvc.exe
2014-03-04 14:05:58 ----A---- C:\Windows\system32\nvsvcr.dll
2014-03-04 14:05:58 ----A---- C:\Windows\system32\nvshext.dll
2014-03-04 14:05:57 ----A---- C:\Windows\system32\nvmctray.dll
2014-03-03 15:59:43 ----D---- C:\Windows\Tasks
2014-03-01 04:25:27 ----RSD---- C:\Windows\Fonts
2014-03-01 00:08:31 ----D---- C:\Windows\LiveKernelReports
2014-02-28 15:09:08 ----D---- C:\Windows\Logs
2014-02-27 17:28:49 ----HD---- C:\Windows\system32\GroupPolicy
2014-02-27 17:28:49 ----D---- C:\Windows\SYSWOW64\GroupPolicy
2014-02-27 15:24:09 ----D---- C:\Windows\Microsoft.NET
2014-02-26 18:42:17 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2014-02-26 02:29:54 ----RSD---- C:\Windows\assembly
2014-02-26 02:28:38 ----D---- C:\Windows\SYSWOW64\en-US
2014-02-26 02:28:38 ----D---- C:\Windows\system32\en-US
2014-02-26 02:28:35 ----SD---- C:\ProgramData\Microsoft
2014-02-18 17:21:41 ----D---- C:\ProgramData\TP-LINK
2014-02-17 21:41:09 ----D---- C:\Users\Walley\AppData\Roaming\DAEMON Tools Lite
2014-02-17 21:41:06 ----D---- C:\Windows\debug
2014-02-17 15:48:41 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2014-02-17 02:42:36 ----D---- C:\Windows\system32\MRT
2014-02-17 02:42:01 ----A---- C:\Windows\system32\MRT.exe
2014-02-17 01:05:35 ----D---- C:\ProgramData\PMB Files
2014-02-16 13:55:38 ----D---- C:\Windows\rescache
2014-02-15 21:06:01 ----D---- C:\Windows\SYSWOW64\cs-CZ
2014-02-15 21:06:01 ----D---- C:\Windows\system32\cs-CZ
2014-02-15 21:06:01 ----D---- C:\Program Files\Internet Explorer
2014-02-15 21:06:01 ----D---- C:\Program Files (x86)\Internet Explorer
2014-02-15 20:35:26 ----D---- C:\Games

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amd_sata;amd_sata; C:\Windows\system32\DRIVERS\amd_sata.sys [2012-04-11 82560]
R0 amd_xata;amd_xata; C:\Windows\system32\DRIVERS\amd_xata.sys [2012-04-11 42624]
R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-03-11 65776]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-03-11 207904]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-09-27 248240]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 SMR410;Symantec SMR Utility Service 4.1.0; C:\Windows\System32\drivers\SMR410.SYS [2014-03-14 96856]
R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\N360x64\1501000.012\SYMDS64.SYS [2013-09-10 493656]
R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\N360x64\1501000.012\SYMEFA64.SYS [2013-09-27 1147480]
R1 aswRdr;aswRdr; \??\C:\Windows\system32\drivers\aswRdr2.sys [2014-03-11 92544]
R1 aswSnx;aswSnx; \??\C:\Windows\system32\drivers\aswSnx.sys [2014-03-11 1038072]
R1 aswSP;aswSP; \??\C:\Windows\system32\drivers\aswSP.sys [2014-03-11 421704]
R1 BHDrvx64;BHDrvx64; \??\C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140214.001\BHDrvx64.sys [2014-02-14 1526488]
R1 ccSet_N360;N360 Settings Manager; C:\Windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys [2013-09-26 162392]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2014-02-04 283064]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [2014-03-14 484952]
R1 IDSVia64;IDSVia64; \??\C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20140313.001\IDSvia64.sys [2014-03-13 524504]
R1 SRTSPX;Symantec Real Time Storage Protection (PEL) x64; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS [2013-09-10 36952]
R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\N360x64\1501000.012\Ironx64.SYS [2013-09-27 264280]
R1 SymNetS;Symantec Network Security WFP Driver; C:\Windows\system32\drivers\N360x64\1501000.012\SYMNETS.SYS [2013-09-26 590936]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 AODDriver4.1;AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]
R2 aswMonFlt;aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [2014-03-11 78648]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-09-27 134944]
R3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 aswStm;aswStm; \??\C:\Windows\system32\drivers\aswStm.sys [2014-03-11 80184]
R3 athur;Wireless Network Adapter Service; C:\Windows\system32\DRIVERS\athurx.sys [2012-10-18 1930240]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2014-03-14 137648]
R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver; C:\Windows\System32\Drivers\EtronHub3.sys [2012-08-07 65152]
R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver; C:\Windows\System32\Drivers\EtronXHCI.sys [2012-08-07 88832]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-10-30 4201104]
R3 NAVENG;NAVENG; \??\C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140314.001\ENG64.SYS [2014-03-14 126040]
R3 NAVEX15;NAVEX15; \??\C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140314.001\EX64.SYS [2014-03-14 2099288]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2013-11-28 197408]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad64v.sys [2013-12-05 39200]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-08-23 565352]
R3 SRTSP;Symantec Real Time Storage Protection x64; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSP64.SYS [2013-09-27 858200]
R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [2014-03-14 177752]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2012-03-30 56448]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2014-01-29 25640]
S3 HTCAND64;HTC Device Driver; C:\Windows\System32\Drivers\ANDROIDUSB.sys [2009-11-02 33736]
S3 htcnprot;HTC NDIS Protocol Driver; C:\Windows\system32\DRIVERS\htcnprot.sys [2013-10-17 36928]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-08-06 361984]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-03-11 50344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 HTCMonitorService;HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [2013-11-10 87368]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-10-23 23808]
R2 N360;Norton 360; C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe [2013-10-08 264360]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2013-12-10 1494304]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-10 15129376]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2014-03-04 922968]
R2 PassThru Service;Internet Pass-Through Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2013-10-17 166912]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-03-04 411936]
R2 Update Surftastic;Update Surftastic; C:\Program Files (x86)\Surftastic\updateSurftastic.exe [2014-03-14 348960]
R2 Util Surftastic;Util Surftastic; C:\Program Files (x86)\Surftastic\bin\utilSurftastic.exe [2014-03-14 348960]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2013-10-23 348376]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-29 116648]
S2 LiveUpdateSvc;LiveUpdate; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2014-03-01 2151744]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-11 257928]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-29 116648]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-02-06 111616]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-12-05 119408]
S3 OpenVPNService;OpenVPN Service; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [2013-08-08 29912]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-02-25 568512]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-01-29 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

#6 Příspěvek od **vyosek** » 15 bře 2014 03:16

Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe

Ulozte nejlepe na plochu
Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
Probehne vytvoreni zalohy a nasledne prohledavani
Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

Ulozte nejlepe na plochu
Ukoncete vsechny programy
Kliknete na Scan a nasledne Clean
Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

BigGuava69 · #7 Příspěvek od **BigGuava69** » 15 bře 2014 16:10

Tady je první log, z JRT :

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Professional x64
Ran by Walley on so 15.03.2014 at 16:07:48,68
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\updater.amiupd
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\updater.amiupd.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{99c91fc5-db5b-4aa0-bb70-5d89c5a4df96}

~~~ Files

Successfully deleted: [File] C:\Windows\Tasks\amiupdxp.job

~~~ Folders

Successfully deleted: [Folder] "C:\Users\Walley\appdata\local\swvupdater"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on so 15.03.2014 at 16:15:11,04
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

BigGuava69 · #8 Příspěvek od **BigGuava69** » 15 bře 2014 16:17

A tohle je log z AdwCleaner:

# AdwCleaner v3.022 - Report created 15/03/2014 at 16:20:20
# Updated 13/03/2014 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : Walley - WALLEY-PC
# Running from : C:\Users\Walley\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\Surftastic
Folder Deleted : C:\Users\Walley\AppData\Local\genienext
Folder Deleted : C:\Users\Walley\AppData\Roaming\newnext.me
File Deleted : C:\Windows\System32\Tasks\Driver Booster Update

