SavePass adware? - prosím o kontrolu

Zpráva

quaken · #1 Příspěvek od **quaken** » 23 srp 2014 15:32

Při instalaci jedné utilitky na minimize-to-tray se mi do počítače nainstaloval adware SavePass. Všiml jsem si podivného chování při instalaci a pak se mi v program files objevily nové složky SavePass1.1 a globalupdate. Po shlédnutí services.msc se také vytvořily nové služby vázající se ke globalupdates, a v doplňcích firefoxu jsem měl rovněž nějaké nové podivné položky, takže mi bylo jasné, že něco není ok. Co je divné, vir se nijak neprojevil - při surfování na internetu měly začít vyskakovat reklamní okna, ale nestalo se tak. Rozhodl jsem se proto vrátit změny instalace pomocí System Restore, ale nevím, jestli to nebyl nešťastný krok. Adware sice z prohlížeče, služeb, nainstalovaných programů a, po zběžné kontrole, i registrů zmizel, ale nejsem si jistý, jestli nečíhá někde schovaný. Mohl bych prosím poprosit o kontrolu?

Ze je log RSIT:

Logfile of random's system information tool 1.10 (written by random/random)
Run by quaken at 2014-08-23 16:28:34
Microsoft Windows 7 Professional N Service Pack 1
System drive C: has 31 GB (27%) free of 114 GB
Total RAM: 4048 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:28:56, on 23.8.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Program Files\VIA XHCI UASP Utility\usb3Monitor.exe
C:\Program Files (x86)\WizMouse\WizMouse.exe
C:\Users\quaken\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\trend micro\quaken.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [WizMouse] "C:\Program Files (x86)\WizMouse\WizMouse.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O4 - Startup: Dropbox.lnk = C:\Users\quaken\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: MenuAppServer.lnk = C:\Program Files\menuApp\MenuApp.exe
O4 - Startup: Stoic Joker's T-Clock 2010 x64.lnk = C:\TClock-x64\Clock.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) - Unknown owner - C:\Windows\system32\igfxCUIService.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7170 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
"taskhost.exe"
taskeng.exe {FED9F095-F40F-4CE1-A329-79D1BBE1A834}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\OpenHardwareMonitor\OpenHardwareMonitor.exe
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\VIA XHCI UASP Utility\usb3Monitor.exe"
"C:\Program Files (x86)\WizMouse\WizMouse.exe"
"C:\Users\quaken\AppData\Roaming\Dropbox\bin\Dropbox.exe" /systemstartup
"C:\Program Files\menuApp\MenuApp.exe" -u
"C:\TClock-x64\Clock.exe"
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Steam\Steam.exe"
"C:\Program Files (x86)\Steam\bin\steamwebhelper.exe" -cefhost -cachedir "C:\Program Files (x86)\Steam\config\htmlcache" -cookiepath "C:\Program Files (x86)\Steam\config\cookies" -steampid 3644 --blacklist-accelerated-compositing --process-per-tab
"C:\Program Files (x86)\Common Files\Steam\SteamService.exe" /RunAsService
"C:\Program Files (x86)\Steam\bin\steamwebhelper.exe" --type=renderer --disable-delegated-renderer --disable-gpu-compositing --disable-threaded-compositing --enable-pinch --enable-software-compositing --no-sandbox --lang=en-US --lang=en-US --product-version="Valve Steam Client" --disable-accelerated-compositing --disable-gpu-compositing --channel="3024.0.1679187753\1201847717" /prefetch:673131151
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"D:\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "about:blank"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 14.0.0.179 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@mozilla.zeniko.ch/SumatraPDF_Browser_Plugin]
"Description"=SumatraPDF Browser Plugin
"Path"=C:\Program Files (x86)\SumatraPDF\npPdfViewer.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 14.0.0.179 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\extensions\
cs@dictionaries.addons.mozilla.org
foxmarks@kei.com

C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\searchplugins\
duckduckgo.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2014-03-14 13671792]
"VIAxHCUtl"=C:\Program Files\VIA XHCI UASP Utility\usb3Monitor []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WizMouse"=C:\Program Files (x86)\WizMouse\WizMouse.exe [2013-09-22 119000]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2014-02-21 292848]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-07-29 4085896]

C:\Users\quaken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\quaken\AppData\Roaming\Dropbox\bin\Dropbox.exe
MenuAppServer.lnk - C:\Program Files\menuApp\MenuApp.exe
Stoic Joker's T-Clock 2010 x64.lnk - C:\TClock-x64\Clock.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm

======File associations======

.ini - open - "C:\Program Files (x86)\Notepad++\notepad++.exe" "%1"
.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.txt - open - "C:\Program Files (x86)\Notepad++\notepad++.exe" "%1"

