prosim o kontrolu

[Erutan]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Erutan at 2014-05-04 13:20:50
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 67 GB (58%) free of 114 GB
Total RAM: 8189 MB (80% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:20:53, on 4.5.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Users\Erutan\AppData\Local\Temp\idm.exe
C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\Gigabyte\GHOST\Tilt.exe
C:\Program Files\trend micro\Erutan.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Tilt] C:\Program Files (x86)\GIGABYTE\GHOST\Tilt.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [df6f1d15fc6b1522ebf209e10045b79f] "C:\Users\Erutan\AppData\Local\Temp\idm.exe" ..
O4 - HKCU\..\Run: [SearchProtection] "C:\Users\Erutan\AppData\Roaming\Search Protection\SearchProtection.EXE" /autostart
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Users\Erutan\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: µTorrent.lnk = C:\Users\Erutan\AppData\Roaming\uTorrent\uTorrent.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Rich Media Downloader - {A7DF592F-6E2A-45C4-9A87-4BD217D714ED} - (no file)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe (file missing)
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ES lite Service for program management. (ES lite Service) - Unknown owner - C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: JMB36X - Unknown owner - C:\Windows\SysWOW64\XSrvSetup.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PandoraService (PanService) - Pandora.TV - C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: Systemk Service (SystemkService) - Aztec Media Inc - C:\Program Files (x86)\Settings Manager\systemk\SystemkService.exe
O23 - Service: @C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9322 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
winlogon.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe" silentrun
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Users\Erutan\AppData\Local\Temp\idm.exe" ..
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Windows\System32\StikyNot.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe"
"C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE"
C:\Windows\SysWOW64\XSrvSetup.exe
"C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files (x86)\Skype\Updater\Updater.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
"C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe"
"C:\Program Files (x86)\Settings Manager\systemk\SystemkService.exe"
"C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files (x86)\Settings Manager\systemk\SystemkService.exe" -monitor 460
"C:\Program Files (x86)\Gigabyte\GHOST\Tilt.exe"
"C:\Program Files (x86)\Settings Manager\systemk\systemku.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM" PriorityLow
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
WLIDSvcM.exe 2576
"C:\Program Files (x86)\PANDORA.TV\PanService\PanProcess.exe" PanProcess
C:\Windows\system32\wbem\wmiprvse.exe
"D:\Download\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default

prefs.js - "browser.search.useDBForOrder" - "false"
prefs.js - "browser.startup.homepage" - "http://www.default-search.net?sid=476&a ... 15&src=hmp"
prefs.js - "keyword.URL" - "http://www.default-search.net/search?si ... &src=ds&p="

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 13.0.0.206 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@esn/npbattlelog,version=2.3.1]
"Description"=
"Path"=C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin]
"Description"=This plugin detects and launches Pando Media Booster
"Path"=C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 13.0.0.206 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll


C:\Program Files (x86)\Mozilla Firefox\plugins\
nppdf32.dll
nppluginrichmediaplayer.dll

C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\extensions\
beed7c57-885c-4fb0-94a4-dded48027c2a@6d3a8558-a11e-49a3-892c-3ce3edc559fb.com
DTToolbar@toolbarnet.com
{1ED03F15-1006-1C66-CCA5-15A00B80A7B7}

C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\searchplugins\
default-search.xml
yahoo_ff.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 532336]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18 403840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll [2009-10-30 1678792]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll [2009-10-30 1019336]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-10-06 11474024]
"XboxStat"=C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [2009-09-30 825184]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"df6f1d15fc6b1522ebf209e10045b79f"=C:\Users\Erutan\AppData\Local\Temp\idm.exe [2014-03-23 879104]
"SearchProtection"=C:\Users\Erutan\AppData\Roaming\Search Protection\SearchProtection.EXE [2014-03-19 842088]
"RESTART_STICKY_NOTES"=C:\Windows\System32\StikyNot.exe [2009-07-14 427520]
"uTorrent"=C:\Users\Erutan\AppData\Roaming\uTorrent\uTorrent.exe [2014-04-28 1270352]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"BCU"=C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe [2009-10-15 375000]
"JMB36X IDE Setup"=C:\Windows\RaidTool\xInsIDE.exe [2010-09-07 43608]
"NUSB3MON"=C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2009-11-20 106496]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2013-03-28 642656]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
""= []
"Tilt"=C:\Program Files (x86)\GIGABYTE\GHOST\Tilt.exe [2009-06-26 724992]

C:\Users\Erutan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
µTorrent.lnk - C:\Users\Erutan\AppData\Roaming\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe]
"Debugger="tasklist.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-05-04 13:20:50 ----D---- C:\rsit
2014-05-04 13:20:50 ----D---- C:\Program Files\trend micro
2014-05-04 09:09:43 ----D---- C:\ProgramData\systemk
2014-05-03 18:23:31 ----D---- C:\Program Files\Microsoft Xbox 360 Accessories
2014-05-03 10:12:54 ----D---- C:\ProgramData\Codemasters
2014-04-28 10:40:01 ----D---- C:\ProgramData\XBlades
2014-04-27 09:39:16 ----A---- C:\Windows\system32\drivers\RzFilter.sys
2014-04-27 09:39:07 ----A---- C:\Windows\SYSWOW64\D3DCompiler_43.dll
2014-04-16 15:37:46 ----SH---- C:\Trainer.dll
2014-04-12 10:13:17 ----D---- C:\Program Files (x86)\Settings Manager
2014-04-12 10:13:03 ----D---- C:\Program Files (x86)\Optimizer Pro
2014-04-12 09:14:30 ----D---- C:\Program Files (x86)\SpeedFan
2014-04-12 09:13:47 ----D---- C:\Fraps
2014-04-12 09:09:56 ----D---- C:\Program Files (x86)\DAEMON Tools Lite

