Bonjour service - rootkit

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz

Vážení uživaterlé!
Ve dnech 4. - 6-9.2026 budou někteříí naši členové na každoročním srazu fóra. Žádáme vás, abyste měli strpení, nemusí se na na řešení vašeho problému dostat hned. Děkujeme za pochopení.
Zamčeno
Zpráva
Autor
kenor
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 27 Led 2011 20:18

Bonjour service - rootkit

#1 Příspěvek od kenor »

Dobrý den,

avast! už podruhé zablokoval stejný soubor, tak raději prosím o kontrolu:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Martin at 2014-12-12 13:45:10
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 35 GB (37%) free of 93 GB
Total RAM: 3959 MB (27% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:45:24, on 12.12.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17496)
Boot mode: Normal

Running processes:
D:\Programy\TeamViewer - Version8\TeamViewer.exe
C:\Program Files (x86)\OscarX7Editor5Mode\OscarX7Editor5Mode\OscarEditor.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Users\Martin\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Windows\WebCam\S6000\S6000Mnt.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files\Alwil Software\Avast5\avastui.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Martin\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
D:\Programy\Mozilla Firefox\firefox.exe
C:\Program Files\trend micro\Martin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 89.111.72.170 sslvpn.cez.cz
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Programy\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll
O4 - HKLM\..\Run: [S6000Mnt] C:\Windows\SysWOW64\Rundll32.exe S6000Rmv.dll,WinMainRmv /StartStillMnt
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programy\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [OscarX7Mouse5Mode] "C:\Program Files (x86)\OscarX7Editor5Mode\OscarX7Editor5Mode\OscarEditor.exe" Minimum
O4 - HKCU\..\RunOnce: [Adobe Speed Launcher] 1418386662
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - Startup: Dropbox.lnk = Martin\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Send Image To MindManager - res://D:\Programy\Mindjet MindManager 10\Mm8InternetExplorer.dll/201
O8 - Extra context menu item: Send Link To MindManager - res://D:\Programy\Mindjet MindManager 10\Mm8InternetExplorer.dll/203
O8 - Extra context menu item: Send Page To MindManager - res://D:\Programy\Mindjet MindManager 10\Mm8InternetExplorer.dll/204
O8 - Extra context menu item: Send Text To MindManager - res://D:\Programy\Mindjet MindManager 10\Mm8InternetExplorer.dll/202
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Odeslat do zařízení Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Odeslat do zařízení &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://*.hola.org
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - https://juniper.net/dana-cached/sc/Juni ... Client.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{879AA761-6462-4710-91C6-F03557004351}: NameServer = 127.0.0.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: @C:\Program Files (x86)\Google\Chrome Remote Desktop\39.0.2171.46\remoting_core.dll,-101 (chromoting) - Google Inc. - C:\Program Files (x86)\Google\Chrome Remote Desktop\39.0.2171.46\remoting_host.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: E-MU Audio Service (emaudsv) - Unknown owner - C:\Windows\system32\emaudsv.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Hola Internet Acceleration Service (hola_svc) - Hola Networks Ltd. - C:\Program Files\Hola\app\hola_svc.exe
O23 - Service: Hola Internet Acceleration Updater (hola_updater) - Hola Networks Ltd. - C:\Program Files\Hola\app\hola_updater.exe
O23 - Service: Úložná technologie Intel(R) Rapid (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: OpenVPN Service (OpenVPNService) - The OpenVPN Project - D:\Programy\OpenVPN\bin\openvpnserv.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - D:\Programy\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - D:\Programy\TeamViewer - Version8\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: Vodafone Mobile Connect Service (VmbService) - Vodafone - C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: Mobile Broadband Service (WMCoreService) - Ericsson AB - C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13481 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe 24471872
\??\C:\Windows\system32\conhost.exe "629855982-16389932975067437528701680987817140821879061906-387767861780803041
"C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k NetworkService
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe"
"C:\Program Files (x86)\Google\Chrome Remote Desktop\39.0.2171.46\remoting_host.exe" --type=daemon --host-config="C:\ProgramData\Google\Chrome Remote Desktop\host.json"
"C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe"
"C:\Program Files (x86)\Google\Chrome Remote Desktop\39.0.2171.46\remoting_host.exe" --type=host --daemon-pipe=388
C:\Windows\system32\emaudsv.exe
"C:\Program Files\Hola\app\hola_svc.exe" --service
"C:\Program Files\Hola\app\hola_updater.exe" --service --run-as hola_updater
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"D:\Programy\TeamViewer - Version8\TeamViewer_Service.exe"
"C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe" servicemode
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"D:\Programy\TeamViewer - Version8\TeamViewer.exe"
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
"C:\Program Files (x86)\OscarX7Editor5Mode\OscarX7Editor5Mode\OscarEditor.exe" Minimum
"D:\Programy\TortoiseSVN\bin\TSVNCache.exe"
"C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe"
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Users\Martin\AppData\Roaming\Dropbox\bin\Dropbox.exe" /systemstartup
C:\Windows\WebCam\S6000\S6000Mnt.exe
C:\Windows\SysWOW64\RunDll32.exe "C:\Program Files\WIDCOMM\Bluetooth Software\SysWOW64\BtMmHook.dll",SetAndWaitBtMmHook
"C:\Program Files\Alwil Software\Avast5\avastui.exe" /nogui
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"D:\Programy\TeamViewer - Version8\tv_w32.exe" --action hooks --log D:\Programy\TeamViewer - Version8\TeamViewer8_Logfile.log
"D:\Programy\TeamViewer - Version8\tv_x64.exe" --action hooks --log D:\Programy\TeamViewer - Version8\TeamViewer8_Logfile.log
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\Windows\system32\svchost.exe -k SDRSVC
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="4740.0.1281098823\1506249958" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,17,38 --disable-accelerated-video-decode --gpu-vendor-id=0x1002 --gpu-device-id=0x68e0 --gpu-driver-vendor="ATI Technologies Inc." --gpu-driver-version=8.812.0.0 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.3.477813537\1611938529" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.4.853619056\1475342690" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.5.172616717\1452680219" /prefetch:673131151
"C:\Windows\system32\wuauclt.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.9.1160519866\353153134" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.10.1734240463\1697399935" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.11.275223571\945703498" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.12.749884493\205028366" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.13.878999497\584471851" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.14.339449951\110499963" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.17.1744831894\1986343316" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=plugin --plugin-path="C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll" --lang=cs --channel="4740.18.870376639\2119072625" /prefetch:-390060480
"C:\Users\Martin\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=ppapi --channel="4740.19.907005341\1314543902" --ppapi-flash-args=enable_hw_video_decode=1 --lang=cs --ignored=" --type=renderer " /prefetch:-632637702
"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/DomRel-Enable/enable/EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Disabled/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/StableBookmarksIndexURLs/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-1-Percent/group_99/UMA-Uniformity-Trial-10-Percent/group_08/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/default/UMA-Uniformity-Trial-5-Percent/group_09/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --disable-accelerated-video-decode --channel="4740.22.515509790\1173570614" /prefetch:673131151
"D:\Programy\Mozilla Firefox\firefox.exe"

"C:\Users\Martin\Downloads\RSITx64.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job - C:\Users\Martin\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job - C:\Users\Martin\AppData\Local\Facebook\Update\FacebookUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job - C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job - C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default

prefs.js - "browser.startup.homepage" - "www.google.com"
prefs.js - "extensions.enabledItems" - "{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23, {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6, {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.1.1, {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8, {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.16"
prefs.js - "keyword.URL" - "https://www.google.com/search"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.246 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0]
"Description"=DivX Plus Web Player
"Path"=C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0]
"Description"=DivX VOD Helper Plug-in
"Path"=C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.3.1]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=D:\Programy\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=D:\Programy\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.3]
"Description"=VLC Multimedia Plugin
"Path"=D:\Programy\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@vmware.com/vmrc,version=2.5.0.00000]
"Description"=
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.246 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.25.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL


D:\Programy\Mozilla Firefox\components\
nsIQTScriptablePlugin.xpt

D:\Programy\Mozilla Firefox\plugins\
NPOFF12.DLL
nppdf32.dll
npqtplugin.dll
npqtplugin2.dll
npqtplugin3.dll
npqtplugin4.dll
npqtplugin5.dll
npwachk.dll
QuickTimePlugin.class

C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\extensions\
{6AC85730-7D0F-4de0-B3FA-21142DD85326}