======List of files/folders created in the last 1 month======

2014-08-23 16:28:34 ----D---- C:\rsit
2014-08-23 16:28:34 ----D---- C:\Program Files\trend micro
2014-08-23 15:28:03 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2014-08-12 20:40:33 ----A---- C:\Windows\SYSWOW64\infocardapi.dll
2014-08-12 20:40:32 ----A---- C:\Windows\SYSWOW64\icardagt.exe
2014-08-12 20:40:32 ----A---- C:\Windows\system32\infocardapi.dll
2014-08-12 20:40:32 ----A---- C:\Windows\system32\icardagt.exe
2014-08-12 20:40:31 ----A---- C:\Windows\SYSWOW64\icardres.dll
2014-08-12 20:40:31 ----A---- C:\Windows\system32\icardres.dll
2014-08-12 20:40:23 ----A---- C:\Windows\SYSWOW64\TsWpfWrp.exe
2014-08-12 20:40:23 ----A---- C:\Windows\system32\TsWpfWrp.exe
2014-08-12 20:40:01 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2014-08-12 20:40:01 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2014-08-12 20:40:01 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2014-08-12 20:40:01 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2014-08-12 20:40:01 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2014-08-12 20:40:01 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2014-08-12 20:40:01 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2014-08-12 20:40:01 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2014-08-12 20:40:01 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2014-08-12 20:40:01 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-12 20:40:01 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-08-12 20:40:00 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2014-08-12 20:40:00 ----A---- C:\Windows\SYSWOW64\ieui.dll
2014-08-12 20:40:00 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2014-08-12 20:40:00 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2014-08-12 20:40:00 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2014-08-12 20:40:00 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2014-08-12 20:40:00 ----A---- C:\Windows\system32\urlmon.dll
2014-08-12 20:40:00 ----A---- C:\Windows\system32\msfeeds.dll
2014-08-12 20:40:00 ----A---- C:\Windows\system32\iernonce.dll
2014-08-12 20:40:00 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-08-12 20:40:00 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-08-12 20:40:00 ----A---- C:\Windows\system32\ie4uinit.exe
2014-08-12 20:40:00 ----A---- C:\Windows\system32\dxtmsft.dll
2014-08-12 20:39:59 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2014-08-12 20:39:59 ----A---- C:\Windows\system32\iesetup.dll
2014-08-12 20:39:59 ----A---- C:\Windows\system32\iertutil.dll
2014-08-12 20:39:59 ----A---- C:\Windows\system32\iedkcs32.dll
2014-08-12 20:39:58 ----A---- C:\Windows\SYSWOW64\wininet.dll
2014-08-12 20:39:58 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2014-08-12 20:39:58 ----A---- C:\Windows\SYSWOW64\msrating.dll
2014-08-12 20:39:58 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2014-08-12 20:39:58 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2014-08-12 20:39:58 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2014-08-12 20:39:58 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2014-08-12 20:39:58 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2014-08-12 20:39:58 ----A---- C:\Windows\system32\jsproxy.dll
2014-08-12 20:39:58 ----A---- C:\Windows\system32\dxtrans.dll
2014-08-12 20:39:57 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-08-12 20:39:57 ----A---- C:\Windows\system32\mshtmled.dll
2014-08-12 20:39:57 ----A---- C:\Windows\system32\jscript9diag.dll
2014-08-12 20:39:57 ----A---- C:\Windows\system32\jscript9.dll
2014-08-12 20:39:57 ----A---- C:\Windows\system32\ieUnatt.exe
2014-08-12 20:39:57 ----A---- C:\Windows\system32\ieui.dll
2014-08-12 20:39:57 ----A---- C:\Windows\system32\ieframe.dll
2014-08-12 20:39:56 ----A---- C:\Windows\system32\wininet.dll
2014-08-12 20:39:56 ----A---- C:\Windows\system32\vbscript.dll
2014-08-12 20:39:56 ----A---- C:\Windows\system32\msrating.dll
2014-08-12 20:39:56 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-08-12 20:39:56 ----A---- C:\Windows\system32\ieapfltr.dll
2014-08-12 20:39:55 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-12 20:39:55 ----A---- C:\Windows\system32\mshtml.dll
2014-08-12 20:39:09 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2014-08-12 20:39:09 ----A---- C:\Windows\SYSWOW64\msi.dll
2014-08-12 20:39:09 ----A---- C:\Windows\system32\rpcrt4.dll
2014-08-12 20:39:09 ----A---- C:\Windows\system32\msi.dll
2014-08-12 20:39:08 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2014-08-12 20:39:08 ----A---- C:\Windows\SYSWOW64\authui.dll
2014-08-12 20:39:08 ----A---- C:\Windows\system32\msihnd.dll
2014-08-12 20:39:08 ----A---- C:\Windows\system32\consent.exe
2014-08-12 20:39:08 ----A---- C:\Windows\system32\authui.dll
2014-08-12 20:39:07 ----A---- C:\Windows\SYSWOW64\tzres.dll
2014-08-12 20:39:07 ----A---- C:\Windows\system32\tzres.dll
2014-08-12 20:39:05 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2014-08-12 20:39:05 ----A---- C:\Windows\system32\win32k.sys
2014-08-12 20:39:05 ----A---- C:\Windows\system32\gdi32.dll
2014-08-12 20:39:05 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2014-08-02 20:26:35 ----A---- C:\Windows\system32\wups2.dll
2014-08-02 20:26:35 ----A---- C:\Windows\system32\wucltux.dll
2014-08-02 20:26:35 ----A---- C:\Windows\system32\wuaueng.dll
2014-08-02 20:26:35 ----A---- C:\Windows\system32\wuauclt.exe
2014-08-02 20:26:33 ----A---- C:\Windows\SYSWOW64\wups.dll
2014-08-02 20:26:33 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2014-08-02 20:26:33 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2014-08-02 20:26:33 ----A---- C:\Windows\system32\wups.dll
2014-08-02 20:26:33 ----A---- C:\Windows\system32\wudriver.dll
2014-08-02 20:26:33 ----A---- C:\Windows\system32\wuapi.dll
2014-08-02 20:26:31 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2014-08-02 20:26:31 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2014-08-02 20:26:31 ----A---- C:\Windows\system32\wuwebv.dll
2014-08-02 20:26:31 ----A---- C:\Windows\system32\wuapp.exe
2014-07-28 22:37:35 ----D---- C:\Users\quaken\AppData\Roaming\Winamp
2014-07-28 22:37:35 ----D---- C:\Program Files (x86)\Winamp
2014-07-28 00:04:55 ----D---- C:\strawberry
2014-07-27 14:49:34 ----D---- C:\Program Files (x86)\Gow
2014-07-26 23:07:32 ----A---- C:\Windows\SYSWOW64\vccorlib110.dll
2014-07-26 23:07:32 ----A---- C:\Windows\SYSWOW64\msvcr110.dll
2014-07-26 23:07:32 ----A---- C:\Windows\SYSWOW64\msvcp110.dll
2014-07-24 22:03:49 ----D---- C:\Users\quaken\AppData\Roaming\Trine1

