Win32:Adware-gen

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Zamčeno
Zpráva
Autor
tomastt
Návštěvník
Návštěvník
Příspěvky: 84
Registrován: 27 Srp 2008 17:56

Win32:Adware-gen

#1 Příspěvek od tomastt »

Zdravím a prosím o radu
stáhnul jsem včera program na nahrávani videa z internetu ze stahuj.cz a po instalaci se nemůžu domluvit se žádným prohlížečem, pořad vyskakuji nějaké reklamní okna a internet je jak šnek, a avast pořad hlásí útoky. Projel jsem PC avastem smazal všechno co našel, ale výsledek žáden.
Tohle mi vypisuje avast.
FileSystemShield C:\Users\Tom\AppData\Local\Temp\nsc2750.tmp\442874 Win32:Adware-gen [Adw]
FileSystemShield C:\Users\Tom\AppData\Local\Temp\nsc2750.tmp\442874 Win32:Adware-gen [Adw]
FileSystemShield C:\Users\Tom\AppData\Local\Temp\nsc2750.tmp\442874 Win32:Adware-gen [Adw]
FileSystemShield C:\Users\Tom\AppData\Local\Temp\nsrF42F.tmp\438980 Win32:Malware-gen
WebShield http://s3.amazonaws.com/sensedl/sense9.exe FileRepMetagen [DRP]
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Win32:Adware-gen

#2 Příspěvek od vyosek »

Zdravim :)

:arrow: Dejte log z FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
tomastt
Návštěvník
Návštěvník
Příspěvky: 84
Registrován: 27 Srp 2008 17:56

Re: Win32:Adware-gen

#3 Příspěvek od tomastt »