C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\searchplugins\
Google.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2014-05-18 581824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4}]
DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08 3118976]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{593DDEC6-7468-4cdd-90E1-42DADAA222E9}]
DivX HiQ - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-02-08 3118976]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\ssv.dll [2012-01-10 341888]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2014-05-18 436600]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - D:\Programy\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll [2012-01-10 59272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2009-05-21 295936]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2009-09-17 1842472]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-01-29 10038304]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OscarX7Mouse5Mode"=C:\Program Files (x86)\OscarX7Editor5Mode\OscarX7Editor5Mode\OscarEditor.exe [2012-03-20 3521024]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Adobe Speed Launcher"=1418386662 []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
C:\Users\Martin\AppData\Roaming\BitTorrent\BitTorrent.exe [2014-11-26 1388888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EaseUS EPM tray]
D:\Programy\EaseUS Partition Master 10.0\bin\EpmNews.exe [2014-03-06 2086568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EaseUS EPM Tray Agent]
D:\Programy\EaseUS Partition Master 10.0\bin\TrayPopupE\TrayTipAgentE.exe [2014-02-13 254024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
C:\Users\Martin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-28 138096]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GarenaPlus]
D:\Programy\Garena Plus\GarenaMessenger.exe [2012-12-17 9152968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
C:\Program Files (x86)\Google\Google Talk\googletalk.exe [2007-01-01 3739648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hola]
C:\Program Files\Hola\app\hola.exe [2014-11-04 1404904]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMReminderService]
D:\Programy\Mindjet MindManager 10\MMReminderService.exe [2011-09-14 37728]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MobileBroadband]
C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [2013-03-25 76288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
D:\Programy\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-01-04 336384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VmbNotifier]
C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbNotifier.exe [2013-03-25 1861632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Martin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GameRanger.lnk]
C:\Users\Martin\AppData\Roaming\GAMERA~1\GAMERA~2\GAMERA~1.EXE [2014-07-07 1837224]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"S6000Mnt"=C:\Windows\SysWOW64\Rundll32.exe [2009-07-14 44544]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2009-12-23 284696]
"UpdReg"=C:\Windows\UpdReg.EXE [2000-05-11 90112]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2013-04-21 59720]
"QuickTime Task"=D:\Programy\QuickTime\QTTask.exe [2013-05-01 421888]
"AvastUI.exe"=C:\Program Files\Alwil Software\Avast5\AvastUI.exe [2014-08-07 3890208]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20 1021128]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\Martin\AppData\Roaming\Dropbox\bin\Dropbox.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"VIDC.TMB0"=tmbvcm64.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-12-12 13:45:11 ----D---- C:\Program Files\trend micro
2014-12-12 13:45:10 ----D---- C:\rsit
2014-12-11 22:08:31 ----D---- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-12-11 22:08:31 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-12-11 22:04:01 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-12-10 17:18:23 ----A---- C:\Windows\system32\WindowsCodecs.dll
2014-12-10 17:18:22 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2014-12-10 17:18:18 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2014-12-10 17:18:18 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2014-12-10 17:18:18 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-12-10 17:18:17 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2014-12-10 17:18:17 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2014-12-10 17:18:17 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2014-12-10 17:18:17 ----A---- C:\Windows\system32\iernonce.dll
2014-12-10 17:18:17 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-12-10 17:18:17 ----A---- C:\Windows\system32\ie4uinit.exe
2014-12-10 17:18:16 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2014-12-10 17:18:16 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2014-12-10 17:18:16 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2014-12-10 17:18:16 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2014-12-10 17:18:16 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 17:18:14 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2014-12-10 17:18:14 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2014-12-10 17:18:14 ----A---- C:\Windows\system32\iedkcs32.dll
2014-12-10 17:18:13 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2014-12-10 17:18:13 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2014-12-10 17:18:13 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2014-12-10 17:18:13 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2014-12-10 17:18:13 ----A---- C:\Windows\system32\urlmon.dll
2014-12-10 17:18:13 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 17:18:12 ----A---- C:\Windows\SYSWOW64\ieui.dll
2014-12-10 17:18:12 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2014-12-10 17:18:12 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 17:18:12 ----A---- C:\Windows\system32\dxtrans.dll
2014-12-10 17:18:11 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2014-12-10 17:18:11 ----A---- C:\Windows\system32\msfeeds.dll
2014-12-10 17:18:10 ----A---- C:\Windows\system32\iesetup.dll
2014-12-10 17:18:10 ----A---- C:\Windows\system32\ieapfltr.dll
2014-12-10 17:18:09 ----A---- C:\Windows\system32\iertutil.dll
2014-12-10 17:18:08 ----A---- C:\Windows\SYSWOW64\wininet.dll
2014-12-10 17:18:08 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2014-12-10 17:18:08 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2014-12-10 17:18:08 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2014-12-10 17:18:07 ----A---- C:\Windows\system32\jsproxy.dll
2014-12-10 17:18:07 ----A---- C:\Windows\system32\ieUnatt.exe
2014-12-10 17:18:03 ----A---- C:\Windows\SYSWOW64\msrating.dll
2014-12-10 17:18:03 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2014-12-10 17:18:02 ----A---- C:\Windows\system32\ieui.dll
2014-12-10 17:18:02 ----A---- C:\Windows\system32\dxtmsft.dll
2014-12-10 17:18:01 ----A---- C:\Windows\system32\ieframe.dll
2014-12-10 17:18:00 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-12-10 17:18:00 ----A---- C:\Windows\system32\mshtmled.dll
2014-12-10 17:18:00 ----A---- C:\Windows\system32\jscript9diag.dll
2014-12-10 17:18:00 ----A---- C:\Windows\system32\jscript9.dll
2014-12-10 17:17:59 ----A---- C:\Windows\system32\wininet.dll
2014-12-10 17:17:59 ----A---- C:\Windows\system32\vbscript.dll
2014-12-10 17:17:58 ----A---- C:\Windows\system32\msrating.dll
2014-12-10 17:17:58 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-12-10 17:17:57 ----A---- C:\Windows\system32\mshtml.dll
2014-12-04 01:06:38 ----D---- C:\ProgramData\sangFroidData
2014-11-28 11:40:39 ----D---- C:\Windows\symbols
2014-11-28 11:37:26 ----D---- C:\ProgramData\VS
2014-11-27 00:09:20 ----D---- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2014-11-26 12:54:03 ----D---- C:\Program Files\Microsoft Silverlight
2014-11-26 12:54:03 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2014-11-19 11:05:53 ----A---- C:\Windows\system32\pku2u.dll
2014-11-19 11:05:53 ----A---- C:\Windows\system32\kerberos.dll
2014-11-19 11:05:52 ----A---- C:\Windows\SYSWOW64\pku2u.dll
2014-11-19 11:05:50 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2014-11-19 04:31:16 ----A---- C:\Windows\SYSWOW64\FM20.DLL

======List of files/folders modified in the last 1 month======

2014-12-12 13:45:11 ----RD---- C:\Program Files
2014-12-12 13:32:56 ----D---- C:\Windows\system32\config
2014-12-12 13:18:19 ----D---- C:\Users\Martin\AppData\Roaming\Dropbox
2014-12-12 13:17:00 ----D---- C:\Windows\Prefetch
2014-12-12 13:15:42 ----A---- C:\Windows\SYSWOW64\log.txt
2014-12-11 22:08:31 ----HD---- C:\ProgramData
2014-12-11 22:08:31 ----D---- C:\Windows\system32\drivers
2014-12-11 21:02:52 ----D---- C:\Users\Martin\AppData\Roaming\Skype
2014-12-11 14:40:30 ----D---- C:\Users\Martin\AppData\Roaming\vlc
2014-12-11 13:27:40 ----D---- C:\Users\Martin\AppData\Roaming\BitTorrent
2014-12-11 12:10:44 ----D---- C:\Windows\winsxs
2014-12-11 12:09:10 ----D---- C:\Windows\SysWOW64
2014-12-11 12:09:10 ----D---- C:\Windows\System32
2014-12-11 12:09:09 ----D---- C:\Windows\SYSWOW64\cs-CZ
2014-12-11 12:09:09 ----D---- C:\Program Files\Internet Explorer
2014-12-11 12:09:08 ----D---- C:\Windows\SYSWOW64\en-US
2014-12-11 12:09:07 ----D---- C:\Windows\system32\en-US
2014-12-11 12:09:07 ----D---- C:\Windows\system32\cs-CZ
2014-12-11 12:09:07 ----D---- C:\Windows\PolicyDefinitions
2014-12-11 12:09:05 ----D---- C:\Program Files (x86)\Internet Explorer
2014-12-11 12:08:59 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-11 12:04:47 ----SHD---- C:\Windows\Installer
2014-12-11 12:04:45 ----D---- C:\ProgramData\Microsoft Help
2014-12-11 12:03:18 ----D---- C:\Windows\Temp
2014-12-11 12:03:18 ----D---- C:\Windows\system32\MRT
2014-12-11 11:51:33 ----A---- C:\Windows\system32\MRT.exe
2014-12-10 17:16:19 ----D---- C:\Windows\system32\catroot
2014-12-10 17:11:53 ----D---- C:\Windows\system32\catroot2
2014-12-09 23:30:09 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2014-11-29 10:50:43 ----D---- C:\Windows\Microsoft.NET
2014-11-29 10:08:10 ----RSD---- C:\Windows\assembly
2014-11-28 22:07:20 ----D---- C:\Windows\system32\Tasks
2014-11-28 11:40:39 ----AD---- C:\Windows
2014-11-28 11:29:33 ----A---- C:\Windows\win.ini
2014-11-27 20:13:24 ----D---- C:\Windows\system32\NDF
2014-11-27 00:09:30 ----D---- C:\Program Files (x86)\Common Files
2014-11-27 00:09:20 ----RD---- C:\Program Files (x86)
2014-11-27 00:01:39 ----RSD---- C:\Windows\Fonts
2014-11-27 00:01:15 ----D---- C:\Program Files (x86)\Microsoft Works
2014-11-26 12:54:32 ----SD---- C:\ProgramData\Microsoft
2014-11-20 22:43:43 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-11-20 22:43:42 ----D---- C:\Windows\inf
2014-11-20 10:34:51 ----D---- C:\ProgramData\Adobe
2014-11-20 10:34:48 ----D---- C:\Program Files (x86)\Adobe
2014-11-19 10:49:37 ----D---- C:\Program Files (x86)\Google
2014-11-17 13:34:18 ----D---- C:\Windows\rescache
2014-11-16 23:06:30 ----D---- C:\Users\Martin\AppData\Roaming\Celemony Software GmbH
2014-11-16 23:06:16 ----A---- C:\debug.txt
2014-11-16 23:06:14 ----A---- C:\Windows\SYSWOW64\msvcsv60.dll
2014-11-16 12:58:55 ----D---- C:\Windows\Tasks