======List of files/folders modified in the last 1 month======

2014-08-23 16:28:34 ----D---- C:\Program Files
2014-08-23 15:57:00 ----D---- C:\Windows\system32\FxsTmp
2014-08-23 15:56:37 ----SHD---- C:\Windows\Installer
2014-08-23 15:56:25 ----RSD---- C:\Windows\assembly
2014-08-23 15:56:17 ----D---- C:\Windows\SysWOW64
2014-08-23 15:56:17 ----D---- C:\Program Files (x86)\LibreOffice 4
2014-08-23 15:56:08 ----RSD---- C:\Windows\Fonts
2014-08-23 15:54:51 ----SHD---- C:\System Volume Information
2014-08-23 15:47:47 ----D---- C:\ProgramData\Origin
2014-08-23 15:37:01 ----D---- C:\Windows\Temp
2014-08-23 15:32:03 ----D---- C:\Program Files (x86)\Steam
2014-08-23 15:27:29 ----D---- C:\Windows\system32\config
2014-08-23 15:20:37 ----D---- C:\Windows\System32
2014-08-23 15:20:37 ----D---- C:\Windows\inf
2014-08-23 15:20:37 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-08-23 15:19:17 ----RD---- C:\Program Files (x86)
2014-08-23 15:16:26 ----D---- C:\OpenHardwareMonitor
2014-08-23 15:16:18 ----D---- C:\Windows\system32\Tasks
2014-08-23 15:16:18 ----D---- C:\Users\quaken\AppData\Roaming\Dropbox
2014-08-23 15:16:15 ----D---- C:\Windows
2014-08-23 15:16:03 ----D---- C:\Windows\system32\wbem
2014-08-23 15:15:44 ----D---- C:\wiztree_1_07_portable
2014-08-23 15:15:44 ----D---- C:\Windows\Tasks
2014-08-23 15:15:44 ----D---- C:\Windows\system32\wfp
2014-08-23 15:15:44 ----D---- C:\Windows\system32\DriverStore
2014-08-23 15:15:44 ----D---- C:\Windows\system32\CodeIntegrity
2014-08-23 15:15:44 ----D---- C:\Windows\system32\catroot2
2014-08-23 15:15:42 ----D---- C:\Windows\AppCompat
2014-08-23 15:15:42 ----D---- C:\Users\quaken\AppData\Roaming\Notepad++
2014-08-23 15:15:42 ----D---- C:\Users\quaken\AppData\Roaming\IrfanView
2014-08-23 15:15:42 ----D---- C:\Users\quaken\AppData\Roaming\Battle.net
2014-08-23 15:15:42 ----D---- C:\Program Files\CrystalDiskInfo6_1_12x64
2014-08-23 15:15:41 ----D---- C:\Program Files (x86)\SpeedFan
2014-08-23 15:15:39 ----D---- C:\Program Files (x86)\GPU-Z
2014-08-23 15:15:39 ----D---- C:\Program Files (x86)\Common Files
2014-08-23 15:15:35 ----D---- C:\Windows\registration
2014-08-23 15:15:27 ----D---- C:\Program Files (x86)\Create_Synchronicity-6.0
2014-08-12 22:18:52 ----D---- C:\Windows\rescache
2014-08-12 22:03:13 ----D---- C:\Windows\Microsoft.NET
2014-08-12 21:31:32 ----D---- C:\Windows\winsxs
2014-08-12 21:30:57 ----D---- C:\Windows\SYSWOW64\en-US
2014-08-12 21:30:57 ----D---- C:\Windows\system32\en-US
2014-08-12 21:30:57 ----D---- C:\Windows\system32\drivers
2014-08-12 21:30:57 ----D---- C:\Program Files\Internet Explorer
2014-08-12 21:30:56 ----D---- C:\Windows\PolicyDefinitions
2014-08-12 21:30:56 ----D---- C:\Program Files (x86)\Internet Explorer
2014-08-12 20:44:38 ----D---- C:\Windows\system32\catroot
2014-08-12 20:42:01 ----D---- C:\Windows\system32\MRT
2014-08-12 20:41:58 ----A---- C:\Windows\system32\MRT.exe
2014-07-27 18:40:47 ----SD---- C:\Users\quaken\AppData\Roaming\Microsoft
2014-07-27 18:40:47 ----SD---- C:\ProgramData\Microsoft
2014-07-24 01:12:43 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-07-09 65776]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-07-09 224896]
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2014-02-21 20464]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2012-12-29 28664]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2014-07-09 93568]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2014-07-09 1041168]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2014-07-09 427360]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2014-07-09 29208]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2014-07-09 79184]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2014-07-09 92008]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2014-03-14 3896920]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\iusb3hub.sys [2014-02-21 370672]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2014-02-21 791024]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2013-09-16 99288]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2014-03-18 906968]
R3 VUSB3HUB;VIA USB 3 Root Hub Service; C:\Windows\system32\DRIVERS\ViaHub3.sys [2013-09-25 225792]
R3 WinRing0_1_2_0;WinRing0_1_2_0; \??\C:\OpenHardwareMonitor\OpenHardwareMonitor.sys []
R3 xhcdrv;VIA USB eXtensible Host Controller Service; C:\Windows\system32\DRIVERS\xhcdrv.sys [2013-09-25 296960]
S3 andnetadb;ADB Interface DriverNet; C:\Windows\System32\Drivers\lgandnetadb.sys []
S3 AndNetDiag;LGE AndroidNet USB Serial Port; C:\Windows\system32\DRIVERS\lgandnetdiag64.sys []
S3 ANDNetModem;LGE AndroidNet USB Modem; C:\Windows\system32\DRIVERS\lgandnetmodem64.sys []
S3 andnetndis;LGE AndroidNet NDIS Ethernet Adapter; C:\Windows\system32\DRIVERS\lgandnetndis64.sys []
S3 etdrv;etdrv; \??\C:\Windows\etdrv.sys [2014-05-26 25640]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2014-05-26 26192]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2014-03-31 3785216]
S3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2014-03-31 450520]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-07-09 50344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-08-27 747520]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-09-16 169432]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-09-16 390616]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2014-03-04 922968]
R3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-08-14 833728]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service; C:\Windows\system32\igfxCUIService.exe [2014-04-09 296432]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2013-01-02 171632]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-07-25 111616]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-08-27 828376]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-07-23 119408]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-05-24 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]

