info.txt logfile of random's system information tool 1.08 2014-08-06 22:47:23
======Uninstall list======
Adobe AIR-->C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Community Help-->msiexec /qb /x {0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}
Adobe Community Help-->MsiExec.exe /I{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}
Adobe Flash Player 14 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_14_0_0_145_ActiveX.exe -maintain activex
Adobe Media Player-->msiexec /qb /x {DE3A9DC5-9A5D-6485-9662-347162C7E4CA}
Adobe Media Player-->MsiExec.exe /I{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}
Adobe Photoshop CS5-->C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\core\PDApp.exe --appletID="DWA_UI" --appletVersion="1.0" --mode="Uninstall" --mediaSignature="{15FEDA5F-141C-4127-8D7E-B962D1742728}"
AMD Accelerated Video Transcoding-->MsiExec.exe /X{41F22D89-7F71-E83A-08E7-7E7473F4A55D}
AMD Catalyst Install Manager-->msiexec /q/x{3FAEEEBE-48F4-84C1-2B49-96AE73E67E3E} REBOOT=ReallySuppress
AMD Drag and Drop Transcoding-->MsiExec.exe /X{CB8EC858-84C9-5A45-F786-86929EE4298B}
AMD Wireless Display v3.0-->MsiExec.exe /X{C3ECDE27-BD89-71E3-254D-DF32AF7C389D}
Apple Application Support-->MsiExec.exe /I{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}
Apple Mobile Device Support-->MsiExec.exe /I{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}
Apple Software Update-->MsiExec.exe /I{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}
Asmedia ASM104x USB 3.0 Host Controller Driver-->MsiExec.exe /X{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}
Bonjour-->MsiExec.exe /X{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}
Catalyst Control Center - Branding-->MsiExec.exe /I{59F0E916-7B87-4F09-888B-850F3F0700B5}
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
DisplayLink Core Software-->MsiExec.exe /X{10453B5E-375D-4774-81FA-50CAF84F3BF2}
DisplayLink Graphics-->MsiExec.exe /X{CE23EBAE-2DE0-44A2-AB1A-23B56CCDA739}
Google Chrome-->"C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\setup.exe" --uninstall --multi-install --chrome --system-level
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
HP Deskjet 1050 J410 series Nápověda-->MsiExec.exe /I{5C90D8CF-F12A-41C6-9007-3B651A1F0D78}
HP Update-->MsiExec.exe /X{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}
HydraVision-->MsiExec.exe /X{89CE7F9B-B4DF-8585-638B-6BD807ADE9C7}
iTunes-->MsiExec.exe /I{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}
Malwarebytes Anti-Malware verze 2.0.2.1012-->"C:\Program Files (x86)\Malwarebytes Anti-Malware\unins000.exe"
Microsoft .NET Framework 4.5-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\\Setup.exe /repair /x86 /x64
Microsoft .NET Framework 4.5-->MsiExec.exe /X{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319-->MsiExec.exe /X{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727-->"C:\ProgramData\Package Cache\{15134cb0-b767-4960-a911-f2d16ae54797}\vcredist_x64.exe" /uninstall
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727-->MsiExec.exe /X{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727-->MsiExec.exe /X{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}
Microsoft_VC80_ATL_x86_x64-->MsiExec.exe /I{925D058B-564A-443A-B4B2-7E90C6432E55}
Microsoft_VC80_ATL_x86-->MsiExec.exe /I{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}
Microsoft_VC80_CRT_x86_x64-->MsiExec.exe /I{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}
Microsoft_VC80_CRT_x86-->MsiExec.exe /I{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}
Microsoft_VC80_MFC_x86_x64-->MsiExec.exe /I{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}
Microsoft_VC80_MFC_x86-->MsiExec.exe /I{D1A19B02-817E-4296-A45B-07853FD74D57}
Microsoft_VC80_MFCLOC_x86_x64-->MsiExec.exe /I{1E9FC118-651D-4934-97BE-E53CAE5C7D45}
Microsoft_VC80_MFCLOC_x86-->MsiExec.exe /I{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}
Microsoft_VC90_ATL_x86_x64-->MsiExec.exe /I{8557397C-A42D-486F-97B3-A2CBC2372593}
Microsoft_VC90_ATL_x86-->MsiExec.exe /I{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}
Microsoft_VC90_CRT_x86_x64-->MsiExec.exe /I{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}
Microsoft_VC90_CRT_x86-->MsiExec.exe /I{08D2E121-7F6A-43EB-97FD-629B44903403}
Microsoft_VC90_MFC_x86_x64-->MsiExec.exe /I{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}
Microsoft_VC90_MFC_x86-->MsiExec.exe /I{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}
PDF Settings CS5-->MsiExec.exe /I{A78FE97A-C0C8-49CE-89D0-EDD524A17392}
Raptr-->"C:\Program Files (x86)\Raptr\uninstall.exe"
Realtek Ethernet Controller Driver-->C:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\Setup.exe -runfromtemp -removeonly
Spybot - Search & Destroy-->"C:\Program Files (x86)\Spybot - Search & Destroy 2\unins000.exe"
TeamSpeak 3 Client-->"D:\Program Files\TeamSpeak 3 Client\uninstall.exe"
WinRAR 5.10 (64-bit)-->G:\Program Files\WinRAR\uninstall.exe
Základní software zařízení HP Deskjet 1050 J410 series-->MsiExec.exe /I{A3E36A5A-8306-42AD-8A0A-EB252823D987}
======Hosts File======
127.0.0.1 activate.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 practivate.adobe.com
======System event log======
Computer Name: 37L4247F27-25
Event Code: 7036
Message: Stav služby Windows Event Log byl změněn na: stopped
Record Number: 5
Source Name: Service Control Manager
Time Written: 20101121035831.093172-000
Event Type: Informace
User:
Computer Name: 37L4247F27-25
Event Code: 7036
Message: Stav služby Diagnostic Policy Service byl změněn na: stopped
Record Number: 4
Source Name: Service Control Manager
Time Written: 20101121035831.093172-000
Event Type: Informace
User:
Computer Name: 37L4247F27-25
Event Code: 6005
Message: Služba Event Log byla spuštěna.
Record Number: 3
Source Name: EventLog
Time Written: 20140730172755.000000-000
Event Type: Informace
User:
Computer Name: 37L4247F27-25
Event Code: 6009
Message: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.
Record Number: 2
Source Name: EventLog
Time Written: 20140730172755.000000-000
Event Type: Informace
User:
Computer Name: 37L4247F27-25
Event Code: 6011
Message: Název tohoto počítače v systémech DNS a NetBIOS byl změněn z 37L4247F27-25 na WIN-LGM3R3I87FI.
Record Number: 1
Source Name: EventLog
Time Written: 20140730172755.000000-000
Event Type: Informace
User:
=====Application event log=====
Computer Name: 37L4247F27-25
Event Code: 5617
Message: Windows Management Instrumentation Service subsystems initialized successfully
Record Number: 5
Source Name: Microsoft-Windows-WMI
Time Written: 20140730172812.000000-000
Event Type: Informace
User:
Computer Name: 37L4247F27-25
Event Code: 5615
Message: Windows Management Instrumentation Service started sucessfully
Record Number: 4
Source Name: Microsoft-Windows-WMI
Time Written: 20140730172806.000000-000
Event Type: Informace
User:
Computer Name: 37L4247F27-25
Event Code: 1531
Message: Služba Profil uživatele byla úspěšně spuštěna.
Record Number: 3
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20140730172757.789310-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM
Computer Name: 37L4247F27-25
Event Code: 4625
Message: Subsystém EventSystem zabraňuje vytváření duplicitních záznamů v protokolu událostí po dobu 86400 sekund. Tuto dobu lze změnit pomocí hodnoty REG_DWORD s názvem SuppressDuplicateDuration v následujícím klíči registru: HKLM\Software\Microsoft\EventSystem\EventLog.
Record Number: 2
Source Name: Microsoft-Windows-EventSystem
Time Written: 20140730172758.000000-000
Event Type: Informace
User:
Computer Name: 37L4247F27-25
Event Code: 1532
Message: Služba Profil uživatele byla zastavena.
Record Number: 1
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20101121035831.124372-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM
=====Security event log=====
Computer Name: 37L4247F27-25
Event Code: 4672
Message: Novému přihlášení byla přiřazena zvláštní oprávnění.
Předmět:
ID zabezpečení: S-1-5-18
Název účtu: SYSTEM
Doména účtu: NT AUTHORITY
ID přihlášení: 0x3e7
Oprávnění: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 5
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140730172737.758875-000
Event Type: Úspěšný audit
User:
Computer Name: 37L4247F27-25
Event Code: 4624
Message: Účet byl úspěšně přihlášen.
Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247F27-25$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7
Typ přihlášení: 5
Nové přihlášení:
ID zabezpečení: S-1-5-18
Název účtu: SYSTEM
Doména účtu: NT AUTHORITY
ID přihlášení: 0x3e7
GUID přihlášení: {00000000-0000-0000-0000-000000000000}
Informace o procesu:
ID procesu: 0x1dc
Název procesu: C:\Windows\System32\services.exe
Informace o síti:
Název pracovní stanice:
Adresa zdrojové sítě -
Zdrojový port: -
Podrobné informace o ověření:
Proces přihlášení: Advapi
Balíček ověření: Negotiate
Přenosové služby: -
Název balíčku (pouze NTLM): -
Délka klíče: 0
Tato událost je generována po vytvoření relace přihlášení. Je generována v počítači, ke kterému byl získán přístup.
Pole s předmětem označují účet v místním systému, který požadoval přihlášení. Jedná se nejčastěji o službu, například službu serveru nebo místní proces, například Winlogon.exe nebo Services.exe.
Pole Typ přihlášení označuje, k jakému typu přihlášení došlo. Nejběžnější typy jsou 2 (interaktivní) a 3 (síť).
Pole Nové přihlášení označují účet, pro který bylo nové přihlášení vytvořeno, tj. účet, který byl přihlášen.
Pole Síť označují původ požadavku na vzdálené přihlášení. Název pracovní stanice není vždy k dispozici a v některých případech může být toto pole prázdné.
Pole s informacemi o ověření poskytují podrobné informace o tomto konkrétním požadavku na přihlášení.
- GUID přihlášení je jednoznačný identifikátor, který je možné použít ke spojení této události s událostí KDC.
- Přenosové služby označují, které pomocné služby se podílely na tomto požadavku na přihlášení.
- Název balíčku označuje, který dílčí protokol z protokolů NTLM byl použit.
- Délka klíče označuje délku generovaného klíče relace. Tato hodnota bude 0, pokud nebyl požadován žádný klíč relace.
Record Number: 4
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140730172737.758875-000
Event Type: Úspěšný audit
User:
Computer Name: 37L4247F27-25
Event Code: 4902
Message: Tabulka zásad auditu pro jednotlivé uživatele byla vytvořena.
Počet prvků: 0
ID zásady: 0x31b05
Record Number: 3
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140730172726.823256-000
Event Type: Úspěšný audit
User:
Computer Name: 37L4247F27-25
Event Code: 4624
Message: Účet byl úspěšně přihlášen.
Předmět:
ID zabezpečení: S-1-0-0
Název účtu: -
Doména účtu: -
ID přihlášení: 0x0
Typ přihlášení: 0
Nové přihlášení:
ID zabezpečení: S-1-5-18
Název účtu: SYSTEM
Doména účtu: NT AUTHORITY
ID přihlášení: 0x3e7
GUID přihlášení: {00000000-0000-0000-0000-000000000000}
Informace o procesu:
ID procesu: 0x4
Název procesu:
Informace o síti:
Název pracovní stanice: -
Adresa zdrojové sítě -
Zdrojový port: -
Podrobné informace o ověření:
Proces přihlášení: -
Balíček ověření: -
Přenosové služby: -
Název balíčku (pouze NTLM): -
Délka klíče: 0
Tato událost je generována po vytvoření relace přihlášení. Je generována v počítači, ke kterému byl získán přístup.
Pole s předmětem označují účet v místním systému, který požadoval přihlášení. Jedná se nejčastěji o službu, například službu serveru nebo místní proces, například Winlogon.exe nebo Services.exe.
Pole Typ přihlášení označuje, k jakému typu přihlášení došlo. Nejběžnější typy jsou 2 (interaktivní) a 3 (síť).
Pole Nové přihlášení označují účet, pro který bylo nové přihlášení vytvořeno, tj. účet, který byl přihlášen.
Pole Síť označují původ požadavku na vzdálené přihlášení. Název pracovní stanice není vždy k dispozici a v některých případech může být toto pole prázdné.
Pole s informacemi o ověření poskytují podrobné informace o tomto konkrétním požadavku na přihlášení.
- GUID přihlášení je jednoznačný identifikátor, který je možné použít ke spojení této události s událostí KDC.
- Přenosové služby označují, které pomocné služby se podílely na tomto požadavku na přihlášení.
- Název balíčku označuje, který dílčí protokol z protokolů NTLM byl použit.
