Sekání pc

[Márty84]

Stahnete SystemLook http://jpshortstuff.247fixes.com/SystemLook.exe a ulozte ho na plochu.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce.
Do okna zkopirujte tento skript

Kód: Vybrat vše

:filefind
*pakigayness*

kliknete na Look a chvili pockejte
Mel by na vas vyskocit log s nazvem Systemlook
Ten mi sem zkopirujte

[kontez.]

Problem po použití nějakého vašeho programu se mi zaneslo pc nějakýmy složkami viz foto některé nejdou smazat vubec a některé když odstranim a zavřu složku a otevřu jsou tam opět zde se jedná o složku AppData favorites recent desktop a ty logy !

[kontez.]

zde je druhy zde se jedná o složky RECYCLE.BIN System Volume Information a program data nekteré nejdou ani odstranit zádam o vyreseni abych tam tyto slozky nemel a neobjevovaly se tam

[kontez.]

a jeste by me zajimalo jaktoze u prvniho prispevku mam ty slozky zlute a ne jake maj byt a jou tam anglicke nazvy chtel bych aby to bylo jako driv jinak me ceka reinstal toto se stalo po pouziti nejakeho vaseho programu ale predtim jsem tomu nevenoval pozornost

[Márty84]

Achjo, to zas ma nekdo rychlejsi ruce nez hlavu
No reinstal vas ted mozna ceka, pokud jste smazal neco, co jste nemel. Kdybyste radeji postupoval podle toho jak jsem psal a nedelal hokusy pokusy, udelal byste lepe.
Neni to totiz vubec zadny problem. Pouze se odkryly skryte a systemove soubory a slozky.
http://www.tipypropc.cz/jak-v-pruzkumni ... e-soubory/
Akorat vy je samozrejme misto zobrazeni nechate skryt.

[kontez.]

aha ja jsem rikal ze jsem pc antitalent je mi 16 a nerozumim tomu nevedel jsem ze jsou to skryte systemove soubory da se to nejak napravit reinstal nechci delat to je jako posledni moznost

[kontez.]

nevim co vse mam skryt jde to udelat nejak hromadne ?

[kontez.]

SystemLook 30.07.11 by jpshortstuff
Log created at 17:12 on 13/07/2014 by David
Zde je log s toho programu prehledl jsem prispevek omlouvam se
Administrator - Elevation successful

========== filefind ==========

Searching for "*pakigayness*"
C:\Users\David\AppData\Local\temp\nseF0.tmp\pakigayness.exe --a---- 86016 bytes [22:32 14/04/2014] [22:32 14/04/2014] 235EA2D7F04F024946AE160529ADCD39
C:\Users\David\AppData\Local\temp\nsl77EF.tmp\pakigayness.exe --a---- 86016 bytes [22:32 14/04/2014] [22:32 14/04/2014] 235EA2D7F04F024946AE160529ADCD39
C:\Users\David\AppData\Local\temp\nsw88D0.tmp\pakigayness.exe --a---- 86016 bytes [22:32 14/04/2014] [22:32 14/04/2014] 235EA2D7F04F024946AE160529ADCD39
C:\Windows\Prefetch\PAKIGAYNESS.EXE-C47784DA.pf --a---- 25542 bytes [15:08 13/07/2014] [15:08 13/07/2014] 07F8A64C9DC34672D55FC7F07C155AE6

-= EOF =-

[kontez.]

Dal jsem NEZOBRAZOVAT SKRYTÉ SOUBORY + jsem dal skrýt chránené souboury operačního systému(doporučeno) je to tak sparvně? jinak ty soubory co tam byly uz tam nejsou

[Márty84]

aha ja jsem rikal ze jsem pc antitalent je mi 16 a nerozumim tomu nevedel jsem ze jsou to skryte systemove soubory

No a proto se stacilo zeptat a ne hned mazat

da se to nejak napravit

To zalezi, jestli se smazalo neco duleziteho. Nektere veci se samy obnovi. Takze pokud pc jede, nemuselo se nic stat.

Dal jsem NEZOBRAZOVAT SKRYTÉ SOUBORY + jsem dal skrýt chránené souboury operačního systému(doporučeno) je to tak sparvně?

Ano, je to spravne



Znovu pouzijte program OTM podle stejneho navodu, ale s timto skriptem

Kód: Vybrat vše

:commands
[EMPTYTEMP]
[EMPTYFLASH]
[Purity]
[ClearAllRestorePoints]

:files
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp
C:\Users\David\AppData\Local\temp\nseF0.tmp\pakigayness.exe
C:\Users\David\AppData\Local\temp\nsl77EF.tmp\pakigayness.exe
C:\Users\David\AppData\Local\temp\nsw88D0.tmp\pakigayness.exe
C:\Windows\Prefetch\PAKIGAYNESS.EXE-C47784DA.pf

[kontez.]