======List of files/folders modified in the last 1 month======

2014-05-04 13:20:50 ----RD---- C:\Program Files
2014-05-04 13:20:41 ----D---- C:\Users\Erutan\AppData\Roaming\uTorrent
2014-05-04 13:20:38 ----D---- C:\Windows\Temp
2014-05-04 12:41:12 ----D---- C:\Users\Erutan\AppData\Roaming\dvdcss
2014-05-04 12:24:54 ----SHD---- C:\System Volume Information
2014-05-04 12:01:19 ----D---- C:\Users\Erutan\AppData\Roaming\vlc
2014-05-04 09:09:43 ----HD---- C:\ProgramData
2014-05-03 22:06:30 ----D---- C:\Users\Erutan\AppData\Roaming\Skype
2014-05-03 18:36:14 ----D---- C:\Windows\system32\config
2014-05-03 18:23:31 ----SHD---- C:\Windows\Installer
2014-05-03 18:23:31 ----SHD---- C:\Config.Msi
2014-05-03 18:21:02 ----D---- C:\ProgramData\Origin
2014-05-03 18:20:42 ----D---- C:\Program Files (x86)\Origin
2014-05-03 09:33:38 ----D---- C:\Windows\SYSWOW64\directx
2014-05-01 18:31:47 ----D---- C:\Windows\system32\catroot2
2014-04-29 11:39:07 ----D---- C:\Windows\SysWOW64
2014-04-29 11:39:05 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2014-04-28 12:48:12 ----D---- C:\Windows\Prefetch
2014-04-27 19:27:52 ----D---- C:\Windows
2014-04-27 19:27:52 ----D---- C:\ProgramData\Razer
2014-04-27 19:27:49 ----D---- C:\Program Files (x86)\Razer
2014-04-27 19:27:48 ----D---- C:\Windows\system32\drivers
2014-04-25 14:55:31 ----D---- C:\Users\Erutan\AppData\Roaming\ViberPC
2014-04-16 15:43:39 ----SD---- C:\Users\Erutan\AppData\Roaming\Microsoft
2014-04-13 02:00:49 ----D---- C:\ProgramData\PMB Files
2014-04-12 19:05:35 ----RD---- C:\Program Files (x86)
2014-04-12 19:05:01 ----AD---- C:\ProgramData\TEMP
2014-04-12 09:10:02 ----D---- C:\Program Files (x86)\DAEMON Tools Toolbar

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AtiPcie;AMD PCI Express (3GIO) Filter; C:\Windows\system32\DRIVERS\AtiPcie.sys [2009-05-05 16440]
R0 JRAID;JRAID; C:\Windows\system32\DRIVERS\jraid.sys [2010-09-07 121432]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 RzFilter;RzFilter; C:\Windows\system32\drivers\RzFilter.sys [2013-07-31 74456]
R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2012-12-29 28664]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2013-07-14 834544]
R1 AppleCharger;AppleCharger; C:\Windows\system32\DRIVERS\AppleCharger.sys [2010-04-27 21544]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 F06DEFF2-5B9C-490D-910F-35D3A91196222;F06DEFF2-5B9C-490D-910F-35D3A91196222; \??\C:\Program Files (x86)\Settings Manager\systemk\x64\systemkmgrc1.cfg [2014-04-28 36240]
R2 AODDriver4.2;AODDriver4.2; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-04-09 57472]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2013-03-29 11658752]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2013-03-29 581120]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2013-02-14 96768]
R3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2014-05-04 25640]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-10-06 2511464]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2009-11-20 75776]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2009-11-20 177152]
R3 RTL8023x64;Realtek 10/100 NIC Family NDIS x64 Driver; C:\Windows\system32\DRIVERS\Rtnic64.sys [2009-06-10 51712]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-09-03 349800]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]
R3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\Windows\system32\DRIVERS\xusb21.sys [2009-08-13 73984]
S3 AODDriver;AODDriver; \??\C:\Program Files (x86)\Gigabyte\ET6\amd64\AODDriver.sys [2010-03-12 52280]
S3 aufjs0io;aufjs0io; C:\Windows\system32\drivers\aufjs0io.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 GVTDrv64;GVTDrv64; \??\C:\Windows\GVTDrv64.sys [2013-07-14 30528]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-21 20992]
S3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys [2010-05-25 253728]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [2010-11-21 88960]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2010-11-21 34816]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys [2010-11-21 117248]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2013-03-29 241152]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2013-03-28 361984]
R2 BCUService;Browser Configuration Utility Service; C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [2009-10-15 223464]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ES lite Service;ES lite Service for program management.; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-08-24 68136]
R2 JMB36X;JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [2010-09-07 72280]
R2 PanService;PandoraService; C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [2012-09-28 625304]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2013-10-04 76888]
R2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-09-05 171680]
R2 SystemkService;Systemk Service; C:\Program Files (x86)\Settings Manager\systemk\SystemkService.exe [2014-04-28 3543056]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2009-08-18 2291568]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-07-09 104912]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-07-08 123856]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-29 257712]
S3 AppleChargerSrv;AppleChargerSrv; C:\Windows\system32\AppleChargerSrv.exe [2010-04-06 31272]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-03-29 119408]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-04-24 572096]
S3 TuneUp.Defrag;@C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [2013-07-14 607048]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2012-07-08 51648]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2012-07-09 139696]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2012-07-09 139696]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2012-07-09 139696]

-----------------EOF-----------------

[vyosek]

Zdravim

Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe

• Ulozte nejlepe na plochu
• Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
• Probehne vytvoreni zalohy a nasledne prohledavani
• Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

• Ulozte nejlepe na plochu
• Ukoncete vsechny programy
• Kliknete na Scan a nasledne Clean
• Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

[Erutan]

Jrt: na zacatku se mi obevila hlaska

Bez názvu.png (71.31 KiB) Zobrazeno 1458 x

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x64
Ran by Erutan on ne 04.05.2014 at 15:18:48,89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\searchprotection
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs\\Tabs



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{3E288F79-03E4-4983-A48E-0D879B51FF19}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\dt soft\daemon tools toolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\installcore
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\installedbrowserextensions
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dt soft\daemon tools toolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\dttoolbar.toolbandobj
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\dttoolbar.toolbandobj.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\firstrowsportapp_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\firstrowsportapp_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\optimizerpro_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\optimizerpro_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\optprostart_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\optprostart_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\daemon tools toolbar
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466906630}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660466906630}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660466906630}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\KMPAskPIPCount_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\KMPAskPIPCount_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110411901130}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660466906630}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\APNSetup_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\APNSetup_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\KMPAskPIPCount_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\KMPAskPIPCount_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}
Successfully deleted: [Registry Key] "hkey_current_user\software\apn pip"
Successfully deleted: [Registry Key] "hkey_current_user\software\pip"



