Prosim o pomoc - podozrive spravanie

[yossarian2]

Dobry den,
prosim o kontrolu logu. PC zdanlivo pracuje spravne, ale:
- systemovy disk C: sa dost rychlo zacal zaplnat datami (neviem zistit, akymi)
- Avast! pri aktualizacii firefox-u hlasi, ze zablokoval subor "helper.exe"
PRIKLADAM:
- AdwCleaner detekoval a vycistil (log pod texom)
- dalej nasleduje vypis FRST, v prilohe addition.txt
Vopred dakujem.
Jozo

# AdwCleaner v4.101 - Report created 11/11/2014 at 05:42:20
# Updated 09/11/2014 by Xplode
# Database : 2014-11-10.9 [Live]
# Operating System : Windows 7 Ultimate Service Pack 1 (32 bits)
# Username : janka - JANKA-PC
# Running from : C:\Users\janka\Desktop\adwcleaner_4.101.exe
# Option : Clean

***** [ Services ] *****

[#] Service Deleted : KMService

***** [ Files / Folders ] *****

File Deleted : C:\Windows\system32\srvany.exe

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3E288F79-03E4-4983-A48E-0D879B51FF19}
Key Deleted : HKCU\Software\dt soft\daemon tools toolbar
Key Deleted : HKLM\SOFTWARE\dt soft\daemon tools toolbar

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v34.0 (x86 cs)


*************************

AdwCleaner[R0].txt - [1042 octets] - [11/11/2014 05:26:51]
AdwCleaner[S0].txt - [952 octets] - [11/11/2014 05:42:20]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1011 octets] ########

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10-11-2014
Ran by janka (administrator) on JANKA-PC on 11-11-2014 08:21:24
Running from C:\Users\janka\Desktop
Loaded Profile: janka (Available profiles: janka)
Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: Slovenčina (Slovensko)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Computer, Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Nalpeiron Ltd.) C:\Windows\System32\nlssrv32.exe
(Crawler.com) C:\Program Files\Spyware Terminator\st_rsser.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Crawler.com) C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Realtek Semiconductor Corp.) C:\Users\janka\AppData\Local\Temp\RtkBtMnt.exe
(acer) C:\Program Files\Acer\Empowering Technology\ePower\ePowerSvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Crawler.com) C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(C. Ghisler & Co.) C:\Program Files\Total Commander\TOTALCMD.EXE
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox 4.0 Beta 7\firefox.exe
(forum.viry.cz) C:\Users\janka\Desktop\FRSTLauncher.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-23] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1557800 2009-08-28] (Synaptics Incorporated)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-01-21] (Microsoft Corporation)
HKLM\...\Run: [eAudio] => C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe [1286144 2007-04-26] (CyberLink)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [IaNvSrv] => C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe [33304 2009-07-13] (Intel Corporation)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5223016 2014-11-01] (AVAST Software)
HKU\S-1-5-21-192176685-3027731864-3682753610-1000\...\MountPoints2: {38a766b6-537f-11e4-97a0-001b247917f7} - F:\AutoRun.exe
HKU\S-1-5-21-192176685-3027731864-3682753610-1000\...\MountPoints2: {38a766bd-537f-11e4-97a0-001b247917f7} - F:\AutoRun.exe
HKU\S-1-5-21-192176685-3027731864-3682753610-1000\...\MountPoints2: {5de8db8c-f8db-11df-bdf8-001b247917f7} - G:\autorun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk
ShortcutTarget: Empowering Technology Launcher.lnk -> C:\Program Files\Acer\Empowering Technology\eAPLauncher.exe (Acer Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xCAD9DA8CDB8CCB01
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [94208] (Apple Computer, Inc.)
Tcpip\Parameters: [DhcpNameServer] 195.146.132.58 195.146.128.62