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2014
Ran by Tom (administrator) on PC on 30-08-2014 19:02:17
Running from C:\Users\Tom\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
() C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
() C:\AMD\amdacpusrsvc.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(CyberLink) D:\Programy\CyberLink\PowerDVD13\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
(Mediaresearch a.s.) C:\Program Files (x86)\SimStream client\UI\Mediaresearch.SimStream.Client.Win.UI.exe
(CyberLink) D:\Programy\CyberLink\PowerDVD13\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
() C:\Users\Tom\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
() C:\Users\Tom\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(ScanSoft, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
(CyberLink Corp.) D:\Programy\CyberLink\PowerDVD13\PowerDVD13\PowerDVD13Agent.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
() C:\Program Files (x86)\Opera\23.0.1522.77\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-15] (CANON INC.)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe [20480 2006-09-20] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-07-31] (AVAST Software)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1611160 2011-03-28] (CANON INC.)
HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [185896 2006-09-28] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [OpwareSE4] => C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [75304 2006-10-11] (ScanSoft, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] => D:\Programy\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [PowerDVD13Agent] => D:\Programy\CyberLink\PowerDVD13\PowerDVD13\PowerDVD13Agent.exe [517144 2013-07-05] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-04-17] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-07-30] (Oracle Corporation)
HKLM-x32\...\Run: [seznam-listicka-distribuce] => C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [cz.seznam.software.autoupdate] => C:\Users\Tom\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [cz.seznam.software.szndesktop] => C:\Users\Tom\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [467680 2014-07-30] (Sony)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SimStream client.lnk
ShortcutTarget: SimStream client.lnk -> C:\Program Files (x86)\SimStream client\UI\Mediaresearch.SimStream.Client.Win.UI.exe (Mediaresearch a.s.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com/search?q={searchT ... d=ie7&rlz=
SearchScopes: HKCU - {0D138FA1-8ED6-430D-93AA-666285BE22D6} URL = http://search.us.com/serp?guid={3D12744 ... earchTerms}
SearchScopes: HKCU - {C701DF75-6FDE-4809-A31E-A3BA5D6FB7BB} URL = http://search.us.com/serp?guid={2D43F46 ... earchTerms}
SearchScopes: HKCU - {D6F38912-0982-47D5-9E66-0997C7FB17A9} URL = http://search.yahoo.com/search?p={searc ... type=10511
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexbho.dll (CANON INC.)
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll (Oracle Corporation)
BHO: YTAHelper -> {FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} -> C:\ProgramData\YTAHelper\YTAHelper64.dll No File
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> D:\Programy\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: YTAHelper -> {FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} -> C:\ProgramData\YTAHelper\YTAHelper.dll No File
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll (CANON INC.)
Handler-x32: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Programy\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @java.com/DTPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tnt2ghost.com/Plugin -> C:\Users\Tom\AppData\Local\TNT2\2.0.0.1760\npTNT2ghost.dll (Search.Us.com)
FF Plugin HKCU: @tnt2npapi.com/Plugin -> C:\Users\Tom\AppData\Local\TNT2\2.0.0.1760\npTNT2.dll (Search.Us.com)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Tom\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-21]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.seznam.cz/?clid=13415
CHR NewTab: Default -> "chrome-extension://olfeabkoenfaoljndfecamgilllcpiak/core/chrome/content/speedDial/speedDial.html",
"chrome-extension://pelmeidfhdlhlbjimpabfcbnnojbboma/index.html"
CHR DefaultSearchKeyword: Default -> istartsurf
CHR DefaultSearchURL: Default -> http://www.istartsurf.com/web/?type=ds& ... earchTerms}
CHR DefaultSuggestURL: Default ->
CHR Profile: C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Dokumenty Google) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-21]
CHR Extension: (Disk Google) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-21]
CHR Extension: (Seznam Lištička - Email) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgjpfhpjcgdppjbgnpnjllokbmcdllig [2014-08-30]
CHR Extension: (Seznam Lištička - Slovník) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\blmojkbhnkkphngknkmgccmlenfaelkd [2014-08-30]
CHR Extension: (YouTube) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-21]
CHR Extension: (Vyhledávání Google) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-21]
CHR Extension: (avast! Online Security) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-21]
CHR Extension: (Peněženka Google) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-21]
CHR Extension: (Seznam Lištička - Rychlá volba) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\olfeabkoenfaoljndfecamgilllcpiak [2014-08-30]
CHR Extension: (Gmail) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-21]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-08]
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-04-17] (Advanced Micro Devices, Inc.) [File not signed]
R2 amdacpusrsvc; C:\AMD\amdacpusrsvc.exe [82432 2014-04-17] () [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-08] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [106488 2014-07-08] (AVAST Software)
R2 CyberLink PowerDVD 13 Media Server Monitor Service; D:\Programy\CyberLink\PowerDVD13\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [77576 2013-07-05] (CyberLink)
R2 CyberLink PowerDVD 13 Media Server Service; D:\Programy\CyberLink\PowerDVD13\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [327432 2013-07-05] (CyberLink)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
S3 Microsoft Office Groove Audit Service; D:\Programy\Microsoft Office\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)
S2 YouTubeAcceleratorService; C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [274656 2014-04-18] (Advanced Micro Devices)
R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-08] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-07-08] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-08] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [448400 2014-07-08] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-08] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-08] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-08] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-08] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-08] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-08] ()
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-07-30] (Sony Mobile Communications)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [104912 2007-11-07] (EZB Systems, Inc.)
R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; D:\Programy\CyberLink\PowerDVD13\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-07-06] (CyberLink Corp.)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-30 19:02 - 2014-08-30 19:02 - 00018766 _____ () C:\Users\Tom\Desktop\FRST.txt
2014-08-30 19:02 - 2014-08-30 19:02 - 00000000 ____D () C:\FRST
2014-08-30 19:01 - 2014-08-30 19:01 - 02103808 _____ (Farbar) C:\Users\Tom\Desktop\FRST64.exe
2014-08-30 18:36 - 2014-08-30 18:40 - 00001920 _____ () C:\Windows\Tasks\7c33e290-040a-4661-87b2-4e4ba5a057ed-5_user.job
2014-08-30 18:36 - 2014-08-30 18:40 - 00001900 _____ () C:\Windows\Tasks\7c33e290-040a-4661-87b2-4e4ba5a057ed-5.job
2014-08-30 18:36 - 2014-08-30 18:36 - 00004930 _____ () C:\Windows\System32\Tasks\7c33e290-040a-4661-87b2-4e4ba5a057ed-5
2014-08-30 18:28 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-30 18:27 - 2014-08-30 18:36 - 00000000 ____D () C:\AdwCleaner
2014-08-30 18:27 - 2014-08-30 18:23 - 01364531 _____ () C:\Users\Tom\Desktop\adwcleaner_3.308.exe
2014-08-30 17:52 - 2014-08-30 17:52 - 00000000 ____D () C:\Users\Tom\Documents\Fax
2014-08-30 17:26 - 2014-08-30 17:45 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-08-30 17:26 - 2014-08-30 17:26 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-08-30 17:26 - 2014-08-30 17:26 - 00000000 _____ () C:\autoexec.bat
2014-08-30 15:32 - 2014-08-30 18:29 - 00000000 ____D () C:\Windows\system32\log
2014-08-30 14:45 - 2014-08-30 14:40 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Tom\Desktop\SpyHunter-installer.exe
2014-08-30 14:45 - 2014-08-30 14:37 - 12925224 _____ (Elex do Brasil Participações Ltda) C:\Users\Tom\Desktop\yet_another_cleaner_sk.exe
2014-08-30 13:21 - 2014-08-30 14:51 - 00000000 ____D () C:\Users\Tom\AppData\Local\Apps\Windows 7 USB DVD Download Tool
2014-08-30 13:12 - 2014-08-30 18:41 - 00000000 ____D () C:\WinSetupFromUSB
2014-08-30 13:08 - 2014-08-30 18:40 - 00006856 _____ () C:\Windows\PFRO.log
2014-08-30 13:08 - 2014-08-30 18:40 - 00000448 _____ () C:\Windows\setupact.log
2014-08-30 13:08 - 2014-08-30 13:08 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-29 19:31 - 2014-08-29 19:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-08-29 14:51 - 2014-08-29 14:51 - 00004304 _____ () C:\Windows\System32\Tasks\Installer_shopperpro
2014-08-29 11:31 - 2014-08-30 13:36 - 00004536 _____ () C:\Windows\System32\Tasks\YTAHelper
2014-08-29 11:31 - 2014-08-30 13:36 - 00003426 _____ () C:\Windows\System32\Tasks\YTAUpdate
2014-08-29 11:31 - 2014-08-30 13:36 - 00003240 _____ () C:\Windows\System32\Tasks\YTAUpdate_logon
2014-08-29 11:31 - 2014-08-29 11:31 - 00000000 ____D () C:\Users\Tom\AppData\Local\CrashRpt
2014-08-29 11:28 - 2014-08-29 12:58 - 00000000 ____D () C:\Program Files (x86)\StreamTransport
2014-08-29 07:53 - 2014-08-29 07:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2014-08-29 07:51 - 2014-08-29 07:51 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-08-29 07:51 - 2014-08-29 07:51 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-08-29 05:38 - 2014-08-29 05:38 - 00000000 ____D () C:\Users\Tom\AppData\Local\Adobe
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-08-28 18:31 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 18:31 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 18:31 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-27 20:40 - 2014-08-27 20:45 - 00000648 _____ () C:\Users\Tom\Desktop\Babovka masožrava od Hrušky.txt
2014-08-24 20:09 - 2014-08-24 20:09 - 34048757 _____ () C:\Users\Tom\Desktop\jun def 6.mp4
2014-08-17 12:11 - 2014-08-17 12:26 - 00000000 ____D () C:\Users\Tom\Desktop\Kowal zaloha
2014-08-14 21:29 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-14 21:29 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-14 21:29 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-14 21:29 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-14 21:29 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-14 21:29 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-14 21:28 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-14 21:28 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 19:20 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-14 19:20 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-14 19:20 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-14 19:20 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-14 19:20 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-14 19:20 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-14 19:20 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-14 19:20 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-14 19:20 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-14 19:20 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-14 19:20 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-14 19:20 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-14 19:19 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-14 19:19 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-14 19:19 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-14 19:19 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-14 19:19 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-14 19:19 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-14 19:19 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-14 19:19 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-14 19:19 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-14 19:19 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-14 19:19 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-14 19:19 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-14 19:19 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-14 19:19 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-14 19:19 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-14 19:19 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-14 19:19 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-14 19:19 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-14 19:19 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-14 19:19 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-14 19:19 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-14 19:19 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-14 19:19 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-14 19:19 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-14 19:19 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-14 19:19 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-14 