-----------------EOF-----------------

#2 Příspěvek od **vyosek** » 23 srp 2014 19:58

Zdravim

Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe

Ulozte nejlepe na plochu
Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
Probehne vytvoreni zalohy a nasledne prohledavani
Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

Ulozte nejlepe na plochu
Ukoncete vsechny programy
Kliknete na Scan a nasledne Clean
Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

quaken · #3 Příspěvek od **quaken** » 24 srp 2014 00:02

Zde jsou:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional N x64
Ran by quaken on ne 24.08.2014 at 0:53:38,28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Users\quaken\AppData\Roaming\pdfforge"

~~~ FireFox

Emptied folder: C:\Users\quaken\AppData\Roaming\mozilla\firefox\profiles\fslw2gye.default\minidumps [9 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on ne 24.08.2014 at 0:57:07,19
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# AdwCleaner v3.308 - Report created 24/08/2014 at 01:00:04
# Updated 20/08/2014 by Xplode
# Operating System : Windows 7 Professional N Service Pack 1 (64 bits)
# Username : quaken - QUAKEN-PC
# Running from : C:\Users\quaken\Desktop\adwcleaner_3.308.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Users\quaken\AppData\Local\globalUpdate

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}

***** [ Browsers ] *****

-\\ Internet Explorer v0.0.0.0

-\\ Mozilla Firefox v31.0 (x86 en-US)

[ File : C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\prefs.js ]

*************************

AdwCleaner[R0].txt - [993 octets] - [24/08/2014 00:59:08]
AdwCleaner[S0].txt - [919 octets] - [24/08/2014 01:00:04]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [978 octets] ##########

#4 Příspěvek od **vyosek** » 24 srp 2014 14:34

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize

Kód: Vybrat vše

autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;

Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

quaken · #5 Příspěvek od **quaken** » 24 srp 2014 20:26

Avast mi Zoek.exe označil jako vir FileRepMetagen [Malware] a smazal. Co to je zač?

#6 Příspěvek od **vyosek** » 24 srp 2014 20:27

Jedna se o falesnou detekci, docasne vypnete Avast - Zoek je nastroj pouzivany pro odstranovani haveti

quaken · #7 Příspěvek od **quaken** » 26 srp 2014 18:36

Zoek.exe v5.0.0.0 Updated 26-08-2014
Tool run by quaken on Łt 26.08.2014 at 19:17:01,79.
Microsoft Windows 7 Professional N 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\quaken\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

26.8.2014 19:17:25 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

Deleted from C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\prefs.js:
user_pref("browser.startup.homepage", "about:blank");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default

user.js not found
---- Lines browser.startup.page removed from prefs.js ----
user_pref("browser.startup.page", 0);
---- FireFox user.js and prefs.js backups ----

prefs_26.08.2014_1922_.backup

==== Firefox Extensions ======================

ProfilePath: C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default
- esk slovnk pro kontrolu pravopisu - %ProfilePath%\extensions\cs@dictionaries.addons.mozilla.org
- Xmarks - %ProfilePath%\extensions\foxmarks@kei.com
- Download Panel Tweaks - %ProfilePath%\extensions\downloadpaneltweaks@dagger2-addons.mozilla.org.xpi
- Feed Sidebar - %ProfilePath%\extensions\feedbar@efinke.com.xpi
- Star-Button In Urlbar - %ProfilePath%\extensions\Starbuttoninurlbar@ArisT2Noia4dev.xpi
- YouTube High Definition - %ProfilePath%\extensions\{7b1bf0b6-a1b9-42b0-b75d-252036438bdc}.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default
9EE20E6E2E3F94714D44F739B9A228F4 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll - Shockwave Flash

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"

==== Reset Google Chrome ======================

Nothing found to reset

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\quaken\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\quaken\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\quaken\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\quaken\AppData\Local\Mozilla\Firefox\Profiles\fslw2gye.default\Cache emptied successfully

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=2 folders=0 22701 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\quaken\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\quaken\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on Łt 26.08.2014 at 19:25:05,11 ======================

#8 Příspěvek od **vyosek** » 26 srp 2014 21:03

Poprosim o FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100

quaken · #9 Příspěvek od **quaken** » 27 srp 2014 06:52

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014
Ran by quaken (administrator) on QUAKEN-PC on 27-08-2014 07:50:43
Running from C:\Users\quaken\Desktop
Platform: Windows 7 Professional N Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\OpenHardwareMonitor\OpenHardwareMonitor.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(VIA Technologies, Inc.) C:\Program Files\VIA XHCI UASP Utility\usb3Monitor.exe
() C:\Program Files (x86)\WizMouse\WizMouse.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Dropbox, Inc.) C:\Users\quaken\AppData\Roaming\Dropbox\bin\Dropbox.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(desktopApps) C:\Program Files\menuApp\MenuApp.exe
(Stoic Joker's Network) C:\TClock-x64\Clock.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(forum.viry.cz) C:\Users\quaken\Desktop\FRSTLauncher.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13671792 2014-03-14] (Realtek Semiconductor)
HKLM\...\Run: [VIAxHCUtl] => C:\Program Files\VIA XHCI UASP Utility\usb3Monito