- Délka klíče označuje délku generovaného klíče relace. Tato hodnota bude 0, pokud nebyl požadován žádný klíč relace.
Record Number: 2
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140730172723.204050-000
Event Type: Úspěšný audit
User:
Computer Name: 37L4247F27-25
Event Code: 4608
Message: Spouští se systém Windows.
Tato událost je zaznamenána při spuštění procesu LSASS.EXE a inicializaci kontrolního podsystému.
Record Number: 1
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20140730172723.001249-000
Event Type: Úspěšný audit
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"NUMBER_OF_PROCESSORS"=4
"PROCESSOR_LEVEL"=21
"PROCESSOR_IDENTIFIER"=AMD64 Family 21 Model 16 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=1001
"windows_tracing_logfile"=C:\BVTBin\Tests\installpackage\csilogfile.log
"windows_tracing_flags"=3
"asl.log"=Destination=file
-----------------EOF-----------------
Logfile of random's system information tool 1.08 (written by random/random)
Run by Frappy at 2014-08-06 22:47:17
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 44 GB (56%) free of 78 GB
Total RAM: 8144 MB (74% free)
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:47:21, on 6.8.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files\trend micro\Frappy.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\RunOnce: [GrpConv] grpconv -o
O4 - HKCU\..\Run: [Raptr] C:\PROGRA~2\Raptr\raptrstub.exe --startup
O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"
O4 - HKCU\..\Run: [Spybot-S&D Cleaning] "C:\PROGRA~2\SPYBOT~1\SDCleaner.exe" /autoclean
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User '?')
O4 - HKUS\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User '?')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User '?')
O4 - HKUS\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User '?')
O4 - HKUS\S-1-5-21-1766096757-1684294531-2525756948-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\..\Run: [Raptr] C:\PROGRA~2\Raptr\raptrstub.exe --startup (User '?')
O4 - S-1-5-21-1766096757-1684294531-2525756948-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 Startup: Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk = ? (User '?')
O4 - S-1-5-21-1766096757-1684294531-2525756948-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 Startup: _uninst_88534135.lnk = Frappy\AppData\Local\Temp\_uninst_88534135.bat (User '?')
O4 - Startup: Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk = ?
O4 - Startup: _uninst_88534135.lnk = Frappy\AppData\Local\Temp\_uninst_88534135.bat
O8 - Extra context menu item: Spustit klienta k monitoru &1 - C:\Windows\web\AOpenClient.htm
O8 - Extra context menu item: Spustit klienta k monitoru &2 - C:\Windows\web\AOpenClient.htm
O8 - Extra context menu item: Spustit klienta k monitoru &3 - C:\Windows\web\AOpenClient.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD2930F7-ECC2-4B82-B5A1-56F8C1DDFF2F}: NameServer = 192.168.1.1
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DisplayLinkManager (DisplayLinkService) - DisplayLink Corp. - C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Unknown owner - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Unknown owner - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 9125 bytes
======Listing Processes======
\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
atieclxx
"C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe"
"C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe"
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe"
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe"
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe" /starttray
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:3884 CREDAT:79873
"D:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1766096757-1684294531-2525756948-10003_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1766096757-1684294531-2525756948-10003 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:3884 CREDAT:79874
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:3884 CREDAT:79875
"C:\Users\Frappy\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RAG6QXYI\RSITx64[1].exe"
C:\Windows\system32\wbem\wmiprvse.exe
======Scheduled tasks folder======
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\Check for updates (Spybot - Search & Destroy).job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\Refresh immunization (Spybot - Search & Destroy).job
C:\Windows\tasks\Scan the system (Spybot - Search & Destroy).job
======Registry dump======
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Raptr"=C:\PROGRA~2\Raptr\raptrstub.exe [2014-08-06 96832]
"HydraVisionDesktopManager"=C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [2014-08-06 2009088]
"Spybot-S&D Cleaning"=C:\PROGRA~2\SPYBOT~1\SDCleaner.exe [2014-08-06 4608424]
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [2014-08-06 850144]
"iTunesHelper"=C:\Program Files (x86)\iTunes\iTunesHelper.exe [2014-08-06 235336]
"AdobeCS5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2014-08-06 448464]
"SDTray"=C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [2014-08-06 4143048]
"HP Software Update"=C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [2014-08-06 90680]
""= []
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"=grpconv -o []
C:\Users\Frappy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk - C:\Windows\system32\RunDll32.exe
_uninst_88534135.lnk - C:\Users\Frappy\AppData\Local\Temp\_uninst_88534135.bat
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ESETOlmarikOlmascoCleaner]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ESETOlmarikOlmascoCleaner.sys]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ESETOlmarikOlmascoCleaner]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ESETOlmarikOlmascoCleaner.sys]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot - Search & Destroy tray access"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe"="C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
======File associations======
.exe - open -
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
======List of files/folders created in the last 1 months======
2014-08-06 22:47:17 ----D---- C:\Program Files\trend micro
2014-08-06 22:47:16 ----D---- C:\rsit
2014-08-06 22:38:54 ----A---- C:\Windows\svchost.com
2014-08-06 22:23:30 ----D---- C:\ProgramData\Kaspersky Lab
2014-08-06 22:23:05 ----A---- C:\Windows\system32\drivers\12553943.sys
2014-08-06 22:21:44 ----D---- C:\Program Files\CCleaner
2014-08-05 21:44:36 ----D---- C:\Users\Frappy\AppData\Roaming\HpUpdate
2014-08-05 21:44:17 ----D---- C:\ProgramData\HP
2014-08-05 21:44:17 ----D---- C:\Program Files\HP
2014-08-05 21:44:17 ----D---- C:\Program Files (x86)\HP
2014-08-05 21:44:13 ----A---- C:\ProgramData\Ament.ini
2014-08-05 21:34:47 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 21:34:30 ----D---- C:\ProgramData\Malwarebytes
2014-08-05 21:34:30 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-05 21:34:30 ----A---- C:\Windows\system32\drivers\mwac.sys
2014-08-05 21:34:30 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-08-05 21:34:30 ----A---- C:\Windows\system32\drivers\mbam.sys
2014-08-02 19:55:48 ----A---- C:\Windows\system32\sdnclean64.exe
2014-08-02 19:55:47 ----D---- C:\ProgramData\Spybot - Search & Destroy
2014-08-02 19:55:43 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-02 19:54:24 ----A---- C:\Windows\system32\drivers\ESETOlmarikOlmascoCleaner.sys
2014-08-02 11:58:27 ----A---- C:\Windows\directx.sys
2014-08-02 11:26:26 ----D---- C:\ProgramData\Battle.net
2014-07-31 21:17:32 ----D---- C:\Users\Frappy\AppData\Roaming\WinRAR
2014-07-31 21:09:39 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2014-07-31 21:07:19 ----D---- C:\Program Files\Common Files\Adobe
2014-07-31 21:06:31 ----D---- C:\Program Files (x86)\Adobe Media Player
2014-07-31 21:04:20 ----D---- C:\Program Files (x86)\Adobe
2014-07-31 21:03:16 ----D---- C:\ProgramData\Adobe
2014-07-31 20:57:39 ----D---- C:\Users\Frappy\AppData\Roaming\Macromedia
2014-07-31 05:56:45 ----D---- C:\Users\Frappy\AppData\Roaming\Apple Computer
2014-07-31 05:55:35 ----DC---- C:\Windows\system32\DRVSTORE
2014-07-31 05:55:35 ----A---- C:\Windows\system32\drivers\GEARAspiWDM.sys
2014-07-31 05:55:10 ----D---- C:\Program Files\iPod
2014-07-31 05:55:09 ----D---- C:\ProgramData\Apple Computer
2014-07-31 05:55:09 ----D---- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-07-31 05:55:09 ----D---- C:\Program Files\iTunes
2014-07-31 05:55:09 ----D---- C:\Program Files (x86)\iTunes
2014-07-31 05:53:39 ----D---- C:\Program Files (x86)\Apple Software Update
2014-07-31 05:53:32 ----D---- C:\Program Files\Common Files\Apple
2014-07-31 05:53:20 ----D---- C:\Program Files\Bonjour
2014-07-31 05:53:20 ----D---- C:\Program Files (x86)\Bonjour
2014-07-31 05:53:06 ----D---- C:\ProgramData\Apple
2014-07-30 23:25:09 ----D---- C:\Users\Frappy\AppData\Roaming\Wargaming.net
2014-07-30 23:05:07 ----A---- C:\Windows\system32\drivers\dlkmdldr.sys
2014-07-30 23:05:07 ----A---- C:\Windows\system32\drivers\dlkmd.sys
2014-07-30 23:04:37 ----D---- C:\Program Files\DisplayLink Graphics
2014-07-30 23:02:56 ----D---- C:\Program Files\DisplayLink Core Software
2014-07-30 23:02:32 ----A---- C:\Windows\system32\drivers\DisplayLinkUsbIo_x64_7.4.48800.0.sys
2014-07-30 23:02:32 ----A---- C:\Windows\system32\DisplayLinkUsbCo64_7.4.48800.0.dll
2014-07-30 22:58:33 ----D---- C:\ProgramData\WarThunder
2014-07-30 21:41:54 ----D---- C:\Users\Frappy\AppData\Roaming\TS3Client
2014-07-30 20:46:22 ----A---- C:\Windows\SYSWOW64\XAudio2_7.dll
2014-07-30 20:46:22 ----A---- C:\Windows\SYSWOW64\XAPOFX1_5.dll
2014-07-30 20:46:22 ----A---- C:\Windows\system32\XAudio2_7.dll
2014-07-30 20:46:22 ----A---- C:\Windows\system32\XAPOFX1_5.dll
2014-07-30 20:46:21 ----A---- C:\Windows\SYSWOW64\xactengine3_7.dll
2014-07-30 20:46:21 ----A---- C:\Windows\SYSWOW64\d3dx11_43.dll
2014-07-30 20:46:21 ----A---- C:\Windows\SYSWOW64\d3dcsx_43.dll
2014-07-30 20:46:21 ----A---- C:\Windows\SYSWOW64\D3DCompiler_43.dll
2014-07-30 20:46:21 ----A---- C:\Windows\system32\xactengine3_7.dll
2014-07-30 20:46:21 ----A---- C:\Windows\system32\d3dx11_43.dll
2014-07-30 20:46:21 ----A---- C:\Windows\system32\d3dcsx_43.dll
2014-07-30 20:46:21 ----A---- C:\Windows\system32\D3DCompiler_43.dll
2014-07-30 20:46:20 ----A---- C:\Windows\SYSWOW64\XAudio2_6.dll
2014-07-30 20:46:20 ----A---- C:\Windows\SYSWOW64\XAPOFX1_4.dll
2014-07-30 20:46:20 ----A---- C:\Windows\SYSWOW64\D3DX9_43.dll
2014-07-30 20:46:20 ----A---- C:\Windows\SYSWOW64\d3dx10_43.dll
2014-07-30 20:46:20 ----A---- C:\Windows\system32\XAudio2_6.dll
2014-07-30 20:46:20 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2014-07-30 20:46:20 ----A---- C:\Windows\system32\D3DX9_43.dll
2014-07-30 20:46:20 ----A---- C:\Windows\system32\d3dx10_43.dll
2014-07-30 20:46:19 ----A---- C:\Windows\SYSWOW64\xactengine3_6.dll