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Key Deleted : HKCU\Software\7373dc185322d0eaea29dbca58a3a300
Key Deleted : HKCU\Software\8e3bc91142bd8d798a10a1667ae4d2be
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Deleted : HKCU\Software\AVG Secure Search

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16521

-\\ Mozilla Firefox v26.0 (cs)

[ File : C:\Users\Walley\AppData\Roaming\Mozilla\Firefox\Profiles\w4ti787z.default\prefs.js ]

*************************

AdwCleaner[R0].txt - [1982 octets] - [15/03/2014 16:18:47]
AdwCleaner[S0].txt - [1874 octets] - [15/03/2014 16:20:20]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1934 octets] ##########

#9 Příspěvek od **vyosek** » 16 bře 2014 16:51

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

BigGuava69 · #10 Příspěvek od **BigGuava69** » 16 bře 2014 21:09

Log ze Zoek :

Zoek.exe v5.0.0.0 Updated 07-March-2014
Tool run by Walley on ne 16.03.2014 at 21:03:33,86.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Walley\Desktop\zoek – kopie.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

16.3.2014 21:04:46 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-1257800471-3726757507-424188603-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{f621d637-4861-47f9-9b7f-45b9c85ec05d} deleted successfully
HKEY_USERS\S-1-5-21-1257800471-3726757507-424188603-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{7251bf00-d2b9-44c2-ae3e-46a58bca8c63} deleted successfully

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Util Surftastic deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Util Surftastic deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Util Surftastic deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Util Surftastic deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Update Surftastic deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Update Surftastic deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Update Surftastic deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Update Surftastic deleted successfully

==== FireFox Fix ======================

Deleted from C:\Users\Walley\AppData\Roaming\Mozilla\Firefox\Profiles\w4ti787z.default\prefs.js:

Added to C:\Users\Walley\AppData\Roaming\Mozilla\Firefox\Profiles\w4ti787z.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

Deleted from C:\Users\Walley\AppData\Roaming\Nvu\Profiles\0kk7rp3d.default\prefs.js:

Added to C:\Users\Walley\AppData\Roaming\Nvu\Profiles\0kk7rp3d.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

C:\Users\Walley\daemonprocess.txt deleted
C:\Users\Walley\.android deleted
C:\PROGRA~2\MediaViewV1 deleted
C:\PROGRA~2\MediaViewerV1 deleted
C:\PROGRA~3\ProductData deleted
C:\Users\Walley\AppData\Local\cache deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"ext@MediaViewV1alpha3023.net"="C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha3023\ff" []

==== Firefox Extensions ======================

ProfilePath: C:\Users\Walley\AppData\Roaming\Mozilla\Firefox\Profiles\w4ti787z.default
- Undetermined - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha528\ff
- Undetermined - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha3023\ff

ProfilePath: C:\Users\Walley\AppData\Roaming\Nvu\Profiles\0kk7rp3d.default
- Undetermined - %ProfilePath%\extensions\installed-extensions.txt
- Nvu default - %ProfilePath%\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
cknnpclblnhehkeagdcjjhlejfcoehhi - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha3023\ch\MediaViewV1alpha3023.crx[]
pfljfjddpddjeeblallimgijlhbnmomn - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha528\ch\MediaViewerV1alpha528.crx[]

AdBlock - Walley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Beats By.Dr.Dre - Walley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lkmnpmgnojjhopfglajfmhclmlmpgclp

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://fr.msn.com/"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://fr.msn.com/"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{searchCLSID} Unknown Url="Not_Found"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE11SR"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchT ... {startPage}"
{7027CEB4-5AFE-420E-AF29-88BEC3765F03} Seznam TV Program Url="http://tv.seznam.cz/hledej?w={searchTer ... arch_12454"

==== Reset Google Chrome ======================

C:\Users\Walley\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences was reset successfully
C:\Users\Walley\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data was reset successfully

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\ext@MediaViewerV1alpha528.net deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\ext@MediaViewV1alpha3023.net deleted successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\cknnpclblnhehkeagdcjjhlejfcoehhi deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\pfljfjddpddjeeblallimgijlhbnmomn deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Walley\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Walley\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Walley\AppData\Local\Mozilla\Firefox\Profiles\w4ti787z.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Walley\AppData\Local\Google\Chrome\User Data\Profile 1\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=22 folders=21 932323 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Walley\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Walley\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on ne 16.03.2014 at 21:14:01,53 ======================

#11 Příspěvek od **vyosek** » 16 bře 2014 21:13

Poprosim o FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100

BigGuava69 · #12 Příspěvek od **BigGuava69** » 17 bře 2014 18:19

FRST log:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Walley (administrator) on WALLEY-PC on 17-03-2014 18:21:56
Running from C:\Users\Walley\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(forum.viry.cz) C:\Users\Walley\Desktop\FRSTLauncher (1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13213840 2012-10-26] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1234064 2012-10-29] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM-x32\...\Run: [Dolby Home Theater v4] - C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [507744 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\...\Run: [AVG-Secure-Search-Update_0214c] - C:\Users\Walley\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=92410166976d47d2b227a59d73ed4bf3-e534b542cddaedde88e441ef4900a4c701768105 /CMPID=0214c
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\...\Run: [7373dc185322d0eaea29dbca58a3a300] - "C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe" .. <===== ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_search_url = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_page_url = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search bar = http://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages =
SearchScopes: HKCU - ${searchCLSID} URL = http://search.live.com/results.aspx?q={ ... rer:source?}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchT ... {startPage}
SearchScopes: HKCU - {7027CEB4-5AFE-420E-AF29-88BEC3765F03} URL = http://tv.seznam.cz/hledej?w={searchTer ... arch_12454
BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} http://download.gigabyte.com.tw/object/Dldrv.ocx
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138

FireFox:
========
FF ProfilePath: C:\Users\Walley\AppData\Roaming\Mozilla\Firefox\Profiles\w4ti787z.default
FF NewTab: hxxp://www.google.com/
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-08-06] (Advanced Micro Devices, Inc.)
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-11-10] (Nero AG)
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2014-03-01] (IObit)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [29912 2013-08-08] (The OpenVPN Project)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] ()