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-07-29] (AVAST Software)
HKU\.DEFAULT\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-05-24] (Microsoft Corporation)
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1709356424-3811023304-1850980228-1000\...\Run: [WizMouse] => C:\Program Files (x86)\WizMouse\WizMouse.exe [119000 2013-09-22] ()
Startup: C:\Users\quaken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\quaken\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\quaken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MenuAppServer.lnk
ShortcutTarget: MenuAppServer.lnk -> C:\Program Files\menuApp\MenuApp.exe (desktopApps)
Startup: C:\Users\quaken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stoic Joker's T-Clock 2010 x64.lnk
ShortcutTarget: Stoic Joker's T-Clock 2010 x64.lnk -> C:\TClock-x64\Clock.exe (Stoic Joker's Network)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKCU - DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default
FF NewTab: hxxp://www.google.com/
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @mozilla.zeniko.ch/SumatraPDF_Browser_Plugin -> C:\Program Files (x86)\SumatraPDF\npPdfViewer.dll (Simon Bünzli)
FF SearchPlugin: C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\searchplugins\duckduckgo.xml
FF Extension: Český slovník pro kontrolu pravopisu - C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\Extensions\cs@dictionaries.addons.mozilla.org [2014-07-11]
FF Extension: Xmarks - C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\Extensions\foxmarks@kei.com [2014-07-26]
FF Extension: Download Panel Tweaks - C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\Extensions\downloadpaneltweaks@dagger2-addons.mozilla.org.xpi [2014-05-24]
FF Extension: Feed Sidebar - C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\Extensions\feedbar@efinke.com.xpi [2014-05-24]
FF Extension: Star-Button In Urlbar - C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\Extensions\Starbuttoninurlbar@ArisT2Noia4dev.xpi [2014-05-24]
FF Extension: YouTube High Definition - C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\Extensions\{7b1bf0b6-a1b9-42b0-b75d-252036438bdc}.xpi [2014-07-10]
FF Extension: Adblock Plus - C:\Users\quaken\AppData\Roaming\Mozilla\Firefox\Profiles\fslw2gye.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-22]

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-09] (AVAST Software)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [296432 2014-04-09] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-09] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-09] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-09] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-09] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-09] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-09] ()
S3 igfx; C:\Windows\System32\DRIVERS\igdkmd64.sys [3785216 2014-03-31] (Intel Corporation) [File not signed]
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [225792 2013-09-25] (VIA Technologies, Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [296960 2013-09-25] (VIA Technologies, Inc.)
S3 andnetadb; System32\Drivers\lgandnetadb.sys [X]
S3 AndNetDiag; system32\DRIVERS\lgandnetdiag64.sys [X]
S3 ANDNetModem; system32\DRIVERS\lgandnetmodem64.sys [X]
S3 andnetndis; system32\DRIVERS\lgandnetndis64.sys [X]
R3 WinRing0_1_2_0; \??\C:\OpenHardwareMonitor\OpenHardwareMonitor.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-27 07:50 - 2014-08-27 07:50 - 00009911 _____ () C:\Users\quaken\Desktop\FRST.txt
2014-08-27 07:49 - 2014-08-27 07:50 - 00000000 ____D () C:\FRST
2014-08-27 07:49 - 2014-08-27 07:49 - 00112640 _____ (forum.viry.cz) C:\Users\quaken\Desktop\FRSTLauncher.exe
2014-08-27 07:48 - 2014-08-27 07:48 - 02103296 _____ (Farbar) C:\Users\quaken\Desktop\FRST64.exe
2014-08-26 19:23 - 2014-08-26 19:16 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-26 19:17 - 2014-08-26 19:25 - 00007533 _____ () C:\zoek-results.log
2014-08-26 19:16 - 2014-08-26 19:22 - 00000000 ____D () C:\zoek_backup
2014-08-26 19:13 - 2014-08-26 19:16 - 01288704 _____ () C:\Users\quaken\Desktop\zoek.exe
2014-08-24 00:59 - 2014-08-24 01:00 - 00000000 ____D () C:\AdwCleaner
2014-08-24 00:58 - 2014-08-24 00:58 - 01364531 _____ () C:\Users\quaken\Desktop\adwcleaner_3.308.exe
2014-08-24 00:57 - 2014-08-24 00:57 - 00000977 _____ () C:\Users\quaken\Desktop\JRT.txt
2014-08-24 00:53 - 2014-08-24 00:53 - 00000000 ____D () C:\Windows\ERUNT
2014-08-23 20:50 - 2014-08-23 20:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-23 17:46 - 2014-08-23 17:46 - 00000000 ____D () C:\briss-0.9
2014-08-23 16:28 - 2014-08-23 16:28 - 00000000 ____D () C:\rsit
2014-08-23 16:28 - 2014-08-23 16:28 - 00000000 ____D () C:\Program Files\trend micro
2014-08-23 15:56 - 2014-08-23 15:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.3
2014-08-23 15:28 - 2014-08-23 15:28 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-23 15:28 - 2014-08-23 15:28 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-12 22:45 - 2014-08-23 15:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