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes

User: All Users

User: David
->Temp folder emptied: 24823765 bytes
->Temporary Internet Files folder emptied: 885515 bytes
->FireFox cache emptied: 371261501 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 1763 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2560396 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 381,00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: David
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Guest

User: Public

Total Flash Files Cleaned = 0,00 mb


Restore point Set: OTM Restore Point
========== FILES ==========
File/Folder C:\Windows\system32\*.tmp.dll not found.
File/Folder C:\Windows\system32\SET*.tmp not found.
File/Folder C:\Windows\*.tmp not found.
File/Folder C:\Users\David\AppData\Local\temp\nseF0.tmp\pakigayness.exe not found.
File/Folder C:\Users\David\AppData\Local\temp\nsl77EF.tmp\pakigayness.exe not found.
File/Folder C:\Users\David\AppData\Local\temp\nsw88D0.tmp\pakigayness.exe not found.
C:\Windows\Prefetch\PAKIGAYNESS.EXE-C47784DA.pf moved successfully.

OTM by OldTimer - Version 3.1.21.0 log created on 07132014_205752

[Márty84]

Fajn. Co pc? Jak to vypada?

[kontez.]

porad tam naskakuje pakigaynes

[Márty84]

Zopakujte tento krok

http://forum.viry.cz/viewtopic.php?f=13 ... 5#p1332780

[kontez.]

Dobrý den dnes jsem se na pc dostal až ted a mam dalsi problem muj mladsi bratr hral na internetu hry a samo od sebe se tam nainstalovalo zrychleni pocitace a to jsem hned odinstaloval a zase to mam zavirovane a nevim kde se to porad bere a pri startu win mi naskocilo userinit.exe chybová bitová kopie a nevim co s tim zde je logz rsit predesly krok jsem ani nestihl udelat.

Logfile of random's system information tool 1.10 (written by random/random)
Run by David at 2014-07-17 22:35:03
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 25 GB (35%) free of 70 GB
Total RAM: 2038 MB (34% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:35:12, on 17.7.2014
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16561)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\David\Downloads\RSIT.exe
C:\Program Files\trend micro\David.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.search.ask.com/?o=APN11459&g ... 50-407&t=4
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-21-3353992676-1699608881-1036909048-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User '?')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Protect Monitor (ProtectMonitor) - Unknown owner - C:\Program Files\PCDApp\StartHelp.exe
O23 - Service: SafetyNut Manager (SafetyNutManager) - SafetyNut Inc - C:\Program Files\Browser Tab Search by Ask\SafetyNut\SafetyNutManager.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 4336 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\qtqpxxi2.default

prefs.js - "browser.startup.homepage" - "seznam.cz"

"{20a82645-c095-46ed-80e3-08825760534b}"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 14.0.0.145 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WPF,version=3.5]
"Description"=Windows Presentation Foundation plug-in for Mozilla browsers
"Path"=c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll


C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\qtqpxxi2.default\searchplugins\
Ask.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06 63912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-10-31 4702208]
"Skytel"=C:\Windows\Skytel.exe [2007-10-11 1826816]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2014-03-11 951576]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2009-02-26 141848]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2009-02-26 173592]
"Persistence"=C:\Windows\system32\igfxpers.exe [2009-02-26 150552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-10 1233920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATKOSD2]
C:\Program Files\ATKOSD2\ATKOSD2.exe [2007-10-17 7737344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
c:\program files\synaptics\syntp\syntpenh.exe [2007-12-06 1029416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2009-02-26 210432]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bpsvc.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsersafeguard.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dprotectsvc.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jumpflip]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectedsearch.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchinstaller.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotection.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchprotector.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\searchsettings64.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snapdo.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst32.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stinst64.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umbrella.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utiljumpflip.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\volaro]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vonteera]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroids.exe]
"Debugger="tasklist.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\websteroidsservice.exe]
"Debugger="tasklist.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.FPS1"=frapsvid.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2014-07-17 22:35:03 ----D---- C:\rsit
2014-07-17 10:48:37 ----D---- C:\Users\David\AppData\Roaming\FirefoxToolbar
2014-07-17 10:47:33 ----D---- C:\ProgramData\SafetyNut
2014-07-16 12:15:56 ----D---- C:\Program Files\Seznam.cz
2014-07-16 12:14:14 ----D---- C:\Users\David\AppData\Roaming\Seznam.cz
2014-07-16 12:12:54 ----D---- C:\Program Files\PCDApp
2014-07-16 12:10:48 ----D---- C:\Program Files\Microsoft Silverlight
2014-07-13 20:57:52 ----D---- C:\_OTM
2014-07-13 15:28:25 ----D---- C:\Users\David\AppData\Roaming\vlc
2014-07-13 15:11:15 ----SHD---- C:\$RECYCLE.BIN
2014-07-13 14:56:03 ----D---- C:\Program Files\Browser Tab Search by Ask
2014-07-13 14:55:02 ----D---- C:\Users\David\AppData\Roaming\uTorrent
2014-07-13 13:26:42 ----A---- C:\Users\David\AppData\Roaming\die.bat
2014-07-13 13:22:04 ----D---- C:\Users\David\AppData\Roaming\Macromedia
2014-07-13 13:22:03 ----D---- C:\Users\David\AppData\Roaming\Adobe
2014-07-13 13:01:09 ----A---- C:\Memory Cleaner.lnk
2014-07-13 13:01:05 ----D---- C:\Users\David\AppData\Roaming\KoshyJohn.com
2014-07-09 07:40:44 ----A---- C:\Windows\system32\win32k.sys
2014-07-09 07:40:43 ----A---- C:\Windows\system32\qedit.dll
2014-07-09 07:40:42 ----A---- C:\Windows\system32\drivers\afd.sys
2014-07-09 07:40:41 ----A---- C:\Windows\system32\vbscript.dll
2014-07-09 07:40:40 ----A---- C:\Windows\system32\wininet.dll
2014-07-09 07:40:40 ----A---- C:\Windows\system32\mshtmled.dll
2014-07-09 07:40:40 ----A---- C:\Windows\system32\jscript.dll
2014-07-09 07:40:40 ----A---- C:\Windows\system32\ieui.dll
2014-07-09 07:40:40 ----A---- C:\Windows\system32\dxtrans.dll
2014-07-09 07:40:40 ----A---- C:\Windows\system32\dxtmsft.dll
2014-07-09 07:40:39 ----A---- C:\Windows\system32\jscript9.dll
2014-07-09 07:40:37 ----A---- C:\Windows\system32\mshtml.dll
2014-07-09 07:40:20 ----A---- C:\Windows\system32\msfeedssync.exe
2014-07-09 07:40:20 ----A---- C:\Windows\system32\msfeedsbs.dll
2014-07-09 07:40:20 ----A---- C:\Windows\system32\msfeeds.dll
2014-07-09 07:40:20 ----A---- C:\Windows\system32\jsproxy.dll
2014-07-09 07:40:19 ----A---- C:\Windows\system32\url.dll
2014-07-09 07:40:17 ----A---- C:\Windows\system32\ieUnatt.exe
2014-07-09 07:40:16 ----A---- C:\Windows\system32\iertutil.dll
2014-07-09 07:40:16 ----A---- C:\Windows\system32\ieframe.dll
2014-07-09 07:40:15 ----A---- C:\Windows\system32\urlmon.dll
2014-07-09 07:40:15 ----A---- C:\Windows\system32\mshta.exe
2014-07-08 19:38:27 ----D---- C:\Program Files\trend micro
2014-07-07 12:36:23 ----A---- C:\Windows\system32\drivers\mwac.sys
2014-07-07 12:36:22 ----D---- C:\Program Files\Malwarebytes Anti-Malware
2014-07-07 12:36:22 ----A---- C:\Windows\system32\drivers\mbam.sys
2014-07-04 14:32:34 ----D---- C:\Program Files\Defraggler
2014-07-01 20:35:22 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-07-01 20:34:55 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-07-01 17:38:43 ----D---- C:\Windows\temp
2014-06-30 17:48:21 ----A---- C:\Windows\system32\drivers\VBoxUSBMon.sys
2014-06-30 17:48:20 ----DC---- C:\Windows\system32\DRVSTORE
2014-06-29 19:43:21 ----D---- C:\Windows\erdnt
2014-06-25 22:41:24 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2014-06-25 22:39:46 ----D---- C:\Program Files\Common Files\Adobe
2014-06-25 22:39:46 ----D---- C:\Program Files\Adobe
2014-06-22 17:44:42 ----D---- C:\Fraps
2014-06-22 17:43:21 ----D---- C:\Program Files\Company
2014-06-22 17:41:43 ----D---- C:\Program Files\FRAPS plna verze 3.4.7