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-02-04] (Disc Soft Ltd)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-03-17 18:21 - 2014-03-17 18:22 - 00011169 _____ () C:\Users\Walley\Desktop\FRST.txt
2014-03-17 17:37 - 2014-03-17 18:21 - 00000000 ____D () C:\FRST
2014-03-17 17:35 - 2014-03-17 17:35 - 00112640 _____ (forum.viry.cz) C:\Users\Walley\Desktop\FRSTLauncher (1).exe
2014-03-17 17:34 - 2014-03-17 17:34 - 00112640 _____ (forum.viry.cz) C:\Users\Walley\Downloads\Nepotvrzeno 997490.crdownload
2014-03-17 17:33 - 2014-03-17 17:33 - 02157056 _____ (Farbar) C:\Users\Walley\Desktop\FRST64.exe
2014-03-16 21:14 - 2014-03-16 21:14 - 00000000 ____D () C:\Users\Walley\.android
2014-03-16 21:13 - 2014-03-16 21:03 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-03-16 21:04 - 2014-03-16 21:14 - 00010423 _____ () C:\zoek-results.log
2014-03-16 21:03 - 2014-03-16 21:10 - 00000000 ____D () C:\zoek_backup
2014-03-16 21:00 - 2014-03-16 20:59 - 01285120 _____ () C:\Users\Walley\Desktop\zoek – kopie.exe
2014-03-16 18:18 - 2014-03-16 18:27 - 00000000 ____D () C:\Users\Walley\AppData\Local\CrashDumps
2014-03-16 15:07 - 2014-03-16 15:07 - 00002788 _____ () C:\Users\Walley\AppData\Local\recently-used.xbel
2014-03-16 14:57 - 2014-03-16 14:57 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\inkscape
2014-03-16 14:52 - 2014-03-16 14:52 - 00000967 _____ () C:\Users\Public\Desktop\Inkscape.lnk
2014-03-16 14:42 - 2014-03-16 14:53 - 00000000 ____D () C:\Program Files (x86)\Inkscape
2014-03-16 14:31 - 2014-03-16 14:32 - 34702513 _____ (inkscape.org) C:\Users\Walley\Downloads\inkscape-0.48.4-1-win32.exe
2014-03-16 14:08 - 2014-03-16 14:08 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Corel
2014-03-16 14:08 - 2014-03-16 14:08 - 00000000 ____D () C:\ProgramData\Protexis
2014-03-16 14:05 - 2014-03-16 14:28 - 00000000 ____D () C:\ProgramData\Corel
2014-03-16 14:03 - 2014-03-16 14:04 - 00228491 _____ () C:\Windows\DirectX.log
2014-03-16 13:58 - 2014-03-16 14:02 - 295206264 _____ (Acresso Software Inc.) C:\Users\Walley\Downloads\PSPX4_TBYB30EN.exe
2014-03-16 04:14 - 2014-03-16 04:14 - 00000000 ____D () C:\Users\Walley\AppData\Local\webkit
2014-03-16 04:11 - 2014-03-16 04:38 - 00000000 ____D () C:\Users\Walley\AppData\Local\gtk-2.0
2014-03-16 04:10 - 2014-03-16 04:10 - 00000000 ____D () C:\Users\Walley\.thumbnails
2014-03-16 03:57 - 2014-03-16 04:38 - 00000000 ____D () C:\Users\Walley\.gimp-2.8
2014-03-16 03:57 - 2014-03-16 03:57 - 00000000 ____D () C:\Users\Walley\AppData\Local\gegl-0.2
2014-03-16 03:54 - 2014-03-16 03:56 - 90332288 _____ (The GIMP Team ) C:\Users\Walley\Downloads\gimp-2.8.8-setup.exe
2014-03-15 16:18 - 2014-03-15 16:20 - 00000000 ____D () C:\AdwCleaner
2014-03-15 16:15 - 2014-03-15 16:15 - 00001680 _____ () C:\Users\Walley\Desktop\JRT.txt
2014-03-15 16:07 - 2014-03-15 16:07 - 00000000 ____D () C:\Windows\ERUNT
2014-03-15 16:06 - 2014-03-15 16:06 - 01950720 _____ () C:\Users\Walley\Downloads\adwcleaner.exe
2014-03-15 16:06 - 2014-03-15 16:06 - 01037734 _____ (Thisisu) C:\Users\Walley\Downloads\JRT.exe
2014-03-14 22:36 - 2014-03-16 23:43 - 00000000 ____D () C:\Users\Walley\Desktop\HTML Page
2014-03-14 17:46 - 2014-03-14 17:47 - 00000000 ____D () C:\rsit
2014-03-14 17:46 - 2014-03-14 17:47 - 00000000 ____D () C:\Program Files\trend micro
2014-03-14 17:45 - 2014-03-14 17:45 - 00935175 _____ () C:\Users\Walley\Downloads\RSITx64.exe
2014-03-14 17:33 - 2014-03-16 21:13 - 00962434 _____ () C:\Windows\PFRO.log
2014-03-14 17:29 - 2014-03-14 17:44 - 00000000 ____D () C:\Users\Walley\AppData\Local\NPE
2014-03-14 17:16 - 2014-03-16 21:13 - 00000000 ____D () C:\ProgramData\Norton
2014-03-14 16:58 - 2014-03-14 17:07 - 00010050 _____ () C:\UsbFix [Clean 1] WALLEY-PC.txt
2014-03-14 16:50 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-14 16:50 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-14 16:50 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-14 16:50 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-14 16:50 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-14 16:50 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-14 16:50 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-14 16:50 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-14 16:50 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-14 16:50 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-14 16:50 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-14 16:50 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-14 16:50 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 16:50 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-14 16:50 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-14 16:50 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 16:50 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-14 16:50 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-14 16:50 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 16:50 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-14 16:50 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 16:50 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 16:50 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 16:50 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-14 16:50 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 16:50 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-14 16:50 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-14 16:50 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-14 16:50 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-14 16:50 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 16:50 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 16:50 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-14 16:50 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 16:50 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-14 16:50 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 16:50 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-14 16:50 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 16:50 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 16:50 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-14 16:50 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-14 16:43 - 2014-03-14 17:00 - 00000000 ____D () C:\UsbFix
2014-03-14 16:43 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-14 16:43 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-14 16:43 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-14 16:43 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-14 16:43 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-14 16:43 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-14 16:43 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-14 16:43 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-14 16:42 - 2014-03-14 16:42 - 01144875 _____ (El Desaparecido - SosVirus.net) C:\Users\Walley\Downloads\UsbFix.exe
2014-03-14 16:39 - 2014-03-14 16:48 - 211474936 ____N (Symantec Corporation) C:\Users\Walley\Downloads\N360-TW-21.1.0-CZ.exe
2014-03-13 20:05 - 2014-03-13 20:10 - 00000000 ____D () C:\Program Files (x86)\Macromedia
2014-03-13 20:05 - 2014-03-13 20:05 - 00000000 ____D () C:\ProgramData\Macromedia
2014-03-13 20:04 - 2014-03-13 20:10 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-03-13 19:32 - 2014-03-13 19:32 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Nvu
2014-03-13 17:27 - 2014-03-17 15:56 - 00002722 _____ () C:\Windows\setupact.log
2014-03-13 17:27 - 2014-03-13 17:27 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-13 16:07 - 2014-03-13 16:10 - 00000000 ____D () C:\Users\Walley\Desktop\NO.6
2014-03-13 16:07 - 2013-12-30 21:56 - 21386221 _____ () C:\Users\Walley\Desktop\The-Elder-Scrolls--V-Skyrim---CRACK.rar
2014-03-12 14:45 - 2014-03-12 14:45 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software
2014-03-12 14:45 - 2014-03-12 14:45 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software
2014-03-11 23:21 - 2014-03-11 23:21 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Jpeg Resampler
2014-03-11 23:20 - 2014-03-11 23:20 - 01357414 _____ (Jpeg Resampler ) C:\Users\Walley\Downloads\JR2010Setup.exe
2014-03-11 23:14 - 2014-03-11 23:14 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\FastStone