2014-07-30 20:46:19 ----A---- C:\Windows\SYSWOW64\X3DAudio1_7.dll
2014-07-30 20:46:19 ----A---- C:\Windows\system32\xactengine3_6.dll
2014-07-30 20:46:19 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2014-07-30 20:46:18 ----A---- C:\Windows\SYSWOW64\XAudio2_5.dll
2014-07-30 20:46:18 ----A---- C:\Windows\system32\XAudio2_5.dll
2014-07-30 20:46:17 ----A---- C:\Windows\SYSWOW64\xactengine3_5.dll
2014-07-30 20:46:17 ----A---- C:\Windows\system32\xactengine3_5.dll
2014-07-30 20:46:16 ----A---- C:\Windows\SYSWOW64\d3dx11_42.dll
2014-07-30 20:46:16 ----A---- C:\Windows\SYSWOW64\d3dcsx_42.dll
2014-07-30 20:46:16 ----A---- C:\Windows\SYSWOW64\D3DCompiler_42.dll
2014-07-30 20:46:16 ----A---- C:\Windows\system32\d3dx11_42.dll
2014-07-30 20:46:16 ----A---- C:\Windows\system32\d3dcsx_42.dll
2014-07-30 20:46:16 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2014-07-30 20:46:15 ----A---- C:\Windows\SYSWOW64\D3DX9_42.dll
2014-07-30 20:46:15 ----A---- C:\Windows\SYSWOW64\d3dx10_42.dll
2014-07-30 20:46:15 ----A---- C:\Windows\SYSWOW64\d3dx10_41.dll
2014-07-30 20:46:15 ----A---- C:\Windows\SYSWOW64\D3DCompiler_41.dll
2014-07-30 20:46:15 ----A---- C:\Windows\system32\D3DX9_42.dll
2014-07-30 20:46:15 ----A---- C:\Windows\system32\d3dx10_42.dll
2014-07-30 20:46:15 ----A---- C:\Windows\system32\d3dx10_41.dll
2014-07-30 20:46:15 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2014-07-30 20:46:14 ----A---- C:\Windows\SYSWOW64\XAudio2_4.dll
2014-07-30 20:46:14 ----A---- C:\Windows\SYSWOW64\XAPOFX1_3.dll
2014-07-30 20:46:14 ----A---- C:\Windows\SYSWOW64\D3DX9_41.dll
2014-07-30 20:46:14 ----A---- C:\Windows\system32\XAudio2_4.dll
2014-07-30 20:46:14 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2014-07-30 20:46:14 ----A---- C:\Windows\system32\D3DX9_41.dll
2014-07-30 20:46:11 ----A---- C:\Windows\SYSWOW64\xactengine3_4.dll
2014-07-30 20:46:11 ----A---- C:\Windows\SYSWOW64\X3DAudio1_6.dll
2014-07-30 20:46:11 ----A---- C:\Windows\system32\xactengine3_4.dll
2014-07-30 20:46:11 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2014-07-30 20:46:10 ----A---- C:\Windows\SYSWOW64\D3DX9_40.dll
2014-07-30 20:46:10 ----A---- C:\Windows\SYSWOW64\d3dx10_40.dll
2014-07-30 20:46:10 ----A---- C:\Windows\SYSWOW64\D3DCompiler_40.dll
2014-07-30 20:46:10 ----A---- C:\Windows\system32\D3DX9_40.dll
2014-07-30 20:46:10 ----A---- C:\Windows\system32\d3dx10_40.dll
2014-07-30 20:46:10 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2014-07-30 20:46:09 ----A---- C:\Windows\SYSWOW64\XAudio2_3.dll
2014-07-30 20:46:09 ----A---- C:\Windows\SYSWOW64\XAPOFX1_2.dll
2014-07-30 20:46:09 ----A---- C:\Windows\system32\XAudio2_3.dll
2014-07-30 20:46:09 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2014-07-30 20:46:08 ----A---- C:\Windows\SYSWOW64\xactengine3_3.dll
2014-07-30 20:46:08 ----A---- C:\Windows\system32\xactengine3_3.dll
2014-07-30 20:46:07 ----A---- C:\Windows\SYSWOW64\XAudio2_2.dll
2014-07-30 20:46:07 ----A---- C:\Windows\SYSWOW64\XAPOFX1_1.dll
2014-07-30 20:46:07 ----A---- C:\Windows\SYSWOW64\X3DAudio1_5.dll
2014-07-30 20:46:07 ----A---- C:\Windows\system32\XAudio2_2.dll
2014-07-30 20:46:07 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2014-07-30 20:46:07 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2014-07-30 20:46:06 ----A---- C:\Windows\SYSWOW64\xactengine3_2.dll
2014-07-30 20:46:06 ----A---- C:\Windows\system32\xactengine3_2.dll
2014-07-30 20:46:05 ----A---- C:\Windows\SYSWOW64\XAudio2_1.dll
2014-07-30 20:46:05 ----A---- C:\Windows\SYSWOW64\XAPOFX1_0.dll
2014-07-30 20:46:05 ----A---- C:\Windows\SYSWOW64\D3DX9_39.dll
2014-07-30 20:46:05 ----A---- C:\Windows\SYSWOW64\d3dx10_39.dll
2014-07-30 20:46:05 ----A---- C:\Windows\SYSWOW64\D3DCompiler_39.dll
2014-07-30 20:46:05 ----A---- C:\Windows\system32\XAudio2_1.dll
2014-07-30 20:46:05 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2014-07-30 20:46:05 ----A---- C:\Windows\system32\D3DX9_39.dll
2014-07-30 20:46:05 ----A---- C:\Windows\system32\d3dx10_39.dll
2014-07-30 20:46:05 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2014-07-30 20:46:03 ----A---- C:\Windows\SYSWOW64\xactengine3_1.dll
2014-07-30 20:46:03 ----A---- C:\Windows\SYSWOW64\X3DAudio1_4.dll
2014-07-30 20:46:03 ----A---- C:\Windows\SYSWOW64\d3dx10_38.dll
2014-07-30 20:46:03 ----A---- C:\Windows\SYSWOW64\D3DCompiler_38.dll
2014-07-30 20:46:03 ----A---- C:\Windows\system32\xactengine3_1.dll
2014-07-30 20:46:03 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2014-07-30 20:46:03 ----A---- C:\Windows\system32\d3dx10_38.dll
2014-07-30 20:46:03 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2014-07-30 20:46:02 ----A---- C:\Windows\SYSWOW64\D3DX9_38.dll
2014-07-30 20:46:02 ----A---- C:\Windows\system32\D3DX9_38.dll
2014-07-30 20:46:01 ----A---- C:\Windows\SYSWOW64\XAudio2_0.dll
2014-07-30 20:46:01 ----A---- C:\Windows\system32\XAudio2_0.dll
2014-07-30 20:45:58 ----A---- C:\Windows\SYSWOW64\xactengine3_0.dll
2014-07-30 20:45:58 ----A---- C:\Windows\SYSWOW64\X3DAudio1_3.dll
2014-07-30 20:45:58 ----A---- C:\Windows\SYSWOW64\D3DX9_37.dll
2014-07-30 20:45:58 ----A---- C:\Windows\SYSWOW64\d3dx10_37.dll
2014-07-30 20:45:58 ----A---- C:\Windows\SYSWOW64\D3DCompiler_37.dll
2014-07-30 20:45:58 ----A---- C:\Windows\system32\xactengine3_0.dll
2014-07-30 20:45:58 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2014-07-30 20:45:58 ----A---- C:\Windows\system32\D3DX9_37.dll
2014-07-30 20:45:58 ----A---- C:\Windows\system32\d3dx10_37.dll
2014-07-30 20:45:58 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2014-07-30 20:45:57 ----A---- C:\Windows\SYSWOW64\xactengine2_10.dll
2014-07-30 20:45:57 ----A---- C:\Windows\system32\xactengine2_10.dll
2014-07-30 20:45:56 ----A---- C:\Windows\SYSWOW64\d3dx9_36.dll
2014-07-30 20:45:56 ----A---- C:\Windows\SYSWOW64\d3dx10_36.dll
2014-07-30 20:45:56 ----A---- C:\Windows\SYSWOW64\D3DCompiler_36.dll
2014-07-30 20:45:56 ----A---- C:\Windows\system32\d3dx9_36.dll
2014-07-30 20:45:56 ----A---- C:\Windows\system32\d3dx10_36.dll
2014-07-30 20:45:56 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2014-07-30 20:45:54 ----A---- C:\Windows\SYSWOW64\xactengine2_9.dll
2014-07-30 20:45:54 ----A---- C:\Windows\system32\xactengine2_9.dll
2014-07-30 20:45:53 ----A---- C:\Windows\SYSWOW64\d3dx10_35.dll
2014-07-30 20:45:53 ----A---- C:\Windows\SYSWOW64\D3DCompiler_35.dll
2014-07-30 20:45:53 ----A---- C:\Windows\system32\d3dx10_35.dll
2014-07-30 20:45:53 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2014-07-30 20:45:52 ----A---- C:\Windows\SYSWOW64\d3dx9_35.dll
2014-07-30 20:45:52 ----A---- C:\Windows\system32\d3dx9_35.dll
2014-07-30 20:45:51 ----A---- C:\Windows\SYSWOW64\xactengine2_8.dll
2014-07-30 20:45:51 ----A---- C:\Windows\SYSWOW64\X3DAudio1_2.dll
2014-07-30 20:45:51 ----A---- C:\Windows\system32\xactengine2_8.dll
2014-07-30 20:45:51 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2014-07-30 20:45:50 ----A---- C:\Windows\SYSWOW64\xinput1_3.dll
2014-07-30 20:45:50 ----A---- C:\Windows\SYSWOW64\d3dx9_34.dll
2014-07-30 20:45:50 ----A---- C:\Windows\SYSWOW64\d3dx10_34.dll
2014-07-30 20:45:50 ----A---- C:\Windows\SYSWOW64\D3DCompiler_34.dll
2014-07-30 20:45:50 ----A---- C:\Windows\system32\xinput1_3.dll
2014-07-30 20:45:50 ----A---- C:\Windows\system32\d3dx9_34.dll
2014-07-30 20:45:50 ----A---- C:\Windows\system32\d3dx10_34.dll
2014-07-30 20:45:50 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2014-07-30 20:45:49 ----A---- C:\Windows\SYSWOW64\xactengine2_7.dll
2014-07-30 20:45:49 ----A---- C:\Windows\SYSWOW64\d3dx9_33.dll
2014-07-30 20:45:49 ----A---- C:\Windows\SYSWOW64\d3dx10_33.dll
2014-07-30 20:45:49 ----A---- C:\Windows\SYSWOW64\D3DCompiler_33.dll
2014-07-30 20:45:49 ----A---- C:\Windows\system32\xactengine2_7.dll
2014-07-30 20:45:49 ----A---- C:\Windows\system32\d3dx9_33.dll
2014-07-30 20:45:49 ----A---- C:\Windows\system32\d3dx10_33.dll
2014-07-30 20:45:49 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2014-07-30 20:45:47 ----A---- C:\Windows\SYSWOW64\xactengine2_6.dll
2014-07-30 20:45:47 ----A---- C:\Windows\system32\xactengine2_6.dll
2014-07-30 20:45:46 ----A---- C:\Windows\SYSWOW64\xactengine2_5.dll
2014-07-30 20:45:46 ----A---- C:\Windows\SYSWOW64\d3dx9_32.dll
2014-07-30 20:45:46 ----A---- C:\Windows\SYSWOW64\d3dx10.dll
2014-07-30 20:45:46 ----A---- C:\Windows\system32\xactengine2_5.dll
2014-07-30 20:45:46 ----A---- C:\Windows\system32\d3dx9_32.dll
2014-07-30 20:45:46 ----A---- C:\Windows\system32\d3dx10.dll
2014-07-30 20:45:45 ----A---- C:\Windows\SYSWOW64\xactengine2_4.dll
2014-07-30 20:45:45 ----A---- C:\Windows\SYSWOW64\x3daudio1_1.dll
2014-07-30 20:45:45 ----A---- C:\Windows\SYSWOW64\d3dx9_31.dll
2014-07-30 20:45:45 ----A---- C:\Windows\system32\xactengine2_4.dll
2014-07-30 20:45:45 ----A---- C:\Windows\system32\x3daudio1_1.dll
2014-07-30 20:45:45 ----A---- C:\Windows\system32\d3dx9_31.dll
2014-07-30 20:45:44 ----A---- C:\Windows\SYSWOW64\xinput1_2.dll
2014-07-30 20:45:44 ----A---- C:\Windows\SYSWOW64\xactengine2_3.dll
2014-07-30 20:45:44 ----A---- C:\Windows\system32\xinput1_2.dll
2014-07-30 20:45:44 ----A---- C:\Windows\system32\xactengine2_3.dll
2014-07-30 20:45:43 ----A---- C:\Windows\SYSWOW64\xinput1_1.dll
2014-07-30 20:45:43 ----A---- C:\Windows\SYSWOW64\xactengine2_2.dll
2014-07-30 20:45:43 ----A---- C:\Windows\system32\xinput1_1.dll
2014-07-30 20:45:43 ----A---- C:\Windows\system32\xactengine2_2.dll
2014-07-30 20:45:42 ----A---- C:\Windows\SYSWOW64\xactengine2_1.dll
2014-07-30 20:45:42 ----A---- C:\Windows\system32\xactengine2_1.dll
2014-07-30 20:45:33 ----A---- C:\Windows\SYSWOW64\d3dx9_30.dll
2014-07-30 20:45:33 ----A---- C:\Windows\system32\d3dx9_30.dll
2014-07-30 20:45:30 ----A---- C:\Windows\SYSWOW64\xactengine2_0.dll
2014-07-30 20:45:30 ----A---- C:\Windows\SYSWOW64\x3daudio1_0.dll
2014-07-30 20:45:30 ----A---- C:\Windows\SYSWOW64\d3dx9_29.dll
2014-07-30 20:45:30 ----A---- C:\Windows\SYSWOW64\d3dx9_28.dll
2014-07-30 20:45:30 ----A---- C:\Windows\SYSWOW64\d3dx9_27.dll
2014-07-30 20:45:30 ----A---- C:\Windows\system32\xactengine2_0.dll
2014-07-30 20:45:30 ----A---- C:\Windows\system32\x3daudio1_0.dll
2014-07-30 20:45:30 ----A---- C:\Windows\system32\d3dx9_29.dll
2014-07-30 20:45:30 ----A---- C:\Windows\system32\d3dx9_28.dll
2014-07-30 20:45:30 ----A---- C:\Windows\system32\d3dx9_27.dll
2014-07-30 20:45:29 ----A---- C:\Windows\SYSWOW64\d3dx9_26.dll
2014-07-30 20:45:29 ----A---- C:\Windows\SYSWOW64\d3dx9_25.dll
2014-07-30 20:45:29 ----A---- C:\Windows\system32\d3dx9_26.dll
2014-07-30 20:45:29 ----A---- C:\Windows\system32\d3dx9_25.dll
2014-07-30 20:45:28 ----A---- C:\Windows\SYSWOW64\d3dx9_24.dll
2014-07-30 20:45:28 ----A---- C:\Windows\system32\d3dx9_24.dll
2014-07-30 20:36:39 ----D---- C:\Users\Frappy\AppData\Roaming\Adobe
2014-07-30 20:35:45 ----D---- C:\Program Files (x86)\Google
2014-07-30 20:35:39 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2014-07-30 20:35:38 ----D---- C:\Windows\SYSWOW64\Macromed