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\ProgramData\babylon"
Successfully deleted: [Folder] "C:\Users\Erutan\AppData\Roaming\babylon"
Successfully deleted: [Folder] "C:\Users\Erutan\AppData\Roaming\search protection"
Successfully deleted: [Folder] "C:\Program Files (x86)\daemon tools toolbar"
Successfully deleted: [Folder] "C:\Program Files (x86)\firstrowsportapp.com"
Successfully deleted: [Folder] "C:\Program Files (x86)\mobogenie"
Successfully deleted: [Folder] "C:\Program Files (x86)\optimizer pro"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Folder] "C:\Users\Erutan\documents\optimizer pro"
Successfully deleted: [Folder] "C:\ProgramData\AskPartnerNetwork"
Successfully deleted: [Folder] "C:\Program Files (x86)\askpartnernetwork"



~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted: [File] C:\Users\Erutan\AppData\Roaming\mozilla\firefox\profiles\7rsi9my6.default\user.js
Successfully deleted the following from C:\Users\Erutan\AppData\Roaming\mozilla\firefox\profiles\7rsi9my6.default\prefs.js

user_pref("browser.newtab.url", "hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=78371C6F65ADAC13&affID=121563&tsp=4943");
user_pref("extensions.crossrider.bic", "143ab7eaad2bf3573ec563da1c89c370");
Emptied folder: C:\Users\Erutan\AppData\Roaming\mozilla\firefox\profiles\7rsi9my6.default\minidumps [71 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 04.05.2014 at 15:22:26,96
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

adwcleaner:
# AdwCleaner v3.205 - Report created 04/05/2014 at 15:24:39
# Updated 28/04/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : Erutan - ERUTAN-PC
# Running from : C:\Users\Erutan\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : BCUService
[#] Service Deleted : SystemkService

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\DeviceVM
Folder Deleted : C:\Program Files (x86)\GreenTree Applications
[!] Folder Deleted : C:\Program Files (x86)\Settings Manager
Folder Deleted : C:\Users\Erutan\.android
Folder Deleted : C:\Users\Erutan\AppData\Local\genienext
Folder Deleted : C:\Users\Erutan\AppData\Local\Mobogenie
Folder Deleted : C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\Extensions\DTToolbar@toolbarnet.com
Folder Deleted : C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\Extensions\beed7c57-885c-4fb0-94a4-dded48027c2a@6d3a8558-a11e-49a3-892c-3ce3edc559fb.com
File Deleted : C:\Windows\System32\roboot64.exe
File Deleted : C:\Users\Erutan\daemonprocess.txt

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook
Key Deleted : HKLM\SOFTWARE\Classes\AddressBarSearch.SearchHook.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Mobogenie_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Mobogenie_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BCU]
Value Deleted : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x64]
Value Deleted : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x86]
Value Deleted : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x64]
Value Deleted : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x86]
Key Deleted : HKCU\Software\df6f1d15fc6b1522ebf209e10045b79f
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{77AA6435-2488-4A94-9FE5-49519DD2ED9B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7DF592F-6E2A-45C4-9A87-4BD217D714ED}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{A7DF592F-6E2A-45C4-9A87-4BD217D714ED}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}
Key Deleted : HKCU\Software\DeviceVM
Key Deleted : HKCU\Software\UpdateStar
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\Software\DeviceVM
Key Deleted : HKLM\Software\PIP
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.7601.17514


-\\ Mozilla Firefox v28.0 (cs)

[ File : C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [7131 octets] - [04/05/2014 15:24:25]
AdwCleaner[S0].txt - [6809 octets] - [04/05/2014 15:24:39]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6869 octets] ##########

[vyosek]

Diky za screen, zkusim probrat s autorem

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
• Do okna vlozte skript nize

• Kód: Vybrat vše

  autoclean;
  emptyclsid;
  iedefaults;
  FFdefaults;
  CHRdefaults;
  emptyalltemp;
  resethosts;
  

• Nasledne kliknete na Run Script
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

[Erutan]

Zde je log

Zoek.exe v5.0.0.0 Updated 14-April-2014
Tool run by Erutan on ne 04.05.2014 at 15:40:53,96.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Erutan\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

4.5.2014 15:41:32 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1926684632-688041120-732502126-1000\Software\Microsoft\Internet Explorer\SearchScopes\{234E6DA8-A7F1-44c3-9969-0590173CB80C} deleted successfully
HKEY_USERS\S-1-5-21-1926684632-688041120-732502126-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DE18F7A9-59BD-4F98-9E63-79D325317248} deleted successfully
HKEY_USERS\S-1-5-21-1926684632-688041120-732502126-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{54739D49-AC03-4C57-9264-C5195596B3A1} deleted successfully
HKEY_USERS\S-1-5-21-1926684632-688041120-732502126-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{54739D49-AC03-4C57-9264-C5195596B3A1} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{54739D49-AC03-4C57-9264-C5195596B3A1} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-1926684632-688041120-732502126-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{54739D49-AC03-4C57-9264-C5195596B3A1} deleted successfully
HKEY_USERS\S-1-5-21-1926684632-688041120-732502126-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.default-search.net?sid=476&a ... 15&src=hmp");
user_pref("browser.search.order.1", "default-search.net");
user_pref("keyword.URL", "http://www.default-search.net/search?si ... &src=ds&p=");
user_pref("browser.search.useDBForOrder", "false");