2014-03-11 22:11 - 2014-03-04 12:32 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-03-11 22:08 - 2014-03-04 15:35 - 31474976 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 25255256 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 23716640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 17755424 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 15783992 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 12708128 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-03-11 22:08 - 2014-03-04 15:35 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 03143456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 02958792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 02783008 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 02411976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 00877856 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 00863064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 00846168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 00832936 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-03-11 22:08 - 2014-03-04 15:35 - 00148016 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-03-11 21:56 - 2014-03-11 21:57 - 04697744 _____ (AVAST Software) C:\Users\Walley\Downloads\avast_free_antivirus_setup_online.exe
2014-03-11 21:54 - 2014-03-11 21:54 - 00003216 _____ () C:\Windows\System32\Tasks\Driver Booster Scan
2014-03-11 21:54 - 2014-03-11 21:54 - 00002858 _____ () C:\Windows\System32\Tasks\Driver Booster SkipUAC (Walley)
2014-03-11 17:32 - 2014-03-11 17:32 - 00000000 ____D () C:\Users\Walley\Documents\Need for Speed World
2014-03-07 16:41 - 2014-03-07 16:41 - 00000230 _____ () C:\Users\Walley\Desktop\Sid Meier's Civilization V (DirectX 11).url
2014-03-06 18:26 - 2014-03-06 18:26 - 00001968 _____ () C:\Users\Walley\Desktop\Drakensang Online.lnk
2014-03-06 18:26 - 2014-03-06 18:26 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online
2014-03-06 18:26 - 2014-03-06 18:26 - 00000000 ____D () C:\Program Files (x86)\Drakensang Online
2014-03-06 18:25 - 2014-03-06 18:26 - 08987616 _____ () C:\Users\Walley\Downloads\DrakensangOnlineSetup.exe
2014-03-05 23:39 - 2014-03-07 21:52 - 00001894 _____ () C:\Users\Walley\Desktop\E.txt
2014-03-02 07:27 - 2014-03-02 07:28 - 57187288 _____ (Nero AG) C:\Users\Walley\Downloads\Nero-9.4.12.3_free.exe
2014-03-02 00:03 - 2014-03-02 00:03 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Flashmedia
2014-03-01 16:31 - 2014-03-14 17:33 - 00000000 ____D () C:\ProgramData\AVG2014
2014-03-01 16:31 - 2014-03-01 16:31 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\TuneUp Software
2014-03-01 16:29 - 2014-03-14 17:33 - 00000000 ____D () C:\ProgramData\MFAData
2014-03-01 16:29 - 2014-03-01 16:29 - 00000000 ____D () C:\Users\Walley\AppData\Local\MFAData
2014-03-01 15:59 - 2014-03-01 15:59 - 00003246 _____ () C:\Windows\System32\Tasks\{91FB0349-5246-4C9A-9573-735C69E76E61}
2014-03-01 15:58 - 2014-03-02 00:00 - 00012846 _____ () C:\Users\Walley\Desktop\Stažené soubory.lnk
2014-03-01 14:51 - 2014-03-17 18:20 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Skype
2014-03-01 14:51 - 2014-03-01 14:51 - 00002731 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-03-01 14:51 - 2014-03-01 14:51 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-01 14:51 - 2014-03-01 14:51 - 00000000 ____D () C:\Users\Walley\AppData\Local\Skype
2014-03-01 14:51 - 2014-03-01 14:51 - 00000000 ____D () C:\ProgramData\Skype
2014-03-01 14:49 - 2014-03-01 14:49 - 01678496 _____ (Skype Technologies S.A.) C:\Users\Walley\Downloads\SkypeSetup.exe
2014-03-01 14:43 - 2004-12-02 18:20 - 01843200 _____ (NCT Company Ltd.) C:\Windows\SysWOW64\NCTAudioFile2.dll
2014-03-01 14:43 - 2004-08-25 13:53 - 00311296 _____ (NCT Company Ltd.) C:\Windows\SysWOW64\NCTAudioRecord2.dll
2014-03-01 14:43 - 2004-05-20 13:07 - 00335872 _____ (NCT Company Ltd.) C:\Windows\SysWOW64\NCTAudioVisualization2.dll
2014-03-01 14:43 - 2002-01-05 15:37 - 00344064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr70.dll
2014-03-01 14:30 - 2014-03-01 14:30 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\ProductData
2014-03-01 14:29 - 2014-03-11 22:04 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-03-01 14:29 - 2014-03-11 21:54 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\IObit
2014-03-01 14:29 - 2014-03-11 21:54 - 00000000 ____D () C:\ProgramData\IObit
2014-03-01 14:29 - 2014-03-01 14:29 - 11201344 _____ (IObit) C:\Users\Walley\Downloads\iobituninstaller3.1.exe
2014-03-01 14:29 - 2014-03-01 14:29 - 00002888 _____ () C:\Windows\System32\Tasks\Uninstaller_SkipUac_Administrator
2014-03-01 14:29 - 2014-03-01 14:29 - 00001252 _____ () C:\Users\Walley\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2014-03-01 14:29 - 2014-03-01 14:29 - 00001228 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-03-01 10:06 - 2014-03-01 10:06 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-01 04:25 - 2014-03-17 15:59 - 00000000 ____D () C:\Users\Walley\AppData\Local\HTC MediaHub
2014-03-01 04:25 - 2014-03-02 22:49 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\HTC
2014-03-01 04:25 - 2014-03-01 04:25 - 00002031 _____ () C:\Users\Public\Desktop\HTC Sync Manager.lnk
2014-03-01 04:25 - 2014-03-01 04:25 - 00000000 ____D () C:\Users\Walley\Documents\HTC
2014-03-01 04:25 - 2014-03-01 04:25 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Apple Computer
2014-03-01 04:25 - 2014-03-01 04:25 - 00000000 ____D () C:\Users\Walley\AppData\Local\Apple Computer
2014-03-01 04:25 - 2014-03-01 04:25 - 00000000 ____D () C:\ProgramData\HTC
2014-03-01 04:24 - 2014-03-01 04:25 - 00000000 ____D () C:\Program Files (x86)\HTC
2014-03-01 04:24 - 2014-03-01 04:24 - 00000000 ____D () C:\Users\Walley\AppData\Local\Downloaded Installations
2014-03-01 04:24 - 2014-03-01 04:24 - 00000000 ____D () C:\Program Files (x86)\Spirent Communications
2014-03-01 04:22 - 2014-03-01 04:23 - 135804592 _____ (HTC) C:\Users\Walley\Downloads\setup_2.4.36.0_htc.exe
2014-02-27 17:28 - 2014-02-27 17:28 - 00000476 __RSH () C:\ProgramData\ntuser.pol
2014-02-26 22:26 - 2014-02-26 22:26 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-02-26 22:23 - 2014-02-08 19:34 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll
2014-02-26 22:23 - 2014-02-08 19:34 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll
2014-02-20 19:54 - 2014-02-20 19:54 - 00003036 _____ () C:\Windows\System32\Tasks\{696899D4-140B-4D8D-9F02-FCAA25C8B63A}
2014-02-18 17:21 - 2014-02-18 17:21 - 00002267 _____ () C:\Users\Public\Desktop\TP-LINK Wireless Configuration Utility.lnk
2014-02-16 01:26 - 2014-03-16 20:18 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\vlc
2014-02-16 01:26 - 2014-02-16 01:26 - 00001066 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-02-16 01:26 - 2014-02-16 01:26 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-02-16 01:22 - 2014-02-16 01:23 - 31140909 _____ () C:\Users\Walley\Downloads\vlc-setup.exe
2014-02-15 20:37 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-15 20:37 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-15 14:27 - 2014-02-15 20:40 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-02-15 14:27 - 2014-02-15 20:40 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-02-15 14:27 - 2014-02-15 20:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-02-15 14:25 - 2014-02-15 14:26 - 13813944 _____ (Microsoft Corporation) C:\Users\Walley\Downloads\MSEInstall_x86_cs_cz.exe
2014-02-15 12:58 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-15 12:58 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-15 12:58 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-15 12:58 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-15 12:58 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-15 12:58 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-15 12:58 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-15 12:58 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-15 12:58 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-15 12:58 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-15 12:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-15 12:58 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-15 12:58 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-15 12:58 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-15 12:58 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-15 12:58 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-15 12:58 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-15 12:58 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-15 12:58 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-15 12:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-15 12:58 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-15 12:58 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-15 12:58 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-15 12:58 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-15 12:58 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-15 12:58 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-15 12:58 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-15 12:58 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll