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-05-18 65776]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-05-18 208416]
R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2009-12-17 538136]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2011-02-04 834544]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 aswKbd;aswKbd; C:\Windows\system32\drivers\aswKbd.sys [2013-03-07 22600]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2014-05-18 93568]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2014-05-18 1039096]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2014-05-18 423240]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2009-02-17 31400]
R1 hola_net;Hola Fast Internet Adapter; C:\Windows\system32\DRIVERS\hola_net.sys [2013-06-23 87232]
R1 hola-drv;Hola Driver; C:\Windows\system32\DRIVERS\hola_drv.sys [2013-06-23 582080]
R1 hola-mon-drv;Hola Monitor Driver; C:\Windows\system32\DRIVERS\hola_mon_drv.sys [2014-11-04 89192]
R1 NEOFLTR_740_30599;Juniper Networks TDI Filter Driver (NEOFLTR_740_30599); \??\C:\Windows\system32\Drivers\NEOFLTR_740_30599.SYS [2014-04-08 108344]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2014-05-18 29208]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2014-05-18 79184]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2014-05-18 85328]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-01-05 8283136]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-01-05 294400]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2012-11-06 96256]
R3 BCM43XX;Ovladač síťového adaptéru Broadcom 802.11; C:\Windows\system32\DRIVERS\bcmwl664.sys [2011-02-01 2978296]
R3 dsNcAdpt;Juniper Network Connect Adapter; C:\Windows\system32\DRIVERS\dsNcAdpt.sys [2014-04-08 36816]
R3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
R3 Impcd;Impcd; C:\Windows\system32\DRIVERS\Impcd.sys [2010-02-10 158720]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-01-29 2260256]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\k57nd60a.sys [2010-07-30 406056]
R3 S6000KNT;S6000KNT_WebCam Driver; C:\Windows\System32\Drivers\S6000KNT.sys [2009-12-15 183040]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2009-09-17 292912]
R3 tap0901;TAP-Windows Adapter V9; C:\Windows\system32\DRIVERS\tap0901.sys [2014-04-08 27136]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\DRIVERS\Apfiltr.sys [2009-05-24 243760]
S3 AtiHdmiService;ATI Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\AtiHdmi.sys [2010-01-28 116736]
S3 AWEAlloc;AWE Memory Allocation Driver; C:\Windows\system32\DRIVERS\awealloc.sys []
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2011-04-28 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 btwampfl;Bluetooth AMP USB Filter; C:\Windows\system32\drivers\btwampfl.sys [2010-06-26 342056]
S3 btwaudio;Bluetooth Audio Device Service; C:\Windows\system32\drivers\btwaudio.sys [2010-06-26 102952]
S3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\DRIVERS\btwavdt.sys [2010-06-26 135720]
S3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2010-06-26 39464]
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2010-06-26 21544]
S3 emusba10;E-MU USB-Audio 1.0 Driver; C:\Windows\system32\DRIVERS\emusba10.sys [2007-11-26 213272]
S3 epmntdrv;epmntdrv; \??\C:\Windows\syswow64\epmntdrv.sys [2013-03-07 13896]
S3 EuGdiDrv;EuGdiDrv; \??\C:\Windows\syswow64\EuGdiDrv.sys [2013-03-07 9160]
S3 GGSAFERDriver;GGSAFER Driver; \??\D:\Programy\Garena Plus\Room\safedrv.sys []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\Windows\System32\Drivers\RtsUStor.sys [2010-03-01 239136]
S3 RTHDMIAzAudService;Service for HDMI; C:\Windows\system32\drivers\RtHDMIVX.sys [2010-01-27 231328]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 SynasUSB;SynasUSB; C:\Windows\system32\drivers\SynUSB64.sys [2006-11-16 31248]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-02-12 19968]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-09-12 64704]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-01-05 203776]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2014-05-18 50344]
R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [2010-06-25 952096]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 dsNcService;Juniper Network Connect Service; C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe [2014-04-08 688240]
R2 emaudsv;E-MU Audio Service; C:\Windows\system32\emaudsv.exe [2007-11-26 25600]
R2 hola_svc;Hola Internet Acceleration Service; C:\Program Files\Hola\app\hola_svc.exe [2014-11-04 8136168]
R2 hola_updater;Hola Internet Acceleration Updater; C:\Program Files\Hola\app\hola_updater.exe [2014-11-04 8136168]
R2 chromoting;@C:\Program Files (x86)\Google\Chrome Remote Desktop\39.0.2171.46\remoting_core.dll,-101; C:\Program Files (x86)\Google\Chrome Remote Desktop\39.0.2171.46\remoting_host.exe [2014-10-29 56648]
R2 IAStorDataMgrSvc;Úložná technologie Intel(R) Rapid; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-12-23 13336]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2009-09-30 268824]
R2 TeamViewer8;TeamViewer 8; D:\Programy\TeamViewer - Version8\TeamViewer_Service.exe [2014-08-04 5095264]
R2 UNS;Intel(R) Management & Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
R2 VmbService;Vodafone Mobile Connect Service; C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [2013-03-25 8704]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22 107912]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2014-04-03 315008]
S2 StarWindServiceAE;StarWind AE Service; D:\Programy\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-09 267440]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2012-09-20 654848]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-22 107912]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-11-22 114688]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-12-09 114800]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 OpenVPNService;OpenVPN Service; D:\Programy\OpenVPN\bin\openvpnserv.exe [2014-08-07 37176]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2011-12-23 419624]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2011-02-02 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S4 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2006-02-28 229376]
S4 msvsmon90;Visual Studio 2008 Remote Debugger; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [2008-07-29 4737024]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]

-----------------EOF-----------------
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Bonjour service - rootkit

#2 Příspěvek od vyosek »

Zdravim :)

:arrow: Jen se zeptam, jedna se o domaci PC nebo nejaky firemni??
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kenor
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 27 Led 2011 20:18

Re: Bonjour service - rootkit

#3 Příspěvek od kenor »

Dobrý den, domácí NB používaný často pro práci z domova.
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Bonjour service - rootkit

#4 Příspěvek od vyosek »

:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Po spusteni probehne stazeni databaze
  • Kliknete na Scan a nasledne Clean
  • Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte
:arrow: Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu
  • Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
  • Do okna vlozte skript nize

  • Kód: Vybrat vše

    autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;
  • Nasledne kliknete na Run Script
  • PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kenor
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 27 Led 2011 20:18

Re: Bonjour service - rootkit

#5 Příspěvek od kenor »

# AdwCleaner v4.105 - Report created 13/12/2014 at 19:37:11
# Updated 08/12/2014 by Xplode
# Database : 2014-12-13.4 [Live]
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : Martin - MARTIN-PC
# Running from : C:\Users\Martin\Desktop\adwcleaner_4.105.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : hola_updater
Service Deleted : hola_svc

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\NCH Software
Folder Deleted : C:\Program Files (x86)\NCH Software
[!] Folder Deleted : C:\Program Files\Hola
Folder Deleted : C:\Users\Martin\AppData\Local\Babylon
Folder Deleted : C:\Users\Martin\AppData\Roaming\NCH Software
Folder Deleted : C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnbmfljfohghaepamnfokgggaejlmfol

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IM
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00B2-0409-0000-0000000FF1CE}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v34.0.5 (x86 cs)