Added to C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default

user.js not found
---- Lines freehdsp removed from prefs.js ----
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.testingGaq.value", "%22http%3A//extclickm
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.name", "FreeHDSport TV V7.0");
---- Lines abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030 removed from prefs.js ----
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.active", true);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.addressbar", "NA");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.addressbarenhanced", "");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.asyncdb.was_copied", "true");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.asyncdb_dbWasSet", true);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.asyncdb_dbWasSet_FF25_FIX", true);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.asyncinternaldb.was_copied", "true");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.asyncinternaldb_dbWasSet", true);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.asyncinternaldb_dbWasSet_FF25_FIX", true);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.backgroundver", 4);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.certdomaininstaller", "");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie._GPL_aoi.value", "%221392406696%22");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie._GPL_parent_zoneid.expiration", "Fri Feb
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie._GPL_parent_zoneid.value", "%22488638%22"
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.au.expiration", "Fri Feb 01 2030 00:00:00
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.au.value", "%222014-2-14%22");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.cm_page_views.expiration", "Sun Apr 13 20
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.cm_page_views.value", "3198");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.cnt.expiration", "Fri Feb 01 2030 00:00:0
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.cnt.value", "%22CZ%22");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.first_run.expiration", "Fri Feb 01 2030 0
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.first_run.value", "%221%22");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.install.expiration", "Fri Feb 01 2030 00:
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.install.value", "%222014-1-19%22");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.InstallationTime.expiration", "Fri Feb 01
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.InstallationTime.value", "%221390151565%2
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.InstallerParams.expiration", "Fri Feb 01
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.InstallerParams.value", "%7B%22source_id%
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.jw_token.expiration", "Fri Feb 01 2030 00
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.jw_token.value", "%226aeba423-6acd-a39b-7
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.partner_is_not_installed.expiration", "Fr
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.partner_is_not_installed.value", "true");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.partner_last_seen.expiration", "Fri Feb 0
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.partner_last_seen.value", "1392406817628"
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.cookie.testingGaq.expiration", "Fri Feb 01 2030
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.description", "Turn your pc into a TV Enjoy endl
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.domain", "");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.enablesearch", false);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.homepage", "");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.changeprevious", false);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.iframe", false);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.InstallationThankYouPage", true);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.InstallationTime", 1390151565);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.__defualt_browser__.expiration", "Fri
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.__defualt_browser__.value", "%22ff%22
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.installer.expiration", "Fri Feb 01 20
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.installer.value", "%7B%22InstallerIde
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.InstallerIdentifiers.expiration", "Fr
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.InstallerIdentifiers.value", "%7B%22i
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.InstallerParams.expiration", "Fri Feb
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.InstallerParams.value", "%7B%22source
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.InstallerParamsCache.expiration", "Fr
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.InstallerParamsCache.value", "%7B%22s
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.InstallerUserIdentifiersCache.expirat
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.InstallerUserIdentifiersCache.value",
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.monetization_plugin_bundledUrls.expir
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.monetization_plugin_bundledUrls.value
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.monetization_plugin_bundledWithHash.e
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.monetization_plugin_bundledWithHash.v
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.monetization_plugin_notBundledArr_.ex
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.monetization_plugin_notBundledArr_.va
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_appVer.expiration", "Fri Fe
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_appVer.value", "55");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_lastVersion.expiration", "F
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_lastVersion.value", "2");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_meta.expiration", "Fri Feb
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_meta.value", "%7B%7D");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_nextCheck.expiration", "Sat
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_nextCheck.value", "true");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_queue.expiration", "Fri Feb
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_queue.value", "%7B%7D");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_remote_resources.expiration
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.internaldb.Resources_remote_resources.value", "%
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.lastDailyReport", "1399209245486");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.lastUpdate", "1399209245485");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.manifesturl", "");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.MyEXT49030.Prefs_is_not_a_function", 2);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.newtab", "");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.opensearch", "");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.pluginsurl", "http://js.clientdemocloud.com/plug
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.pluginsversion", 51);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.publisher", "installdaddy");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.searchstatus", 0);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.setnewtab", false);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.thankyou", "");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.updateinterval", 360);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.49030.ver", 55);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.apps", "49030");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.bic", "143ab7eaad2bf3573ec563da1c89c370");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.cid", 49030);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.FilesValidatorDueTime", "1399209304998");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.firstrun", false);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.hadappinstalled", true);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.installationdate", 1390151642);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.modetype", "production");
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.reportInstall", true);
user_pref("extensions.abeed7c57885c4fb094a4dded48027c2a6d3a8558a11e49a3892c3ce3edc559fbcom49030.statsDailyCounter", 208);
---- FireFox user.js and prefs.js backups ----

prefs_04.05.2014_1546_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Mozilla Firefox\browser\searchplugins\default-search.xml deleted
C:\Users\Erutan\AppData\Roaming\Common deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Erutan\AppData\Local\cache deleted
C:\Users\Erutan\Downloads\SopCast.zip deleted
C:\Users\Erutan\AppData\LocalLow\FreeHDSport TV V7.0 deleted
C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\searchplugins\default-search.xml deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default
- Settings Manager - %ProfilePath%\extensions\{1ED03F15-1006-1C66-CCA5-15A00B80A7B7}
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default
9FD6A1990289B9290563CA069CB74EF9 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll - Shockwave Flash


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"
{12A060F8-8179-46b2-883D-BD34D05974F8} Bing Url="http://www.bing.com/search?q={searchTer ... R2&pc=SPLH"
{37C0457A-241A-4210-9EA1-75367BC307B6} Google Url="http://www.google.com/cse?cx=partner-pu ... 4067623346"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchT ... {startPage}"

==== Reset Google Chrome ======================

Nothing found to reset

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Erutan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Erutan\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Erutan\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Erutan\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Erutan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\Erutan\AppData\Local\Mozilla\Firefox\Profiles\7rsi9my6.default\Cache emptied successfully

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=87 folders=29 14220589 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Erutan\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Erutan\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Users\Erutan\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found
"C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted

==== EOF on ne 04.05.2014 at 15:48:45,22 ======================

[vyosek]

Tak to bychom meli procisteno

Mrknem na zbytecky - dejte log z FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100