==================== One Month Modified Files and Folders =======

2014-03-17 18:22 - 2014-03-17 18:21 - 00011169 _____ () C:\Users\Walley\Desktop\FRST.txt
2014-03-17 18:21 - 2014-03-17 17:37 - 00000000 ____D () C:\FRST
2014-03-17 18:20 - 2014-03-01 14:51 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Skype
2014-03-17 18:19 - 2014-01-29 15:04 - 00000952 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-17 18:07 - 2014-01-29 13:28 - 00003978 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9E030DF9-3427-4E53-A338-5A05626FA41A}
2014-03-17 17:42 - 2014-01-29 20:21 - 01938741 _____ () C:\Windows\WindowsUpdate.log
2014-03-17 17:35 - 2014-03-17 17:35 - 00112640 _____ (forum.viry.cz) C:\Users\Walley\Desktop\FRSTLauncher (1).exe
2014-03-17 17:34 - 2014-03-17 17:34 - 00112640 _____ (forum.viry.cz) C:\Users\Walley\Downloads\Nepotvrzeno 997490.crdownload
2014-03-17 17:33 - 2014-03-17 17:33 - 02157056 _____ (Farbar) C:\Users\Walley\Desktop\FRST64.exe
2014-03-17 17:33 - 2014-01-29 13:29 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-17 16:01 - 2011-04-12 09:34 - 00668866 _____ () C:\Windows\system32\perfh005.dat
2014-03-17 16:01 - 2011-04-12 09:34 - 00141526 _____ () C:\Windows\system32\perfc005.dat
2014-03-17 16:01 - 2009-07-14 06:13 - 01584554 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-17 15:59 - 2014-03-01 04:25 - 00000000 ____D () C:\Users\Walley\AppData\Local\HTC MediaHub
2014-03-17 15:59 - 2014-01-29 15:04 - 00000948 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-17 15:56 - 2014-03-13 17:27 - 00002722 _____ () C:\Windows\setupact.log
2014-03-17 15:56 - 2014-01-29 13:45 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-03-17 15:56 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-16 23:43 - 2014-03-14 22:36 - 00000000 ____D () C:\Users\Walley\Desktop\HTML Page
2014-03-16 21:14 - 2014-03-16 21:14 - 00000000 ____D () C:\Users\Walley\.android
2014-03-16 21:14 - 2014-03-16 21:04 - 00010423 _____ () C:\zoek-results.log
2014-03-16 21:14 - 2014-01-29 20:21 - 00000000 ____D () C:\Users\Walley
2014-03-16 21:13 - 2014-03-14 17:33 - 00962434 _____ () C:\Windows\PFRO.log
2014-03-16 21:13 - 2014-03-14 17:16 - 00000000 ____D () C:\ProgramData\Norton
2014-03-16 21:10 - 2014-03-16 21:03 - 00000000 ____D () C:\zoek_backup
2014-03-16 21:03 - 2014-03-16 21:13 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-03-16 20:59 - 2014-03-16 21:00 - 01285120 _____ () C:\Users\Walley\Desktop\zoek – kopie.exe
2014-03-16 20:55 - 2014-01-29 15:09 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-03-16 20:54 - 2009-07-14 05:45 - 00016848 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-16 20:54 - 2009-07-14 05:45 - 00016848 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-16 20:18 - 2014-02-16 01:26 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\vlc
2014-03-16 18:27 - 2014-03-16 18:18 - 00000000 ____D () C:\Users\Walley\AppData\Local\CrashDumps
2014-03-16 15:07 - 2014-03-16 15:07 - 00002788 _____ () C:\Users\Walley\AppData\Local\recently-used.xbel
2014-03-16 14:57 - 2014-03-16 14:57 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\inkscape
2014-03-16 14:53 - 2014-03-16 14:42 - 00000000 ____D () C:\Program Files (x86)\Inkscape
2014-03-16 14:52 - 2014-03-16 14:52 - 00000967 _____ () C:\Users\Public\Desktop\Inkscape.lnk
2014-03-16 14:32 - 2014-03-16 14:31 - 34702513 _____ (inkscape.org) C:\Users\Walley\Downloads\inkscape-0.48.4-1-win32.exe
2014-03-16 14:28 - 2014-03-16 14:05 - 00000000 ____D () C:\ProgramData\Corel
2014-03-16 14:08 - 2014-03-16 14:08 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Corel
2014-03-16 14:08 - 2014-03-16 14:08 - 00000000 ____D () C:\ProgramData\Protexis
2014-03-16 14:04 - 2014-03-16 14:03 - 00228491 _____ () C:\Windows\DirectX.log
2014-03-16 14:02 - 2014-03-16 13:58 - 295206264 _____ (Acresso Software Inc.) C:\Users\Walley\Downloads\PSPX4_TBYB30EN.exe
2014-03-16 04:38 - 2014-03-16 04:11 - 00000000 ____D () C:\Users\Walley\AppData\Local\gtk-2.0
2014-03-16 04:38 - 2014-03-16 03:57 - 00000000 ____D () C:\Users\Walley\.gimp-2.8
2014-03-16 04:14 - 2014-03-16 04:14 - 00000000 ____D () C:\Users\Walley\AppData\Local\webkit
2014-03-16 04:10 - 2014-03-16 04:10 - 00000000 ____D () C:\Users\Walley\.thumbnails
2014-03-16 03:57 - 2014-03-16 03:57 - 00000000 ____D () C:\Users\Walley\AppData\Local\gegl-0.2
2014-03-16 03:56 - 2014-03-16 03:54 - 90332288 _____ (The GIMP Team ) C:\Users\Walley\Downloads\gimp-2.8.8-setup.exe
2014-03-15 23:22 - 2014-01-29 15:05 - 00002143 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-15 17:44 - 2014-01-30 14:43 - 00000000 ____D () C:\Users\Walley\AppData\Local\PMB Files
2014-03-15 17:44 - 2014-01-30 14:43 - 00000000 ____D () C:\ProgramData\PMB Files
2014-03-15 16:20 - 2014-03-15 16:18 - 00000000 ____D () C:\AdwCleaner
2014-03-15 16:15 - 2014-03-15 16:15 - 00001680 _____ () C:\Users\Walley\Desktop\JRT.txt
2014-03-15 16:07 - 2014-03-15 16:07 - 00000000 ____D () C:\Windows\ERUNT
2014-03-15 16:06 - 2014-03-15 16:06 - 01950720 _____ () C:\Users\Walley\Downloads\adwcleaner.exe
2014-03-15 16:06 - 2014-03-15 16:06 - 01037734 _____ (Thisisu) C:\Users\Walley\Downloads\JRT.exe
2014-03-15 01:57 - 2014-01-29 19:09 - 00000000 ____D () C:\Games
2014-03-15 01:57 - 2014-01-29 18:22 - 00000000 ____D () C:\Users\Walley\AppData\Local\Adobe
2014-03-15 01:06 - 2014-01-30 15:20 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-03-14 22:22 - 2009-07-14 05:45 - 00277432 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-14 17:47 - 2014-03-14 17:46 - 00000000 ____D () C:\rsit
2014-03-14 17:47 - 2014-03-14 17:46 - 00000000 ____D () C:\Program Files\trend micro
2014-03-14 17:45 - 2014-03-14 17:45 - 00935175 _____ () C:\Users\Walley\Downloads\RSITx64.exe
2014-03-14 17:44 - 2014-03-14 17:29 - 00000000 ____D () C:\Users\Walley\AppData\Local\NPE
2014-03-14 17:37 - 2014-01-29 20:21 - 00000000 ___RD () C:\Users\Walley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-14 17:33 - 2014-03-01 16:31 - 00000000 ____D () C:\ProgramData\AVG2014
2014-03-14 17:33 - 2014-03-01 16:29 - 00000000 ____D () C:\ProgramData\MFAData
2014-03-14 17:07 - 2014-03-14 16:58 - 00010050 _____ () C:\UsbFix [Clean 1] WALLEY-PC.txt
2014-03-14 17:00 - 2014-03-14 16:43 - 00000000 ____D () C:\UsbFix
2014-03-14 16:48 - 2014-03-14 16:39 - 211474936 ____N (Symantec Corporation) C:\Users\Walley\Downloads\N360-TW-21.1.0-CZ.exe
2014-03-14 16:42 - 2014-03-14 16:42 - 01144875 _____ (El Desaparecido - SosVirus.net) C:\Users\Walley\Downloads\UsbFix.exe
2014-03-14 16:38 - 2014-01-29 15:04 - 00058400 _____ () C:\Users\Walley\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-13 20:10 - 2014-03-13 20:05 - 00000000 ____D () C:\Program Files (x86)\Macromedia
2014-03-13 20:10 - 2014-03-13 20:04 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-03-13 20:10 - 2014-01-29 13:29 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Macromedia
2014-03-13 20:05 - 2014-03-13 20:05 - 00000000 ____D () C:\ProgramData\Macromedia
2014-03-13 19:32 - 2014-03-13 19:32 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Nvu
2014-03-13 17:27 - 2014-03-13 17:27 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-13 16:10 - 2014-03-13 16:07 - 00000000 ____D () C:\Users\Walley\Desktop\NO.6
2014-03-12 14:45 - 2014-03-12 14:45 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software
2014-03-12 14:45 - 2014-03-12 14:45 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software
2014-03-11 23:21 - 2014-03-11 23:21 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Jpeg Resampler
2014-03-11 23:20 - 2014-03-11 23:20 - 01357414 _____ (Jpeg Resampler ) C:\Users\Walley\Downloads\JR2010Setup.exe
2014-03-11 23:14 - 2014-03-11 23:14 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\FastStone
2014-03-11 22:11 - 2014-01-29 13:45 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-03-11 22:04 - 2014-03-01 14:29 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-03-11 21:57 - 2014-03-11 21:56 - 04697744 _____ (AVAST Software) C:\Users\Walley\Downloads\avast_free_antivirus_setup_online.exe
2014-03-11 21:54 - 2014-03-11 21:54 - 00003216 _____ () C:\Windows\System32\Tasks\Driver Booster Scan
2014-03-11 21:54 - 2014-03-11 21:54 - 00002858 _____ () C:\Windows\System32\Tasks\Driver Booster SkipUAC (Walley)
2014-03-11 21:54 - 2014-03-01 14:29 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\IObit
2014-03-11 21:54 - 2014-03-01 14:29 - 00000000 ____D () C:\ProgramData\IObit
2014-03-11 19:35 - 2014-01-29 13:29 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-11 19:35 - 2014-01-29 13:29 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-11 19:35 - 2014-01-29 13:29 - 00003852 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-11 17:32 - 2014-03-11 17:32 - 00000000 ____D () C:\Users\Walley\Documents\Need for Speed World
2014-03-11 16:03 - 2014-02-04 13:10 - 00000348 _____ () C:\Users\Walley\rgmnr
2014-03-07 21:52 - 2014-03-05 23:39 - 00001894 _____ () C:\Users\Walley\Desktop\E.txt
2014-03-07 16:41 - 2014-03-07 16:41 - 00000230 _____ () C:\Users\Walley\Desktop\Sid Meier's Civilization V (DirectX 11).url
2014-03-06 18:26 - 2014-03-06 18:26 - 00001968 _____ () C:\Users\Walley\Desktop\Drakensang Online.lnk
2014-03-06 18:26 - 2014-03-06 18:26 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online
2014-03-06 18:26 - 2014-03-06 18:26 - 00000000 ____D () C:\Program Files (x86)\Drakensang Online
2014-03-06 18:26 - 2014-03-06 18:25 - 08987616 _____ () C:\Users\Walley\Downloads\DrakensangOnlineSetup.exe