[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossrider.bic", "13e7fdad5b9195a7125352f8abe5383c");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.InstallationThankYouPage", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.InstallationTime", 1367944648);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.active", true);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.addressbar", "");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.addressbarenhanced", "");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.backgroundver", 5);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.can_run_bg_code", true);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.certdomaininstaller", "");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.changeprevious", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.cookie.CrossriderNotifier_channels.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.cookie.CrossriderNotifier_channels.value", "%7B%22app0%22%3A%22app0%22%2C%22app14917%22%3A%22app14917%22%2C%22CZ%22%3A%22CZ%22%7D");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.cookie.CrossriderNotifier_css.expiration", "Wed May 08 2013 18:37:32 GMT+0200");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.cookie.CrossriderNotifier_css.value", "%22.%25CSSClass%25%20%7B%5Cn%5Ctdisplay%3Anone%3B%5Cn%7D%5Cn%5Cn.%25CSSClass%25-top-left%20%7B%5Cn%5Ctfont-size%3A[...]
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.cookie.CrossriderNotifier_geolocation.expiration", "Tue May 14 2013 18:37:32 GMT+0200");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.cookie.CrossriderNotifier_geolocation.value", "%22CZ%22");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.cookie.CrossriderNotifier_metadata.expiration", "Wed May 08 2013 18:37:32 GMT+0200");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.cookie.CrossriderNotifier_metadata.value", "%7B%22appId%22%3A14917%2C%22appName%22%3A%22Chat%20Undetected%22%2C%22lastMessageId%22%3A0%2C%22nextCheck%22%[...]
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.cookie.InstallationTime.value", "1367944648");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.description", "Chat Undetected lets you disable Facebook Messengers read receipt feature, preventing others from seeing if you have viewed a message or [...]
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.domain", "");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.enablesearch", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.homepage", "");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.iframe", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.InstallerIdentifiers.value", "%7B%22installer_bic%22%3Anull%2C%22installer_verifier%22%3Anull%7D");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.Resources_appVer.value", "61");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.Resources_lastVersion.value", "0");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.Resources_meta.value", "%7B%7D");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.Resources_nextCheck.expiration", "Wed May 08 2013 15:47:45 GMT+0200");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.Resources_nextCheck.value", "true");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.Resources_queue.value", "%7B%7D");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.__crossrider_daily_ping__.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.__crossrider_daily_ping__.value", "1367999285577");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb._sanity_pings_counter.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb._sanity_pings_counter.value", "2");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.installer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.internaldb.installer.value", "%7B%22InstallerIdentifiers%22%3A%7B%22installer_bic%22%3Anull%2C%22installer_verifier%22%3Anull%7D%2C%22version%22%3Anull%7[...]
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.js", "\n\n//vamos\n");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.manifesturl", "");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.name", "Chat Undetected");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.newtab", "");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.opensearch", "");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_1.name", "base");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_1.ver", 5);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_13.name", "CrossriderAppUtils");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_13.ver", 3);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_14.name", "CrossriderUtils");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_14.ver", 3);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_16.name", "FFAppAPIWrapper");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_16.ver", 7);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_17.name", "jQuery");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_17.ver", 4);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_21.name", "debug");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_21.ver", 4);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_22.name", "resources");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_22.ver", 4);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_28.name", "initializer");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_28.ver", 2);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_4.name", "jquery_1_7_1");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_4.ver", 3);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_47.name", "resources_background");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_47.ver", 3);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_5.name", "notifications");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_5.ver", 5);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_64.name", "appApiMessage");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_64.ver", 2);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_7.code", "appAPI.hooks={$:$jquery_171,hooks:{},addHook:function(a,b){this.hooks[a]=b;},removeHook:function(a){delete this.hooks[a];},regis[...]
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_7.name", "hooks");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_7.ver", 1);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_72.name", "appApiValidation");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_72.ver", 3);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_78.name", "CrossriderInfo");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_78.ver", 3);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_79.name", "CrossriderDailyPing");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_79.ver", 9);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_9.name", "search_engine_hook");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_9.ver", 1);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_98.name", "omniCommands");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins.plugin_98.ver", 2);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins_lists.plugins_0", "4,14,78,16,64,47,72,98");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins_lists.plugins_1", "17,14,78,13,16,64,4,1,21,22,72,7,98,9,79,5,28");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.plugins_lists.plugins_5", "4,14,78,13,16,64,47,72");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.pluginsurl", "hxxps://w9u6a2p6.ssl.hwcdn.net/plugin/apps/14917/plugins/091/ff/plugins.json");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.pluginsversion", 24);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.publisher", "Crossrider");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.searchstatus", 0);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.setnewtab", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.thankyou", "hxxp://crossrider.com/thank_you/14917");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.updateinterval", 360);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.14917.ver", 61);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.apps", "14917");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.bic", "13e7fdad5b9195a7125352f8abe5383c");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.cid", 14917);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.firstrun", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.hadappinstalled", true);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.installationdate", 1367944648);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.lastcheck", 22799988);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.lastcheckitem", 22800240);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.modetype", "production");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.reportInstall", true);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917.statsDailyCounter", 2);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.crossriderapp14917@crossrider.com.install-event-fired", true);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.DNSErrUrl", "hxxp://start.facemoods.com/?a=ddrnw&f=5");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.aflt", "_#ddrnw");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.dfltSrch", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.dnsErr", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.fcmdVrsn", "1.2.7.5.3");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.firstRun", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.first_time", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.hmpg", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.hmpgUrl", "hxxp://start.facemoods.com/?a=ddrnw");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.id", "_#4a5739c9000000000000705ab6da7399");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.instlDay", "_#15236");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.mntz", "");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.newTab", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.prtnrId", "_#facemoods.com");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.searchProviderAdded", false);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.sid", "_#bb9c63a92fd3431fa8a3b8c7a6e51fdb");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.tlbrSrchUrl", "hxxp://start.facemoods.com/?a=ddrnw&f=3");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.uninst", true);
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.update", "_#v1.4.0");
[sg37au0m.default\prefs.js] - Line Deleted : user_pref("extensions.facemoods.vrsn", "_#1.4.17.11");

-\\ Google Chrome v39.0.2171.95


-\\ Chromium v


*************************

AdwCleaner[R0].txt - [17902 octets] - [13/12/2014 19:31:45]
AdwCleaner[R1].txt - [17963 octets] - [13/12/2014 19:35:08]
AdwCleaner[S0].txt - [19233 octets] - [13/12/2014 19:37:11]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [19294 octets] ##########

--------------------


Zoek.exe v5.0.0.0 Updated 12-December-2014
Tool run by Martin on so 13.12.2014 at 19:51:01,03.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Martin\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

13.12.2014 19:52:13 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\MSXML 4.0 deleted successfully
C:\PROGRA~3\ALM deleted successfully
C:\PROGRA~3\Guitar Pro 6 deleted successfully
C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) deleted successfully
C:\PROGRA~3\Oracle deleted successfully
C:\PROGRA~3\{A518DCBE-06AD-461B-8F2E-C53AA3525C15} deleted successfully
C:\Users\Martin\AppData\Roaming\Media Player Classic deleted successfully
C:\Users\Martin\AppData\Roaming\Publish Providers deleted successfully
C:\Users\Martin\AppData\Roaming\runic games deleted successfully
C:\Users\Martin\AppData\Roaming\SoftMaker deleted successfully
C:\Users\Martin\AppData\Roaming\Toribash deleted successfully
C:\Users\Martin\AppData\Local\2K Games deleted successfully
C:\Users\Martin\AppData\Local\TSVNCache deleted successfully
C:\Users\Martin\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2490246678-3699060608-628407935-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5} deleted successfully
HKEY_USERS\S-1-5-21-2490246678-3699060608-628407935-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5} deleted successfully
HKEY_USERS\S-1-5-21-2490246678-3699060608-628407935-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F4E39681-15F8-4fda-B8A3-B5C98378F2F3} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\prefs.js:
user_pref("browser.startup.homepage", "www.google.com");
user_pref("browser.search.defaulturl", "https://www.google.com/search");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "https://www.google.com/search");

Added to C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default

user.js not found
---- Lines browser.startup.page removed from prefs.js ----
user_pref("browser.startup.page", 3);
---- FireFox user.js and prefs.js backups ----

prefs_13.12.2014_2011_.backup

==== Batch Command(s) Run By Tool======================

C:\Windows\system32\appdata deleted

==== Deleting Files \ Folders ======================

C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) not found
C:\PROGRA~3\{A518DCBE-06AD-461B-8F2E-C53AA3525C15} not found
C:\Users\Martin\.android deleted
C:\Users\Martin\AppData\Roaming\alsoft.ini deleted
C:\Users\Martin\AppData\Roaming\MPQEditor.ini deleted
C:\PROGRA~3\hash.dat deleted
C:\PROGRA~3\boost_interprocess deleted
C:\Users\Martin\AppData\LocalLow\boost_interprocess deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\GPT.INI deleted
C:\Windows\Syswow64\GroupPolicy\gpt.ini deleted
C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\extensions\firefox@ghostery.com.xpi deleted
C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\jetpack deleted
"C:\Users\Martin\AppData\Local\{06CAC24A-B241-4B91-8F6E-350D81C47133}" deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\Alwil Software\Avast5\WebRep\FF" [18.05.2014 09:03]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default
- Undetermined - personas@christopher.beard
- Undetermined - {6AC85730-7D0F-4de0-B3FA-21142DD85326}
- Undetermined - {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
- ColorZilla - %ProfilePath%\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
- Firebug - %ProfilePath%\extensions\firebug@software.joehewitt.com.xpi
- Personas Plus - %ProfilePath%\extensions\personas@christopher.beard.xpi
- Flagfox - %ProfilePath%\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi
- Stylish - %ProfilePath%\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default
9860727E477F17B88E39AF8B69B0407A - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll - Shockwave Flash
3CD19649B2C3023D65E67C056457A2BC - C:\Users\Martin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll - Facebook Video Calling Plugin
0CA4180B21C6B728578F3B0433BB740E - D:\Programy\VLC\npvlc.dll - VLC Web Plugin
68BCBB241EF254BC5100D9E6C06ECC71 - C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll - Google Talk Plugin Video Accelerator
99FE6AFE80EB7FE3EEB75DC504A326A3 - C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npo1d.dll - Google Talk Plugin Video Renderer
AF42019A3B0EDBFA6878F75B9377A792 - C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll - Google Talk Plugin
CFAF7B67C78D09D79688AEDCA3D090E2 - C:\Users\Martin\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll - Google Update
EEEB86077BB4682B3FCFEDA5AED3E396 - D:\Programy\QuickTime\Plugins\npqtplugin5.dll - QuickTime Plug-in 7.7.4
BADFB0DCCD9B7E9F2F6EB7954D24EED1 - D:\Programy\QuickTime\Plugins\npqtplugin4.dll - QuickTime Plug-in 7.7.4
1153F58FACBC9731AF6CDF313F76DF29 - D:\Programy\QuickTime\Plugins\npqtplugin3.dll - QuickTime Plug-in 7.7.4
9E4F520270BF7301CC24E8FA67791C22 - D:\Programy\QuickTime\Plugins\npqtplugin2.dll - QuickTime Plug-in 7.7.4
E50A1DB5DE70D656287511297B42F9F2 - D:\Programy\QuickTime\Plugins\npqtplugin.dll - QuickTime Plug-in 7.7.4
7B882AEBC5F6DBEA4E0361C0FC3E36D4 - D:\Programy\Office14\NPSPWRAP.DLL - Microsoft Office 2010
7E2B763CF671ADB558D5F7110889D469 - D:\Programy\Office14\NPAUTHZ.DLL - Microsoft Office 2010