19:19 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-14 19:19 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-14 19:19 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-14 19:19 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-14 19:19 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-14 19:19 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-14 19:19 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-14 19:19 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-14 19:19 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-14 19:19 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-14 19:19 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-14 19:19 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-14 19:19 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-14 19:19 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-14 19:19 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-14 19:19 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-14 19:19 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-14 19:19 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-14 19:19 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-14 19:19 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-14 19:19 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-14 19:19 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-14 19:19 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-14 19:19 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-14 19:19 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-14 19:19 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-14 19:19 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-14 19:19 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-14 19:19 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-14 19:19 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-14 19:19 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-14 19:19 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-14 19:19 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-14 19:19 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-14 19:19 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-14 19:19 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-14 19:19 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-14 19:19 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-14 19:19 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-14 19:19 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-14 19:19 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-14 19:19 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-14 19:19 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-14 19:19 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-14 19:19 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-14 19:19 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-06 08:18 - 2014-08-06 08:18 - 00000000 ____D () C:\Users\Tom\Documents\Poznámkové bloky aplikace OneNote
2014-08-05 22:00 - 2014-08-07 12:24 - 00000000 ____D () C:\Users\Tom\Desktop\FreeRapid-0.9u4
2014-08-05 22:00 - 2014-08-05 22:00 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\VitySoft
2014-08-05 22:00 - 2014-08-05 22:00 - 00000000 ____D () C:\Users\Tom\.objectdb
2014-08-04 18:53 - 2014-08-04 18:54 - 00000000 ____D () C:\Users\Tom\Desktop\gabka tel
2014-08-04 14:53 - 2014-08-04 14:53 - 00000000 ____D () C:\Users\Tom\Desktop\děda ERA
2014-07-31 06:12 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-07-31 06:12 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-07-31 06:12 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-07-31 06:12 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-07-31 06:12 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-07-31 06:12 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-07-31 06:12 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-07-31 06:12 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-07-31 06:12 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-07-31 06:12 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-07-31 06:12 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-07-31 06:12 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-07-31 06:12 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-07-31 06:12 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-30 19:02 - 2014-08-30 19:02 - 00018766 _____ () C:\Users\Tom\Desktop\FRST.txt
2014-08-30 19:02 - 2014-08-30 19:02 - 00000000 ____D () C:\FRST
2014-08-30 19:01 - 2014-08-30 19:01 - 02103808 _____ (Farbar) C:\Users\Tom\Desktop\FRST64.exe
2014-08-30 18:47 - 2009-07-14 06:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-30 18:47 - 2009-07-14 06:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-30 18:45 - 2014-04-21 15:50 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Seznam.cz
2014-08-30 18:44 - 2014-05-17 12:06 - 00000000 ____D () C:\Users\Tom\Desktop\Mažoretky pravidla
2014-08-30 18:44 - 2010-11-21 11:27 - 00668138 _____ () C:\Windows\system32\perfh005.dat
2014-08-30 18:44 - 2010-11-21 11:27 - 00140798 _____ () C:\Windows\system32\perfc005.dat
2014-08-30 18:44 - 2009-07-14 07:13 - 01582262 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-30 18:43 - 2014-04-21 12:55 - 01628136 _____ () C:\Windows\WindowsUpdate.log
2014-08-30 18:42 - 2014-07-18 08:09 - 00000000 ____D () C:\Program Files (x86)\Kresleni
2014-08-30 18:42 - 2014-05-16 17:23 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2014-08-30 18:41 - 2014-08-30 13:12 - 00000000 ____D () C:\WinSetupFromUSB
2014-08-30 18:40 - 2014-08-30 18:36 - 00001920 _____ () C:\Windows\Tasks\7c33e290-040a-4661-87b2-4e4ba5a057ed-5_user.job
2014-08-30 18:40 - 2014-08-30 18:36 - 00001900 _____ () C:\Windows\Tasks\7c33e290-040a-4661-87b2-4e4ba5a057ed-5.job
2014-08-30 18:40 - 2014-08-30 13:08 - 00006856 _____ () C:\Windows\PFRO.log
2014-08-30 18:40 - 2014-08-30 13:08 - 00000448 _____ () C:\Windows\setupact.log
2014-08-30 18:40 - 2014-06-08 13:59 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Skype
2014-08-30 18:40 - 2014-04-21 14:08 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-08-30 18:40 - 2014-04-21 13:58 - 00000942 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-30 18:40 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-30 18:37 - 2014-04-21 14:22 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-08-30 18:36 - 2014-08-30 18:36 - 00004930 _____ () C:\Windows\System32\Tasks\7c33e290-040a-4661-87b2-4e4ba5a057ed-5
2014-08-30 18:36 - 2014-08-30 18:27 - 00000000 ____D () C:\AdwCleaner
2014-08-30 18:29 - 2014-08-30 15:32 - 00000000 ____D () C:\Windows\system32\log
2014-08-30 18:29 - 2014-04-22 13:27 - 00000000 ____D () C:\ProgramData\Temp
2014-08-30 18:29 - 2014-04-21 13:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-08-30 18:29 - 2009-07-14 04:34 - 00000580 _____ () C:\Windows\win.ini
2014-08-30 18:28 - 2014-04-21 14:02 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-30 18:23 - 2014-08-30 18:27 - 01364531 _____ () C:\Users\Tom\Desktop\adwcleaner_3.308.exe
2014-08-30 18:21 - 2014-04-21 13:58 - 00000946 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-30 17:52 - 2014-08-30 17:52 - 00000000 ____D () C:\Users\Tom\Documents\Fax
2014-08-30 17:45 - 2014-08-30 17:26 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-08-30 17:26 - 2014-08-30 17:26 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-08-30 17:26 - 2014-08-30 17:26 - 00000000 _____ () C:\autoexec.bat
2014-08-30 15:32 - 2014-04-21 12:57 - 00001599 _____ () C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-30 15:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-30 14:51 - 2014-08-30 13:21 - 00000000 ____D () C:\Users\Tom\AppData\Local\Apps\Windows 7 USB DVD Download Tool
2014-08-30 14:43 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-08-30 14:40 - 2014-08-30 14:45 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Tom\Desktop\SpyHunter-installer.exe
2014-08-30 14:37 - 2014-08-30 14:45 - 12925224 _____ (Elex do Brasil Participações Ltda) C:\Users\Tom\Desktop\yet_another_cleaner_sk.exe
2014-08-30 13:36 - 2014-08-29 11:31 - 00004536 _____ () C:\Windows\System32\Tasks\YTAHelper
2014-08-30 13:36 - 2014-08-29 11:31 - 00003426 _____ () C:\Windows\System32\Tasks\YTAUpdate
2014-08-30 13:36 - 2014-08-29 11:31 - 00003240 _____ () C:\Windows\System32\Tasks\YTAUpdate_logon
2014-08-30 13:35 - 2014-05-06 11:16 - 00000000 ____D () C:\Program Files (x86)\Seznam.cz
2014-08-30 13:10 - 2014-05-06 07:43 - 00000000 ____D () C:\Users\Tom\Desktop\Nová složka
2014-08-30 13:08 - 2014-08-30 13:08 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-29 21:44 - 2014-04-21 14:51 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Mumble
2014-08-29 19:33 - 2014-04-22 10:42 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-29 19:31 - 2014-08-29 19:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-08-29 18:10 - 2014-04-21 14:57 - 00000000 ____D () C:\World_of_Tanks
2014-08-29 14:51 - 2014-08-29 14:51 - 00004304 _____ () C:\Windows\System32\Tasks\Installer_shopperpro
2014-08-29 14:43 - 2014-05-17 11:03 - 00000000 ____D () C:\Windows\Minidump
2014-08-29 14:43 - 2014-05-04 13:51 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Vso
2014-08-29 14:43 - 2014-05-04 13:50 - 00000000 ____D () C:\ProgramData\VSO
2014-08-29 14:43 - 2014-04-21 13:47 - 00000000 ____D () C:\Windows\Panther
2014-08-29 12:58 - 2014-08-29 11:28 - 00000000 ____D () C:\Program Files (x86)\StreamTransport
2014-08-29 11:31 - 2014-08-29 11:31 - 00000000 ____D () C:\Users\Tom\AppData\Local\CrashRpt
2014-08-29 10:20 - 2014-04-21 13:57 - 00111104 _____ () C:\Users\Tom\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-29 10:20 - 2009-07-14 06:45 - 00420816 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-29 07:53 - 2014-08-29 07:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2014-08-29 07:51 - 2014-08-29 07:51 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-08-29 07:51 - 2014-08-29 07:51 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-08-29 07:51 - 2014-04-22 10:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-08-29 06:43 - 2014-04-22 13:14 - 00001120 _____ () C:\Users\Tom\AppData\Local\MRDownloader.nast
2014-08-29 05:38 - 2014-08-29 05:38 - 00000000 ____D () C:\Users\Tom\AppData\Local\Adobe
2014-08-29 05:36 - 2014-04-21 14:02 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-29 05:36 - 2014-04-21 14:02 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-29 05:36 - 2014-04-21 14:02 - 00003852 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-08-27 20:45 - 2014-08-27 20:40 - 00000648 _____ () C:\Users\Tom\Desktop\Babovka masožrava od Hrušky.txt
2014-08-27 18:39 - 2014-07-20 19:11 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-08-27 18:39 - 2014-07-20 19:11 - 00000000 ____D () C:\Program Files\Java
2014-08-27 18:39 - 2014-07-11 13:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-24 20:09 - 2014-08-24 20:09 - 34048757 _____ () C:\Users\Tom\Desktop\jun def 6.mp4
2014-08-24 11:03 - 2014-07-30 09:58 - 00002026 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2014-08-24 11:03 - 2014-07-30 09:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-08-24 11:03 - 2014-04-21 14:44 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-08-23 04:07 - 2014-08-28 18:31 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 18:31 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 18:31 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 14:06 - 2014-04-21 14:38 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-19 11:15 - 2014-06-03 16:58 - 00003816 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1398081438
2014-08-19 11:15 - 2014-04-21 13:57 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-08-17 12:26 - 2014-08-17 12:11 - 00000000 ____D () C:\Users\Tom\Desktop\Kowal zaloha
2014-08-15 19:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-15 16:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 21:32 - 2014-04-21 13:11 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 21:31 - 2014-04-21 13:11 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-14 21:28 - 2014-05-06 08:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 20:26 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-08-11 19:12 - 2014-07-30 17:20 - 00000000 ____D () C:\Users\Tom\Desktop\Fotky telefon
2014-08-11 17:19 - 2014-06-10 17:27 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\abgx360
2014-08-07 12:24 - 2014-08-05 22:00 - 00000000 ____D () C:\Users\Tom\Desktop\FreeRapid-0.9u4
2014-08-07 12:24 - 2014-04-23 18:45 - 00000000 ____D () C:\Users\Mcx1-PC
2014-08-07 12:24 - 2014-04-23 11:48 - 00000000 ____D () C:\Users\Tom\AppData\Local\Cyberlink SoftDMA
2014-08-07 12:24 - 2014-04-21 12:56 - 00000000 ____D () C:\Users\Tom\AppData\Local\VirtualStore
2014-08-07 12:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-07 11:26 - 2014-04-21 14:08 - 00001992 _____ () C:\Users\Public\Desktop\avast! SafeZone.lnk
2014-08-07 11:25 - 2014-04-21 12:56 - 00000000 ____D () C:\Users\Tom
2014-08-07 04:06 - 2014-08-14 19:19 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-14 19:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-06 08:18 - 2014-08-06 08:18 - 00000000 ____D () C:\Users\Tom\Documents\Poznámkové bloky aplikace OneNote
2014-08-05 22:00 - 2014-08-05 22:00 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\VitySoft
2014-08-05 22:00 - 2014-08-05 22:00 - 00000000 ____D () C:\Users\Tom\.objectdb
2014-08-05 09:20 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-04 18:54 - 2014-08-04 18:53 - 00000000 ____D () C:\Users\Tom\Desktop\gabka tel
2014-08-04 14:53 - 2014-08-04 14:53 - 00000000 ____D () C:\Users\Tom\Desktop\děda ERA
2014-08-01 01:41 - 2014-08-14 19:19 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-14 19:19 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