2014-03-04 15:35 - 2014-03-11 22:08 - 31474976 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 25255256 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 23716640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 17755424 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 15783992 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 12708128 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-03-04 15:35 - 2014-03-11 22:08 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 03143456 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 02958792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 02783008 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 02411976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433523.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 01516488 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433523.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 00877856 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 00863064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 00846168 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 00832936 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-03-04 15:35 - 2014-03-11 22:08 - 00148016 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-03-04 15:35 - 2014-01-30 01:16 - 18302384 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-03-04 15:35 - 2014-01-30 01:16 - 14709720 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-03-04 15:35 - 2014-01-30 01:16 - 02715264 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-03-04 15:35 - 2014-01-29 13:45 - 00024544 _____ () C:\Windows\system32\nvinfo.pb
2014-03-04 15:35 - 2014-01-29 13:44 - 03093280 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-03-04 15:35 - 2014-01-29 13:44 - 00947808 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-03-04 14:06 - 2014-01-29 13:45 - 06714312 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-03-04 14:06 - 2014-01-29 13:45 - 03497816 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-03-04 14:05 - 2014-01-29 13:45 - 03649185 _____ () C:\Windows\system32\nvcoproc.bin
2014-03-04 14:05 - 2014-01-29 13:45 - 02558808 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-03-04 14:05 - 2014-01-29 13:45 - 00922968 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-03-04 14:05 - 2014-01-29 13:45 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-03-04 14:05 - 2014-01-29 13:45 - 00064968 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-03-04 12:32 - 2014-03-11 22:11 - 00599840 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-03-02 22:49 - 2014-03-01 04:25 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\HTC
2014-03-02 07:28 - 2014-03-02 07:27 - 57187288 _____ (Nero AG) C:\Users\Walley\Downloads\Nero-9.4.12.3_free.exe
2014-03-02 00:12 - 2014-01-29 20:21 - 00000000 ____D () C:\Users\Walley\AppData\Local\VirtualStore
2014-03-02 00:03 - 2014-03-02 00:03 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Flashmedia
2014-03-02 00:00 - 2014-03-01 15:58 - 00012846 _____ () C:\Users\Walley\Desktop\Stažené soubory.lnk
2014-03-01 16:31 - 2014-03-01 16:31 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\TuneUp Software
2014-03-01 16:29 - 2014-03-01 16:29 - 00000000 ____D () C:\Users\Walley\AppData\Local\MFAData
2014-03-01 15:59 - 2014-03-01 15:59 - 00003246 _____ () C:\Windows\System32\Tasks\{91FB0349-5246-4C9A-9573-735C69E76E61}
2014-03-01 14:51 - 2014-03-01 14:51 - 00002731 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-03-01 14:51 - 2014-03-01 14:51 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-01 14:51 - 2014-03-01 14:51 - 00000000 ____D () C:\Users\Walley\AppData\Local\Skype
2014-03-01 14:51 - 2014-03-01 14:51 - 00000000 ____D () C:\ProgramData\Skype
2014-03-01 14:49 - 2014-03-01 14:49 - 01678496 _____ (Skype Technologies S.A.) C:\Users\Walley\Downloads\SkypeSetup.exe
2014-03-01 14:30 - 2014-03-01 14:30 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\ProductData
2014-03-01 14:29 - 2014-03-01 14:29 - 11201344 _____ (IObit) C:\Users\Walley\Downloads\iobituninstaller3.1.exe
2014-03-01 14:29 - 2014-03-01 14:29 - 00002888 _____ () C:\Windows\System32\Tasks\Uninstaller_SkipUac_Administrator
2014-03-01 14:29 - 2014-03-01 14:29 - 00001252 _____ () C:\Users\Walley\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2014-03-01 14:29 - 2014-03-01 14:29 - 00001228 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-03-01 10:06 - 2014-03-01 10:06 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-01 07:05 - 2014-03-14 16:50 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-01 06:17 - 2014-03-14 16:50 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-01 06:16 - 2014-03-14 16:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-01 05:58 - 2014-03-14 16:50 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-01 05:52 - 2014-03-14 16:50 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-01 05:51 - 2014-03-14 16:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-01 05:42 - 2014-03-14 16:50 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-01 05:40 - 2014-03-14 16:50 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-01 05:37 - 2014-03-14 16:50 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-01 05:33 - 2014-03-14 16:50 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-01 05:33 - 2014-03-14 16:50 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-01 05:32 - 2014-03-14 16:50 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-01 05:30 - 2014-03-14 16:50 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-01 05:23 - 2014-03-14 16:50 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-01 05:17 - 2014-03-14 16:50 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-01 05:11 - 2014-03-14 16:50 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-01 05:02 - 2014-03-14 16:50 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-01 04:54 - 2014-03-14 16:50 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-01 04:52 - 2014-03-14 16:50 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-01 04:51 - 2014-03-14 16:50 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-01 04:47 - 2014-03-14 16:50 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-01 04:43 - 2014-03-14 16:50 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-01 04:43 - 2014-03-14 16:50 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-01 04:42 - 2014-03-14 16:50 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-01 04:40 - 2014-03-14 16:50 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-01 04:38 - 2014-03-14 16:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-01 04:37 - 2014-03-14 16:50 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-01 04:35 - 2014-03-14 16:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-01 04:25 - 2014-03-01 04:25 - 00002031 _____ () C:\Users\Public\Desktop\HTC Sync Manager.lnk
2014-03-01 04:25 - 2014-03-01 04:25 - 00000000 ____D () C:\Users\Walley\Documents\HTC
2014-03-01 04:25 - 2014-03-01 04:25 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\Apple Computer
2014-03-01 04:25 - 2014-03-01 04:25 - 00000000 ____D () C:\Users\Walley\AppData\Local\Apple Computer
2014-03-01 04:25 - 2014-03-01 04:25 - 00000000 ____D () C:\ProgramData\HTC
2014-03-01 04:25 - 2014-03-01 04:24 - 00000000 ____D () C:\Program Files (x86)\HTC
2014-03-01 04:24 - 2014-03-01 04:24 - 00000000 ____D () C:\Users\Walley\AppData\Local\Downloaded Installations
2014-03-01 04:24 - 2014-03-01 04:24 - 00000000 ____D () C:\Program Files (x86)\Spirent Communications
2014-03-01 04:23 - 2014-03-01 04:22 - 135804592 _____ (HTC) C:\Users\Walley\Downloads\setup_2.4.36.0_htc.exe
2014-03-01 04:18 - 2014-03-14 16:50 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-01 04:16 - 2014-03-14 16:50 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-01 04:14 - 2014-03-14 16:50 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-01 04:10 - 2014-03-14 16:50 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-01 04:03 - 2014-03-14 16:50 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-01 04:00 - 2014-03-14 16:50 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-01 03:57 - 2014-03-14 16:50 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-01 03:38 - 2014-03-14 16:50 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-01 03:32 - 2014-03-14 16:50 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-01 03:27 - 2014-03-14 16:50 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-01 03:25 - 2014-03-14 16:50 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-01 03:25 - 2014-03-14 16:50 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-01 00:08 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\LiveKernelReports
2014-02-27 17:28 - 2014-02-27 17:28 - 00000476 __RSH () C:\ProgramData\ntuser.pol
2014-02-27 17:28 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-02-27 17:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-02-26 22:26 - 2014-02-26 22:26 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-02-26 18:42 - 2014-01-29 13:28 - 01559268 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-20 22:14 - 2014-01-29 15:04 - 00003948 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-20 22:14 - 2014-01-29 15:04 - 00003696 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-20 19:54 - 2014-02-20 19:54 - 00003036 _____ () C:\Windows\System32\Tasks\{696899D4-140B-4D8D-9F02-FCAA25C8B63A}
2014-02-18 17:21 - 2014-02-18 17:21 - 00002267 _____ () C:\Users\Public\Desktop\TP-LINK Wireless Configuration Utility.lnk
2014-02-18 17:21 - 2014-01-29 18:16 - 00000000 ____D () C:\ProgramData\TP-LINK
2014-02-17 21:41 - 2014-02-04 14:42 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\DAEMON Tools Lite
2014-02-17 15:48 - 2014-01-29 13:24 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-17 02:42 - 2014-01-29 13:53 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-17 02:42 - 2014-01-29 13:53 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-16 13:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-16 01:26 - 2014-02-16 01:26 - 00001066 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-02-16 01:26 - 2014-02-16 01:26 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-02-16 01:23 - 2014-02-16 01:22 - 31140909 _____ () C:\Users\Walley\Downloads\vlc-setup.exe
2014-02-15 20:40 - 2014-02-15 14:27 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-02-15 20:40 - 2014-02-15 14:27 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-02-15 20:40 - 2014-02-15 14:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-02-15 14:26 - 2014-02-15 14:25 - 13813944 _____ (Microsoft Corporation) C:\Users\Walley\Downloads\MSEInstall_x86_cs_cz.exe