2014-08-12 20:40 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-12 20:40 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-12 20:40 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-12 20:40 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-12 20:40 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-12 20:40 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-12 20:40 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-12 20:40 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-12 20:40 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-12 20:40 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-12 20:40 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-12 20:40 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-12 20:40 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-12 20:40 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-12 20:40 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-12 20:40 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-12 20:40 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-12 20:40 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-12 20:40 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-12 20:40 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-12 20:40 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-12 20:40 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-12 20:40 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-12 20:40 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-12 20:40 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-12 20:40 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-12 20:40 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-12 20:40 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-12 20:40 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-12 20:40 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-12 20:40 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-12 20:40 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-12 20:40 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-12 20:40 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-12 20:39 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-12 20:39 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-12 20:39 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-12 20:39 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-12 20:39 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-12 20:39 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-12 20:39 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-12 20:39 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-12 20:39 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-12 20:39 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-12 20:39 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-12 20:39 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-12 20:39 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-12 20:39 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-12 20:39 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-12 20:39 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-12 20:39 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-12 20:39 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-12 20:39 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-12 20:39 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-12 20:39 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-12 20:39 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-12 20:39 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-12 20:39 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-12 20:39 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-12 20:39 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-12 20:39 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-12 20:39 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-12 20:39 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-12 20:39 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-12 20:39 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-12 20:39 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-12 20:39 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-12 20:39 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-12 20:39 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-12 20:39 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-12 20:39 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-12 20:39 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-12 20:39 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-12 20:39 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-12 20:39 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-12 20:39 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-12 20:39 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-12 20:39 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-12 20:39 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-02 20:26 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-02 20:26 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-02 20:26 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-02 20:26 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-02 20:26 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-02 20:26 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-02 20:26 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-02 20:26 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-02 20:26 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-02 20:26 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-02 20:26 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-02 20:26 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-02 20:26 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-02 20:26 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-30 22:08 - 2014-07-30 22:09 - 00000000 ____D () C:\Users\quaken\Desktop\fotky do rámečků
2014-07-28 22:37 - 2014-07-28 22:39 - 00000000 ____D () C:\Users\quaken\AppData\Roaming\Winamp
2014-07-28 22:37 - 2014-07-28 22:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winamp
2014-07-28 22:37 - 2014-07-28 22:37 - 00000000 ____D () C:\Program Files (x86)\Winamp
2014-07-28 00:04 - 2014-07-28 00:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Strawberry Perl
2014-07-28 00:04 - 2014-07-28 00:04 - 00000000 ____D () C:\strawberry

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-27 07:50 - 2014-08-27 07:50 - 00009911 _____ () C:\Users\quaken\Desktop\FRST.txt