Some content of TEMP:
====================
C:\Users\Tom\AppData\Local\Temp\appshat_generic.exe
C:\Users\Tom\AppData\Local\Temp\cabex.dll
C:\Users\Tom\AppData\Local\Temp\listicka-partner-13415-1.1.2-offline.exe
C:\Users\Tom\AppData\Local\Temp\PartnerInstaller_smtyc.exe
C:\Users\Tom\AppData\Local\Temp\PodoWebSetup.exe
C:\Users\Tom\AppData\Local\Temp\Quarantine.exe
C:\Users\Tom\AppData\Local\Temp\SHSetup.exe
C:\Users\Tom\AppData\Local\Temp\unelevate.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-17 16:03

==================== End Of Log ============================
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Win32:Adware-gen

#4 Příspěvek od vyosek »

:arrow: Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe
  • Ulozte nejlepe na plochu
  • Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
  • Probehne vytvoreni zalohy a nasledne prohledavani
  • Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte
:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Kliknete na Scan a nasledne Clean
  • Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
tomastt
Návštěvník
Návštěvník
Příspěvky: 84
Registrován: 27 Srp 2008 17:56

Re: Win32:Adware-gen

#5 Příspěvek od tomastt »

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Tom on so 30.08.2014 at 19:08:32,50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0D138FA1-8ED6-430D-93AA-666285BE22D6}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{C701DF75-6FDE-4809-A31E-A3BA5D6FB7BB}



~~~ Files