Some content of TEMP:
====================
C:\Users\Walley\AppData\Local\Temp\promote-upx.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-03-11 17:05

===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================

Drive c: () (Fixed) (Total:111.69 GB) (Free:13.29 GB) NTFS

Available physical RAM: 6451.16 MB
Total physical RAM: 8152.75 MB
Percentage of memory in use: 20%

==================== MBR and Partition Table ==================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: 8DE02E1D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)

==================== Scheduled Tasks (whitelisted) ==================

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Alternate Data Streams (whitelisted) ==================

==================== Security Center ==================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)

***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Walley\Desktop" je 2689 MB.

***** Startup Programs *****

***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000

==================== End Of Log ==============================

#13 Příspěvek od **vyosek** » 18 bře 2014 10:46

Tvorba fixlistu pro FRST

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

Start
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\Users\Walley\AppData\Local\Temp\promote-upx.exe

2014-03-01 14:49 - 2014-03-01 14:49 - 01678496 _____ (Skype Technologies S.A.) C:\Users\Walley\Downloads\SkypeSetup.exe
2014-03-01 14:30 - 2014-03-01 14:30 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\ProductData
2014-03-01 14:29 - 2014-03-01 14:29 - 11201344 _____ (IObit) C:\Users\Walley\Downloads\iobituninstaller3.1.exe
2014-03-01 14:29 - 2014-03-01 14:29 - 00002888 _____ () C:\Windows\System32\Tasks\Uninstaller_SkipUac_Administrator
2014-03-01 14:29 - 2014-03-01 14:29 - 00001252 _____ () C:\Users\Walley\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2014-03-01 14:29 - 2014-03-01 14:29 - 00001228 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-03-01 16:29 - 2014-03-01 16:29 - 00000000 ____D () C:\Users\Walley\AppData\Local\MFAData
2014-03-11 22:04 - 2014-03-01 14:29 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-03-11 21:57 - 2014-03-11 21:56 - 04697744 _____ (AVAST Software) C:\Users\Walley\Downloads\avast_free_antivirus_setup_online.exe
2014-03-11 21:54 - 2014-03-01 14:29 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\IObit
2014-03-11 21:54 - 2014-03-01 14:29 - 00000000 ____D () C:\ProgramData\IObit
2014-03-17 17:35 - 2014-03-17 17:35 - 00112640 _____ (forum.viry.cz) C:\Users\Walley\Desktop\FRSTLauncher (1).exe
2014-03-17 17:34 - 2014-03-17 17:34 - 00112640 _____ (forum.viry.cz) C:\Users\Walley\Downloads\Nepotvrzeno 997490.crdownload
2014-03-16 21:13 - 2014-03-16 21:03 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-03-16 21:04 - 2014-03-16 21:14 - 00010423 _____ () C:\zoek-results.log
2014-03-16 21:03 - 2014-03-16 21:10 - 00000000 ____D () C:\zoek_backup
2014-03-16 21:00 - 2014-03-16 20:59 - 01285120 _____ () C:\Users\Walley\Desktop\zoek – kopie.exe
2014-03-15 16:15 - 2014-03-15 16:15 - 00001680 _____ () C:\Users\Walley\Desktop\JRT.txt
2014-03-15 16:06 - 2014-03-15 16:06 - 01950720 _____ () C:\Users\Walley\Downloads\adwcleaner.exe
2014-03-15 16:06 - 2014-03-15 16:06 - 01037734 _____ (Thisisu) C:\Users\Walley\Downloads\JRT.exe
2014-03-14 16:58 - 2014-03-14 17:07 - 00010050 _____ () C:\UsbFix [Clean 1] WALLEY-PC.txt
2014-03-14 16:43 - 2014-03-14 17:00 - 00000000 ____D () C:\UsbFix
2014-03-14 16:42 - 2014-03-14 16:42 - 01144875 _____ (El Desaparecido - SosVirus.net) C:\Users\Walley\Downloads\UsbFix.exe
C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe
C:\Users\Walley\AppData\Roaming\AVG 0214c Campaign

S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2014-03-01] (IObit)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_search_url = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_page_url = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search bar = http://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages =
SearchScopes: HKCU - ${searchCLSID} URL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {7027CEB4-5AFE-420E-AF29-88BEC3765F03} URL = http://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_12454
BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\...\Run: [AVG-Secure-Search-Update_0214c] - C:\Users\Walley\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=92410166976d47d2b227a59d73ed4bf3-e534b542cddaedde88e441ef4900a4c701768105 /CMPID=0214c
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\...\Run: [7373dc185322d0eaea29dbca58a3a300] - "C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe" .. <===== ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)