[Erutan]

log:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-05-2014
Ran by Erutan (administrator) on ERUTAN-PC on 04-05-2014 16:04:05
Running from C:\Users\Erutan\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Program Files (x86)\Gigabyte\EasySaver\essvr.exe
() C:\Windows\SysWOW64\XSrvSetup.exe
(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(PandoraTV) C:\Program Files (x86)\PANDORA.TV\PanService\PanProcess.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\Gigabyte\GHOST\Tilt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11474024 2010-10-06] (Realtek Semiconductor)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [43608 2010-09-07] ()
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Tilt] => C:\Program Files (x86)\GIGABYTE\GHOST\Tilt.exe [724992 2009-06-26] ()
HKU\S-1-5-21-1926684632-688041120-732502126-1000\...\Run: [df6f1d15fc6b1522ebf209e10045b79f] => "C:\Users\Erutan\AppData\Local\Temp\idm.exe" .. <===== ATTENTION
HKU\S-1-5-21-1926684632-688041120-732502126-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1926684632-688041120-732502126-1000\...\Run: [uTorrent] => C:\Users\Erutan\AppData\Roaming\uTorrent\uTorrent.exe [1270352 2014-04-28] (BitTorrent Inc.)
HKU\S-1-5-21-1926684632-688041120-732502126-1000\...\MountPoints2: {5fff78a1-ec8a-11e2-ab56-806e6f6e6963} - G:\Run.exe
Startup: C:\Users\Erutan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\µTorrent.lnk
ShortcutTarget: µTorrent.lnk -> C:\Users\Erutan\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
HKLM\...\AppCertDlls: [x64] -> c:\program files (x86)\settings manager\systemk\x64\sysapcrt.dll
HKLM\...\AppCertDlls: [x86] -> c:\program files (x86)\settings manager\systemk\sysapcrt.dll

==================== Internet (Whitelisted) ====================

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchT ... {startPage}
SearchScopes: HKCU - {12A060F8-8179-46b2-883D-BD34D05974F8} URL = http://www.bing.com/search?q={searchTer ... R2&pc=SPLH
SearchScopes: HKCU - {37C0457A-241A-4210-9EA1-75367BC307B6} URL = http://www.google.com/cse?cx=partner-pu ... 4067623346
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchT ... {startPage}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default
FF NewTab: hxxp://www.google.com/
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - F:\trials\datapack\orbit\npuplaypc.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppluginrichmediaplayer.dll ()
FF SearchPlugin: C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\searchplugins\yahoo_ff.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mapy-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: Settings Manager - C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\Extensions\{1ED03F15-1006-1C66-CCA5-15A00B80A7B7} [2014-05-04]
FF Extension: Adblock Plus - C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-07-14]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-28] (Advanced Micro Devices, Inc.)
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 ES lite Service; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
R2 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [72280 2010-09-07] ()
R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [625304 2012-09-28] (Pandora.TV)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-04] ()
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607048 2013-07-14] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

S3 AODDriver; C:\Program Files (x86)\Gigabyte\ET6\amd64\AODDriver.sys [52280 2010-03-12] (Advanced Micro Devices)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21544 2010-04-27] ()
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2013-07-14] ()
R3 RTL8023x64; C:\Windows\System32\DRIVERS\Rtnic64.sys [51712 2009-06-10] (Realtek Semiconductor Corporation )
R0 RzFilter; C:\Windows\System32\drivers\RzFilter.sys [74456 2013-07-31] (Razer USA Ltd)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2013-07-14] ()
U3 aq23sif6; C:\Windows\System32\Drivers\aq23sif6.sys [0 ] (Microsoft Corporation)
S1 F06DEFF2-5B9C-490D-910F-35D3A91196222; \??\C:\Program Files (x86)\Settings Manager\systemk\x64\systemkmgrc1.cfg [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-04 16:04 - 2014-05-04 16:04 - 00010005 _____ () C:\Users\Erutan\Desktop\FRST.txt
2014-05-04 16:02 - 2014-05-04 16:04 - 00000000 ____D () C:\FRST
2014-05-04 16:02 - 2014-05-04 16:02 - 02062336 _____ (Farbar) C:\Users\Erutan\Desktop\FRST64.exe
2014-05-04 15:47 - 2014-05-04 15:40 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-05-04 15:41 - 2014-05-04 15:48 - 00024627 _____ () C:\zoek-results.log
2014-05-04 15:40 - 2014-05-04 15:46 - 00000000 ____D () C:\zoek_backup
2014-05-04 15:24 - 2014-05-04 15:24 - 00000000 ____D () C:\AdwCleaner
2014-05-04 15:18 - 2014-05-04 15:18 - 00000000 ____D () C:\Windows\ERUNT
2014-05-04 13:20 - 2014-05-04 13:20 - 00000000 ____D () C:\rsit
2014-05-04 13:20 - 2014-05-04 13:20 - 00000000 ____D () C:\Program Files\trend micro
2014-05-04 12:40 - 2014-05-04 12:39 - 00002657 _____ () C:\Users\Erutan\Desktop\Game – zástupce.lnk
2014-05-04 09:09 - 2014-05-04 15:24 - 00000000 ____D () C:\ProgramData\systemk
2014-05-03 18:23 - 2014-05-03 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Xbox 360 Accessories
2014-05-03 18:23 - 2014-05-03 18:23 - 00000000 ____D () C:\Program Files\Microsoft Xbox 360 Accessories
2014-05-03 10:12 - 2014-05-03 10:12 - 00000000 ____D () C:\ProgramData\Codemasters
2014-04-30 13:00 - 2014-04-30 13:00 - 00000610 _____ () C:\Users\Public\Desktop\The Wolf Among Us.lnk
2014-04-30 13:00 - 2014-04-30 13:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Wolf Among Us
2014-04-29 12:11 - 2014-04-30 13:00 - 00000000 ____D () C:\Users\Erutan\Documents\Telltale Games
2014-04-28 10:40 - 2014-04-28 10:40 - 00000000 ____D () C:\ProgramData\XBlades
2014-04-27 18:32 - 2014-04-27 18:32 - 00000609 _____ () C:\Users\Public\Desktop\Devil May Cry 4.lnk
2014-04-27 18:32 - 2014-04-27 18:32 - 00000000 ____D () C:\Users\Erutan\Documents\CAPCOM
2014-04-27 18:32 - 2014-04-27 18:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CAPCOM
2014-04-27 09:39 - 2014-04-27 09:39 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-04-27 09:39 - 2013-07-31 23:40 - 00074456 _____ (Razer USA Ltd) C:\Windows\system32\Drivers\RzFilter.sys
2014-04-26 00:24 - 2014-04-26 00:24 - 00000000 ____D () C:\Users\Erutan\AppData\Local\MercurySteam
2014-04-26 00:24 - 2014-04-26 00:24 - 00000000 ____D () C:\Users\Erutan\AppData\Local\EMU
2014-04-21 00:22 - 2014-04-21 00:24 - 00000000 ____D () C:\Users\Erutan\AppData\Local\Darksiders2
2014-04-21 00:21 - 2014-04-21 00:21 - 00000805 _____ () C:\Users\Erutan\Desktop\Darksiders II.lnk
2014-04-16 15:37 - 2014-04-16 15:37 - 00114688 ___SH () C:\Trainer.dll
2014-04-12 09:14 - 2014-05-04 12:35 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-04-12 09:14 - 2014-04-12 09:14 - 00001016 _____ () C:\Users\Erutan\Desktop\SpeedFan.lnk
2014-04-12 09:14 - 2014-04-12 09:14 - 00000000 ____D () C:\Users\Erutan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 09:13 - 2014-04-12 09:13 - 00000581 _____ () C:\Users\Public\Desktop\Fraps.lnk
2014-04-12 09:13 - 2014-04-12 09:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
2014-04-12 09:13 - 2014-04-12 09:13 - 00000000 ____D () C:\Fraps
2014-04-12 09:10 - 2014-04-12 09:10 - 00001959 _____ () C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
2014-04-12 09:10 - 2014-04-12 09:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2014-04-12 09:09 - 2014-04-12 09:10 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2014-04-11 11:26 - 2014-04-11 11:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Metal Gear Rising Revengeance
2014-04-10 11:02 - 2014-04-10 11:02 - 00001327 _____ () C:\Users\Erutan\Desktop\Origin.lnk
2014-04-10 11:02 - 2014-04-10 11:02 - 00000830 _____ () C:\Users\Erutan\Desktop\Steam.lnk