2014-07-30 20:35:35 ----D---- C:\Windows\system32\Macromed
2014-07-30 20:33:09 ----D---- C:\Users\Frappy\AppData\Roaming\ATI
2014-07-30 20:33:09 ----D---- C:\ProgramData\ATI
2014-07-30 20:26:30 ----D---- C:\Windows\Panther
2014-07-30 20:26:18 ----RASH---- C:\BOOTSECT.BAK
2014-07-30 20:26:15 ----SHD---- C:\Boot
2014-07-30 20:23:53 ----D---- C:\Users\Frappy\AppData\Roaming\library_dir
2014-07-30 20:22:00 ----D---- C:\Users\Frappy\AppData\Roaming\Raptr
2014-07-30 20:22:00 ----D---- C:\Program Files (x86)\Raptr
2014-07-30 20:21:56 ----D---- C:\Program Files (x86)\AMD AVT
2014-07-30 20:20:30 ----D---- C:\ProgramData\AMD
2014-07-30 20:19:35 ----D---- C:\Program Files\AMD
2014-07-30 20:18:48 ----D---- C:\Program Files\Common Files\ATI Technologies
2014-07-30 20:18:31 ----D---- C:\Program Files (x86)\ATI Technologies
2014-07-30 20:18:16 ----D---- C:\ProgramData\Package Cache
2014-07-30 20:16:28 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2014-07-30 20:15:17 ----D---- C:\Program Files (x86)\Microsoft.NET
2014-07-30 20:14:27 ----D---- C:\Program Files\ATI Technologies
2014-07-30 20:14:25 ----D---- C:\Program Files\ATI
2014-07-30 20:13:34 ----D---- C:\AMD
2014-07-30 19:58:12 ----A---- C:\Windows\system32\wups2.dll
2014-07-30 19:58:12 ----A---- C:\Windows\system32\wucltux.dll
2014-07-30 19:58:12 ----A---- C:\Windows\system32\wuaueng.dll
2014-07-30 19:58:12 ----A---- C:\Windows\system32\wuauclt.exe
2014-07-30 19:58:06 ----A---- C:\Windows\system32\wups.dll
2014-07-30 19:58:06 ----A---- C:\Windows\system32\wudriver.dll
2014-07-30 19:58:06 ----A---- C:\Windows\system32\wuapi.dll
2014-07-30 19:57:59 ----A---- C:\Windows\system32\wuwebv.dll
2014-07-30 19:57:59 ----A---- C:\Windows\system32\wuapp.exe
2014-07-30 19:48:43 ----A---- C:\Windows\system32\drivers\volsnap.sys
2014-07-30 19:47:15 ----D---- C:\Program Files (x86)\ASM104xUSB3
2014-07-30 19:46:57 ----SHD---- C:\Windows\Installer
2014-07-30 19:46:40 ----A---- C:\Windows\AsTaskSched.dll
2014-07-30 19:42:55 ----A---- C:\Windows\system32\drivers\Rt64win7.sys
2014-07-30 19:42:54 ----A---- C:\Windows\system32\RTNUninst64.dll
2014-07-30 19:42:54 ----A---- C:\Windows\system32\RtNicProp64.dll
2014-07-30 19:42:50 ----D---- C:\Program Files (x86)\Realtek
2014-07-30 19:42:49 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2014-07-30 19:41:48 ----D---- C:\Windows\AsDmiHtm
2014-07-30 19:41:12 ----A---- C:\Windows\Language_trs.ini
2014-07-30 19:41:07 ----A---- C:\Windows\Ascd_tmp.ini
2014-07-30 19:37:59 ----D---- C:\Users\Frappy\AppData\Roaming\Identities
2014-07-30 19:37:39 ----SD---- C:\Users\Frappy\AppData\Roaming\Microsoft
2014-07-30 19:37:39 ----D---- C:\Users\Frappy\AppData\Roaming\Media Center Programs
2014-07-30 19:37:31 ----SHD---- C:\Recovery
2014-07-30 19:37:31 ----SHD---- C:\ProgramData\Šablony
2014-07-30 19:37:31 ----SHD---- C:\ProgramData\Plocha
2014-07-30 19:37:31 ----SHD---- C:\ProgramData\Oblíbené položky
2014-07-30 19:37:31 ----SHD---- C:\ProgramData\Nabídka Start
2014-07-30 19:37:31 ----SHD---- C:\ProgramData\Dokumenty
2014-07-30 19:37:31 ----SHD---- C:\ProgramData\Data aplikací
2014-07-30 19:30:20 ----D---- C:\Windows\SoftwareDistribution
2014-07-30 19:28:04 ----D---- C:\Windows\Prefetch
2014-07-30 19:27:03 ----ASH---- C:\pagefile.sys
2014-07-30 19:27:02 ----SHD---- C:\System Volume Information
2014-07-30 19:27:02 ----ASH---- C:\hiberfil.sys
======List of files/folders modified in the last 1 months======
2014-08-06 22:47:18 ----D---- C:\Windows\Temp
2014-08-06 22:47:17 ----RD---- C:\Program Files
2014-08-06 22:45:10 ----D---- C:\Windows\System32
2014-08-06 22:45:10 ----D---- C:\Windows\inf
2014-08-06 22:45:10 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-08-06 22:41:31 ----D---- C:\Windows
2014-08-06 22:40:51 ----D---- C:\Windows\system32\drivers
2014-08-06 22:36:20 ----D---- C:\Windows\system32\Tasks
2014-08-06 22:23:30 ----HD---- C:\ProgramData
2014-08-06 22:22:10 ----D---- C:\Windows\Logs
2014-08-06 22:22:10 ----D---- C:\Windows\debug
2014-08-06 21:41:19 ----D---- C:\Windows\system32\wdi
2014-08-06 21:38:44 ----D---- C:\Windows\IME
2014-08-06 21:38:39 ----D---- C:\Windows\security
2014-08-05 21:44:27 ----D---- C:\Windows\system32\catroot
2014-08-05 21:44:26 ----D---- C:\Windows\system32\DriverStore
2014-08-05 21:44:17 ----RD---- C:\Program Files (x86)
2014-08-05 21:44:17 ----D---- C:\Windows\twain_32
2014-08-05 21:39:33 ----D---- C:\Windows\system32\config
2014-08-02 19:55:59 ----D---- C:\Windows\Tasks
2014-08-02 19:55:51 ----SD---- C:\ProgramData\Microsoft
2014-08-02 19:27:05 ----D---- C:\Windows\system32\drivers\UMDF
2014-08-02 11:58:27 ----D---- C:\Program Files (x86)\Common Files
2014-08-02 10:44:25 ----RSD---- C:\Windows\Fonts
2014-07-31 21:24:31 ----D---- C:\Windows\system32\drivers\etc
2014-07-31 21:07:19 ----D---- C:\Program Files\Common Files
2014-07-31 21:06:10 ----D---- C:\Windows\winsxs
2014-07-31 21:05:00 ----D---- C:\Windows\SysWOW64
2014-07-31 00:51:53 ----D---- C:\Windows\rescache
2014-07-31 00:22:36 ----D---- C:\Windows\Microsoft.NET
2014-07-30 20:50:25 ----D---- C:\Windows\system32\catroot2
2014-07-30 20:45:42 ----RSD---- C:\Windows\assembly
2014-07-30 20:26:20 ----D---- C:\Windows\system32\cs-CZ
2014-07-30 20:18:04 ----D---- C:\Program Files\Common Files\Microsoft Shared
2014-07-30 20:15:18 ----D---- C:\Windows\SYSWOW64\en-US
2014-07-30 20:15:18 ----D---- C:\Windows\system32\en-US
2014-07-30 19:53:19 ----D---- C:\Windows\system32\LogFiles
2014-07-30 19:42:40 ----D---- C:\Windows\system32\restore
2014-07-30 19:41:53 ----D---- C:\Windows\system32\CodeIntegrity
2014-07-30 19:41:03 ----D---- C:\Windows\SYSWOW64\drivers
2014-07-30 19:37:52 ----SHD---- C:\$Recycle.Bin
2014-07-30 19:37:39 ----RD---- C:\Users
2014-07-30 19:37:31 ----D---- C:\Program Files\Windows NT
2014-07-30 19:30:26 ----D---- C:\Windows\system32\sysprep
2014-07-23 10:52:00 ----N---- C:\Windows\system32\MpSigStub.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R0 12553943;12553943; C:\Windows\system32\DRIVERS\12553943.sys [2014-08-06 458336]
R0 dlkmdldr;dlkmdldr; C:\Windows\system32\drivers\dlkmdldr.sys [2013-10-07 15664]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R2 AODDriver4.3;AODDriver4.3; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2014-02-11 59616]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2014-04-18 15376384]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2014-04-18 638976]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2012-08-20 138568]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2012-08-20 416072]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2013-12-19 94720]
R3 DisplayLinkUsbIo_x64;DisplayLinkUsbIo_x64; C:\Windows\system32\DRIVERS\DisplayLinkUsbIo_x64_7.4.48800.0.sys [2014-07-30 44944]
R3 dlkmd;dlkmd; C:\Windows\system32\drivers\dlkmd.sys [2013-10-07 388912]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2012-08-21 33240]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2014-05-12 25816]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2014-08-06 122584]
R3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2014-05-12 63704]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2012-06-12 726160]
S3 ESETOlmarikOlmascoCleaner;ESET Olmarik/Olmasco Cleaner; \??\C:\Windows\system32\Drivers\ESETOlmarikOlmascoCleaner.sys [2014-08-02 157384]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2014-04-18 239616]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2014-04-17 344064]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2014-06-12 43336]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]
R2 DisplayLinkService;DisplayLinkManager; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [2013-10-07 9281840]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2014-05-12 860472]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-05-12 1809720]
R2 SDScannerService;Spybot-S&D 2 Scanner Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-06-24 1738168]
R2 SDUpdateService;Spybot-S&D 2 Updating Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2014-06-27 2088408]
R2 SDWSCService;Spybot-S&D 2 Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2014-04-25 171928]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-07-09 104912]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-07-08 123856]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-06 158120]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-30 262320]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-06 158120]
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2014-07-08 641352]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-08-06 625856]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2012-07-08 51648]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2012-07-09 139696]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2012-07-09 139696]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2012-07-09 139696]
-----------------EOF-----------------
HElp me Neshta virus
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
-
ceddrik
- Návštěvník
- Příspěvky: 68
- Registrován: 06 Zář 2007 18:13
- Místo/Bydliště: Ostrava
- Kontaktovat uživatele:
HElp me Neshta virus
Naposledy upravil(a) cernohous13 dne 07 Srp 2014 06:01, celkem upraveno 1 x.
Důvod: Nedávej logy do [code]
Důvod: Nedávej logy do [code]
Re: HElp me Neshta virus
Zdravim 
Odinstalujte Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam
Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Odinstalujte Spybot - Search & Destroy - program ma uz nejlepsi leta davno za sebou a posledni cca 3 roky neni schopen celit aktualnim hrozbam Stahnete RKill http://download.bleepingcomputer.com/grinler/rkill.com
- Pokud ho havet blokuje, pouzijte jeden z nasledujicich - i ty prejmenovane
Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe
Rkill iExplore.exe:
http://download.bleepingcomputer.com/gr ... xplore.exe
Rkill uSeRiNiT.exe:
http://download.bleepingcomputer.com/gr ... eRiNiT.exe
Rkill WiNlOgOn.exe:
http://download.bleepingcomputer.com/gr ... NlOgOn.exe - Ulozte nejlepena plochu a ukoncete vsechny aplikace (jinak to udela RKill za Vas)
- Spustte tradicne dvojklikem - program probehne do par sekund a ukonci i svou cinnost
- RKill ukonci vsechny ne-systemove procesy - tedy i procesy, pod kterymi bezi havet
- Na plose vznikne log Rkill.txt ten mi sem vlozte
- Ted nerestartujte PC - prisli byste o ucinek RKillu
Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
- Pokud mate Win XP spustte pod uctem Spravce\Administratora
- Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
- Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
- Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
- Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
- Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
- Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
- Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen
od 1. února 2011.