~~~ Folders



~~~ Chrome

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Google [Blacklisted Policy]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on so 30.08.2014 at 19:13:59,61
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Nahoru
tomastt
Návštěvník
Návštěvník
Příspěvky: 84
Registrován: 27 Srp 2008 17:56

Re: Win32:Adware-gen

#6 Příspěvek od tomastt »

# AdwCleaner v3.308 - Report created 30/08/2014 at 19:15:42
# Updated 20/08/2014 by Xplode
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : Tom - PC
# Running from : C:\Users\Tom\Desktop\adwcleaner_3.308.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****

Task Deleted : 7c33e290-040a-4661-87b2-4e4ba5a057ed-5
Task Deleted : 7c33e290-040a-4661-87b2-4e4ba5a057ed-5_user

***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Google Chrome v36.0.1985.143

[ File : C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [20290 octets] - [30/08/2014 18:28:00]
AdwCleaner[R1].txt - [11268 octets] - [30/08/2014 18:35:59]
AdwCleaner[R2].txt - [1148 octets] - [30/08/2014 19:14:47]
AdwCleaner[S0].txt - [18611 octets] - [30/08/2014 18:29:16]
AdwCleaner[S1].txt - [11013 octets] - [30/08/2014 18:36:47]
AdwCleaner[S2].txt - [1074 octets] - [30/08/2014 19:15:42]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1134 octets] ##########
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Win32:Adware-gen

#7 Příspěvek od vyosek »

:arrow: Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu
  • Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
  • Do okna vlozte skript nize

  • Kód: Vybrat vše

    autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;
  • Nasledne kliknete na Run Script
  • PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
tomastt
Návštěvník
Návštěvník
Příspěvky: 84
Registrován: 27 Srp 2008 17:56

Re: Win32:Adware-gen

#8 Příspěvek od tomastt »

piše mi to "není platná aplikace typu win32"
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Win32:Adware-gen

#9 Příspěvek od vyosek »

Dejte novy log z FRST
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
tomastt
Návštěvník
Návštěvník
Příspěvky: 84
Registrován: 27 Srp 2008 17:56

Re: Win32:Adware-gen

#10 Příspěvek od tomastt »

stahnul jsem to z posledniho odkazu v raru taky hlasil že neni win32 ale naběhl


Zoek.exe v5.0.0.0 Updated 04-August-2014
Tool run by Tom on ne 31.08.2014 at 9:39:40,08.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Tom\Desktop\zoek\zoek.scr [Scan all users] [Script inserted]

==== System Restore Info ======================

31.8.2014 9:40:34 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3424097178-4144622376-3597314994-1001\Software\Microsoft\Internet Explorer\SearchScopes\{D6F38912-0982-47D5-9E66-0997C7FB17A9} deleted successfully
HKEY_USERS\S-1-5-21-3424097178-4144622376-3597314994-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} deleted successfully
HKEY_USERS\S-1-5-21-3424097178-4144622376-3597314994-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\YouTubeAcceleratorService deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\YouTubeAcceleratorService deleted successfully

==== Deleting Files \ Folders ======================

C:\Users\Tom\AppData\Roaming\Mediaresearch.SimStream deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Tom\Searches deleted
C:\Users\Tom\Desktop\MRDownloader.exe deleted
C:\Users\Tom\AppData\Roaming\vsoConvertXtoDVD5_setup.exe deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [07.08.2014 11:25]

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[08.07.2014 20:40]

Seznam Lištička - Email - Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgjpfhpjcgdppjbgnpnjllokbmcdllig
Seznam Lištička - Slovník - Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\blmojkbhnkkphngknkmgccmlenfaelkd
avast Online Security - Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki
Seznam Lištička - Rychlá volba - Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\olfeabkoenfaoljndfecamgilllcpiak

==== Chromium Startpages ======================

C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "http://www.seznam.cz/?clid=13415",


==== Chrome Fix ======================

C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pelmeidfhdlhlbjimpabfcbnnojbboma_0.localstorage deleted successfully
C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pelmeidfhdlhlbjimpabfcbnnojbboma_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com/search?q={searchT ... d=ie7&rlz="
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Default_Search_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Default_Search_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchT ... d=ie7&rlz="

==== Reset Google Chrome ======================

C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1RL5BDSU will be deleted at reboot
C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6AI069LV will be deleted at reboot
C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R6PJG0MO will be deleted at reboot
C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TC6BGEXX will be deleted at reboot
C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZIOEOZX will be deleted at reboot
C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YGT2HM5P will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=15 folders=10 35917710 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Mcx1-PC\AppData\Local\Temp emptied successfully
C:\Users\Tom\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Tom\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun.log" not found
"C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1RL5BDSU" not found
"C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6AI069LV" not found
"C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R6PJG0MO" not found
"C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TC6BGEXX" not found
"C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZIOEOZX" not found
"C:\Users\Tom\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YGT2HM5P" not found

==== EOF on ne 31.08.2014 at 9:59:17,97 ======================
Nahoru
tomastt
Návštěvník
Návštěvník
Příspěvky: 84
Registrován: 27 Srp 2008 17:56

Re: Win32:Adware-gen

#11 Příspěvek od tomastt »

Log FRST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2014
Ran by Tom (administrator) on PC on 31-08-2014 11:56:34
Running from C:\Users\Tom\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
() C:\AMD\amdacpusrsvc.exe
(CyberLink) D:\Programy\CyberLink\PowerDVD13\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
(CyberLink) D:\Programy\CyberLink\PowerDVD13\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
() C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
() C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Users\Tom\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
() C:\Users\Tom\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Mediaresearch a.s.) C:\Program Files (x86)\SimStream client\UI\Mediaresearch.SimStream.Client.Win.UI.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(ScanSoft, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(CyberLink Corp.) D:\Programy\CyberLink\PowerDVD13\PowerDVD13\PowerDVD13Agent.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
() C:\Program Files (x86)\Opera\23.0.1522.77\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\23.0.1522.77\opera.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-15] (CANON INC.)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe [20480 2006-09-20] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-07-31] (AVAST Software)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1611160 2011-03-28] (CANON INC.)
HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [185896 2006-09-28] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [OpwareSE4] => C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [75304 2006-10-11] (ScanSoft, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] => D:\Programy\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [PowerDVD13Agent] => D:\Programy\CyberLink\PowerDVD13\PowerDVD13\PowerDVD13Agent.exe [517144 2013-07-05] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-04-17] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-07-30] (Oracle Corporation)
HKLM-x32\...\Run: [seznam-listicka-distribuce] => C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [cz.seznam.software.autoupdate] => C:\Users\Tom\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [cz.seznam.software.szndesktop] => C:\Users\Tom\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [467680 2014-07-30] (Sony)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SimStream client.lnk
ShortcutTarget: SimStream client.lnk -> C:\Program Files (x86)\SimStream client\UI\Mediaresearch.SimStream.Client.Win.UI.exe (Mediaresearch a.s.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKCU - DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexbho.dll (CANON INC.)
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> D:\Programy\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll (CANON INC.)
Handler-x32: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Programy\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @java.com/DTPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.20.2 -> C:\Program Files\Java\jre1.8.0_20\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tnt2ghost.com/Plugin -> C:\Users\Tom\AppData\Local\TNT2\2.0.0.1760\npTNT2ghost.dll (Search.Us.com)
FF Plugin HKCU: @tnt2npapi.com/Plugin -> C:\Users\Tom\AppData\Local\TNT2\2.0.0.1760\npTNT2.dll (Search.Us.com)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Tom\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-21]

Chrome:
=======
CHR Profile: C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-21]
CHR Extension: (Google Drive) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-21]
CHR Extension: (Seznam Lištička - Email) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgjpfhpjcgdppjbgnpnjllokbmcdllig [2014-08-30]
CHR Extension: (Seznam Lištička - Slovník) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\blmojkbhnkkphngknkmgccmlenfaelkd [2014-08-30]
CHR Extension: (YouTube) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-21]