======List of files/folders modified in the last 1 month======

2014-07-17 22:35:12 ----D---- C:\Windows\Prefetch
2014-07-17 22:25:03 ----A---- C:\Windows\system32\acovcnt.exe
2014-07-17 11:19:38 ----SHD---- C:\System Volume Information
2014-07-17 10:47:33 ----D---- C:\ProgramData
2014-07-16 22:13:42 ----D---- C:\Windows
2014-07-16 12:23:58 ----D---- C:\Windows\inf
2014-07-16 12:16:24 ----RD---- C:\Program Files
2014-07-16 12:16:20 ----D---- C:\Windows\Tasks
2014-07-16 12:12:28 ----D---- C:\Windows\system32\Tasks
2014-07-16 12:11:40 ----SHD---- C:\Windows\Installer
2014-07-16 12:11:40 ----SD---- C:\ProgramData\Microsoft
2014-07-15 10:38:58 ----D---- C:\Windows\system32\drivers
2014-07-13 12:54:23 ----D---- C:\Windows\Debug
2014-07-11 19:33:12 ----SD---- C:\Users\David\AppData\Roaming\Microsoft
2014-07-10 19:52:29 ----D---- C:\Windows\PCHEALTH
2014-07-10 14:49:35 ----D---- C:\Program Files\Windows Journal
2014-07-10 14:49:33 ----D---- C:\Windows\System32
2014-07-10 14:49:31 ----D---- C:\Windows\system32\migration
2014-07-10 14:49:31 ----D---- C:\Program Files\Internet Explorer
2014-07-10 06:46:42 ----D---- C:\Windows\system32\catroot
2014-07-10 06:46:41 ----D---- C:\Windows\system32\catroot2
2014-07-10 06:46:36 ----D---- C:\Windows\winsxs
2014-07-10 06:32:47 ----D---- C:\Windows\system32\MRT
2014-07-10 06:27:12 ----A---- C:\Windows\system32\mrt.exe
2014-07-06 00:27:53 ----D---- C:\Program Files\Google
2014-07-01 20:35:37 ----D---- C:\ProgramData\Malwarebytes
2014-07-01 17:34:33 ----A---- C:\Windows\system.ini
2014-07-01 17:34:22 ----D---- C:\Windows\system32\drivers\etc
2014-07-01 17:29:55 ----D---- C:\Windows\AppPatch
2014-07-01 17:29:54 ----D---- C:\Program Files\Common Files
2014-06-30 18:10:28 ----D---- C:\Windows\SoftwareDistribution
2014-06-22 18:23:33 ----D---- C:\Windows\Microsoft.NET
2014-06-22 17:43:31 ----D---- C:\Windows\system32\Printing_Admin_Scripts
2014-06-22 17:41:46 ----D---- C:\Windows\system32\bitstreams

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2007-09-29 308248]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2014-01-25 231960]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2014-05-20 242240]
R1 F06DEFF2-5B9C-490D-910F-35D3A91196223;F06DEFF2-5B9C-490D-910F-35D3A91196223; \??\C:\Program Files\Browser Tab Search by Ask\SafetyNut\configmgrc2.cfg [2014-07-10 34384]
R2 ASMMAP;ASMMAP; \??\C:\Program Files\ATKGFNEX\ASMMAP.sys [2007-07-24 13880]
R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [2007-08-03 20936]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2014-03-11 104264]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2007-08-08 45568]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-07-30 43008]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2007-12-06 761856]
R3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-10 22528]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2009-06-17 30208]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2009-02-26 4569088]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-11-01 2011224]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2007-01-24 5632]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2014-05-12 23256]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2014-07-17 110296]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2006-12-14 7680]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-10 148992]
R3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2007-07-13 50688]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-10 89088]
R3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-12-06 196400]
R3 WudfPf;@%SystemRoot%\system32\drivers\Wudfpf.sys,-1000; C:\Windows\system32\drivers\WudfPf.sys [2014-05-18 66560]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-21 508416]
S3 drmkaud;Dekodér zvuků DRM jádra společnosti Microsoft; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Ovladač funkce Microsoft 1.1 UAA pro službu zvuku High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2014-05-12 51928]
S3 MSKSSRV;Server proxy služby datových proudů Microsoft; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Server proxy hodin datových proudů Microsoft; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Server proxy správce kvality datových proudů Microsoft; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]
S3 MSTEE;Konvertor jímka-jímka typu T datových proudů Microsoft; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2014-05-18 155136]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ASLDRService;ASLDR Service; C:\Program Files\ATK Hotkey\ASLDRSrv.exe [2007-10-02 94208]
R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [2007-08-08 94208]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [2014-05-12 860472]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-05-12 1809720]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2014-03-11 22216]
R2 SafetyNutManager;SafetyNut Manager; C:\Program Files\Browser Tab Search by Ask\SafetyNut\SafetyNutManager.exe [2014-07-10 3573456]
R2 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2007-08-03 125496]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2014-03-11 279776]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 ProtectMonitor;Protect Monitor; C:\Program Files\PCDApp\StartHelp.exe [2014-06-28 65846]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe [2014-06-11 119408]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2013-09-11 770168]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------
jeste delam test pres MBAM porad detekuje hrozby pak jsem dam zaznam