Člen
od 1. února 2011.-
ceddrik
- Návštěvník
- Příspěvky: 68
- Registrován: 06 Zář 2007 18:13
- Místo/Bydliště: Ostrava
- Kontaktovat uživatele:
Re: HElp me Neshta virus
LOG RKILL
Rkill 2.6.7 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 08/07/2014 11:28:55 AM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
* HKLM\Software\Classes\exefile\shell\open\command "@" was changed. It was reset to "%1" %*!
* HKLM\Software\Classes\exefile\shell\open\command\\IsolatedCommand was changed. It was reset to "%1" %*!
Performing miscellaneous checks:
* No issues found.
Checking Windows Service Integrity:
* No issues found.
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* HOSTS file entries found:
127.0.0.1 localhost
127.0.0.1 activate.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
::1 localhost
Program finished at: 08/07/2014 11:29:31 AM
Execution time: 0 hours(s), 0 minute(s), and 36 seconds(s)
LOG COMBOFIX
ComboFix 14-08-06.02 - Frappy 07.08.2014 11:34:02.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8144.6846 [GMT 2:00]
Spuštěný z: c:\users\Frappy\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\directx.sys
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-07-07 do 2014-08-07 )))))))))))))))))))))))))))))))
.
.
2014-08-07 09:39 . 2014-08-07 09:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-08-06 21:22 . 2014-08-06 20:24 458336 ----a-w- c:\windows\system32\drivers\11807390.sys
2014-08-06 20:47 . 2014-08-06 20:47 -------- d-----w- c:\program files\trend micro
2014-08-06 20:47 . 2014-08-06 20:47 -------- d-----w- C:\rsit
2014-08-06 20:23 . 2014-08-06 20:23 -------- d-----w- c:\programdata\Kaspersky Lab
2014-08-06 20:23 . 2014-08-06 20:24 458336 ----a-w- c:\windows\system32\drivers\12553943.sys
2014-08-06 20:21 . 2014-08-06 20:21 -------- d-----w- c:\program files\CCleaner
2014-08-06 06:45 . 2014-07-14 02:12 10924376 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{94B2FACC-34A5-423B-83FD-98CA78D2AAE2}\mpengine.dll
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\program files (x86)\HP
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\programdata\HP
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\program files\HP
2014-08-05 19:34 . 2014-08-07 09:31 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 19:34 . 2014-08-05 19:34 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-08-05 19:34 . 2014-08-05 19:34 -------- d-----w- c:\programdata\Malwarebytes
2014-08-05 19:34 . 2014-05-12 05:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-08-05 19:34 . 2014-05-12 05:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-05 19:34 . 2014-05-12 05:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-08-02 17:55 . 2014-08-07 09:29 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-08-02 17:55 . 2014-08-07 09:30 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2014-08-02 17:54 . 2014-08-02 17:54 157384 ----a-w- c:\windows\system32\drivers\ESETOlmarikOlmascoCleaner.sys
2014-08-02 09:58 . 2014-08-02 09:58 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2014-08-02 09:26 . 2014-08-02 09:26 -------- d-----w- c:\programdata\Battle.net
2014-07-31 19:09 . 2014-07-31 19:21 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2014-07-31 19:07 . 2014-07-31 19:08 -------- d-----w- c:\program files\Common Files\Adobe
2014-07-31 19:06 . 2014-07-31 19:06 -------- d-----w- c:\program files (x86)\Adobe Media Player
2014-07-31 19:04 . 2014-07-31 19:04 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2014-07-31 19:02 . 2014-07-31 19:07 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2014-07-31 03:55 . 2014-07-31 03:55 -------- dc----w- c:\windows\system32\DRVSTORE
2014-07-31 03:55 . 2012-08-21 11:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\program files\iPod
2014-07-31 03:55 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\iTunes
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\program files\iTunes
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\programdata\Apple Computer
2014-07-31 03:53 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\Apple Software Update
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\program files\Common Files\Apple
2014-07-31 03:53 . 2014-08-05 20:59 -------- d-----w- c:\program files (x86)\Bonjour
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\program files\Bonjour
2014-07-31 03:53 . 2014-07-31 03:55 -------- d-----w- c:\program files (x86)\Common Files\Apple
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\programdata\Apple
2014-07-30 21:05 . 2013-10-07 10:45 388912 ----a-w- c:\windows\system32\drivers\dlkmd.sys
2014-07-30 21:05 . 2013-10-07 10:45 15664 ----a-w- c:\windows\system32\drivers\dlkmdldr.sys
2014-07-30 21:04 . 2014-07-30 21:04 -------- d-----w- c:\program files\DisplayLink Graphics
2014-07-30 21:02 . 2014-07-30 21:03 -------- d-----w- c:\program files\DisplayLink Core Software
2014-07-30 21:02 . 2014-07-30 21:02 734208 ----a-w- c:\windows\system32\DisplayLinkUsbCo64_7.4.48800.0.dll
2014-07-30 21:02 . 2014-07-30 21:02 44944 ----a-w- c:\windows\system32\drivers\DisplayLinkUsbIo_x64_7.4.48800.0.sys
2014-07-30 20:58 . 2014-07-30 20:58 -------- d-----w- c:\programdata\WarThunder
2014-07-30 18:45 . 2008-03-05 14:03 238088 ----a-w- c:\windows\SysWow64\xactengine3_0.dll
2014-07-30 18:44 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\Common Files\Steam
2014-07-30 18:35 . 2014-07-30 18:36 -------- d-----w- c:\program files (x86)\Google
2014-07-30 18:35 . 2014-07-30 18:35 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-30 18:35 . 2014-07-30 18:35 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-30 18:35 . 2014-07-30 18:35 -------- d-----w- c:\windows\SysWow64\Macromed
2014-07-30 18:35 . 2014-07-30 18:35 -------- d-----w- c:\windows\system32\Macromed
2014-07-30 18:33 . 2014-07-30 18:33 -------- d-----w- c:\programdata\ATI
2014-07-30 18:27 . 2014-07-30 18:27 0 ----a-w- c:\windows\ativpsrm.bin
2014-07-30 18:26 . 2014-08-06 20:22 -------- d-----w- c:\windows\Panther
2014-07-30 18:26 . 2014-07-30 18:26 -------- d-----w- C:\Boot
2014-07-30 18:22 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\Raptr
2014-07-30 18:21 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\AMD AVT
2014-07-30 18:21 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies
2014-07-30 18:20 . 2014-07-30 18:21 -------- d-----w- c:\programdata\AMD
2014-07-30 18:19 . 2014-07-30 18:19 -------- d-----w- c:\program files\AMD
2014-07-30 18:18 . 2014-07-30 18:18 -------- d-----w- c:\program files\Common Files\ATI Technologies
2014-07-30 18:18 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\ATI Technologies
2014-07-30 18:18 . 2014-07-30 18:18 -------- d-----w- c:\programdata\Package Cache
2014-07-30 18:15 . 2014-07-30 18:15 -------- d-----w- c:\program files (x86)\Microsoft.NET
2014-07-30 18:14 . 2014-07-30 18:21 -------- d-----w- c:\program files\ATI Technologies
2014-07-30 18:14 . 2014-07-30 18:14 -------- d-----w- c:\program files\ATI
2014-07-30 18:13 . 2014-07-30 18:13 -------- d-----w- C:\AMD
2014-07-30 17:58 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2014-07-30 17:58 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2014-07-30 17:58 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2014-07-30 17:58 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2014-07-30 17:58 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2014-07-30 17:58 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2014-07-30 17:58 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2014-07-30 17:57 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2014-07-30 17:57 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2014-07-30 17:48 . 2011-02-25 06:25 296320 ----a-w- c:\windows\system32\drivers\volsnap.sys
2014-07-30 17:47 . 2014-07-30 17:47 -------- d-----w- c:\program files (x86)\ASM104xUSB3
2014-07-30 17:46 . 2014-08-05 19:44 -------- d-sh--w- c:\windows\Installer
2014-07-30 17:46 . 2014-07-30 17:46 16896 ----a-w- c:\windows\AsTaskSched.dll
2014-07-30 17:42 . 2012-06-12 14:00 726160 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2014-07-30 17:42 . 2012-06-12 14:00 74344 ----a-w- c:\windows\system32\RtNicProp64.dll
2014-07-30 17:42 . 2012-06-12 14:00 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2014-07-30 17:42 . 2014-07-30 17:42 -------- d-----w- c:\program files (x86)\Realtek
2014-07-30 17:42 . 2014-07-30 17:42 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2014-07-30 17:41 . 2014-07-30 17:41 -------- d-----w- c:\windows\AsDmiHtm
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-23 08:52 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Raptr"="c:\progra~2\Raptr\raptrstub.exe" [2014-08-06 55360]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2014-08-06 1967616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2014-08-06 767200]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-08-06 193864]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2014-08-06 406992]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2014-08-06 49208]
.
c:\users\Frappy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 1050 J410 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN1CQ11GDW05QT;CONNECTION=USB;MONITOR=1; [2009-7-14 45568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ESETOlmarikOlmascoCleaner]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ESETOlmarikOlmascoCleaner.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R3 ESETOlmarikOlmascoCleaner;ESET Olmarik/Olmasco Cleaner;c:\windows\system32\Drivers\ESETOlmarikOlmascoCleaner.sys;c:\windows\SYSNATIVE\Drivers\ESETOlmarikOlmascoCleaner.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 11807390;11807390;c:\windows\system32\DRIVERS\11807390.sys;c:\windows\SYSNATIVE\DRIVERS\11807390.sys [x]
S0 12553943;12553943;c:\windows\system32\DRIVERS\12553943.sys;c:\windows\SYSNATIVE\DRIVERS\12553943.sys [x]
S0 dlkmdldr;dlkmdldr;c:\windows\system32\drivers\dlkmdldr.sys;c:\windows\SYSNATIVE\drivers\dlkmdldr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.3;AODDriver4.3;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 DisplayLinkService;DisplayLinkManager;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 DisplayLinkUsbIo_x64;DisplayLinkUsbIo_x64;c:\windows\system32\DRIVERS\DisplayLinkUsbIo_x64_7.4.48800.0.sys;c:\windows\SYSNATIVE\DRIVERS\DisplayLinkUsbIo_x64_7.4.48800.0.sys [x]
S3 dlkmd;dlkmd;c:\windows\system32\drivers\dlkmd.sys;c:\windows\SYSNATIVE\drivers\dlkmd.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-08-06 21:37 1145672 ----a-w- c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-08-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-30 18:35]
.
2014-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-07-30 21:36]
.
2014-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-07-30 21:36]
.
.
--------- X64 Entries -----------
.
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Spustit klienta k monitoru &1 - c:\windows\web\AOpenClient.htm
IE: Spustit klienta k monitoru &2 - c:\windows\web\AOpenClient.htm
TCP: Interfaces\{DD2930F7-ECC2-4B82-B5A1-56F8C1DDFF2F}: NameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
c:\users\Frappy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_.lnk - c:\users\Frappy\AppData\Local\Temp\_uninst_.bat
c:\users\Frappy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_11807390.lnk - c:\users\Frappy\AppData\Local\Temp\_uninst_11807390.bat
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-08-07 11:40:30
ComboFix-quarantined-files.txt 2014-08-07 09:40
.
Před spuštěním: Volných bajtů: 43 882 762 240
Po spuštění: Volných bajtů: 44 501 135 360
.
- - End Of File - - A3B8D4C9C50A1673216D9FD95ED50192
A36C5E4F47E84449FF07ED3517B43A31
Rkill 2.6.7 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 08/07/2014 11:28:55 AM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
* HKLM\Software\Classes\exefile\shell\open\command "@" was changed. It was reset to "%1" %*!
* HKLM\Software\Classes\exefile\shell\open\command\\IsolatedCommand was changed. It was reset to "%1" %*!
Performing miscellaneous checks:
* No issues found.
Checking Windows Service Integrity:
* No issues found.
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* HOSTS file entries found:
127.0.0.1 localhost
127.0.0.1 activate.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
::1 localhost
Program finished at: 08/07/2014 11:29:31 AM
Execution time: 0 hours(s), 0 minute(s), and 36 seconds(s)
LOG COMBOFIX
ComboFix 14-08-06.02 - Frappy 07.08.2014 11:34:02.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8144.6846 [GMT 2:00]
Spuštěný z: c:\users\Frappy\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\directx.sys
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-07-07 do 2014-08-07 )))))))))))))))))))))))))))))))
.
.