==================== One Month Modified Files and Folders =======

2014-05-04 16:04 - 2014-05-04 16:04 - 00010005 _____ () C:\Users\Erutan\Desktop\FRST.txt
2014-05-04 16:04 - 2014-05-04 16:02 - 00000000 ____D () C:\FRST
2014-05-04 16:02 - 2014-05-04 16:02 - 02062336 _____ (Farbar) C:\Users\Erutan\Desktop\FRST64.exe
2014-05-04 15:55 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-04 15:55 - 2009-07-14 06:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-04 15:51 - 2013-07-14 15:41 - 01603364 _____ () C:\Windows\WindowsUpdate.log
2014-05-04 15:48 - 2014-05-04 15:41 - 00024627 _____ () C:\zoek-results.log
2014-05-04 15:48 - 2014-02-03 00:16 - 00000144 _____ () C:\service.log
2014-05-04 15:48 - 2013-07-30 22:30 - 00061444 _____ () C:\Windows\PFRO.log
2014-05-04 15:48 - 2013-07-25 12:26 - 00108489 _____ () C:\Windows\setupact.log
2014-05-04 15:48 - 2013-07-14 16:17 - 00000000 ____D () C:\Users\Erutan\AppData\Roaming\uTorrent
2014-05-04 15:48 - 2013-07-14 15:54 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2014-05-04 15:48 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-04 15:46 - 2014-05-04 15:40 - 00000000 ____D () C:\zoek_backup
2014-05-04 15:40 - 2014-05-04 15:47 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-05-04 15:34 - 2013-11-27 12:17 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-04 15:24 - 2014-05-04 15:24 - 00000000 ____D () C:\AdwCleaner
2014-05-04 15:24 - 2014-05-04 09:09 - 00000000 ____D () C:\ProgramData\systemk
2014-05-04 15:24 - 2013-07-14 15:41 - 00000000 ____D () C:\Users\Erutan
2014-05-04 15:18 - 2014-05-04 15:18 - 00000000 ____D () C:\Windows\ERUNT
2014-05-04 13:23 - 2013-07-16 19:23 - 00000000 ____D () C:\Users\Erutan\Documents\My Games
2014-05-04 13:20 - 2014-05-04 13:20 - 00000000 ____D () C:\rsit
2014-05-04 13:20 - 2014-05-04 13:20 - 00000000 ____D () C:\Program Files\trend micro
2014-05-04 12:41 - 2013-07-15 14:34 - 00000000 ____D () C:\Users\Erutan\AppData\Roaming\dvdcss
2014-05-04 12:39 - 2014-05-04 12:40 - 00002657 _____ () C:\Users\Erutan\Desktop\Game – zástupce.lnk
2014-05-04 12:37 - 2013-10-24 01:26 - 00000000 ____D () C:\Users\Erutan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-05-04 12:35 - 2014-04-12 09:14 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-05-04 12:09 - 2013-12-19 16:00 - 00000000 ____D () C:\Users\Erutan\AppData\Local\CrashDumps
2014-05-04 12:04 - 2013-08-24 09:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hry
2014-05-04 12:01 - 2014-03-02 19:58 - 00000000 ____D () C:\Users\Erutan\AppData\Roaming\vlc
2014-05-03 22:06 - 2013-07-14 18:20 - 00000000 ____D () C:\Users\Erutan\AppData\Roaming\Skype
2014-05-03 18:23 - 2014-05-03 18:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Xbox 360 Accessories
2014-05-03 18:23 - 2014-05-03 18:23 - 00000000 ____D () C:\Program Files\Microsoft Xbox 360 Accessories
2014-05-03 18:23 - 2013-08-03 10:20 - 00199440 _____ () C:\Windows\DirectX.log
2014-05-03 18:21 - 2013-07-14 16:34 - 00000000 ____D () C:\ProgramData\Origin
2014-05-03 18:20 - 2013-07-14 16:34 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-05-03 10:12 - 2014-05-03 10:12 - 00000000 ____D () C:\ProgramData\Codemasters
2014-05-03 09:33 - 2013-08-24 09:50 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-05-02 18:35 - 2009-07-14 07:08 - 00032628 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-30 13:00 - 2014-04-30 13:00 - 00000610 _____ () C:\Users\Public\Desktop\The Wolf Among Us.lnk
2014-04-30 13:00 - 2014-04-30 13:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Wolf Among Us
2014-04-30 13:00 - 2014-04-29 12:11 - 00000000 ____D () C:\Users\Erutan\Documents\Telltale Games
2014-04-29 12:11 - 2013-07-16 19:23 - 00000000 ____D () C:\Users\Erutan\AppData\Local\SKIDROW
2014-04-29 11:39 - 2013-11-27 12:17 - 00003852 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-29 11:39 - 2013-07-14 19:16 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-29 11:39 - 2013-07-14 19:16 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-28 10:40 - 2014-04-28 10:40 - 00000000 ____D () C:\ProgramData\XBlades
2014-04-27 20:17 - 2013-12-14 18:10 - 00000000 ____D () C:\Users\Erutan\AppData\Local\PMB Files
2014-04-27 19:27 - 2013-12-14 20:13 - 00000000 ____D () C:\ProgramData\Razer