==== Chromium Look ======================

Google Chrome Version: 39.0.2171.95 (Up to date, latest Stable version: 39.0.2171.95)

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
nneajnkjbffgblleaoojgaacokifdkhm - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx[08.02.2011 01:17]

QRreader beta - Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfdjglobiolninfgldchakgfldifphic
AdBlock - Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
Last.fm Scrobbler - Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhinaapppaileiechjoiifaancjggfjm
Windows Media Player Extension for HTML5 - Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.google.com/search?q={searchT ... d=ie7&rlz="
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchT ... d=ie7&rlz="

==== Reset Google Chrome ======================

C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_CURRENT_USER\Software\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hola deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Martin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Martin\AppData\Local\Mozilla\Firefox\Profiles\sg37au0m.default\cache2 emptied successfully
C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\personas\cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=42 folders=11 2394658 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Martin\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Martin\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on so 13.12.2014 at 20:31:21,78 ======================
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Bonjour service - rootkit

#6 Příspěvek od vyosek »

Dejte log z FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kenor
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 27 Led 2011 20:18

Re: Bonjour service - rootkit

#7 Příspěvek od kenor »

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-12-2014
Ran by Martin (administrator) on MARTIN-PC on 13-12-2014 23:04:15
Running from C:\Users\Martin\Desktop
Loaded Profile: Martin (Available profiles: Martin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\39.0.2171.46\remoting_host.exe
(Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\39.0.2171.46\remoting_host.exe
(E-MU Systems) C:\Windows\System32\emaudsv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(TeamViewer GmbH) D:\Programy\TeamViewer - Version8\TeamViewer_Service.exe
(Ericsson AB) C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(TeamViewer GmbH) D:\Programy\TeamViewer - Version8\TeamViewer.exe
(TeamViewer GmbH) D:\Programy\TeamViewer - Version8\tv_w32.exe
(TeamViewer GmbH) D:\Programy\TeamViewer - Version8\tv_x64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\OscarX7Editor5Mode\OscarX7Editor5Mode\OscarEditor.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
() C:\Windows\WebCam\S6000\S6000Mnt.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\avastui.exe
(http://tortoisesvn.net) D:\Programy\TortoiseSVN\bin\TSVNCache.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Dropbox, Inc.) C:\Users\Martin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Mozilla Corporation) D:\Programy\Mozilla Firefox\firefox.exe
(Mozilla Corporation) D:\Programy\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
(Valve Corporation) D:\Programy\Steam\Steam.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) D:\Programy\Steam\bin\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Valve Corporation) D:\Programy\Steam\bin\steamwebhelper.exe
(forum.viry.cz) C:\Users\Martin\Desktop\FRSTLauncher.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-21] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10038304 2010-01-29] (Realtek Semiconductor)
HKLM-x32\...\Run: [S6000Mnt] => C:\Windows\SysWOW64\Rundll32.exe S6000Rmv.dll,WinMainRmv /StartStillMnt
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-23] (Intel Corporation)
HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => D:\Programy\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3890208 2014-08-07] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\Run: [OscarX7Mouse5Mode] => C:\Program Files (x86)\OscarX7Editor5Mode\OscarX7Editor5Mode\OscarEditor.exe [3521024 2012-03-20] ()
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {126d4258-de47-11e1-a7ef-705ab6da7399} - I:\AutoRun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {1339cf42-3099-11e0-8e71-705ab6da7399} - F:\wubi.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {57f3ddf6-dade-11e1-a808-705ab6da7399} - I:\AutoRun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {57f3ddfb-dade-11e1-a808-705ab6da7399} - I:\AutoRun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {91096197-5969-11e0-8f57-705ab6da7399} - H:\autorun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {9e045ed4-b89f-11e3-917d-705ab6da7399} - I:\setup_vmb_lite.exe /checkApplicationPresence
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Martin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [1TortoiseNormal] -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: [2TortoiseModified] -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: [3TortoiseConflict] -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: [4TortoiseLocked] -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: [5TortoiseReadOnly] -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: [6TortoiseDeleted] -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: [7TortoiseAdded] -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: [8TortoiseIgnored] -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers: [9TortoiseUnversioned] -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [1TortoiseNormal] -> {C5994560-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [2TortoiseModified] -> {C5994561-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [3TortoiseConflict] -> {C5994562-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [4TortoiseLocked] -> {C5994563-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [5TortoiseReadOnly] -> {C5994564-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [6TortoiseDeleted] -> {C5994565-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [7TortoiseAdded] -> {C5994566-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [8TortoiseIgnored] -> {C5994567-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)
ShellIconOverlayIdentifiers-x32: [9TortoiseUnversioned] -> {C5994568-53D9-4125-87C9-F193FC689CB2} => C:\Program Files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll (http://tortoisesvn.net)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com/search?q={searchT ... d=ie7&rlz=
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2490246678-3699060608-628407935-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> D:\Programy\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {AA570693-00E2-4907-B6F1-60A1199B030C} https://juniper.net/dana-cached/sc/Juni ... ient64.cab
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/Juni ... Client.cab
Tcpip\Parameters: [DhcpNameServer] 109.88.203.3 62.197.111.140
Tcpip\..\Interfaces\{879AA761-6462-4710-91C6-F03557004351}: [NameServer] 127.0.0.1

FireFox:
========
FF ProfilePath: C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default
FF NewTab: hxxp://www.google.com/
FF DefaultSearchUrl: hxxp://www.google.com/search?btnG=Google+Search&q=
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF NetworkProxy: "http", "106.3.98.89"
FF NetworkProxy: "http_port", 81
FF NetworkProxy: "socks_version", 4
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.3.1 -> C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.3.1 -> C:\Program Files (x86)\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> D:\Programy\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> D:\Programy\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> D:\Programy\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2490246678-3699060608-628407935-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Martin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKU\S-1-5-21-2490246678-3699060608-628407935-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKU\S-1-5-21-2490246678-3699060608-628407935-1000: @talk.google.com/O1DPlugin -> C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKU\S-1-5-21-2490246678-3699060608-628407935-1000: @talk.google.com/O3DPlugin -> C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKU\S-1-5-21-2490246678-3699060608-628407935-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Martin\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-2490246678-3699060608-628407935-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Martin\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Martin\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Martin\AppData\Roaming\mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin ProgramFiles/Appdata: C:\Users\Martin\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF Extension: ColorZilla - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\Extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326} [2012-09-30]
FF Extension: Firebug - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\Extensions\firebug@software.joehewitt.com.xpi [2012-09-20]
FF Extension: Personas Plus - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\Extensions\personas@christopher.beard.xpi [2011-09-03]
FF Extension: Flagfox - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\Extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}.xpi [2014-03-08]
FF Extension: Stylish - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2014-10-06]
FF Extension: Adblock Plus - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sg37au0m.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-15]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011-02-27]
FF HKLM-x32\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011-02-27]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-05-25]
FF StartMenuInternet: FIREFOX.EXE - D:\Programy\Mozilla Firefox\firefox.exe