2014-08-27 07:50 - 2014-08-27 07:49 - 00000000 ____D () C:\FRST
2014-08-27 07:49 - 2014-08-27 07:49 - 00112640 _____ (forum.viry.cz) C:\Users\quaken\Desktop\FRSTLauncher.exe
2014-08-27 07:48 - 2014-08-27 07:48 - 02103296 _____ (Farbar) C:\Users\quaken\Desktop\FRST64.exe
2014-08-27 07:48 - 2009-07-14 07:12 - 00782470 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-27 07:47 - 2014-05-22 07:16 - 02061009 _____ () C:\Windows\WindowsUpdate.log
2014-08-27 07:46 - 2014-05-22 20:06 - 00000000 ____D () C:\OpenHardwareMonitor
2014-08-27 07:46 - 2014-05-22 07:41 - 00000000 ___RD () C:\Users\quaken\Dropbox
2014-08-27 07:46 - 2014-05-22 07:38 - 00000000 ____D () C:\Users\quaken\AppData\Roaming\Dropbox
2014-08-27 07:44 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-27 07:44 - 2009-07-14 06:56 - 00048145 _____ () C:\Windows\setupact.log
2014-08-26 19:48 - 2014-05-22 20:05 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-08-26 19:31 - 2009-07-14 06:50 - 00013792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-26 19:31 - 2009-07-14 06:50 - 00013792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-26 19:25 - 2014-08-26 19:17 - 00007533 _____ () C:\zoek-results.log
2014-08-26 19:24 - 2014-05-22 20:13 - 00153048 _____ () C:\Windows\PFRO.log
2014-08-26 19:22 - 2014-08-26 19:16 - 00000000 ____D () C:\zoek_backup
2014-08-26 19:16 - 2014-08-26 19:23 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-26 19:16 - 2014-08-26 19:13 - 01288704 _____ () C:\Users\quaken\Desktop\zoek.exe
2014-08-24 10:57 - 2014-06-08 03:37 - 00000000 ____D () C:\Users\quaken\Documents\Recepty
2014-08-24 01:00 - 2014-08-24 00:59 - 00000000 ____D () C:\AdwCleaner
2014-08-24 00:58 - 2014-08-24 00:58 - 01364531 _____ () C:\Users\quaken\Desktop\adwcleaner_3.308.exe
2014-08-24 00:57 - 2014-08-24 00:57 - 00000977 _____ () C:\Users\quaken\Desktop\JRT.txt
2014-08-24 00:53 - 2014-08-24 00:53 - 00000000 ____D () C:\Windows\ERUNT
2014-08-23 23:27 - 2009-07-14 07:38 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-08-23 20:50 - 2014-08-23 20:50 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-23 17:46 - 2014-08-23 17:46 - 00000000 ____D () C:\briss-0.9
2014-08-23 17:33 - 2014-06-25 21:45 - 00000000 ____D () C:\Users\quaken\AppData\Local\Battle.net
2014-08-23 17:20 - 2009-07-14 06:50 - 00321696 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-23 16:28 - 2014-08-23 16:28 - 00000000 ____D () C:\rsit
2014-08-23 16:28 - 2014-08-23 16:28 - 00000000 ____D () C:\Program Files\trend micro
2014-08-23 16:06 - 2014-06-08 03:36 - 00000000 ____D () C:\Users\quaken\Documents\loginy
2014-08-23 15:57 - 2014-05-22 07:34 - 00071960 _____ () C:\Users\quaken\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 15:56 - 2014-08-23 15:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.3
2014-08-23 15:56 - 2014-07-02 20:10 - 00000000 ____D () C:\Program Files (x86)\LibreOffice 4
2014-08-23 15:47 - 2014-06-07 20:53 - 00000000 ____D () C:\ProgramData\Origin
2014-08-23 15:30 - 2014-05-25 00:46 - 00000000 ____D () C:\Users\quaken\AppData\Local\Skyrim
2014-08-23 15:28 - 2014-08-23 15:28 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-23 15:28 - 2014-08-23 15:28 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-23 15:16 - 2014-05-22 19:29 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-08-23 15:16 - 2014-05-22 07:15 - 00000000 ____D () C:\Users\quaken
2014-08-23 15:15 - 2014-08-12 22:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
2014-08-23 15:15 - 2014-07-12 21:18 - 00000000 ____D () C:\wiztree_1_07_portable
2014-08-23 15:15 - 2014-07-03 22:25 - 00000000 ____D () C:\Users\quaken\Documents\Assassin's Creed IV Black Flag
2014-08-23 15:15 - 2014-06-25 21:45 - 00000000 ____D () C:\Users\quaken\AppData\Roaming\Battle.net
2014-08-23 15:15 - 2014-06-08 00:34 - 00000000 ____D () C:\Program Files (x86)\Create_Synchronicity-6.0
2014-08-23 15:15 - 2014-05-25 20:55 - 00000000 ____D () C:\Program Files (x86)\SpeedFan
2014-08-23 15:15 - 2014-05-24 10:12 - 00000000 ____D () C:\Users\quaken\AppData\Roaming\Notepad++
2014-08-23 15:15 - 2014-05-22 20:04 - 00000000 ____D () C:\Users\quaken\AppData\Roaming\IrfanView
2014-08-23 15:15 - 2014-05-22 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID
2014-08-23 15:15 - 2014-05-22 19:39 - 00000000 ____D () C:\Program Files (x86)\GPU-Z
2014-08-23 15:15 - 2014-05-22 07:50 - 00000000 ____D () C:\Program Files\CrystalDiskInfo6_1_12x64
2014-08-23 15:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-23 15:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-08-22 21:12 - 2014-06-08 03:00 - 00000000 ____D () C:\Users\quaken\Desktop\100LGDSC
2014-08-18 23:02 - 2014-05-25 01:04 - 00000000 ____D () C:\Users\quaken\Documents\Nexus Mod Manager
2014-08-18 07:39 - 2014-05-22 07:38 - 00000000 ____D () C:\Users\quaken\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-08-12 22:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-12 21:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-12 21:28 - 2014-06-08 03:00 - 00000330 _____ () C:\Users\quaken\Desktop\TIP FILMY!!.txt
2014-08-12 21:04 - 2014-06-08 03:37 - 00000000 ____D () C:\Users\quaken\Documents\ALZA
2014-08-12 20:42 - 2014-05-22 19:31 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-12 20:41 - 2014-05-22 19:31 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-10 22:36 - 2009-07-14 07:08 - 00032574 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-10 22:36 - 2009-07-14 07:08 - 00032574 _____ () C:\Windows\Tasks\SCHEDLGU(14).TXT
2014-08-01 01:41 - 2014-08-12 20:39 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-12 20:40 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-30 22:09 - 2014-07-30 22:08 - 00000000 ____D () C:\Users\quaken\Desktop\fotky do rámečků
2014-07-28 22:39 - 2014-07-28 22:37 - 00000000 ____D () C:\Users\quaken\AppData\Roaming\Winamp