2014-04-27 19:27 - 2013-12-14 20:13 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-04-27 18:32 - 2014-04-27 18:32 - 00000609 _____ () C:\Users\Public\Desktop\Devil May Cry 4.lnk
2014-04-27 18:32 - 2014-04-27 18:32 - 00000000 ____D () C:\Users\Erutan\Documents\CAPCOM
2014-04-27 18:32 - 2014-04-27 18:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CAPCOM
2014-04-27 18:32 - 2014-01-24 20:46 - 00000000 ____D () C:\Users\Erutan\AppData\Local\CAPCOM
2014-04-27 09:39 - 2014-04-27 09:39 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2014-04-26 00:24 - 2014-04-26 00:24 - 00000000 ____D () C:\Users\Erutan\AppData\Local\MercurySteam
2014-04-26 00:24 - 2014-04-26 00:24 - 00000000 ____D () C:\Users\Erutan\AppData\Local\EMU
2014-04-25 14:55 - 2013-10-20 18:10 - 00000000 ____D () C:\Users\Erutan\AppData\Roaming\ViberPC
2014-04-25 14:55 - 2013-10-20 18:09 - 00000000 ____D () C:\Users\Erutan\AppData\Local\Viber
2014-04-21 15:45 - 2013-12-02 23:17 - 00000000 ____D () C:\Users\Erutan\Documents\FIFA 14
2014-04-21 00:24 - 2014-04-21 00:22 - 00000000 ____D () C:\Users\Erutan\AppData\Local\Darksiders2
2014-04-21 00:21 - 2014-04-21 00:21 - 00000805 _____ () C:\Users\Erutan\Desktop\Darksiders II.lnk
2014-04-21 00:21 - 2013-12-13 22:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Catalyst
2014-04-16 15:37 - 2014-04-16 15:37 - 00114688 ___SH () C:\Trainer.dll
2014-04-15 19:09 - 2013-07-14 15:41 - 00000000 ____D () C:\Users\Erutan\AppData\Local\VirtualStore
2014-04-13 02:00 - 2013-12-14 18:10 - 00000000 ____D () C:\ProgramData\PMB Files
2014-04-12 09:17 - 2013-07-14 15:41 - 00000000 ___RD () C:\Users\Erutan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-12 09:14 - 2014-04-12 09:14 - 00001016 _____ () C:\Users\Erutan\Desktop\SpeedFan.lnk
2014-04-12 09:14 - 2014-04-12 09:14 - 00000000 ____D () C:\Users\Erutan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 09:14 - 2013-07-14 16:07 - 00000045 _____ () C:\Windows\SysWOW64\initdebug.nfo
2014-04-12 09:14 - 2013-07-14 16:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
2014-04-12 09:13 - 2014-04-12 09:13 - 00000581 _____ () C:\Users\Public\Desktop\Fraps.lnk
2014-04-12 09:13 - 2014-04-12 09:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
2014-04-12 09:13 - 2014-04-12 09:13 - 00000000 ____D () C:\Fraps
2014-04-12 09:10 - 2014-04-12 09:10 - 00001959 _____ () C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
2014-04-12 09:10 - 2014-04-12 09:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2014-04-12 09:10 - 2014-04-12 09:09 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite
2014-04-11 11:26 - 2014-04-11 11:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Metal Gear Rising Revengeance
2014-04-10 11:02 - 2014-04-10 11:02 - 00001327 _____ () C:\Users\Erutan\Desktop\Origin.lnk
2014-04-10 11:02 - 2014-04-10 11:02 - 00000830 _____ () C:\Users\Erutan\Desktop\Steam.lnk

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 11:32

==================== End Of Log ============================

[vyosek]

Tvorba fixlistu pro FRST

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  Start
  HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
  HKLM-x32\...\Run: [] => [X]
  HKLM-x32\...\Run: [Tilt] => C:\Program Files (x86)\GIGABYTE\GHOST\Tilt.exe [724992 2009-06-26] ()
  HKU\S-1-5-21-1926684632-688041120-732502126-1000\...\Run: [df6f1d15fc6b1522ebf209e10045b79f] => "C:\Users\Erutan\AppData\Local\Temp\idm.exe" .. <===== ATTENTION
  C:\Users\Erutan\AppData\Local\Temp\idm.exe
  HKU\S-1-5-21-1926684632-688041120-732502126-1000\...\Run: [uTorrent] => C:\Users\Erutan\AppData\Roaming\uTorrent\uTorrent.exe [1270352 2014-04-28] (BitTorrent Inc.)
  HKU\S-1-5-21-1926684632-688041120-732502126-1000\...\MountPoints2: {5fff78a1-ec8a-11e2-ab56-806e6f6e6963} - G:\Run.exe
  Startup: C:\Users\Erutan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\µTorrent.lnk
  
  SearchScopes: HKCU - {12A060F8-8179-46b2-883D-BD34D05974F8} URL = http://www.bing.com/search?q={searchTerms}&form=SPLBR2&pc=SPLH
  SearchScopes: HKCU - {37C0457A-241A-4210-9EA1-75367BC307B6} URL = http://www.google.com/cse?cx=partner-pu ... e=UTF-8&q={searchTerms}&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A4067623346
  