FireFox:
========
FF ProfilePath: C:\Users\janka\AppData\Roaming\Mozilla\Firefox\Profiles\n3ytitto.default
FF Homepage: about:home
FF NetworkProxy: "type", 1
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\janka\AppData\Roaming\Mozilla\Firefox\Profiles\n3ytitto.default\searchplugins\duckduckgo.xml
FF SearchPlugin: C:\Users\janka\AppData\Roaming\Mozilla\Firefox\Profiles\n3ytitto.default\searchplugins\facebook-search.xml
FF SearchPlugin: C:\Users\janka\AppData\Roaming\Mozilla\Firefox\Profiles\n3ytitto.default\searchplugins\googletranslate.xml
FF Extension: NetVideoHunter - C:\Users\janka\AppData\Roaming\Mozilla\Firefox\Profiles\n3ytitto.default\Extensions\netvideohunter@netvideohunter.com [2014-08-16]
FF Extension: DownloadHelper - C:\Users\janka\AppData\Roaming\Mozilla\Firefox\Profiles\n3ytitto.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]
FF Extension: Adblock Plus - C:\Users\janka\AppData\Roaming\Mozilla\Firefox\Profiles\n3ytitto.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-10]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-09-06]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox 4.0 Beta 7\firefox.exe

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-10-23]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-10-23] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3192344 2014-10-23] (Avast Software)
R2 Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [229376 2006-02-28] (Apple Computer, Inc.) [File not signed]
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [13080 2010-05-11] (Microsoft Corporation)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2011-07-07] (Macrovision Europe Ltd.) [File not signed]
R2 nlsX86cc; C:\Windows\system32\nlssrv32.exe [66560 2012-01-31] (Nalpeiron Ltd.) [File not signed]
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
R2 ST2012_Svc; C:\Program Files\Spyware Terminator\st_rsser.exe [587912 2013-04-03] (Crawler.com)
R2 WMIService; C:\Program Files\Acer\Empowering Technology\ePower\ePowerSvc.exe [167936 2007-09-20] (acer) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-10-23] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-11-01] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-10-23] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-10-23] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-11-01] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422760 2014-10-23] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [91496 2014-10-23] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2014-10-23] ()
R3 nuvotoncir; C:\Windows\System32\DRIVERS\nuvotoncir.sys [44544 2009-06-24] (Nuvoton Technology Corporation)
S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [104744 2009-03-25] (MCCI Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-11-25] () [File not signed]
R1 sp_rsdrv2; C:\Windows\system32\drivers\sp_rsdrv2.sys [32768 2011-06-21] () [File not signed]
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [218192 2014-10-23] (Avast Software)
S3 WLAN(WLAN); C:\Windows\System32\DRIVERS\zd1211u.sys [248320 2004-10-06] (ZyDAS Technology Corporation) [File not signed]
U3 ab6o1xbt; C:\Windows\system32\Drivers\ab6o1xbt.sys [0 ] (Microsoft Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2010-03-09] () [File not signed]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-11 08:21 - 2014-11-11 08:23 - 00012862 _____ () C:\Users\janka\Desktop\FRST.txt
2014-11-11 08:18 - 2014-11-11 08:21 - 00000000 ____D () C:\FRST
2014-11-11 08:15 - 2014-11-11 08:15 - 00112640 _____ (forum.viry.cz) C:\Users\janka\Desktop\FRSTLauncher.exe
2014-11-11 08:08 - 2014-11-11 08:07 - 01107968 _____ (Farbar) C:\Users\janka\Desktop\FRST.exe
2014-11-11 07:27 - 2014-11-11 07:27 - 00000247 _____ () C:\Windows\system32\2014-11-11-06-27-47.002-aswFe.exe-1188.log
2014-11-11 07:22 - 2014-11-11 07:27 - 00000247 _____ () C:\Windows\system32\2014-11-11-06-22-25.065-aswFe.exe-2776.log
2014-11-11 07:06 - 2014-11-11 07:06 - 00000197 _____ () C:\Windows\system32\2014-11-11-06-06-14.016-AvastVBoxSVC.exe-5676.log
2014-11-11 06:05 - 2014-11-11 06:05 - 00000247 _____ () C:\Windows\system32\2014-11-11-05-05-34.085-aswFe.exe-6128.log
2014-11-11 05:57 - 2014-11-11 06:05 - 00000247 _____ () C:\Windows\system32\2014-11-11-04-57-23.074-aswFe.exe-4736.log
2014-11-11 05:50 - 2014-11-11 05:50 - 00000197 _____ () C:\Windows\system32\2014-11-11-04-50-13.007-AvastVBoxSVC.exe-4576.log
2014-11-11 05:26 - 2014-11-11 07:02 - 00000000 ____D () C:\AdwCleaner
2014-11-11 05:26 - 2014-11-11 01:16 - 02140160 _____ () C:\Users\janka\Desktop\adwcleaner_4.101.exe
2014-11-09 13:13 - 2014-11-09 13:22 - 00000247 _____ () C:\Windows\system32\2014-11-09-12-13-07.087-aswFe.exe-5192.log
2014-11-09 13:03 - 2014-11-09 13:03 - 00000197 _____ () C:\Windows\system32\2014-11-09-12-03-52.097-AvastVBoxSVC.exe-4272.log
2014-11-05 00:33 - 2014-11-09 13:00 - 00000000 ____D () C:\Program Files\Mozilla Firefox 4.0 Beta 7
2014-11-04 15:39 - 2014-11-04 15:46 - 00000247 _____ () C:\Windows\system32\2014-11-04-14-39-57.087-aswFe.exe-4428.log
2014-11-04 15:39 - 2014-11-04 15:39 - 00000197 _____ () C:\Windows\system32\2014-11-04-14-39-53.046-AvastVBoxSVC.exe-4684.log
2014-11-04 15:04 - 2014-10-23 06:22 - 00291352 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-11-03 12:22 - 2014-11-03 12:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-10-28 22:56 - 2014-11-05 00:34 - 00000000 ____D () C:\Program Files\Mozilla Firefox 4.0 Beta 7.bak