Chrome:
=======
CHR HomePage: Default -> www.google.com
CHR StartupUrls: Default -> "www.google.com"
CHR Profile: C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-12-13]
CHR Extension: (Dokumenty Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-12-13]
CHR Extension: (Disk Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-13]
CHR Extension: (QRreader beta) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfdjglobiolninfgldchakgfldifphic [2012-01-22]
CHR Extension: (YouTube) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-17]
CHR Extension: (Vyhledávání Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-17]
CHR Extension: (Tabulky Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-12-13]
CHR Extension: (Vzdálená plocha Chrome) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2013-01-18]
CHR Extension: (AdBlock) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-08-17]
CHR Extension: (Last.fm Scrobbler) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hhinaapppaileiechjoiifaancjggfjm [2013-05-29]
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak [2013-01-08]
CHR Extension: (Peněženka Google) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2011-10-18]
CHR Extension: (Gmail) - C:\Users\Martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-17]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2011-02-08]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-05-18] (AVAST Software)
S4 Bonjour Service; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [229376 2006-02-28] (Apple Computer, Inc.) [File not signed]
R2 chromoting; C:\Program Files (x86)\Google\Chrome Remote Desktop\39.0.2171.46\remoting_host.exe [56648 2014-10-29] (Google Inc.)
R2 emaudsv; C:\Windows\system32\emaudsv.exe [25600 2007-11-26] (E-MU Systems)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2012-09-20] (Macrovision Europe Ltd.) [File not signed]
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4737024 2008-07-29] (Microsoft Corporation)
S3 OpenVPNService; D:\Programy\OpenVPN\bin\openvpnserv.exe [37176 2014-08-07] (The OpenVPN Project)
S2 StarWindServiceAE; D:\Programy\Alcohol 120\StarWind\StarWindServiceAE.exe [370688 2009-12-23] (StarWind Software) [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TeamViewer8; D:\Programy\TeamViewer - Version8\TeamViewer_Service.exe [5095264 2014-08-04] (TeamViewer GmbH)
R2 VmbService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [8704 2013-03-25] (Vodafone) [File not signed]
R2 WMCoreService; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [462888 2010-03-18] (Ericsson AB)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-18] ()
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-03-07] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-18] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-18] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-18] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-18] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-18] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-18] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-18] ()
S3 emusba10; C:\Windows\System32\DRIVERS\emusba10.sys [213272 2007-11-26] (E-MU Systems)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [13896 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] () [File not signed]
R1 hola-drv; C:\Windows\System32\DRIVERS\hola_drv.sys [582080 2013-06-23] (Hola Networks Ltd.)
R1 hola-mon-drv; C:\Windows\System32\DRIVERS\hola_mon_drv.sys [89192 2014-11-04] (Hola Networks Ltd.)
R1 hola_net; C:\Windows\System32\DRIVERS\hola_net.sys [87232 2013-06-23] (Hola Networks Ltd.)
R1 NEOFLTR_740_30599; C:\Windows\system32\Drivers\NEOFLTR_740_30599.SYS [108344 2014-04-08] (Juniper Networks)
R3 S6000KNT; C:\Windows\System32\Drivers\S6000KNT.sys [183040 2009-12-15] (Windows (R) Win 7 DDK provider)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2011-02-04] () [File not signed]
S3 SynasUSB; C:\Windows\System32\drivers\SynUSB64.sys [31248 2006-11-16] (SIA Syncrosoft)
U5 UnlockerDriver5; D:\Programy\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
U3 ana1axo9; C:\Windows\System32\Drivers\ana1axo9.sys [0 ] (Microsoft Corporation)
S3 AWEAlloc; system32\DRIVERS\awealloc.sys [X]
S3 GGSAFERDriver; \??\D:\Programy\Garena Plus\Room\safedrv.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S2 XilinxPC4Driver; \SystemRoot\System32\drivers\XPC4DRVR.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-13 23:04 - 2014-12-13 23:08 - 00026733 _____ () C:\Users\Martin\Desktop\FRST.txt
2014-12-13 23:03 - 2014-12-13 23:04 - 00000000 ____D () C:\FRST
2014-12-13 23:02 - 2014-12-13 23:02 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Downloads\Nepotvrzeno 650460.crdownload
2014-12-13 23:02 - 2014-12-13 23:02 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Desktop\FRSTLauncher.exe
2014-12-13 22:39 - 2014-12-13 22:40 - 02119168 _____ (Farbar) C:\Users\Martin\Desktop\FRST64.exe
2014-12-13 20:22 - 2014-12-13 20:32 - 00000000 ____D () C:\Users\Martin\AppData\Local\TSVNCache
2014-12-13 20:22 - 2014-12-13 19:50 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-12-13 19:51 - 2014-12-13 20:31 - 00013780 _____ () C:\zoek-results.log
2014-12-13 19:47 - 2014-12-13 20:11 - 00000000 ____D () C:\zoek_backup
2014-12-13 19:31 - 2014-12-13 19:37 - 00000000 ____D () C:\AdwCleaner
2014-12-13 19:27 - 2014-12-13 19:27 - 04271693 _____ () C:\Users\Martin\Downloads\zoek.rar
2014-12-13 19:27 - 2014-12-13 19:27 - 04235193 _____ () C:\Users\Martin\Downloads\zoek (1).rar
2014-12-12 13:45 - 2014-12-12 13:45 - 00000000 ____D () C:\rsit
2014-12-12 13:45 - 2014-12-12 13:45 - 00000000 ____D () C:\Program Files\trend micro
2014-12-12 13:31 - 2014-12-12 13:32 - 01222144 _____ () C:\Users\Martin\Downloads\RSITx64.exe
2014-12-11 22:08 - 2014-12-11 22:08 - 00135384 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-11 22:04 - 2014-12-11 22:04 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-11 22:03 - 2014-12-11 22:43 - 00000000 ____D () C:\Users\Martin\Desktop\mbar
2014-12-11 22:03 - 2014-12-11 22:05 - 00000000 ____D () C:\Users\Martin\Desktop\diskHealth
2014-12-11 22:00 - 2014-12-11 22:02 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Martin\Downloads\mbar-1.08.2.1001.exe
2014-12-10 17:18 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-10 17:18 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-10 17:18 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-10 17:18 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 17:18 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-10 17:18 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-10 17:18 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-10 17:18 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-10 17:18 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-10 17:18 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-10 17:18 - 2014-11-22 03:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-10 17:18 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-10 17:18 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-10 17:18 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-10 17:18 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 17:18 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-10 17:18 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-10 17:18 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-10 17:18 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 17:18 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-10 17:18 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-10 17:18 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-10 17:18 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-10 17:18 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-10 17:18 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-10 17:18 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-10 17:18 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-10 17:18 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-10 17:18 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-10 17:18 - 2014-11-22 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-10 17:18 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-10 17:18 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-10 17:18 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-10 17:18 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-10 17:18 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-10 17:18 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-10 17:18 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-10 17:18 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-10 17:18 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-10 17:18 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-10 17:18 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-10 17:18 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-10 17:18 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-10 17:18 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-10 17:18 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-10 17:18 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-10 17:18 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-10 17:18 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-10 17:18 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-10 17:18 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-10 17:18 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-10 17:18 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-10 17:18 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-10 17:17 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-10 17:17 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-10 17:17 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-10 17:17 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-10 17:17 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-09 22:54 - 2014-12-09 22:54 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Adobe
2014-12-09 22:54 - 2014-12-09 22:54 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Adobe
2014-12-09 22:53 - 2014-12-09 22:53 - 00000000 ____D () C:\Users\Default\AppData\Roaming\AVAST Software
2014-12-09 22:53 - 2014-12-09 22:53 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\AVAST Software
2014-12-04 01:07 - 2014-12-04 01:07 - 00000000 ____D () C:\Users\Martin\AppData\Local\3DVIA
2014-12-04 01:06 - 2014-12-04 01:11 - 00000000 ____D () C:\ProgramData\sangFroidData
2014-11-28 21:52 - 2014-11-28 21:59 - 13044784 _____ () C:\Users\Martin\Desktop\cannon.psd
2014-11-28 11:40 - 2014-11-28 11:40 - 00000000 ____D () C:\Windows\symbols
2014-11-28 11:37 - 2014-11-28 11:37 - 00000000 ____D () C:\ProgramData\VS
2014-11-27 21:51 - 2014-11-27 21:51 - 00000000 ____D () C:\Users\Martin\Desktop\th
2014-11-27 00:14 - 2014-11-27 00:14 - 00000000 ____D () C:\Users\Default\Documents\Visual Studio 2008
2014-11-27 00:14 - 2014-11-27 00:14 - 00000000 ____D () C:\Users\Default User\Documents\Visual Studio 2008
2014-11-27 00:09 - 2014-11-27 00:09 - 00000000 ____D () C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
2014-11-27 00:07 - 2014-11-27 00:07 - 00000000 ____D () C:\Users\Default\Documents\Visual Studio 2010
2014-11-27 00:07 - 2014-11-27 00:07 - 00000000 ____D () C:\Users\Default User\Documents\Visual Studio 2010
2014-11-26 23:58 - 2014-11-26 23:58 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-11-26 23:58 - 2014-11-26 23:58 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-11-26 12:54 - 2014-11-26 12:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-11-26 12:54 - 2014-11-26 12:54 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-11-26 12:54 - 2014-11-26 12:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-11-25 22:58 - 2014-11-26 17:07 - 00002185 _____ () C:\Users\Martin\Documents\mish2.gp5
2014-11-23 11:44 - 2014-11-27 23:20 - 00018746 _____ () C:\Users\Martin\Documents\euler122.xlsx
2014-11-20 10:34 - 2014-11-20 10:35 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-11-20 10:34 - 2014-11-20 10:34 - 00002025 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-11-19 11:05 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-19 11:05 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-19 11:05 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-19 11:05 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-19 04:31 - 2014-11-19 04:31 - 01217192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FM20.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-13 23:06 - 2012-07-16 20:20 - 00000966 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job
2014-12-13 23:03 - 2012-07-19 15:58 - 00000952 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-13 23:00 - 2011-02-03 20:37 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Skype
2014-12-13 22:54 - 2014-09-08 14:04 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-12-13 22:54 - 2011-02-03 20:37 - 00000000 ____D () C:\ProgramData\Skype
2014-12-13 22:35 - 2014-08-13 13:44 - 00014680 _____ () C:\Windows\setupact.log
2014-12-13 22:30 - 2012-06-13 08:58 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-13 22:09 - 2014-09-28 00:03 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job
2014-12-13 20:37 - 2009-07-14 05:45 - 00017120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-13 20:37 - 2009-07-14 05:45 - 00017120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-13 20:36 - 2011-09-03 13:27 - 01068794 _____ () C:\Windows\WindowsUpdate.log
2014-12-13 20:32 - 2011-09-25 18:48 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Dropbox
2014-12-13 20:24 - 2013-10-27 12:37 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-12-13 20:24 - 2012-07-19 15:58 - 00000948 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-13 20:24 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-13 20:23 - 2014-08-13 13:44 - 00012706 _____ () C:\Windows\PFRO.log
2014-12-13 20:11 - 2011-02-01 12:42 - 00000000 ____D () C:\Users\Martin
2014-12-13 20:11 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-12-13 20:11 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-12-13 19:26 - 2014-11-11 14:35 - 00000000 ____D () C:\Users\Martin\UMLet
2014-12-13 18:34 - 2012-07-15 16:08 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-12-13 18:33 - 2014-09-28 00:03 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job
2014-12-13 18:33 - 2012-07-16 20:20 - 00000914 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job
2014-12-11 15:09 - 2011-10-25 18:37 - 00000000 ____D () C:\Users\Martin\AppData\Local\Last.fm
2014-12-11 14:40 - 2011-02-01 19:20 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\vlc
2014-12-11 13:27 - 2011-02-01 14:41 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\BitTorrent
2014-12-11 12:16 - 2011-09-25 18:48 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-11 12:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-11 12:08 - 2012-04-26 08:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-11 12:04 - 2011-02-18 12:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-11 12:03 - 2013-08-14 22:18 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-11 11:51 - 2011-02-04 17:09 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-09 23:30 - 2012-04-06 09:03 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-09 23:30 - 2012-04-06 09:03 - 00003852 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-09 23:30 - 2011-05-20 12:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-07 23:45 - 2014-11-09 18:05 - 00000147 _____ () C:\Users\Martin\Desktop\aiBotting.txt
2014-11-29 10:08 - 2013-01-18 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2010 Express
2014-11-28 11:29 - 2009-07-14 03:34 - 00000500 _____ () C:\Windows\win.ini
2014-11-27 20:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-27 11:12 - 2009-07-14 05:45 - 05313040 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-27 00:14 - 2011-09-07 15:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual C++ 2008 Express Edition
2014-11-27 00:07 - 2011-02-01 13:46 - 00150312 _____ () C:\Users\Martin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-27 00:01 - 2011-02-18 12:03 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-11-20 22:43 - 2009-07-14 16:18 - 00672456 _____ () C:\Windows\system32\perfh005.dat
2014-11-20 22:43 - 2009-07-14 16:18 - 00143018 _____ () C:\Windows\system32\perfc005.dat
2014-11-20 22:43 - 2009-07-14 06:13 - 01593504 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-20 10:34 - 2011-02-01 15:36 - 00000000 ____D () C:\ProgramData\Adobe
2014-11-20 10:34 - 2011-02-01 15:36 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-11-19 10:49 - 2011-02-01 13:50 - 00000000 ____D () C:\Program Files (x86)\Google
2014-11-17 13:34 - 2014-09-13 13:22 - 00000000 ____D () C:\Windows\rescache
2014-11-16 23:06 - 2013-04-28 14:32 - 00000000 _____ () C:\debug.txt
2014-11-16 23:06 - 2011-03-14 12:44 - 00000016 _____ () C:\Windows\SysWOW64\w3data.vss
2014-11-16 23:06 - 2011-03-14 12:44 - 00000016 _____ () C:\Windows\SysWOW64\msvcsv60.dll
2014-11-16 23:06 - 2011-03-14 12:44 - 00000016 _____ () C:\Windows\msocreg32.dat
2014-11-16 23:06 - 2011-02-14 19:18 - 00000000 ____D () C:\Users\Martin\AppData\Roaming\Celemony Software GmbH
2014-11-16 12:58 - 2011-02-01 13:50 - 00003948 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-16 12:58 - 2011-02-01 13:50 - 00003696 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