  FF Plugin HKCU: ubisoft.com/uplaypc - F:\trials\datapack\orbit\npuplaypc.dll No File
  FF SearchPlugin: C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\searchplugins\yahoo_ff.xml
  
  R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [625304 2012-09-28] (Pandora.TV)
  C:\Program Files (x86)\PANDORA.TV
  
  2014-05-04 15:47 - 2014-05-04 15:40 - 00024064 _____ () C:\Windows\zoek-delete.exe
  2014-05-04 15:41 - 2014-05-04 15:48 - 00024627 _____ () C:\zoek-results.log
  2014-05-04 15:40 - 2014-05-04 15:46 - 00000000 ____D () C:\zoek_backup
  
  Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
  
  AlternateDataStreams: C:\ProgramData\TEMP:373E1720
  
  Hosts:
  End
  

• Ulozte vytvoreny TXT jako fixlist.txt
• Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

• Kliknete na Fix
• Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

[Erutan]

Doufam ze jsem vse udelal zpravne

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-05-2014
Ran by Erutan at 2014-05-05 16:07:23 Run:1
Running from C:\Users\Erutan\Desktop\Nová složka
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Tilt] => C:\Program Files (x86)\GIGABYTE\GHOST\Tilt.exe [724992 2009-06-26] ()
HKU\S-1-5-21-1926684632-688041120-732502126-1000\...\Run: [df6f1d15fc6b1522ebf209e10045b79f] => "C:\Users\Erutan\AppData\Local\Temp\idm.exe" .. <===== ATTENTION
C:\Users\Erutan\AppData\Local\Temp\idm.exe
HKU\S-1-5-21-1926684632-688041120-732502126-1000\...\Run: [uTorrent] => C:\Users\Erutan\AppData\Roaming\uTorrent\uTorrent.exe [1270352 2014-04-28] (BitTorrent Inc.)
HKU\S-1-5-21-1926684632-688041120-732502126-1000\...\MountPoints2: {5fff78a1-ec8a-11e2-ab56-806e6f6e6963} - G:\Run.exe
Startup: C:\Users\Erutan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\µTorrent.lnk

SearchScopes: HKCU - {12A060F8-8179-46b2-883D-BD34D05974F8} URL = http://www.bing.com/search?q={searchTer ... R2&pc=SPLH
SearchScopes: HKCU - {37C0457A-241A-4210-9EA1-75367BC307B6} URL = http://www.google.com/cse?cx=partner-pu ... e=UTF-8&q={searchTerms}&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A4067623346

FF Plugin HKCU: ubisoft.com/uplaypc - F:\trials\datapack\orbit\npuplaypc.dll No File
FF SearchPlugin: C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\searchplugins\yahoo_ff.xml

R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [625304 2012-09-28] (Pandora.TV)
C:\Program Files (x86)\PANDORA.TV

2014-05-04 15:47 - 2014-05-04 15:40 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-05-04 15:41 - 2014-05-04 15:48 - 00024627 _____ () C:\zoek-results.log
2014-05-04 15:40 - 2014-05-04 15:46 - 00000000 ____D () C:\zoek_backup

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

Hosts:
End
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\GrooveMonitor => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Tilt => Value deleted successfully.
HKU\S-1-5-21-1926684632-688041120-732502126-1000\Software\Microsoft\Windows\CurrentVersion\Run\\df6f1d15fc6b1522ebf209e10045b79f => Value not found.
"C:\Users\Erutan\AppData\Local\Temp\idm.exe" => File/Directory not found.
HKU\S-1-5-21-1926684632-688041120-732502126-1000\Software\Microsoft\Windows\CurrentVersion\Run\\uTorrent => Value deleted successfully.
HKU\S-1-5-21-1926684632-688041120-732502126-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5fff78a1-ec8a-11e2-ab56-806e6f6e6963} => Key deleted successfully.
HKCR\CLSID\{5fff78a1-ec8a-11e2-ab56-806e6f6e6963} => Key not found.
C:\Users\Erutan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\µTorrent.lnk => Moved successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{12A060F8-8179-46b2-883D-BD34D05974F8} => Key deleted successfully.
HKCR\CLSID\{12A060F8-8179-46b2-883D-BD34D05974F8} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{37C0457A-241A-4210-9EA1-75367BC307B6} => Key deleted successfully.
HKCR\CLSID\{37C0457A-241A-4210-9EA1-75367BC307B6} => Key not found.
HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc => Key deleted successfully.
F:\trials\datapack\orbit\npuplaypc.dll not found.
C:\Users\Erutan\AppData\Roaming\Mozilla\Firefox\Profiles\7rsi9my6.default\searchplugins\yahoo_ff.xml => Moved successfully.
PanService => Service stopped successfully.
PanService => Service deleted successfully.
C:\Program Files (x86)\PANDORA.TV => Moved successfully.
C:\Windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

==== End of Fixlog ====

[vyosek]

AAAno, vse OK

Jak se chova PC??

[Erutan]

1:rychleji se zapina(mam ssd takze toho si vsimam hodne)
2:internet jede rychleji , nevyskakuji mi ruzne toolbary a neprepina se mi sama domovska stranka
3:nove prijene usb zarizeni se zobrazujou(predtim nezobrazovaly-nesly mi nainstalovat ovladace)
4:nejsem si jisty to poznam spise casem, ale reklbych ze pri projizdeni dat na disku E (2tb) se rychleji oteviraji/nacitaji slozky
dekuji moc!!!kdyby bylo jeste neco co bych mohl udelat pro lepsi chod pc urcite si rad necham poradit
btw prominte mi pravopis a interpunkci

[vyosek]

Tak jeste uklidime

T-Cleaner http://vyosek.tym.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

[Erutan]

je to vse dekuji moc pc slape jako novy kdyby mel ruce tak me poplaca po rameni

[vyosek]

Nemate zac, rad jsem pomohl Zase nekdy

A na zaklade Pravidla o zamykani temat