CHR Extension: (Google Search) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-21]
CHR Extension: (avast! Online Security) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-21]
CHR Extension: (Google Wallet) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-21]
CHR Extension: (Seznam Lištička - Rychlá volba) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\olfeabkoenfaoljndfecamgilllcpiak [2014-08-30]
CHR Extension: (Gmail) - C:\Users\Tom\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-21]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-04-17] (Advanced Micro Devices, Inc.) [File not signed]
R2 amdacpusrsvc; C:\AMD\amdacpusrsvc.exe [82432 2014-04-17] () [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-08] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [106488 2014-07-08] (AVAST Software)
R2 CyberLink PowerDVD 13 Media Server Monitor Service; D:\Programy\CyberLink\PowerDVD13\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [77576 2013-07-05] (CyberLink)
R2 CyberLink PowerDVD 13 Media Server Service; D:\Programy\CyberLink\PowerDVD13\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [327432 2013-07-05] (CyberLink)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
S3 Microsoft Office Groove Audit Service; D:\Programy\Microsoft Office\Office12\GrooveAuditService.exe [64856 2009-02-26] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [274656 2014-04-18] (Advanced Micro Devices)
R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-08] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-07-08] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-08] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [448400 2014-07-08] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-08] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-08] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-08] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-08] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-08] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-08] ()
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2014-07-30] (Sony Mobile Communications)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [104912 2007-11-07] (EZB Systems, Inc.)
R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; D:\Programy\CyberLink\PowerDVD13\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-07-06] (CyberLink Corp.)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-31 09:59 - 2014-08-31 09:59 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Mediaresearch.SimStream
2014-08-31 09:51 - 2014-02-13 23:59 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-31 09:40 - 2014-08-31 09:59 - 00011619 _____ () C:\zoek-results.log
2014-08-31 09:39 - 2014-08-31 09:49 - 00000000 ____D () C:\zoek_backup
2014-08-31 09:39 - 2014-08-31 09:39 - 00000000 ____D () C:\Users\Tom\Desktop\zoek
2014-08-31 09:38 - 2014-08-31 09:38 - 04245477 _____ () C:\Users\Tom\Desktop\zoek.rar
2014-08-31 09:02 - 2014-08-31 09:02 - 00002908 _____ () C:\Windows\System32\Tasks\{CA69402D-AAC4-43FC-9E05-4DBA1AF05B12}
2014-08-31 09:02 - 2014-08-31 09:02 - 00002908 _____ () C:\Windows\System32\Tasks\{B2DB47BE-B0F1-4862-A666-DCF0ACB900B1}
2014-08-30 19:13 - 2014-08-30 19:13 - 00001043 _____ () C:\Users\Tom\Desktop\JRT.txt
2014-08-30 19:08 - 2014-08-30 19:08 - 00000000 ____D () C:\Windows\ERUNT
2014-08-30 19:07 - 2014-08-30 19:07 - 01016261 _____ (Thisisu) C:\Users\Tom\Desktop\JRT.exe
2014-08-30 19:02 - 2014-08-31 11:56 - 00017634 _____ () C:\Users\Tom\Desktop\FRST.txt
2014-08-30 19:02 - 2014-08-31 11:56 - 00000000 ____D () C:\FRST
2014-08-30 19:02 - 2014-08-30 19:03 - 00033929 _____ () C:\Users\Tom\Desktop\Addition.txt
2014-08-30 19:01 - 2014-08-30 19:01 - 02103808 _____ (Farbar) C:\Users\Tom\Desktop\FRST64.exe
2014-08-30 18:28 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-30 18:27 - 2014-08-30 19:15 - 00000000 ____D () C:\AdwCleaner
2014-08-30 18:27 - 2014-08-30 18:23 - 01364531 _____ () C:\Users\Tom\Desktop\adwcleaner_3.308.exe
2014-08-30 17:52 - 2014-08-30 17:52 - 00000000 ____D () C:\Users\Tom\Documents\Fax
2014-08-30 17:26 - 2014-08-30 17:45 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-08-30 17:26 - 2014-08-30 17:26 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-08-30 17:26 - 2014-08-30 17:26 - 00000000 _____ () C:\autoexec.bat
2014-08-30 15:32 - 2014-08-30 18:29 - 00000000 ____D () C:\Windows\system32\log
2014-08-30 13:21 - 2014-08-30 14:51 - 00000000 ____D () C:\Users\Tom\AppData\Local\Apps\Windows 7 USB DVD Download Tool
2014-08-30 13:12 - 2014-08-30 18:41 - 00000000 ____D () C:\WinSetupFromUSB
2014-08-30 13:08 - 2014-08-31 09:58 - 00007496 _____ () C:\Windows\PFRO.log
2014-08-30 13:08 - 2014-08-31 09:58 - 00000616 _____ () C:\Windows\setupact.log
2014-08-30 13:08 - 2014-08-30 13:08 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-29 19:31 - 2014-08-29 19:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-08-29 14:51 - 2014-08-29 14:51 - 00004304 _____ () C:\Windows\System32\Tasks\Installer_shopperpro
2014-08-29 11:31 - 2014-08-30 13:36 - 00004536 _____ () C:\Windows\System32\Tasks\YTAHelper
2014-08-29 11:31 - 2014-08-30 13:36 - 00003426 _____ () C:\Windows\System32\Tasks\YTAUpdate
2014-08-29 11:31 - 2014-08-30 13:36 - 00003240 _____ () C:\Windows\System32\Tasks\YTAUpdate_logon
2014-08-29 11:31 - 2014-08-29 11:31 - 00000000 ____D () C:\Users\Tom\AppData\Local\CrashRpt
2014-08-29 11:28 - 2014-08-29 12:58 - 00000000 ____D () C:\Program Files (x86)\StreamTransport
2014-08-29 07:53 - 2014-08-29 07:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2014-08-29 07:51 - 2014-08-29 07:51 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-08-29 07:51 - 2014-08-29 07:51 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-08-29 05:38 - 2014-08-29 05:38 - 00000000 ____D () C:\Users\Tom\AppData\Local\Adobe
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-08-28 18:31 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 18:31 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 18:31 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-27 20:40 - 2014-08-27 20:45 - 00000648 _____ () C:\Users\Tom\Desktop\Babovka masožrava od Hrušky.txt
2014-08-24 20:09 - 2014-08-24 20:09 - 34048757 _____ () C:\Users\Tom\Desktop\jun def 6.mp4
2014-08-17 12:11 - 2014-08-17 12:26 - 00000000 ____D () C:\Users\Tom\Desktop\Kowal zaloha
2014-08-14 21:29 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-14 21:29 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-14 21:29 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-14 21:29 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-14 21:29 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-14 21:29 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-14 21:28 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-14 21:28 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-14 19:20 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-14 19:20 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-14 19:20 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-14 19:20 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-14 19:20 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-14 19:20 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-14 19:20 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-14 19:20 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-14 19:20 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-14 19:20 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-14 19:20 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-14 19:20 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-14 19:19 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-14 19:19 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-14 19:19 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-14 19:19 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-14 19:19 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-14 19:19 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-14 19:19 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-14 19:19 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-14 19:19 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-14 19:19 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-14 19:19 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-14 19:19 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-14 19:19 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-14 19:19 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-14 19:19 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-14 19:19 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-14 19:19 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-14 19:19 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-14 19:19 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-14 19:19 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-14 19:19 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-14 19:19 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-14 19:19 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-14 19:19 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-14 19:19 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-14 19:19 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-14 19:19 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-14 19:19 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-14 19:19 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-14 19:19 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-14 19:19 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-14 19:19 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-14 19:19 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-14 19:19 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-14 19:19 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-14 19:19 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-14 19:19 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-14 19:19 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-14 19:19 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-14 19:19 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-14 19:19 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-14 