2014-08-07 09:39 . 2014-08-07 09:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-08-06 21:22 . 2014-08-06 20:24 458336 ----a-w- c:\windows\system32\drivers\11807390.sys
2014-08-06 20:47 . 2014-08-06 20:47 -------- d-----w- c:\program files\trend micro
2014-08-06 20:47 . 2014-08-06 20:47 -------- d-----w- C:\rsit
2014-08-06 20:23 . 2014-08-06 20:23 -------- d-----w- c:\programdata\Kaspersky Lab
2014-08-06 20:23 . 2014-08-06 20:24 458336 ----a-w- c:\windows\system32\drivers\12553943.sys
2014-08-06 20:21 . 2014-08-06 20:21 -------- d-----w- c:\program files\CCleaner
2014-08-06 06:45 . 2014-07-14 02:12 10924376 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{94B2FACC-34A5-423B-83FD-98CA78D2AAE2}\mpengine.dll
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\program files (x86)\HP
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\programdata\HP
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\program files\HP
2014-08-05 19:34 . 2014-08-07 09:31 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 19:34 . 2014-08-05 19:34 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-08-05 19:34 . 2014-08-05 19:34 -------- d-----w- c:\programdata\Malwarebytes
2014-08-05 19:34 . 2014-05-12 05:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-08-05 19:34 . 2014-05-12 05:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-05 19:34 . 2014-05-12 05:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-08-02 17:55 . 2014-08-07 09:29 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-08-02 17:55 . 2014-08-07 09:30 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2014-08-02 17:54 . 2014-08-02 17:54 157384 ----a-w- c:\windows\system32\drivers\ESETOlmarikOlmascoCleaner.sys
2014-08-02 09:58 . 2014-08-02 09:58 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2014-08-02 09:26 . 2014-08-02 09:26 -------- d-----w- c:\programdata\Battle.net
2014-07-31 19:09 . 2014-07-31 19:21 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2014-07-31 19:07 . 2014-07-31 19:08 -------- d-----w- c:\program files\Common Files\Adobe
2014-07-31 19:06 . 2014-07-31 19:06 -------- d-----w- c:\program files (x86)\Adobe Media Player
2014-07-31 19:04 . 2014-07-31 19:04 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2014-07-31 19:02 . 2014-07-31 19:07 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2014-07-31 03:55 . 2014-07-31 03:55 -------- dc----w- c:\windows\system32\DRVSTORE
2014-07-31 03:55 . 2012-08-21 11:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\program files\iPod
2014-07-31 03:55 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\iTunes
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\program files\iTunes
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\programdata\Apple Computer
2014-07-31 03:53 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\Apple Software Update
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\program files\Common Files\Apple
2014-07-31 03:53 . 2014-08-05 20:59 -------- d-----w- c:\program files (x86)\Bonjour
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\program files\Bonjour
2014-07-31 03:53 . 2014-07-31 03:55 -------- d-----w- c:\program files (x86)\Common Files\Apple
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\programdata\Apple
2014-07-30 21:05 . 2013-10-07 10:45 388912 ----a-w- c:\windows\system32\drivers\dlkmd.sys
2014-07-30 21:05 . 2013-10-07 10:45 15664 ----a-w- c:\windows\system32\drivers\dlkmdldr.sys
2014-07-30 21:04 . 2014-07-30 21:04 -------- d-----w- c:\program files\DisplayLink Graphics
2014-07-30 21:02 . 2014-07-30 21:03 -------- d-----w- c:\program files\DisplayLink Core Software
2014-07-30 21:02 . 2014-07-30 21:02 734208 ----a-w- c:\windows\system32\DisplayLinkUsbCo64_7.4.48800.0.dll
2014-07-30 21:02 . 2014-07-30 21:02 44944 ----a-w- c:\windows\system32\drivers\DisplayLinkUsbIo_x64_7.4.48800.0.sys
2014-07-30 20:58 . 2014-07-30 20:58 -------- d-----w- c:\programdata\WarThunder
2014-07-30 18:45 . 2008-03-05 14:03 238088 ----a-w- c:\windows\SysWow64\xactengine3_0.dll
2014-07-30 18:44 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\Common Files\Steam
2014-07-30 18:35 . 2014-07-30 18:36 -------- d-----w- c:\program files (x86)\Google
2014-07-30 18:35 . 2014-07-30 18:35 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-30 18:35 . 2014-07-30 18:35 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-30 18:35 . 2014-07-30 18:35 -------- d-----w- c:\windows\SysWow64\Macromed
2014-07-30 18:35 . 2014-07-30 18:35 -------- d-----w- c:\windows\system32\Macromed
2014-07-30 18:33 . 2014-07-30 18:33 -------- d-----w- c:\programdata\ATI
2014-07-30 18:27 . 2014-07-30 18:27 0 ----a-w- c:\windows\ativpsrm.bin
2014-07-30 18:26 . 2014-08-06 20:22 -------- d-----w- c:\windows\Panther
2014-07-30 18:26 . 2014-07-30 18:26 -------- d-----w- C:\Boot
2014-07-30 18:22 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\Raptr
2014-07-30 18:21 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\AMD AVT
2014-07-30 18:21 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies
2014-07-30 18:20 . 2014-07-30 18:21 -------- d-----w- c:\programdata\AMD
2014-07-30 18:19 . 2014-07-30 18:19 -------- d-----w- c:\program files\AMD
2014-07-30 18:18 . 2014-07-30 18:18 -------- d-----w- c:\program files\Common Files\ATI Technologies
2014-07-30 18:18 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\ATI Technologies
2014-07-30 18:18 . 2014-07-30 18:18 -------- d-----w- c:\programdata\Package Cache
2014-07-30 18:15 . 2014-07-30 18:15 -------- d-----w- c:\program files (x86)\Microsoft.NET
2014-07-30 18:14 . 2014-07-30 18:21 -------- d-----w- c:\program files\ATI Technologies
2014-07-30 18:14 . 2014-07-30 18:14 -------- d-----w- c:\program files\ATI
2014-07-30 18:13 . 2014-07-30 18:13 -------- d-----w- C:\AMD
2014-07-30 17:58 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2014-07-30 17:58 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2014-07-30 17:58 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2014-07-30 17:58 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2014-07-30 17:58 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2014-07-30 17:58 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2014-07-30 17:58 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2014-07-30 17:57 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2014-07-30 17:57 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2014-07-30 17:48 . 2011-02-25 06:25 296320 ----a-w- c:\windows\system32\drivers\volsnap.sys
2014-07-30 17:47 . 2014-07-30 17:47 -------- d-----w- c:\program files (x86)\ASM104xUSB3
2014-07-30 17:46 . 2014-08-05 19:44 -------- d-sh--w- c:\windows\Installer
2014-07-30 17:46 . 2014-07-30 17:46 16896 ----a-w- c:\windows\AsTaskSched.dll
2014-07-30 17:42 . 2012-06-12 14:00 726160 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2014-07-30 17:42 . 2012-06-12 14:00 74344 ----a-w- c:\windows\system32\RtNicProp64.dll
2014-07-30 17:42 . 2012-06-12 14:00 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2014-07-30 17:42 . 2014-07-30 17:42 -------- d-----w- c:\program files (x86)\Realtek
2014-07-30 17:42 . 2014-07-30 17:42 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2014-07-30 17:41 . 2014-07-30 17:41 -------- d-----w- c:\windows\AsDmiHtm
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-23 08:52 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Raptr"="c:\progra~2\Raptr\raptrstub.exe" [2014-08-06 55360]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2014-08-06 1967616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2014-08-06 767200]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-08-06 193864]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2014-08-06 406992]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2014-08-06 49208]
.
c:\users\Frappy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 1050 J410 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN1CQ11GDW05QT;CONNECTION=USB;MONITOR=1; [2009-7-14 45568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ESETOlmarikOlmascoCleaner]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ESETOlmarikOlmascoCleaner.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R3 ESETOlmarikOlmascoCleaner;ESET Olmarik/Olmasco Cleaner;c:\windows\system32\Drivers\ESETOlmarikOlmascoCleaner.sys;c:\windows\SYSNATIVE\Drivers\ESETOlmarikOlmascoCleaner.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 11807390;11807390;c:\windows\system32\DRIVERS\11807390.sys;c:\windows\SYSNATIVE\DRIVERS\11807390.sys [x]
S0 12553943;12553943;c:\windows\system32\DRIVERS\12553943.sys;c:\windows\SYSNATIVE\DRIVERS\12553943.sys [x]
S0 dlkmdldr;dlkmdldr;c:\windows\system32\drivers\dlkmdldr.sys;c:\windows\SYSNATIVE\drivers\dlkmdldr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.3;AODDriver4.3;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 DisplayLinkService;DisplayLinkManager;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 DisplayLinkUsbIo_x64;DisplayLinkUsbIo_x64;c:\windows\system32\DRIVERS\DisplayLinkUsbIo_x64_7.4.48800.0.sys;c:\windows\SYSNATIVE\DRIVERS\DisplayLinkUsbIo_x64_7.4.48800.0.sys [x]
S3 dlkmd;dlkmd;c:\windows\system32\drivers\dlkmd.sys;c:\windows\SYSNATIVE\drivers\dlkmd.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-08-06 21:37 1145672 ----a-w- c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-08-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-30 18:35]
.
2014-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-07-30 21:36]
.
2014-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-07-30 21:36]
.
.
--------- X64 Entries -----------
.
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Spustit klienta k monitoru &1 - c:\windows\web\AOpenClient.htm
IE: Spustit klienta k monitoru &2 - c:\windows\web\AOpenClient.htm
TCP: Interfaces\{DD2930F7-ECC2-4B82-B5A1-56F8C1DDFF2F}: NameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
c:\users\Frappy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_.lnk - c:\users\Frappy\AppData\Local\Temp\_uninst_.bat
c:\users\Frappy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_11807390.lnk - c:\users\Frappy\AppData\Local\Temp\_uninst_11807390.bat
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-08-07 11:40:30
ComboFix-quarantined-files.txt 2014-08-07 09:40
.
Před spuštěním: Volných bajtů: 43 882 762 240
Po spuštění: Volných bajtů: 44 501 135 360
.
- - End Of File - - A3B8D4C9C50A1673216D9FD95ED50192
A36C5E4F47E84449FF07ED3517B43A31
Naposledy upravil(a) vyosek dne 07 Srp 2014 11:05, celkem upraveno 1 x.