2014-07-28 22:37 - 2014-07-28 22:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winamp
2014-07-28 22:37 - 2014-07-28 22:37 - 00000000 ____D () C:\Program Files (x86)\Winamp
2014-07-28 00:05 - 2014-07-28 00:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Strawberry Perl
2014-07-28 00:04 - 2014-07-28 00:04 - 00000000 ____D () C:\strawberry

Some content of TEMP:
====================
C:\Users\quaken\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpgragd5.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-08-18 22:50

===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================

Drive c: () (Fixed) (Total:111.69 GB) (Free:43.48 GB) NTFS
Drive d: () (Fixed) (Total:298.09 GB) (Free:130.72 GB) NTFS

Available physical RAM: 2757.38 MB
Total physical RAM: 4047.55 MB
Percentage of memory in use: 31%

==================== MBR and Partition Table ==================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: FB7601D0)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=111.7 GB) - (Type=07 NTFS)
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: C4DB994E)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== Scheduled Tasks (whitelisted) ==================

==================== Alternate Data Streams (whitelisted) ==================

==================== Security Center ==================

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)

***** Velikost "Plochy" *****

Velikost slozky "C:\Users\quaken\Desktop" je 105 MB.

***** Startup Programs *****

***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000

==================== End Of Log ==============================

#10 Příspěvek od **vyosek** » 27 srp 2014 12:42

Tvorba fixlistu pro FRST

Spustte poznamkovy blok (Start-spustit-notepad)
Zkopirujte skript nize

Kód: Vybrat vše

Start
2014-08-27 07:50 - 2014-08-27 07:50 - 00009911 _____ () C:\Users\quaken\Desktop\FRST.txt
2014-08-27 07:49 - 2014-08-27 07:49 - 00112640 _____ (forum.viry.cz) C:\Users\quaken\Desktop\FRSTLauncher.exe
2014-08-26 19:23 - 2014-08-26 19:16 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-26 19:17 - 2014-08-26 19:25 - 00007533 _____ () C:\zoek-results.log
2014-08-26 19:16 - 2014-08-26 19:22 - 00000000 ____D () C:\zoek_backup
2014-08-26 19:13 - 2014-08-26 19:16 - 01288704 _____ () C:\Users\quaken\Desktop\zoek.exe
2014-08-24 00:59 - 2014-08-24 01:00 - 00000000 ____D () C:\AdwCleaner
2014-08-24 00:58 - 2014-08-24 00:58 - 01364531 _____ () C:\Users\quaken\Desktop\adwcleaner_3.308.exe
2014-08-24 00:57 - 2014-08-24 00:57 - 00000977 _____ () C:\Users\quaken\Desktop\JRT.txt
2014-08-24 00:53 - 2014-08-24 00:53 - 00000000 ____D () C:\Windows\ERUNT
2014-08-23 16:28 - 2014-08-23 16:28 - 00000000 ____D () C:\rsit
2014-08-23 16:28 - 2014-08-23 16:28 - 00000000 ____D () C:\Program Files\trend micro

Hosts:
Reboot:
End

Ulozte vytvoreny TXT jako fixlist.txt
Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

Kliknete na Fix
Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

quaken · #11 Příspěvek od **quaken** » 27 srp 2014 22:04

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-08-2014
Ran by quaken at 2014-08-27 23:02:41 Run:1
Running from C:\Users\quaken\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
2014-08-27 07:50 - 2014-08-27 07:50 - 00009911 _____ () C:\Users\quaken\Desktop\FRST.txt
2014-08-27 07:49 - 2014-08-27 07:49 - 00112640 _____ (forum.viry.cz) C:\Users\quaken\Desktop\FRSTLauncher.exe
2014-08-26 19:23 - 2014-08-26 19:16 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-26 19:17 - 2014-08-26 19:25 - 00007533 _____ () C:\zoek-results.log
2014-08-26 19:16 - 2014-08-26 19:22 - 00000000 ____D () C:\zoek_backup
2014-08-26 19:13 - 2014-08-26 19:16 - 01288704 _____ () C:\Users\quaken\Desktop\zoek.exe
2014-08-24 00:59 - 2014-08-24 01:00 - 00000000 ____D () C:\AdwCleaner
2014-08-24 00:58 - 2014-08-24 00:58 - 01364531 _____ () C:\Users\quaken\Desktop\adwcleaner_3.308.exe
2014-08-24 00:57 - 2014-08-24 00:57 - 00000977 _____ () C:\Users\quaken\Desktop\JRT.txt
2014-08-24 00:53 - 2014-08-24 00:53 - 00000000 ____D () C:\Windows\ERUNT
2014-08-23 16:28 - 2014-08-23 16:28 - 00000000 ____D () C:\rsit
2014-08-23 16:28 - 2014-08-23 16:28 - 00000000 ____D () C:\Program Files\trend micro

Hosts:
Reboot:
End
*****************

"C:\Users\quaken\Desktop\FRST.txt" => File/Directory not found.
C:\Users\quaken\Desktop\FRSTLauncher.exe => Moved successfully.
C:\Windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\quaken\Desktop\zoek.exe => Moved successfully.
C:\AdwCleaner => Moved successfully.
C:\Users\quaken\Desktop\adwcleaner_3.308.exe => Moved successfully.
C:\Users\quaken\Desktop\JRT.txt => Moved successfully.
C:\Windows\ERUNT => Moved successfully.
C:\rsit => Moved successfully.
C:\Program Files\trend micro => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

The system needed a reboot.

==== End of Fixlog ====

#12 Příspěvek od **vyosek** » 28 srp 2014 06:41

Jak se chova PC???

quaken · #13 Příspěvek od **quaken** » 28 srp 2014 07:42

Bez znamky nakazy - je uplne v pohode. Mam to tedy brat tak, ze uz je odvirovano? To by bylo super.

#14 Příspěvek od **vyosek** » 28 srp 2014 08:18

Tak jeste uklidime

T-Cleaner http://vyosek.tym.cz/pro_usery/T-Cleaner.exe

Stahnete a spustte
Pro potvrzeni volby mackejte A, Enter
Po pouziti utilitu smazte
Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

Stahnete a spustte
Kliknete na CleanUp a potvrdte YES
Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

dejte Hledej problémy
nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

quaken · #15 Příspěvek od **quaken** » 28 srp 2014 21:42

Všechno v pořádku, díky moc za pomoc!

VIRY.CZ

SavePass adware? - prosím o kontrolu

SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu

Re: SavePass adware? - prosím o kontrolu