2014-10-26 12:31 - 2014-10-26 12:31 - 00000197 _____ () C:\Windows\system32\2014-10-26-11-31-26.055-AvastVBoxSVC.exe-3412.log
2014-10-26 11:56 - 2014-09-29 01:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-26 11:56 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-26 11:56 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-26 11:56 - 2014-09-19 01:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-26 11:56 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-26 11:55 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-26 11:55 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-26 11:55 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-26 11:55 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-26 11:55 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-26 11:55 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-26 11:55 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-26 11:55 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-26 11:55 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-26 11:55 - 2014-09-19 02:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-26 11:55 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-26 11:55 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-26 11:55 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-26 11:55 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-26 11:55 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-26 11:55 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-26 11:55 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-26 11:55 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-26 11:55 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-26 11:55 - 2014-09-19 01:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-26 11:55 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-26 11:55 - 2014-09-19 01:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-26 11:55 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-26 11:55 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-26 11:55 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-26 11:55 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-26 11:55 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-26 11:55 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-26 11:55 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-26 11:55 - 2014-07-17 02:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-26 11:55 - 2014-07-17 02:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-26 11:55 - 2014-07-17 02:39 - 00919552 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-26 11:55 - 2014-07-17 02:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-26 11:55 - 2014-07-17 02:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-26 11:55 - 2014-07-17 02:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-26 11:55 - 2014-07-17 02:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-26 11:55 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-26 11:55 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-26 11:55 - 2014-07-17 02:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-26 11:55 - 2014-07-09 02:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-26 11:55 - 2014-07-09 02:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-26 11:55 - 2014-07-09 02:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-26 11:55 - 2014-07-09 02:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-26 11:55 - 2014-07-09 02:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-26 11:55 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-26 11:55 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-26 11:55 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-26 11:55 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-26 11:54 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-26 11:54 - 2014-07-17 02:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-26 11:51 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-23 14:14 - 2014-10-23 14:14 - 00000197 _____ () C:\Windows\system32\2014-10-23-13-14-31.032-AvastVBoxSVC.exe-3768.log
2014-10-23 06:44 - 2014-10-23 06:44 - 00000247 _____ () C:\Windows\system32\2014-10-23-05-44-18.079-aswFe.exe-6104.log
2014-10-23 06:38 - 2014-10-23 06:38 - 00000197 _____ () C:\Windows\system32\2014-10-23-05-38-02.063-AvastVBoxSVC.exe-3732.log
2014-10-23 06:31 - 2014-10-23 06:31 - 00000000 ____D () C:\Windows\system32\vbox
2014-10-23 06:22 - 2014-11-04 15:04 - 00002005 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2014-10-23 06:22 - 2014-10-23 06:22 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-10-19 10:05 - 2014-10-19 10:05 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-10-15 19:52 - 2007-05-26 13:37 - 00101376 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbmdm.sys
2014-10-15 19:52 - 2007-05-26 13:37 - 00023424 _____ (Huawei Tech. Co., Ltd.) C:\Windows\system32\Drivers\ewdcsc.sys
2014-10-15 19:51 - 2014-10-15 19:51 - 00002135 _____ () C:\Users\Public\Desktop\Mobile Connect.lnk
2014-10-15 19:51 - 2014-10-15 19:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mobile Connect
2014-10-15 19:51 - 2014-10-15 19:51 - 00000000 ____D () C:\Program Files\Huawei technologies