Hosts:
CMD: shutdown /r /f /t 2

End

Ulozte vytvoreny TXT jako fixlist.txt
Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

Kliknete na Fix
Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

BigGuava69 · #14 Příspěvek od **BigGuava69** » 18 bře 2014 17:02

Fixlog vytvořený ve FRST :

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by Walley at 2014-03-18 17:05:17 Run:1
Running from C:\Users\Walley\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\Users\Walley\AppData\Local\Temp\promote-upx.exe

2014-03-01 14:49 - 2014-03-01 14:49 - 01678496 _____ (Skype Technologies S.A.) C:\Users\Walley\Downloads\SkypeSetup.exe
2014-03-01 14:30 - 2014-03-01 14:30 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\ProductData
2014-03-01 14:29 - 2014-03-01 14:29 - 11201344 _____ (IObit) C:\Users\Walley\Downloads\iobituninstaller3.1.exe
2014-03-01 14:29 - 2014-03-01 14:29 - 00002888 _____ () C:\Windows\System32\Tasks\Uninstaller_SkipUac_Administrator
2014-03-01 14:29 - 2014-03-01 14:29 - 00001252 _____ () C:\Users\Walley\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk
2014-03-01 14:29 - 2014-03-01 14:29 - 00001228 _____ () C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-03-01 16:29 - 2014-03-01 16:29 - 00000000 ____D () C:\Users\Walley\AppData\Local\MFAData
2014-03-11 22:04 - 2014-03-01 14:29 - 00000000 ____D () C:\Program Files (x86)\IObit
2014-03-11 21:57 - 2014-03-11 21:56 - 04697744 _____ (AVAST Software) C:\Users\Walley\Downloads\avast_free_antivirus_setup_online.exe
2014-03-11 21:54 - 2014-03-01 14:29 - 00000000 ____D () C:\Users\Walley\AppData\Roaming\IObit
2014-03-11 21:54 - 2014-03-01 14:29 - 00000000 ____D () C:\ProgramData\IObit
2014-03-17 17:35 - 2014-03-17 17:35 - 00112640 _____ (forum.viry.cz) C:\Users\Walley\Desktop\FRSTLauncher (1).exe
2014-03-17 17:34 - 2014-03-17 17:34 - 00112640 _____ (forum.viry.cz) C:\Users\Walley\Downloads\Nepotvrzeno 997490.crdownload
2014-03-16 21:13 - 2014-03-16 21:03 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-03-16 21:04 - 2014-03-16 21:14 - 00010423 _____ () C:\zoek-results.log
2014-03-16 21:03 - 2014-03-16 21:10 - 00000000 ____D () C:\zoek_backup
2014-03-16 21:00 - 2014-03-16 20:59 - 01285120 _____ () C:\Users\Walley\Desktop\zoek – kopie.exe
2014-03-15 16:15 - 2014-03-15 16:15 - 00001680 _____ () C:\Users\Walley\Desktop\JRT.txt
2014-03-15 16:06 - 2014-03-15 16:06 - 01950720 _____ () C:\Users\Walley\Downloads\adwcleaner.exe
2014-03-15 16:06 - 2014-03-15 16:06 - 01037734 _____ (Thisisu) C:\Users\Walley\Downloads\JRT.exe
2014-03-14 16:58 - 2014-03-14 17:07 - 00010050 _____ () C:\UsbFix [Clean 1] WALLEY-PC.txt
2014-03-14 16:43 - 2014-03-14 17:00 - 00000000 ____D () C:\UsbFix
2014-03-14 16:42 - 2014-03-14 16:42 - 01144875 _____ (El Desaparecido - SosVirus.net) C:\Users\Walley\Downloads\UsbFix.exe
C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe
C:\Users\Walley\AppData\Roaming\AVG 0214c Campaign

S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2014-03-01] (IObit)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_search_url = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_page_url = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search bar = http://search.msn.com/spbasic.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages =
SearchScopes: HKCU - ${searchCLSID} URL = http://search.live.com/results.aspx?q={ ... rer:source?}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchT ... {startPage}
SearchScopes: HKCU - {7027CEB4-5AFE-420E-AF29-88BEC3765F03} URL = http://tv.seznam.cz/hledej?w={searchTer ... arch_12454
BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\...\Run: [AVG-Secure-Search-Update_0214c] - C:\Users\Walley\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=92410166976d47d2b227a59d73ed4bf3-e534b542cddaedde88e441ef4900a4c701768105 /CMPID=0214c
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\...\Run: [7373dc185322d0eaea29dbca58a3a300] - "C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe" .. <===== ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)

Hosts:
CMD: shutdown /r /f /t 2

End
*****************

C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
C:\Users\Walley\AppData\Local\Temp\promote-upx.exe => Moved successfully.
C:\Users\Walley\Downloads\SkypeSetup.exe => Moved successfully.
C:\Users\Walley\AppData\Roaming\ProductData => Moved successfully.
C:\Users\Walley\Downloads\iobituninstaller3.1.exe => Moved successfully.
C:\Windows\System32\Tasks\Uninstaller_SkipUac_Administrator => Moved successfully.
C:\Users\Walley\AppData\Roaming\Microsoft\Windows\Start Menu\Uninstall Programs.lnk => Moved successfully.
C:\Users\Public\Desktop\IObit Uninstaller.lnk => Moved successfully.
C:\Users\Walley\AppData\Local\MFAData => Moved successfully.
C:\Program Files (x86)\IObit => Moved successfully.
C:\Users\Walley\Downloads\avast_free_antivirus_setup_online.exe => Moved successfully.
C:\Users\Walley\AppData\Roaming\IObit => Moved successfully.
C:\ProgramData\IObit => Moved successfully.
C:\Users\Walley\Desktop\FRSTLauncher (1).exe => Moved successfully.
"C:\Users\Walley\Downloads\Nepotvrzeno 997490.crdownload" => File/Directory not found.
C:\Windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\Walley\Desktop\zoek – kopie.exe => Moved successfully.
C:\Users\Walley\Desktop\JRT.txt => Moved successfully.
C:\Users\Walley\Downloads\adwcleaner.exe => Moved successfully.
C:\Users\Walley\Downloads\JRT.exe => Moved successfully.
C:\UsbFix [Clean 1] WALLEY-PC.txt => Moved successfully.
C:\UsbFix => Moved successfully.
C:\Users\Walley\Downloads\UsbFix.exe => Moved successfully.
"C:\Users\Walley\AppData\Local\Temp\mscorsvw.exe" => File/Directory not found.
"C:\Users\Walley\AppData\Roaming\AVG 0214c Campaign" => File/Directory not found.
LiveUpdateSvc => Service deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search bar => Value deleted successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Secondary Start Pages => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\${searchCLSID} => Key deleted successfully.
HKCR\CLSID\${searchCLSID} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key deleted successfully.
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7027CEB4-5AFE-420E-AF29-88BEC3765F03} => Key deleted successfully.
HKCR\CLSID\{7027CEB4-5AFE-420E-AF29-88BEC3765F03} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814} => Key deleted successfully.
HKCR\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814} => Key deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => Value deleted successfully.
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => Value deleted successfully.
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\Software\Microsoft\Windows\CurrentVersion\Run\\AVG-Secure-Search-Update_0214c => Value deleted successfully.
HKU\S-1-5-21-1257800471-3726757507-424188603-1000\Software\Microsoft\Windows\CurrentVersion\Run\\7373dc185322d0eaea29dbca58a3a300 => Value deleted successfully.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\NvBackend => Value deleted successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

========= shutdown /r /f /t 2 =========

========= End of CMD: =========

The system needed a reboot.

==== End of Fixlog ====

#15 Příspěvek od **vyosek** » 18 bře 2014 17:09

Tak jeste uklidime

T-Cleaner http://vyosek.tym.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

VIRY.CZ

USB Virus

USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus

Re: USB Virus