19:19 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-14 19:19 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-14 19:19 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-14 19:19 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-14 19:19 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-14 19:19 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-14 19:19 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-14 19:19 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-14 19:19 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-14 19:19 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-14 19:19 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-14 19:19 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-14 19:19 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-14 19:19 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-14 19:19 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-14 19:19 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-14 19:19 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-14 19:19 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-14 19:19 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-14 19:19 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-14 19:19 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-14 19:19 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-14 19:19 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-14 19:19 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-14 19:19 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-14 19:19 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-14 19:19 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-14 19:19 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-14 19:19 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-14 19:19 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-14 19:19 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-06 08:18 - 2014-08-06 08:18 - 00000000 ____D () C:\Users\Tom\Documents\Poznámkové bloky aplikace OneNote
2014-08-05 22:00 - 2014-08-07 12:24 - 00000000 ____D () C:\Users\Tom\Desktop\FreeRapid-0.9u4
2014-08-05 22:00 - 2014-08-05 22:00 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\VitySoft
2014-08-05 22:00 - 2014-08-05 22:00 - 00000000 ____D () C:\Users\Tom\.objectdb
2014-08-04 18:53 - 2014-08-04 18:54 - 00000000 ____D () C:\Users\Tom\Desktop\gabka tel
2014-08-04 14:53 - 2014-08-04 14:53 - 00000000 ____D () C:\Users\Tom\Desktop\děda ERA

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-31 11:56 - 2014-08-30 19:02 - 00017634 _____ () C:\Users\Tom\Desktop\FRST.txt
2014-08-31 11:56 - 2014-08-30 19:02 - 00000000 ____D () C:\FRST
2014-08-31 11:28 - 2014-04-21 14:02 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-31 11:21 - 2014-04-21 13:58 - 00000946 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-31 10:59 - 2014-06-08 13:59 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Skype
2014-08-31 10:06 - 2009-07-14 06:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-31 10:06 - 2009-07-14 06:45 - 00031312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-31 10:04 - 2014-04-21 15:50 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Seznam.cz
2014-08-31 10:03 - 2010-11-21 11:27 - 00668138 _____ () C:\Windows\system32\perfh005.dat
2014-08-31 10:03 - 2010-11-21 11:27 - 00140798 _____ () C:\Windows\system32\perfc005.dat
2014-08-31 10:03 - 2009-07-14 07:13 - 01582262 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-31 09:59 - 2014-08-31 09:59 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Mediaresearch.SimStream
2014-08-31 09:59 - 2014-08-31 09:40 - 00011619 _____ () C:\zoek-results.log
2014-08-31 09:59 - 2014-04-21 13:58 - 00000942 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-31 09:59 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-31 09:58 - 2014-08-30 13:08 - 00007496 _____ () C:\Windows\PFRO.log
2014-08-31 09:58 - 2014-08-30 13:08 - 00000616 _____ () C:\Windows\setupact.log
2014-08-31 09:58 - 2014-04-21 14:22 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-08-31 09:58 - 2014-04-21 12:55 - 01680041 _____ () C:\Windows\WindowsUpdate.log
2014-08-31 09:49 - 2014-08-31 09:39 - 00000000 ____D () C:\zoek_backup
2014-08-31 09:49 - 2014-04-21 12:56 - 00000000 ____D () C:\Users\Tom
2014-08-31 09:39 - 2014-08-31 09:39 - 00000000 ____D () C:\Users\Tom\Desktop\zoek
2014-08-31 09:38 - 2014-08-31 09:38 - 04245477 _____ () C:\Users\Tom\Desktop\zoek.rar
2014-08-31 09:02 - 2014-08-31 09:02 - 00002908 _____ () C:\Windows\System32\Tasks\{CA69402D-AAC4-43FC-9E05-4DBA1AF05B12}
2014-08-31 09:02 - 2014-08-31 09:02 - 00002908 _____ () C:\Windows\System32\Tasks\{B2DB47BE-B0F1-4862-A666-DCF0ACB900B1}
2014-08-31 09:00 - 2014-04-21 14:08 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-08-30 22:45 - 2014-04-21 14:51 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Mumble
2014-08-30 20:28 - 2014-04-21 14:57 - 00000000 ____D () C:\World_of_Tanks
2014-08-30 19:15 - 2014-08-30 18:27 - 00000000 ____D () C:\AdwCleaner
2014-08-30 19:13 - 2014-08-30 19:13 - 00001043 _____ () C:\Users\Tom\Desktop\JRT.txt
2014-08-30 19:08 - 2014-08-30 19:08 - 00000000 ____D () C:\Windows\ERUNT
2014-08-30 19:07 - 2014-08-30 19:07 - 01016261 _____ (Thisisu) C:\Users\Tom\Desktop\JRT.exe
2014-08-30 19:03 - 2014-08-30 19:02 - 00033929 _____ () C:\Users\Tom\Desktop\Addition.txt
2014-08-30 19:01 - 2014-08-30 19:01 - 02103808 _____ (Farbar) C:\Users\Tom\Desktop\FRST64.exe
2014-08-30 18:44 - 2014-05-17 12:06 - 00000000 ____D () C:\Users\Tom\Desktop\Mažoretky pravidla
2014-08-30 18:42 - 2014-07-18 08:09 - 00000000 ____D () C:\Program Files (x86)\Kresleni
2014-08-30 18:42 - 2014-05-16 17:23 - 00000000 ____D () C:\Program Files (x86)\IrfanView
2014-08-30 18:41 - 2014-08-30 13:12 - 00000000 ____D () C:\WinSetupFromUSB
2014-08-30 18:29 - 2014-08-30 15:32 - 00000000 ____D () C:\Windows\system32\log
2014-08-30 18:29 - 2014-04-22 13:27 - 00000000 ____D () C:\ProgramData\Temp
2014-08-30 18:29 - 2014-04-21 13:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-08-30 18:29 - 2009-07-14 04:34 - 00000580 _____ () C:\Windows\win.ini
2014-08-30 18:23 - 2014-08-30 18:27 - 01364531 _____ () C:\Users\Tom\Desktop\adwcleaner_3.308.exe
2014-08-30 17:52 - 2014-08-30 17:52 - 00000000 ____D () C:\Users\Tom\Documents\Fax
2014-08-30 17:45 - 2014-08-30 17:26 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-08-30 17:26 - 2014-08-30 17:26 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-08-30 17:26 - 2014-08-30 17:26 - 00000000 _____ () C:\autoexec.bat
2014-08-30 15:32 - 2014-04-21 12:57 - 00001599 _____ () C:\Users\Tom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-30 15:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-30 14:51 - 2014-08-30 13:21 - 00000000 ____D () C:\Users\Tom\AppData\Local\Apps\Windows 7 USB DVD Download Tool
2014-08-30 14:43 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-08-30 13:36 - 2014-08-29 11:31 - 00004536 _____ () C:\Windows\System32\Tasks\YTAHelper
2014-08-30 13:36 - 2014-08-29 11:31 - 00003426 _____ () C:\Windows\System32\Tasks\YTAUpdate
2014-08-30 13:36 - 2014-08-29 11:31 - 00003240 _____ () C:\Windows\System32\Tasks\YTAUpdate_logon
2014-08-30 13:35 - 2014-05-06 11:16 - 00000000 ____D () C:\Program Files (x86)\Seznam.cz
2014-08-30 13:10 - 2014-05-06 07:43 - 00000000 ____D () C:\Users\Tom\Desktop\Nová složka
2014-08-30 13:08 - 2014-08-30 13:08 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-29 19:33 - 2014-04-22 10:42 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-29 19:31 - 2014-08-29 19:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-08-29 14:51 - 2014-08-29 14:51 - 00004304 _____ () C:\Windows\System32\Tasks\Installer_shopperpro
2014-08-29 14:43 - 2014-05-17 11:03 - 00000000 ____D () C:\Windows\Minidump
2014-08-29 14:43 - 2014-05-04 13:51 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\Vso
2014-08-29 14:43 - 2014-05-04 13:50 - 00000000 ____D () C:\ProgramData\VSO
2014-08-29 14:43 - 2014-04-21 13:47 - 00000000 ____D () C:\Windows\Panther
2014-08-29 12:58 - 2014-08-29 11:28 - 00000000 ____D () C:\Program Files (x86)\StreamTransport
2014-08-29 11:31 - 2014-08-29 11:31 - 00000000 ____D () C:\Users\Tom\AppData\Local\CrashRpt
2014-08-29 10:20 - 2014-04-21 13:57 - 00111104 _____ () C:\Users\Tom\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-29 10:20 - 2009-07-14 06:45 - 00420816 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-29 07:53 - 2014-08-29 07:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2014-08-29 07:51 - 2014-08-29 07:51 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-08-29 07:51 - 2014-08-29 07:51 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-08-29 07:51 - 2014-04-22 10:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-08-29 06:43 - 2014-04-22 13:14 - 00001120 _____ () C:\Users\Tom\AppData\Local\MRDownloader.nast
2014-08-29 05:38 - 2014-08-29 05:38 - 00000000 ____D () C:\Users\Tom\AppData\Local\Adobe
2014-08-29 05:36 - 2014-04-21 14:02 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-29 05:36 - 2014-04-21 14:02 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-29 05:36 - 2014-04-21 14:02 - 00003852 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-08-28 20:02 - 2014-08-28 20:02 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-08-27 20:45 - 2014-08-27 20:40 - 00000648 _____ () C:\Users\Tom\Desktop\Babovka masožrava od Hrušky.txt
2014-08-27 18:39 - 2014-07-20 19:11 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-08-27 18:39 - 2014-07-20 19:11 - 00000000 ____D () C:\Program Files\Java
2014-08-27 18:39 - 2014-07-11 13:24 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-24 20:09 - 2014-08-24 20:09 - 34048757 _____ () C:\Users\Tom\Desktop\jun def 6.mp4
2014-08-24 11:03 - 2014-07-30 09:58 - 00002026 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2014-08-24 11:03 - 2014-07-30 09:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-08-24 11:03 - 2014-04-21 14:44 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-08-23 04:07 - 2014-08-28 18:31 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 18:31 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 18:31 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 14:06 - 2014-04-21 14:38 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-19 11:15 - 2014-06-03 16:58 - 00003816 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1398081438