Files to move or delete:
====================
C:\Users\Martin\fbchathistory.dat


Some content of TEMP:
====================
C:\Users\Martin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp58oict.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================

Task: {CC625182-5F77-4431-81AC-E535927D0FA3} - System32\Tasks\{00CC26D7-D4DF-4701-8CDF-7BA682176F51} => pcalua.exe -a D:\Programy\Nahrávání\VstPlugIns\Syntheway\AFSynthewayFantasizeSoundFontPlayerVSTiv23COOKiE-peace-out\setup.exe -d D:\Programy\Nahrávání\VstPlugIns\Syntheway\AFSynthewayFantasizeSoundFontPlayerVSTiv23COOKiE-peace-out

==================== Scheduled Tasks (whitelisted) ==================

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job => C:\Users\Martin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job => C:\Users\Martin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job => C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job => C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Alternate Data Streams (whitelisted) ==================

AlternateDataStreams: C:\Windows:095661E9DEF17EEE
AlternateDataStreams: C:\ProgramData\TEMP:C8B8CEBD
AlternateDataStreams: C:\Users\Public\DRM:مايكروسوفت

==================== Security Center ==================

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Martin\Desktop" je 9612 MB.


***** Startup Programs *****

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent
"C:\Users\Martin\AppData\Roaming\BitTorrent\BitTorrent.exe" /MINIMIZED [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EaseUS EPM tray
D:\Programy\EaseUS Partition Master 10.0\bin\EpmNews.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EaseUS EPM Tray Agent
"D:\Programy\EaseUS Partition Master 10.0\bin\TrayPopupE\TrayTipAgentE.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update
"C:\Users\Martin\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GarenaPlus
"D:\Programy\Garena Plus\GarenaMessenger.exe" -autolaunch [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk
C:\Program Files (x86)\Google\Google Talk\googletalk.exe /autostart [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor
"C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMReminderService
D:\Programy\Mindjet MindManager 10\MMReminderService.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MobileBroadband
C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe /silent [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC
"D:\Programy\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VmbNotifier
C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbNotifier.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Martin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GameRanger.lnk
C:\Users\Martin\AppData\Roaming\GAMERA~1\GAMERA~2\GAMERA~1.EXE


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"9000:TCP"="9000:TCP:*:Enabled:SqueezeCenter 9000 tcp"
"3483:UDP"="3483:UDP:*:Enabled:SqueezeCenter 3483 udp"
"3483:TCP"="3483:TCP:*:Enabled:SqueezeCenter 3483 tcp"


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================
Přílohy
Addition.zip
(15.62 KiB) Staženo 54 x
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Bonjour service - rootkit

#8 Příspěvek od vyosek »

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
CloseProcesses:

HKLM-x32\...\Run: [QuickTime Task] => D:\Programy\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\Run: [OscarX7Mouse5Mode] => C:\Program Files (x86)\OscarX7Editor5Mode\OscarX7Editor5Mode\OscarEditor.exe [3521024 2012-03-20] ()
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {126d4258-de47-11e1-a7ef-705ab6da7399} - I:\AutoRun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {1339cf42-3099-11e0-8e71-705ab6da7399} - F:\wubi.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {57f3ddf6-dade-11e1-a808-705ab6da7399} - I:\AutoRun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {57f3ddfb-dade-11e1-a808-705ab6da7399} - I:\AutoRun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {91096197-5969-11e0-8f57-705ab6da7399} - H:\autorun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {9e045ed4-b89f-11e3-917d-705ab6da7399} - I:\setup_vmb_lite.exe /checkApplicationPresence

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2490246678-3699060608-628407935-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File

FF NetworkProxy: "http", "106.3.98.89"
FF NetworkProxy: "http_port", 81
FF NetworkProxy: "socks_version", 4
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

U3 ana1axo9; C:\Windows\System32\Drivers\ana1axo9.sys [0 ] (Microsoft Corporation)
S3 AWEAlloc; system32\DRIVERS\awealloc.sys [X]
S3 GGSAFERDriver; \??\D:\Programy\Garena Plus\Room\safedrv.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S2 XilinxPC4Driver; \SystemRoot\System32\drivers\XPC4DRVR.SYS [X]

2014-12-13 23:04 - 2014-12-13 23:08 - 00026733 _____ () C:\Users\Martin\Desktop\FRST.txt
2014-12-13 23:02 - 2014-12-13 23:02 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Downloads\Nepotvrzeno 650460.crdownload
2014-12-13 23:02 - 2014-12-13 23:02 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Desktop\FRSTLauncher.exe
2014-12-13 20:22 - 2014-12-13 19:50 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-12-13 19:51 - 2014-12-13 20:31 - 00013780 _____ () C:\zoek-results.log
2014-12-13 19:47 - 2014-12-13 20:11 - 00000000 ____D () C:\zoek_backup
2014-12-13 19:31 - 2014-12-13 19:37 - 00000000 ____D () C:\AdwCleaner
2014-12-13 19:27 - 2014-12-13 19:27 - 04271693 _____ () C:\Users\Martin\Downloads\zoek.rar
2014-12-13 19:27 - 2014-12-13 19:27 - 04235193 _____ () C:\Users\Martin\Downloads\zoek (1).rar
2014-12-12 13:45 - 2014-12-12 13:45 - 00000000 ____D () C:\rsit
2014-12-12 13:45 - 2014-12-12 13:45 - 00000000 ____D () C:\Program Files\trend micro
2014-12-12 13:31 - 2014-12-12 13:32 - 01222144 _____ () C:\Users\Martin\Downloads\RSITx64.exe
2014-12-11 22:08 - 2014-12-11 22:08 - 00135384 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-11 22:04 - 2014-12-11 22:04 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-11 22:03 - 2014-12-11 22:43 - 00000000 ____D () C:\Users\Martin\Desktop\mbar

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job => C:\Users\Martin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job => C:\Users\Martin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job => C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job => C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe

AlternateDataStreams: C:\Windows:095661E9DEF17EEE
AlternateDataStreams: C:\ProgramData\TEMP:C8B8CEBD
AlternateDataStreams: C:\Users\Public\DRM:مايكروسوفت

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GarenaPlus" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Martin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GameRanger.lnk" /f

Hosts:
EmptyTemp:
Reboot:
End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kenor
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 27 Led 2011 20:18

Re: Bonjour service - rootkit

#9 Příspěvek od kenor »

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-12-2014
Ran by Martin at 2014-12-15 00:01:46 Run:1
Running from C:\Users\Martin\Desktop
Loaded Profile: Martin (Available profiles: Martin)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:

HKLM-x32\...\Run: [QuickTime Task] => D:\Programy\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\Run: [OscarX7Mouse5Mode] => C:\Program Files (x86)\OscarX7Editor5Mode\OscarX7Editor5Mode\OscarEditor.exe [3521024 2012-03-20] ()
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {126d4258-de47-11e1-a7ef-705ab6da7399} - I:\AutoRun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {1339cf42-3099-11e0-8e71-705ab6da7399} - F:\wubi.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {57f3ddf6-dade-11e1-a808-705ab6da7399} - I:\AutoRun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {57f3ddfb-dade-11e1-a808-705ab6da7399} - I:\AutoRun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {91096197-5969-11e0-8f57-705ab6da7399} - H:\autorun.exe
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\...\MountPoints2: {9e045ed4-b89f-11e3-917d-705ab6da7399} - I:\setup_vmb_lite.exe /checkApplicationPresence

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2490246678-3699060608-628407935-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File

FF NetworkProxy: "http", "106.3.98.89"
FF NetworkProxy: "http_port", 81
FF NetworkProxy: "socks_version", 4
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

U3 ana1axo9; C:\Windows\System32\Drivers\ana1axo9.sys [0 ] (Microsoft Corporation)
S3 AWEAlloc; system32\DRIVERS\awealloc.sys [X]
S3 GGSAFERDriver; \??\D:\Programy\Garena Plus\Room\safedrv.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S2 XilinxPC4Driver; \SystemRoot\System32\drivers\XPC4DRVR.SYS [X]

2014-12-13 23:04 - 2014-12-13 23:08 - 00026733 _____ () C:\Users\Martin\Desktop\FRST.txt
2014-12-13 23:02 - 2014-12-13 23:02 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Downloads\Nepotvrzeno 650460.crdownload
2014-12-13 23:02 - 2014-12-13 23:02 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Desktop\FRSTLauncher.exe
2014-12-13 20:22 - 2014-12-13 19:50 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-12-13 19:51 - 2014-12-13 20:31 - 00013780 _____ () C:\zoek-results.log
2014-12-13 19:47 - 2014-12-13 20:11 - 00000000 ____D () C:\zoek_backup
2014-12-13 19:31 - 2014-12-13 19:37 - 00000000 ____D () C:\AdwCleaner
2014-12-13 19:27 - 2014-12-13 19:27 - 04271693 _____ () C:\Users\Martin\Downloads\zoek.rar
2014-12-13 19:27 - 2014-12-13 19:27 - 04235193 _____ () C:\Users\Martin\Downloads\zoek (1).rar
2014-12-12 13:45 - 2014-12-12 13:45 - 00000000 ____D () C:\rsit
2014-12-12 13:45 - 2014-12-12 13:45 - 00000000 ____D () C:\Program Files\trend micro
2014-12-12 13:31 - 2014-12-12 13:32 - 01222144 _____ () C:\Users\Martin\Downloads\RSITx64.exe
2014-12-11 22:08 - 2014-12-11 22:08 - 00135384 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-11 22:04 - 2014-12-11 22:04 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-11 22:03 - 2014-12-11 22:43 - 00000000 ____D () C:\Users\Martin\Desktop\mbar

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job => C:\Users\Martin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job => C:\Users\Martin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job => C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job => C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe

AlternateDataStreams: C:\Windows:095661E9DEF17EEE
AlternateDataStreams: C:\ProgramData\TEMP:C8B8CEBD
AlternateDataStreams: C:\Users\Public\DRM:مايكروسوفت

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GarenaPlus" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Martin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GameRanger.lnk" /f

Hosts:
EmptyTemp:
Reboot:
End
*****************

Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\GrooveMonitor => value deleted successfully.
HKU\S-1-5-21-2490246678-3699060608-628407935-1000\Software\Microsoft\Windows\CurrentVersion\Run\\OscarX7Mouse5Mode => value deleted successfully.
"HKU\S-1-5-21-2490246678-3699060608-628407935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{126d4258-de47-11e1-a7ef-705ab6da7399}" => Key deleted successfully.
"HKCR\CLSID\{126d4258-de47-11e1-a7ef-705ab6da7399}" => Key not found.
"HKU\S-1-5-21-2490246678-3699060608-628407935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1339cf42-3099-11e0-8e71-705ab6da7399}" => Key deleted successfully.
"HKCR\CLSID\{1339cf42-3099-11e0-8e71-705ab6da7399}" => Key not found.
"HKU\S-1-5-21-2490246678-3699060608-628407935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{57f3ddf6-dade-11e1-a808-705ab6da7399}" => Key deleted successfully.
"HKCR\CLSID\{57f3ddf6-dade-11e1-a808-705ab6da7399}" => Key not found.
"HKU\S-1-5-21-2490246678-3699060608-628407935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{57f3ddfb-dade-11e1-a808-705ab6da7399}" => Key deleted successfully.
"HKCR\CLSID\{57f3ddfb-dade-11e1-a808-705ab6da7399}" => Key not found.
"HKU\S-1-5-21-2490246678-3699060608-628407935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91096197-5969-11e0-8f57-705ab6da7399}" => Key deleted successfully.
"HKCR\CLSID\{91096197-5969-11e0-8f57-705ab6da7399}" => Key not found.
"HKU\S-1-5-21-2490246678-3699060608-628407935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9e045ed4-b89f-11e3-917d-705ab6da7399}" => Key deleted successfully.
"HKCR\CLSID\{9e045ed4-b89f-11e3-917d-705ab6da7399}" => Key not found.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Local Page => Value was restored successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-2490246678-3699060608-628407935-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66}" => Key deleted successfully.
"HKCR\CLSID\{012E1000-F331-11DB-8314-0800200C9A66}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => Key deleted successfully.
"HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
"HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
ana1axo9 => Service deleted successfully.
AWEAlloc => Service deleted successfully.
GGSAFERDriver => Service deleted successfully.
hwdatacard => Service deleted successfully.
XilinxPC4Driver => Service deleted successfully.
C:\Users\Martin\Desktop\FRST.txt => Moved successfully.
"C:\Users\Martin\Downloads\Nepotvrzeno 650460.crdownload" => File/Directory not found.
C:\Users\Martin\Desktop\FRSTLauncher.exe => Moved successfully.
C:\Windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\AdwCleaner => Moved successfully.
C:\Users\Martin\Downloads\zoek.rar => Moved successfully.
C:\Users\Martin\Downloads\zoek (1).rar => Moved successfully.
C:\rsit => Moved successfully.
C:\Program Files\trend micro => Moved successfully.
C:\Users\Martin\Downloads\RSITx64.exe => Moved successfully.
C:\Windows\system32\Drivers\MBAMSwissArmy.sys => Moved successfully.
C:\Windows\system32\Drivers\mbamchameleon.sys => Moved successfully.
C:\Users\Martin\Desktop\mbar => Moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job => Moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000Core.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490246678-3699060608-628407935-1000UA.job => Moved successfully.
C:\Windows => ":095661E9DEF17EEE" ADS removed successfully.
C:\ProgramData\TEMP => ":C8B8CEBD" ADS removed successfully.
C:\Users\Public\DRM => ":مايكروسوفت" ADS removed successfully.

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GarenaPlus" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Martin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^GameRanger.lnk" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 495.7 MB temporary data.


The system needed a reboot.

==== End of Fixlog ====
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Bonjour service - rootkit

#10 Příspěvek od vyosek »

Tak jeste uklidime :James008:

:arrow: DelFix https://toolslib.net/downloads/finish/2/
  • Stahnete a spustte
  • Ponechte zatrzitkou pouze u volby Remote disinfection tools
  • Kliknete na Run
:arrow: Stahnete Ccleaner https://www.piriform.com/ccleaner/download/standard
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: A pokud nejsou problemy ci dotazy, je to z me strany vse :|
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
kenor
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 27 Led 2011 20:18

Re: Bonjour service - rootkit

#11 Příspěvek od kenor »

Bezva, děkuji mnohokrát :)
Nahoru
Avatar uživatele
vyosek
VIP
VIP
Příspěvky: 56365
Registrován: 07 Lis 2006 15:24
Místo/Bydliště: Šalingrad - Brno

Re: Bonjour service - rootkit

#12 Příspěvek od vyosek »

Nemate zac, rad jsem pomohl :worship: Zase nekdy Obrázek

A na zaklade Pravidla o zamykani temat :lock:
"Kdo víno má a nepije,kdo hrozny má a nejí je, kdo ženu má a nelíbá, kdo zábavě se vyhýbá, na toho vemte bič a hůl, to není člověk, to je vůl."
Člen Obrázek od 1. února 2011.
Nahoru
Zamčeno

Vrátit se na „Řešení problémů, logy“