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-11 08:17 - 2014-08-15 23:49 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-11 08:11 - 2009-07-14 05:34 - 00014224 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-11 08:11 - 2009-07-14 05:34 - 00014224 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-11 07:09 - 2014-01-31 15:25 - 01409319 ____N () C:\Windows\WindowsUpdate.log
2014-11-11 07:04 - 2013-07-03 16:32 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-11-11 07:03 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-10 11:16 - 2011-12-03 05:29 - 00000000 ____D () C:\Users\janka\AppData\Roaming\vlc
2014-11-09 13:00 - 2012-03-17 10:58 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-06 18:24 - 2012-05-06 15:35 - 00000000 ____D () C:\Users\janka\AppData\Local\CrashDumps
2014-11-01 09:48 - 2013-09-06 12:28 - 00070384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2014-11-01 09:48 - 2011-02-24 20:20 - 00787800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-10-28 06:35 - 2010-11-25 21:14 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-27 07:18 - 2011-03-04 01:14 - 00716744 _____ () C:\Windows\system32\perfh019.dat
2014-10-27 07:18 - 2011-03-04 01:14 - 00151050 _____ () C:\Windows\system32\perfc019.dat
2014-10-27 07:18 - 2011-03-04 00:31 - 00145744 _____ () C:\Windows\system32\perfh01B.dat
2014-10-27 07:18 - 2011-03-04 00:31 - 00037250 _____ () C:\Windows\system32\perfc01B.dat
2014-10-27 07:18 - 2010-11-25 21:02 - 04345386 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-26 13:24 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2014-10-26 12:44 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-26 12:29 - 2009-07-14 05:33 - 01680568 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-26 12:23 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\sk-SK
2014-10-26 12:23 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\ru-RU
2014-10-26 12:23 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\fr-FR
2014-10-26 12:23 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-10-26 12:13 - 2013-08-12 11:19 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-26 12:01 - 2010-11-25 22:01 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-23 09:04 - 2010-11-25 20:58 - 00000000 ____D () C:\Users\janka
2014-10-23 06:22 - 2014-04-23 03:03 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-10-23 06:22 - 2013-12-18 04:18 - 00091496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-10-23 06:22 - 2013-11-09 11:05 - 00422760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-10-23 06:22 - 2013-09-06 12:29 - 00206248 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-10-23 06:22 - 2013-09-06 12:28 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-10-23 06:22 - 2012-02-24 04:24 - 00081768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-10-20 16:00 - 2010-11-25 21:05 - 00000000 ____D () C:\Users\janka\AppData\Roaming\Adobe
2014-10-19 10:07 - 2013-09-21 07:42 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-19 10:06 - 2014-08-16 08:24 - 00000000 ____D () C:\Program Files\Java
2014-10-19 10:04 - 2014-08-16 08:25 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-10-17 22:28 - 2013-10-01 07:53 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-17 22:28 - 2013-10-01 07:53 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-16 14:54 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-15 19:51 - 2010-11-25 21:27 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information