Důvod: log odstranen z code
Důvod: log odstranen z code
Re: HElp me Neshta virus
Nedavete logy do code Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
- Ulozte nejlepe na plochu
- Ukoncete vsechny programy
- Kliknete na Scan a nasledne Clean
- Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.-
ceddrik
- Návštěvník
- Příspěvky: 68
- Registrován: 06 Zář 2007 18:13
- Místo/Bydliště: Ostrava
- Kontaktovat uživatele:
Re: HElp me Neshta virus
Dobry den , daný krok provedu po přichodu z prace což bude cirka v 21:30 a omlouvam se do code už vkladat nebudu v tuto chvili počítač po rkill a combofix začina konečně reagovat pomalu jak ma pánové vy nikdy nesklamete
v tuto chvili počítač po rkill a combofix začina konečně reagovat pomalu jak ma pánové vy nikdy nesklameteRe: HElp me Neshta virus
Ou Kej, vecer tu budu
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.-
ceddrik
- Návštěvník
- Příspěvky: 68
- Registrován: 06 Zář 2007 18:13
- Místo/Bydliště: Ostrava
- Kontaktovat uživatele:
Re: HElp me Neshta virus
# AdwCleaner v3.303 - Report created 07/08/2014 at 21:36:08
# Updated 06/08/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Frappy - FRAPPY-PC
# Running from : C:\Users\Frappy\Desktop\adwcleaner_3.303.exe
# Option : Scan
***** [ Services ] *****
***** [ Files / Folders ] *****
***** [ Scheduled Tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
***** [ Browsers ] *****
-\\ Internet Explorer v8.0.7601.17514
-\\ Google Chrome v36.0.1985.125
[ File : C:\Users\Frappy\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [807 octets] - [07/08/2014 21:32:23]
AdwCleaner[R1].txt - [728 octets] - [07/08/2014 21:36:08]
AdwCleaner[S0].txt - [639 octets] - [07/08/2014 21:34:32]
########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [846 octets] ##########
# Updated 06/08/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Frappy - FRAPPY-PC
# Running from : C:\Users\Frappy\Desktop\adwcleaner_3.303.exe
# Option : Scan
***** [ Services ] *****
***** [ Files / Folders ] *****
***** [ Scheduled Tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
***** [ Browsers ] *****
-\\ Internet Explorer v8.0.7601.17514
-\\ Google Chrome v36.0.1985.125
[ File : C:\Users\Frappy\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [807 octets] - [07/08/2014 21:32:23]
AdwCleaner[R1].txt - [728 octets] - [07/08/2014 21:36:08]
AdwCleaner[S0].txt - [639 octets] - [07/08/2014 21:34:32]
########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [846 octets] ##########
-
ceddrik
- Návštěvník
- Příspěvky: 68
- Registrován: 06 Zář 2007 18:13
- Místo/Bydliště: Ostrava
- Kontaktovat uživatele:
Re: HElp me Neshta virus
Dáno scan následně clean po chvíli program přestal pracovat vyplivl tento log a zmizel:-D sám od sebe se vypnul / spaadl 
-
ceddrik
- Návštěvník
- Příspěvky: 68
- Registrován: 06 Zář 2007 18:13
- Místo/Bydliště: Ostrava
- Kontaktovat uživatele:
Re: HElp me Neshta virus
Ale PC už se chová líp po vašich programech už fungují exe soubory a nevyskakuje svchvost zatím
Re: HElp me Neshta virus
Pokud nemate, tak presunte Combofix na plochu
- Spustte poznamkovy blok (Start-spustit-notepad)
- Zkopirujte skript nize
Kód: Vybrat vše
KillAll:: Folder:: c:\programdata\Spybot - Search & Destroy c:\program files (x86)\Spybot - Search & Destroy 2 File:: c:\windows\system32\Drivers\ESETOlmarikOlmascoCleaner.sys c:\windows\system32\DRIVERS\11807390.sys c:\windows\system32\DRIVERS\12553943.sys Driver:: 11807390 12553943 ESETOlmarikOlmascoCleaner Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "iTunesHelper"=- "AdobeCS5ServiceManager"=- "HP Software Update"=- [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ESETOlmarikOlmascoCleaner] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ESETOlmarikOlmascoCleaner.sys] DDS:: c:\windows\Tasks\Adobe Flash Player Updater.job c:\windows\Tasks\GoogleUpdateTaskMachineCore.job c:\windows\Tasks\GoogleUpdateTaskMachineUA.job RegLock:: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] ClearJavaCache:: Reboot::- Ulozte vytvoreny TXT jako CFScript.txt
- Pretahnete vytvoreny CFScript.txt nad Combofix a pustte (viz obrazek nize)
- Po aplikaci skriptu (a pripadnem restartu) na Vas vypadne log, jeho obsah sem vlozte
Pokud vyskoci hlaska "Pokus pouzit neplatnou operaci na klic registru, ktery je oznacen pro odstraneni", tak jen restartujte PC - registr se da do kupy - jedna se o vnitrni chybu, kterou zpusobuje CF a autor ji zatim neumi bohuzel opravit Muze se stat, ze po aplikaci skriptu nenabehnou windows, v tomto pripade restartuje PC a mackejte F8 a zvolte Posledni znamou konfiguraci"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.-
ceddrik
- Návštěvník
- Příspěvky: 68
- Registrován: 06 Zář 2007 18:13
- Místo/Bydliště: Ostrava
- Kontaktovat uživatele:
Re: HElp me Neshta virus
ComboFix 14-08-06.02 - Frappy 08.08.2014 8:57.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8144.6452 [GMT 2:00]
Spuštěný z: c:\users\Frappy\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Frappy\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\system32\DRIVERS\11807390.sys"
"c:\windows\system32\DRIVERS\12553943.sys"
"c:\windows\system32\Drivers\ESETOlmarikOlmascoCleaner.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Spybot - Search & Destroy 2
c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe.log
c:\program files (x86)\Spybot - Search & Destroy 2\spybotsd2-install-bdcore-update.exe
c:\programdata\Spybot - Search & Destroy
c:\programdata\Spybot - Search & Destroy\Cleaning\140802-195937.xml
c:\programdata\Spybot - Search & Destroy\ClientCount.bin
c:\programdata\Spybot - Search & Destroy\Logs\140802-195937.xml.cleaning.log
c:\programdata\Spybot - Search & Destroy\Logs\Cleaner.log
c:\programdata\Spybot - Search & Destroy\Logs\Firewall.log
c:\programdata\Spybot - Search & Destroy\Logs\Checks.140802-1959.txt
c:\programdata\Spybot - Search & Destroy\Logs\Checks.140802-2028.txt
c:\programdata\Spybot - Search & Destroy\Logs\Scanner.log
c:\programdata\Spybot - Search & Destroy\Logs\Updates.log
c:\windows\system32\DRIVERS\11807390.sys
c:\windows\system32\DRIVERS\12553943.sys
c:\windows\system32\Drivers\ESETOlmarikOlmascoCleaner.sys
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_11807390
-------\Legacy_12553943
-------\Legacy_ESETOLMARIKOLMASCOCLEANER
-------\Service_11807390
-------\Service_12553943
-------\Service_ESETOlmarikOlmascoCleaner
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-07-08 do 2014-08-08 )))))))))))))))))))))))))))))))
.
.
2014-08-08 07:03 . 2014-08-08 07:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-08-07 19:32 . 2014-08-07 19:36 -------- d-----w- C:\AdwCleaner
2014-08-06 20:47 . 2014-08-06 20:47 -------- d-----w- c:\program files\trend micro
2014-08-06 20:47 . 2014-08-06 20:47 -------- d-----w- C:\rsit
2014-08-06 20:23 . 2014-08-06 20:23 -------- d-----w- c:\programdata\Kaspersky Lab
2014-08-06 20:21 . 2014-08-06 20:21 -------- d-----w- c:\program files\CCleaner
2014-08-06 06:45 . 2014-07-14 02:12 10924376 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{94B2FACC-34A5-423B-83FD-98CA78D2AAE2}\mpengine.dll
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\program files (x86)\HP
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\programdata\HP
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\program files\HP
2014-08-05 19:34 . 2014-08-08 07:05 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 19:34 . 2014-08-05 19:34 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-08-05 19:34 . 2014-08-05 19:34 -------- d-----w- c:\programdata\Malwarebytes
2014-08-05 19:34 . 2014-05-12 05:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-08-05 19:34 . 2014-05-12 05:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-05 19:34 . 2014-05-12 05:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-08-02 09:58 . 2014-08-02 09:58 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2014-08-02 09:26 . 2014-08-02 09:26 -------- d-----w- c:\programdata\Battle.net
2014-07-31 19:09 . 2014-07-31 19:21 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2014-07-31 19:07 . 2014-07-31 19:08 -------- d-----w- c:\program files\Common Files\Adobe
2014-07-31 19:06 . 2014-07-31 19:06 -------- d-----w- c:\program files (x86)\Adobe Media Player
2014-07-31 19:04 . 2014-07-31 19:04 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2014-07-31 19:02 . 2014-07-31 19:07 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2014-07-31 03:55 . 2014-07-31 03:55 -------- dc----w- c:\windows\system32\DRVSTORE
2014-07-31 03:55 . 2012-08-21 11:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\program files\iPod
2014-07-31 03:55 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\iTunes
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\program files\iTunes
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\programdata\Apple Computer
2014-07-31 03:53 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\Apple Software Update
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\program files\Common Files\Apple
2014-07-31 03:53 . 2014-08-05 20:59 -------- d-----w- c:\program files (x86)\Bonjour
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\program files\Bonjour
2014-07-31 03:53 . 2014-07-31 03:55 -------- d-----w- c:\program files (x86)\Common Files\Apple
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\programdata\Apple
2014-07-30 21:05 . 2013-10-07 10:45 388912 ----a-w- c:\windows\system32\drivers\dlkmd.sys
2014-07-30 21:05 . 2013-10-07 10:45 15664 ----a-w- c:\windows\system32\drivers\dlkmdldr.sys
2014-07-30 21:04 . 2014-07-30 21:04 -------- d-----w- c:\program files\DisplayLink Graphics
2014-07-30 21:02 . 2014-07-30 21:03 -------- d-----w- c:\program files\DisplayLink Core Software
2014-07-30 21:02 . 2014-07-30 21:02 734208 ----a-w- c:\windows\system32\DisplayLinkUsbCo64_7.4.48800.0.dll
2014-07-30 21:02 . 2014-07-30 21:02 44944 ----a-w- c:\windows\system32\drivers\DisplayLinkUsbIo_x64_7.4.48800.0.sys
2014-07-30 20:58 . 2014-07-30 20:58 -------- d-----w- c:\programdata\WarThunder
2014-07-30 18:45 . 2008-03-05 14:03 238088 ----a-w- c:\windows\SysWow64\xactengine3_0.dll
2014-07-30 18:44 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\Common Files\Steam
2014-07-30 18:35 . 2014-07-30 18:36 -------- d-----w- c:\program files (x86)\Google
2014-07-30 18:35 . 2014-07-30 18:35 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-30 18:35 . 2014-07-30 18:35 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-30 18:35 . 2014-07-30 18:35 -------- d-----w- c:\windows\SysWow64\Macromed
2014-07-30 18:35 . 2014-07-30 18:35 -------- d-----w- c:\windows\system32\Macromed
2014-07-30 18:33 . 2014-07-30 18:33 -------- d-----w- c:\programdata\ATI
2014-07-30 18:27 . 2014-07-30 18:27 0 ----a-w- c:\windows\ativpsrm.bin
2014-07-30 18:26 . 2014-08-06 20:22 -------- d-----w- c:\windows\Panther
2014-07-30 18:26 . 2014-07-30 18:26 -------- d-----w- C:\Boot
2014-07-30 18:22 . 2014-08-08 06:52 -------- d-----w- c:\program files (x86)\Raptr
2014-07-30 18:21 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\AMD AVT
2014-07-30 18:21 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies
2014-07-30 18:20 . 2014-07-30 18:21 -------- d-----w- c:\programdata\AMD
2014-07-30 18:19 . 2014-07-30 18:19 -------- d-----w- c:\program files\AMD
2014-07-30 18:18 . 2014-07-30 18:18 -------- d-----w- c:\program files\Common Files\ATI Technologies
2014-07-30 18:18 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\ATI Technologies
2014-07-30 18:18 . 2014-07-30 18:18 -------- d-----w- c:\programdata\Package Cache
2014-07-30 18:15 . 2014-07-30 18:15 -------- d-----w- c:\program files (x86)\Microsoft.NET
2014-07-30 18:14 . 2014-07-30 18:21 -------- d-----w- c:\program files\ATI Technologies
2014-07-30 18:14 . 2014-07-30 18:14 -------- d-----w- c:\program files\ATI
2014-07-30 18:13 . 2014-07-30 18:13 -------- d-----w- C:\AMD
2014-07-30 17:58 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2014-07-30 17:58 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2014-07-30 17:58 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2014-07-30 17:58 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2014-07-30 17:58 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2014-07-30 17:58 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2014-07-30 17:58 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2014-07-30 17:57 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2014-07-30 17:57 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2014-07-30 17:48 . 2011-02-25 06:25 296320 ----a-w- c:\windows\system32\drivers\volsnap.sys
2014-07-30 17:47 . 2014-07-30 17:47 -------- d-----w- c:\program files (x86)\ASM104xUSB3
2014-07-30 17:46 . 2014-08-05 19:44 -------- d-sh--w- c:\windows\Installer
2014-07-30 17:46 . 2014-07-30 17:46 16896 ----a-w- c:\windows\AsTaskSched.dll
2014-07-30 17:42 . 2012-06-12 14:00 726160 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2014-07-30 17:42 . 2012-06-12 14:00 74344 ----a-w- c:\windows\system32\RtNicProp64.dll
2014-07-30 17:42 . 2012-06-12 14:00 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2014-07-30 17:42 . 2014-07-30 17:42 -------- d-----w- c:\program files (x86)\Realtek
2014-07-30 17:42 . 2014-07-30 17:42 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2014-07-30 17:41 . 2014-07-30 17:41 -------- d-----w- c:\windows\AsDmiHtm
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-23 08:52 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2014-08-06 1967616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2014-08-06 767200]
.
c:\users\Frappy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 1050 J410 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN1CQ11GDW05QT;CONNECTION=USB;MONITOR=1; [2009-7-14 45568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 dlkmdldr;dlkmdldr;c:\windows\system32\drivers\dlkmdldr.sys;c:\windows\SYSNATIVE\drivers\dlkmdldr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.3;AODDriver4.3;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 DisplayLinkService;DisplayLinkManager;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 DisplayLinkUsbIo_x64;DisplayLinkUsbIo_x64;c:\windows\system32\DRIVERS\DisplayLinkUsbIo_x64_7.4.48800.0.sys;c:\windows\SYSNATIVE\DRIVERS\DisplayLinkUsbIo_x64_7.4.48800.0.sys [x]
S3 dlkmd;dlkmd;c:\windows\system32\drivers\dlkmd.sys;c:\windows\SYSNATIVE\drivers\dlkmd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MBAMSWISSARMY
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-08-06 21:37 1145672 ----a-w- c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-08-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-30 18:35]
.
2014-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-07-30 21:36]
.
2014-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-07-30 21:36]
.
.
--------- X64 Entries -----------
.
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Spustit klienta k monitoru &1 - c:\windows\web\AOpenClient.htm
IE: Spustit klienta k monitoru &2 - c:\windows\web\AOpenClient.htm
IE: Spustit klienta k monitoru &3 - c:\windows\web\AOpenClient.htm
TCP: Interfaces\{DD2930F7-ECC2-4B82-B5A1-56F8C1DDFF2F}: NameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
c:\program files (x86)\Malwarebytes Anti-Malware\mbam.exe
.
**************************************************************************
.
Celkový čas: 2014-08-08 09:08:21 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-08-08 07:08
ComboFix2.txt 2014-08-07 09:40
.
Před spuštěním: Volných bajtů: 46 641 934 336
Po spuštění: Volných bajtů: 49 463 255 040
.