2014-08-19 11:15 - 2014-04-21 13:57 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-08-17 12:26 - 2014-08-17 12:11 - 00000000 ____D () C:\Users\Tom\Desktop\Kowal zaloha
2014-08-15 19:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-15 16:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-14 21:32 - 2014-04-21 13:11 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-14 21:31 - 2014-04-21 13:11 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-14 21:28 - 2014-05-06 08:42 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 20:26 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-08-11 19:12 - 2014-07-30 17:20 - 00000000 ____D () C:\Users\Tom\Desktop\Fotky telefon
2014-08-11 17:19 - 2014-06-10 17:27 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\abgx360
2014-08-07 12:24 - 2014-08-05 22:00 - 00000000 ____D () C:\Users\Tom\Desktop\FreeRapid-0.9u4
2014-08-07 12:24 - 2014-04-23 18:45 - 00000000 ____D () C:\Users\Mcx1-PC
2014-08-07 12:24 - 2014-04-23 11:48 - 00000000 ____D () C:\Users\Tom\AppData\Local\Cyberlink SoftDMA
2014-08-07 12:24 - 2014-04-21 12:56 - 00000000 ____D () C:\Users\Tom\AppData\Local\VirtualStore
2014-08-07 12:24 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-07 11:26 - 2014-04-21 14:08 - 00001992 _____ () C:\Users\Public\Desktop\avast! SafeZone.lnk
2014-08-07 04:06 - 2014-08-14 19:19 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-14 19:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-06 08:18 - 2014-08-06 08:18 - 00000000 ____D () C:\Users\Tom\Documents\Poznámkové bloky aplikace OneNote
2014-08-05 22:00 - 2014-08-05 22:00 - 00000000 ____D () C:\Users\Tom\AppData\Roaming\VitySoft
2014-08-05 22:00 - 2014-08-05 22:00 - 00000000 ____D () C:\Users\Tom\.objectdb
2014-08-05 09:20 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-04 18:54 - 2014-08-04 18:53 - 00000000 ____D () C:\Users\Tom\Desktop\gabka tel
2014-08-04 14:53 - 2014-08-04 14:53 - 00000000 ____D () C:\Users\Tom\Desktop\děda ERA
2014-08-01 01:41 - 2014-08-14 19:19 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-14 19:19 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-31 10:16

==================== End Of Log ============================
Nahoru
tomastt
Návštěvník
Návštěvník
Příspěvky: 84
Registrován: 27 Srp 2008 17:56

Re: Win32:Adware-gen

#12 Příspěvek od tomastt »

co dál??
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Win32:Adware-gen

#13 Příspěvek od vyosek »

:arrow: Omlouvam se, pracovni povinnosti

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] => D:\Programy\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [PowerDVD13Agent] => D:\Programy\CyberLink\PowerDVD13\PowerDVD13\PowerDVD13Agent.exe [517144 2013-07-05] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-07-30] (Oracle Corporation)
HKLM-x32\...\Run: [seznam-listicka-distribuce] => C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [cz.seznam.software.autoupdate] => C:\Users\Tom\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [cz.seznam.software.szndesktop] => C:\Users\Tom\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [467680 2014-07-30] (Sony)

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
C:\Program Files\Enigma Software Group

2014-08-31 09:51 - 2014-02-13 23:59 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-31 09:40 - 2014-08-31 09:59 - 00011619 _____ () C:\zoek-results.log
2014-08-31 09:39 - 2014-08-31 09:49 - 00000000 ____D () C:\zoek_backup
2014-08-31 09:39 - 2014-08-31 09:39 - 00000000 ____D () C:\Users\Tom\Desktop\zoek
2014-08-31 09:38 - 2014-08-31 09:38 - 04245477 _____ () C:\Users\Tom\Desktop\zoek.rar
2014-08-31 09:02 - 2014-08-31 09:02 - 00002908 _____ () C:\Windows\System32\Tasks\{CA69402D-AAC4-43FC-9E05-4DBA1AF05B12}
2014-08-31 09:02 - 2014-08-31 09:02 - 00002908 _____ () C:\Windows\System32\Tasks\{B2DB47BE-B0F1-4862-A666-DCF0ACB900B1}
2014-08-30 19:13 - 2014-08-30 19:13 - 00001043 _____ () C:\Users\Tom\Desktop\JRT.txt
2014-08-30 19:08 - 2014-08-30 19:08 - 00000000 ____D () C:\Windows\ERUNT
2014-08-30 19:07 - 2014-08-30 19:07 - 01016261 _____ (Thisisu) C:\Users\Tom\Desktop\JRT.exe
2014-08-30 19:02 - 2014-08-31 11:56 - 00017634 _____ () C:\Users\Tom\Desktop\FRST.txt
2014-08-30 19:02 - 2014-08-30 19:03 - 00033929 _____ () C:\Users\Tom\Desktop\Addition.txt
2014-08-30 18:28 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-30 18:27 - 2014-08-30 19:15 - 00000000 ____D () C:\AdwCleaner
2014-08-30 18:27 - 2014-08-30 18:23 - 01364531 _____ () C:\Users\Tom\Desktop\adwcleaner_3.308.exe
2014-08-29 14:51 - 2014-08-29 14:51 - 00004304 _____ () C:\Windows\System32\Tasks\Installer_shopperpro
2014-08-29 11:31 - 2014-08-30 13:36 - 00004536 _____ () C:\Windows\System32\Tasks\YTAHelper
2014-08-29 11:31 - 2014-08-30 13:36 - 00003426 _____ () C:\Windows\System32\Tasks\YTAUpdate
2014-08-29 11:31 - 2014-08-30 13:36 - 00003240 _____ () C:\Windows\System32\Tasks\YTAUpdate_logon

Hosts:
Reboot:
End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
tomastt
Návštěvník
Návštěvník
Příspěvky: 84
Registrován: 27 Srp 2008 17:56

Re: Win32:Adware-gen

#14 Příspěvek od tomastt »

doufám že je to ono

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 31-08-2014 02
Ran by Tom at 2014-09-01 19:03:12 Run:1
Running from C:\Users\Tom\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] => D:\Programy\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [PowerDVD13Agent] => D:\Programy\CyberLink\PowerDVD13\PowerDVD13\PowerDVD13Agent.exe [517144 2013-07-05] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-07-30] (Oracle Corporation)
HKLM-x32\...\Run: [seznam-listicka-distribuce] => C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [cz.seznam.software.autoupdate] => C:\Users\Tom\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [cz.seznam.software.szndesktop] => C:\Users\Tom\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [92664 2013-04-12] ()
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [467680 2014-07-30] (Sony)

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
C:\Program Files\Enigma Software Group

2014-08-31 09:51 - 2014-02-13 23:59 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-08-31 09:40 - 2014-08-31 09:59 - 00011619 _____ () C:\zoek-results.log
2014-08-31 09:39 - 2014-08-31 09:49 - 00000000 ____D () C:\zoek_backup
2014-08-31 09:39 - 2014-08-31 09:39 - 00000000 ____D () C:\Users\Tom\Desktop\zoek
2014-08-31 09:38 - 2014-08-31 09:38 - 04245477 _____ () C:\Users\Tom\Desktop\zoek.rar
2014-08-31 09:02 - 2014-08-31 09:02 - 00002908 _____ () C:\Windows\System32\Tasks\{CA69402D-AAC4-43FC-9E05-4DBA1AF05B12}
2014-08-31 09:02 - 2014-08-31 09:02 - 00002908 _____ () C:\Windows\System32\Tasks\{B2DB47BE-B0F1-4862-A666-DCF0ACB900B1}
2014-08-30 19:13 - 2014-08-30 19:13 - 00001043 _____ () C:\Users\Tom\Desktop\JRT.txt
2014-08-30 19:08 - 2014-08-30 19:08 - 00000000 ____D () C:\Windows\ERUNT
2014-08-30 19:07 - 2014-08-30 19:07 - 01016261 _____ (Thisisu) C:\Users\Tom\Desktop\JRT.exe
2014-08-30 19:02 - 2014-08-31 11:56 - 00017634 _____ () C:\Users\Tom\Desktop\FRST.txt
2014-08-30 19:02 - 2014-08-30 19:03 - 00033929 _____ () C:\Users\Tom\Desktop\Addition.txt
2014-08-30 18:28 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-30 18:27 - 2014-08-30 19:15 - 00000000 ____D () C:\AdwCleaner
2014-08-30 18:27 - 2014-08-30 18:23 - 01364531 _____ () C:\Users\Tom\Desktop\adwcleaner_3.308.exe
2014-08-29 14:51 - 2014-08-29 14:51 - 00004304 _____ () C:\Windows\System32\Tasks\Installer_shopperpro
2014-08-29 11:31 - 2014-08-30 13:36 - 00004536 _____ () C:\Windows\System32\Tasks\YTAHelper
2014-08-29 11:31 - 2014-08-30 13:36 - 00003426 _____ () C:\Windows\System32\Tasks\YTAUpdate
2014-08-29 11:31 - 2014-08-30 13:36 - 00003240 _____ () C:\Windows\System32\Tasks\YTAUpdate_logon

Hosts:
Reboot:
End
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\GrooveMonitor => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\PowerDVD13Agent => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\seznam-listicka-distribuce => value deleted successfully.
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\Software\Microsoft\Windows\CurrentVersion\Run\\cz.seznam.software.autoupdate => value deleted successfully.
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\Software\Microsoft\Windows\CurrentVersion\Run\\cz.seznam.software.szndesktop => value deleted successfully.
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Skype => value deleted successfully.
HKU\S-1-5-21-3424097178-4144622376-3597314994-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Sony PC Companion => value deleted successfully.
esgiguard => Service deleted successfully.
C:\Program Files\Enigma Software Group => Moved successfully.
C:\Windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\Tom\Desktop\zoek => Moved successfully.
C:\Users\Tom\Desktop\zoek.rar => Moved successfully.
C:\Windows\System32\Tasks\{CA69402D-AAC4-43FC-9E05-4DBA1AF05B12} => Moved successfully.
C:\Windows\System32\Tasks\{B2DB47BE-B0F1-4862-A666-DCF0ACB900B1} => Moved successfully.
C:\Users\Tom\Desktop\JRT.txt => Moved successfully.
C:\Windows\ERUNT => Moved successfully.
C:\Users\Tom\Desktop\JRT.exe => Moved successfully.
C:\Users\Tom\Desktop\FRST.txt => Moved successfully.
C:\Users\Tom\Desktop\Addition.txt => Moved successfully.
C:\Windows\SysWOW64\sqlite3.dll => Moved successfully.
C:\AdwCleaner => Moved successfully.
C:\Users\Tom\Desktop\adwcleaner_3.308.exe => Moved successfully.
C:\Windows\System32\Tasks\Installer_shopperpro => Moved successfully.
C:\Windows\System32\Tasks\YTAHelper => Moved successfully.
C:\Windows\System32\Tasks\YTAUpdate => Moved successfully.
C:\Windows\System32\Tasks\YTAUpdate_logon => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.


The system needed a reboot.

==== End of Fixlog ====
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Win32:Adware-gen

#15 Příspěvek od vyosek »

Ano, v poradku :)

Jak se chova PC??
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Zamčeno

Vrátit se na „Řešení problémů, logy“