Some content of TEMP:
====================
C:\Users\janka\AppData\Local\Temp\Quarantine.exe
C:\Users\janka\AppData\Local\Temp\RtkBtMnt.exe
C:\Users\janka\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-05 17:39




===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================

Drive c: () (Fixed) (Total:58.5 GB) (Free:13.35 GB) NTFS
Drive d: () (Fixed) (Total:90.45 GB) (Free:31.82 GB) NTFS
Drive f: (Elements) (Fixed) (Total:1397.26 GB) (Free:236.36 GB) NTFS

Available physical RAM: 851.19 MB
Total physical RAM: 2046.41 MB
Percentage of memory in use: 58%

==================== MBR and Partition Table ==================

Disk: 0 (Size: 513.6 MB) (Disk ID: 05843665)
Partition 1: (Not Active) - (Size=513 MB) - (Type=1B)
Disk: 2 (MBR Code: Windows XP) (Size: 1397.3 GB) (Disk ID: 0013FD67)
Partition 1: (Not Active) - (Size=1397.3 GB) - (Type=07 NTFS)

==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Alternate Data Streams (whitelisted) ==================

AlternateDataStreams: C:\Windows:nlsPreferences

==================== Security Center ==================

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\janka\Desktop" je 3 MB.


***** Startup Programs *****

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Belkin Storage Manager
"C:\Program Files\Belkin Storage Manager\StorageManager.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant
"C:\Program Files\Unlocker\UnlockerAssistant.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^802.11b+g USB Wireless LAN Utility.lnk
C:\PROGRA~1\WLAN\802~1.11B\ZDWlan.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================

Do prilohy skusim dat spakovany "addition.txt"

[JaRon]

ahoj
takze Office je nelegalny a so systemom je to ako

[yossarian2]

fiiiha... počítač dostala priateľka od syna - študenta, aj so systémom. je možné, že je to nejaká "školská" licencia?
naozaj netuším.
j.

[JaRon]

nuz, ak je to nejaka cracknuta pochybna edicia, tak sa problemy casom budu kopit ,,,
+
citat:
TFC http://oldtimer.geekstogo.com/TFC.exe
• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte
+
prescanuj PC s MBAM

[yossarian2]

TFC prebehol úspešne.
MBAM po pár minútach skončil modrou obrazovkou (BSOD).

[JaRon]

pozri aku mas verziu MBAM -
ak mas 2.x, tak ju odinstaluj a daj tam 1.75

[yossarian2]

výsledok testu MBAM 1.75.0.1300:

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware.) 1.75.0.1300
www.malwarebytes.org

Verze: v2014.11.11.04

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.17358
janka :: JANKA-PC [administrátor]

Ochrana: Povolena

11. 11. 2014 13:48:16
mbam-log-2014-11-11 (13-48-16).txt

Typ: Kompletní kontrola (C:\|D:\|F:\|)
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 561871
Uplynulý čas: 2 hodin, 17 minut, 26 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 0
(Žádné škodlivé položky nebyly zjištěny)

(konec)

[JaRon]

ziadna nakaza tam, nie je
mozes odinstalovat Spyware Terminator, postaci obcasny scan s MBAM

[yossarian2]

ĎAKUJEM... taký kameň mi teraz padol zo srdca...

Dám si poradiť. Len MBAM ma vyzýva, aby som si nainštaloval novšiu verziu 2.0.3. a tá spôsobuje modrú smrť...

[JaRon]

hlasky MBAM ignoruj - odscanuje to kvalitne aj 1.75-ka
rado sa stalo