- - End Of File - - BDA11108C40E8752A90990FC397D3044
A36C5E4F47E84449FF07ED3517B43A31
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8144.6452 [GMT 2:00]
Spuštěný z: c:\users\Frappy\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Frappy\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
FILE ::
"c:\windows\system32\DRIVERS\11807390.sys"
"c:\windows\system32\DRIVERS\12553943.sys"
"c:\windows\system32\Drivers\ESETOlmarikOlmascoCleaner.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Spybot - Search & Destroy 2
c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe.log
c:\program files (x86)\Spybot - Search & Destroy 2\spybotsd2-install-bdcore-update.exe
c:\programdata\Spybot - Search & Destroy
c:\programdata\Spybot - Search & Destroy\Cleaning\140802-195937.xml
c:\programdata\Spybot - Search & Destroy\ClientCount.bin
c:\programdata\Spybot - Search & Destroy\Logs\140802-195937.xml.cleaning.log
c:\programdata\Spybot - Search & Destroy\Logs\Cleaner.log
c:\programdata\Spybot - Search & Destroy\Logs\Firewall.log
c:\programdata\Spybot - Search & Destroy\Logs\Checks.140802-1959.txt
c:\programdata\Spybot - Search & Destroy\Logs\Checks.140802-2028.txt
c:\programdata\Spybot - Search & Destroy\Logs\Scanner.log
c:\programdata\Spybot - Search & Destroy\Logs\Updates.log
c:\windows\system32\DRIVERS\11807390.sys
c:\windows\system32\DRIVERS\12553943.sys
c:\windows\system32\Drivers\ESETOlmarikOlmascoCleaner.sys
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_11807390
-------\Legacy_12553943
-------\Legacy_ESETOLMARIKOLMASCOCLEANER
-------\Service_11807390
-------\Service_12553943
-------\Service_ESETOlmarikOlmascoCleaner
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-07-08 do 2014-08-08 )))))))))))))))))))))))))))))))
.
.
2014-08-08 07:03 . 2014-08-08 07:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-08-07 19:32 . 2014-08-07 19:36 -------- d-----w- C:\AdwCleaner
2014-08-06 20:47 . 2014-08-06 20:47 -------- d-----w- c:\program files\trend micro
2014-08-06 20:47 . 2014-08-06 20:47 -------- d-----w- C:\rsit
2014-08-06 20:23 . 2014-08-06 20:23 -------- d-----w- c:\programdata\Kaspersky Lab
2014-08-06 20:21 . 2014-08-06 20:21 -------- d-----w- c:\program files\CCleaner
2014-08-06 06:45 . 2014-07-14 02:12 10924376 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{94B2FACC-34A5-423B-83FD-98CA78D2AAE2}\mpengine.dll
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\program files (x86)\HP
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\programdata\HP
2014-08-05 19:44 . 2014-08-05 19:44 -------- d-----w- c:\program files\HP
2014-08-05 19:34 . 2014-08-08 07:05 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-05 19:34 . 2014-08-05 19:34 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-08-05 19:34 . 2014-08-05 19:34 -------- d-----w- c:\programdata\Malwarebytes
2014-08-05 19:34 . 2014-05-12 05:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-08-05 19:34 . 2014-05-12 05:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-05 19:34 . 2014-05-12 05:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-08-02 09:58 . 2014-08-02 09:58 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2014-08-02 09:26 . 2014-08-02 09:26 -------- d-----w- c:\programdata\Battle.net
2014-07-31 19:09 . 2014-07-31 19:21 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2014-07-31 19:07 . 2014-07-31 19:08 -------- d-----w- c:\program files\Common Files\Adobe
2014-07-31 19:06 . 2014-07-31 19:06 -------- d-----w- c:\program files (x86)\Adobe Media Player
2014-07-31 19:04 . 2014-07-31 19:04 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2014-07-31 19:02 . 2014-07-31 19:07 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2014-07-31 03:55 . 2014-07-31 03:55 -------- dc----w- c:\windows\system32\DRVSTORE
2014-07-31 03:55 . 2012-08-21 11:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\program files\iPod
2014-07-31 03:55 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\iTunes
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\program files\iTunes
2014-07-31 03:55 . 2014-07-31 03:55 -------- d-----w- c:\programdata\Apple Computer
2014-07-31 03:53 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\Apple Software Update
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\program files\Common Files\Apple
2014-07-31 03:53 . 2014-08-05 20:59 -------- d-----w- c:\program files (x86)\Bonjour
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\program files\Bonjour
2014-07-31 03:53 . 2014-07-31 03:55 -------- d-----w- c:\program files (x86)\Common Files\Apple
2014-07-31 03:53 . 2014-07-31 03:53 -------- d-----w- c:\programdata\Apple
2014-07-30 21:05 . 2013-10-07 10:45 388912 ----a-w- c:\windows\system32\drivers\dlkmd.sys
2014-07-30 21:05 . 2013-10-07 10:45 15664 ----a-w- c:\windows\system32\drivers\dlkmdldr.sys
2014-07-30 21:04 . 2014-07-30 21:04 -------- d-----w- c:\program files\DisplayLink Graphics
2014-07-30 21:02 . 2014-07-30 21:03 -------- d-----w- c:\program files\DisplayLink Core Software
2014-07-30 21:02 . 2014-07-30 21:02 734208 ----a-w- c:\windows\system32\DisplayLinkUsbCo64_7.4.48800.0.dll
2014-07-30 21:02 . 2014-07-30 21:02 44944 ----a-w- c:\windows\system32\drivers\DisplayLinkUsbIo_x64_7.4.48800.0.sys
2014-07-30 20:58 . 2014-07-30 20:58 -------- d-----w- c:\programdata\WarThunder
2014-07-30 18:45 . 2008-03-05 14:03 238088 ----a-w- c:\windows\SysWow64\xactengine3_0.dll
2014-07-30 18:44 . 2014-08-06 20:38 -------- d-----w- c:\program files (x86)\Common Files\Steam
2014-07-30 18:35 . 2014-07-30 18:36 -------- d-----w- c:\program files (x86)\Google
2014-07-30 18:35 . 2014-07-30 18:35 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-07-30 18:35 . 2014-07-30 18:35 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-30 18:35 . 2014-07-30 18:35 -------- d-----w- c:\windows\SysWow64\Macromed
2014-07-30 18:35 . 2014-07-30 18:35 -------- d-----w- c:\windows\system32\Macromed
2014-07-30 18:33 . 2014-07-30 18:33 -------- d-----w- c:\programdata\ATI
2014-07-30 18:27 . 2014-07-30 18:27 0 ----a-w- c:\windows\ativpsrm.bin
2014-07-30 18:26 . 2014-08-06 20:22 -------- d-----w- c:\windows\Panther
2014-07-30 18:26 . 2014-07-30 18:26 -------- d-----w- C:\Boot
2014-07-30 18:22 . 2014-08-08 06:52 -------- d-----w- c:\program files (x86)\Raptr
2014-07-30 18:21 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\AMD AVT
2014-07-30 18:21 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies
2014-07-30 18:20 . 2014-07-30 18:21 -------- d-----w- c:\programdata\AMD
2014-07-30 18:19 . 2014-07-30 18:19 -------- d-----w- c:\program files\AMD
2014-07-30 18:18 . 2014-07-30 18:18 -------- d-----w- c:\program files\Common Files\ATI Technologies
2014-07-30 18:18 . 2014-07-30 18:21 -------- d-----w- c:\program files (x86)\ATI Technologies
2014-07-30 18:18 . 2014-07-30 18:18 -------- d-----w- c:\programdata\Package Cache
2014-07-30 18:15 . 2014-07-30 18:15 -------- d-----w- c:\program files (x86)\Microsoft.NET
2014-07-30 18:14 . 2014-07-30 18:21 -------- d-----w- c:\program files\ATI Technologies
2014-07-30 18:14 . 2014-07-30 18:14 -------- d-----w- c:\program files\ATI
2014-07-30 18:13 . 2014-07-30 18:13 -------- d-----w- C:\AMD
2014-07-30 17:58 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2014-07-30 17:58 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2014-07-30 17:58 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2014-07-30 17:58 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2014-07-30 17:58 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2014-07-30 17:58 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2014-07-30 17:58 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2014-07-30 17:57 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2014-07-30 17:57 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2014-07-30 17:48 . 2011-02-25 06:25 296320 ----a-w- c:\windows\system32\drivers\volsnap.sys
2014-07-30 17:47 . 2014-07-30 17:47 -------- d-----w- c:\program files (x86)\ASM104xUSB3
2014-07-30 17:46 . 2014-08-05 19:44 -------- d-sh--w- c:\windows\Installer
2014-07-30 17:46 . 2014-07-30 17:46 16896 ----a-w- c:\windows\AsTaskSched.dll
2014-07-30 17:42 . 2012-06-12 14:00 726160 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2014-07-30 17:42 . 2012-06-12 14:00 74344 ----a-w- c:\windows\system32\RtNicProp64.dll
2014-07-30 17:42 . 2012-06-12 14:00 107552 ----a-w- c:\windows\system32\RTNUninst64.dll
2014-07-30 17:42 . 2014-07-30 17:42 -------- d-----w- c:\program files (x86)\Realtek
2014-07-30 17:42 . 2014-07-30 17:42 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2014-07-30 17:41 . 2014-07-30 17:41 -------- d-----w- c:\windows\AsDmiHtm
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-23 08:52 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2014-08-06 1967616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2014-08-06 767200]
.
c:\users\Frappy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Sledovat výstrahy inkoustu - HP Deskjet 1050 J410 series.lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 1050 J410 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN1CQ11GDW05QT;CONNECTION=USB;MONITOR=1; [2009-7-14 45568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 dlkmdldr;dlkmdldr;c:\windows\system32\drivers\dlkmdldr.sys;c:\windows\SYSNATIVE\drivers\dlkmdldr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.3;AODDriver4.3;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 DisplayLinkService;DisplayLinkManager;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe;c:\program files\DisplayLink Core Software\DisplayLinkManager.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 DisplayLinkUsbIo_x64;DisplayLinkUsbIo_x64;c:\windows\system32\DRIVERS\DisplayLinkUsbIo_x64_7.4.48800.0.sys;c:\windows\SYSNATIVE\DRIVERS\DisplayLinkUsbIo_x64_7.4.48800.0.sys [x]
S3 dlkmd;dlkmd;c:\windows\system32\drivers\dlkmd.sys;c:\windows\SYSNATIVE\drivers\dlkmd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MBAMSWISSARMY
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-08-06 21:37 1145672 ----a-w- c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-08-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-30 18:35]
.
2014-08-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-07-30 21:36]
.
2014-08-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-07-30 21:36]
.
.
--------- X64 Entries -----------
.
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Spustit klienta k monitoru &1 - c:\windows\web\AOpenClient.htm
IE: Spustit klienta k monitoru &2 - c:\windows\web\AOpenClient.htm
IE: Spustit klienta k monitoru &3 - c:\windows\web\AOpenClient.htm
TCP: Interfaces\{DD2930F7-ECC2-4B82-B5A1-56F8C1DDFF2F}: NameServer = 192.168.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
c:\program files (x86)\Malwarebytes Anti-Malware\mbam.exe
.
**************************************************************************
.
Celkový čas: 2014-08-08 09:08:21 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-08-08 07:08
ComboFix2.txt 2014-08-07 09:40
.
Před spuštěním: Volných bajtů: 46 641 934 336
Po spuštění: Volných bajtů: 49 463 255 040
.
- - End Of File - - BDA11108C40E8752A90990FC397D3044
A36C5E4F47E84449FF07ED3517B43A31
Re: HElp me Neshta virus
Tak jeste uklidime 
Odinstalujte Combofix
T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe
OTC http://oldtimer.geekstogo.com/OTC.exe
TFC http://oldtimer.geekstogo.com/TFC.exe
Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič
A pokud nejsou problemy ci dotazy, je to z me strany vse 
Odinstalujte Combofix
- Prejmenujte ComboFix na Uninstall
- Spustte jej
- Tohle smaze Combofix a jeho slozky
T-Cleaner http://vyosek.ic.cz/pro_usery/T-Cleaner.exe
- Stahnete a spustte
- Pro potvrzeni volby mackejte A, Enter
- Po pouziti utilitu smazte
- Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)
OTC http://oldtimer.geekstogo.com/OTC.exe
- Stahnete a spustte
- Kliknete na CleanUp a potvrdte YES
- Program uklidi a restartuje PC
TFC http://oldtimer.geekstogo.com/TFC.exe
- Stahnete a spustte
- Kliknete na Start a potvrdte OK
- Program uklidi a restartuje pc
- Po pouziti utilitu smazte
Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478Panel čistič
- Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
- dejte Hledej problémy
- nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
- postup opakujte dokud nebude bez problemu - vetsinou cca 3x
- Zde muzete odinstalovat nepotrebne programy
A pokud nejsou problemy ci dotazy, je to z me strany vse "Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.-
ceddrik
- Návštěvník
- Příspěvky: 68
- Registrován: 06 Zář 2007 18:13
- Místo/Bydliště: Ostrava
- Kontaktovat uživatele:
Re: HElp me Neshta virus
Mnohokrát děkuji . V tuto chvíli se počítač tváří zase normálně tak doufejme že to tak zase na dlouhou dobu bude
Re: HElp me Neshta virus
Zase nekdy 
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen od 1. února 2011.
Člen
od 1. února 2011.
Přispějete na provoz fóra?