Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Kontrola logu prosím.

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
Sxmanek
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 14 pro 2014 14:12

Kontrola logu prosím.

#1 Příspěvek od Sxmanek »

Zdravím, poslední dobou se mi objevují všude reklamy i na stránkách, kde by žádné reklamy být neměli. Občas mi prohlížeč nenajde ani google a sem tam se mi sekne celý nb. V prohlížeči mám nějaký browser, který i když smažu, tak po znovuspuštění tam je. Mohli by jste se mi podívat na log prosím.

Kód: Vybrat vše

Logfile of random's system information tool 1.10 (written by random/random)
Run by Tomas at 2014-12-14 14:08:24
Microsoft Windows 7 Professional  Service Pack 1
System drive C: has 80 GB (52%) free of 153 GB
Total RAM: 2046 MB (40% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:08:49, on 14/12/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17496)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
C:\Program Files\YTDownloader\YTDownloader.exe
C:\Program Files\f552dd4c52e3\b786bdb3c67d.exe
C:\Users\Tomas\AppData\Local\Akamai\netsession_win.exe
C:\Program Files\AutoHotkey\AutoHotkey.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\Users\Tomas\AppData\Local\Akamai\netsession_win.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Microsoft Office\Office15\MsoSync.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\Tomas\Downloads\RSIT.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\trend micro\Tomas.exe
C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: 54.235.90.58 hjjjegfhiceggepdokloeepnhlfnedkk
O2 - BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (file missing)
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WindowsDriverScan86] C:\Program Files\Adobe Arkalis\Arkalis86.lnk
O4 - HKLM\..\Run: [WindowsDriverScan64] C:\Program Files\Adobe Arkalis\Arkalis.lnk
O4 - HKLM\..\Run: [EaseUS EPM tray] C:\Program Files\EaseUS\EaseUS Partition Master 10.1\bin\EpmNews.exe
O4 - HKLM\..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [YTDownloader] "C:\Program Files\YTDownloader\YTDownloader.exe" /boot
O4 - HKLM\..\Run: [f552dd4c52e3] C:\Program Files\f552dd4c52e3\b786bdb3c67d.exe
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Tomas\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [YTDownloader] "C:\Program Files\YTDownloader\YTDownloader.exe" /boot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: AutoHotkey.ahk
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~1\MICROS~3\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do OneNotu - res://C:\PROGRA~1\MICROS~3\Office15\ONBttnIE.dll/105
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{F95BE2F3-86C9-4C92-9B82-A09C88FE4DC4}: NameServer = 78.136.128.4 78.136.128.12
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: FlexNet Licensing Service - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Company - C:\Windows\system32\Hpservice.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files\Sony\Sony PC Companion\PCCService.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Universal Updater Service (UniversalUpdater) - Unknown owner - C:\Program Files\0ca45c95134d\cf3e08d747e4.exe
O23 - Service: Cisco AnyConnect Secure Mobility Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

--
End of file - 11337 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe  
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files\Google\Update\GoogleUpdate.exe  /c 
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files\Google\Update\GoogleUpdate.exe  /ua /installsource scheduler 
C:\Windows\tasks\IFE.job - C:\Users\Tomas\AppData\Roaming\IFE.exe  /infocmdline=s/ThzX2kSv+d0HGvyLZUZPYqGOBpdXT/rWeUaiLh4FNuizedl/t6905o6KcLZnLao6ZsOM1DsAtXhrv66Q/QsvJQ8utEssJHAKK/8GPYyqtTxwj8TDxAgKbAMTi54U/56pj/MNyKohjPgCJZKKTWNApZ7CUriBfKDTbHwc3YHdtc9V4+h7evHcuwmXZxLYzUFEA52F8m9d1BGagFetDV2nLXWzVWpGdKoRbcfzBi/2DMWHwaobdHCtK9NnlloFaKa/gpiU5g2E+goYhHkUiMdif3PVWUIMy6/KJzUsvwdmCCK6aWsArADJ8BSvRLSra+oO6ykBiwYWUS73/QC1nNkalcbvtCNNCk9MvTDvMCRhZkhS039zq5/A3zzqC06FRrI6g4T+J/PWBVhLfSSCqzYA3T1ZpIRN+a0rR4CxnjoUJYmD80jO/NAy2VJNGh199LVJzeVniWW2Bj7aP1kbipOUA5lRd9i4em43i94XMhorBoV1BzP5IkZmyr+3AUK4HT 
C:\Windows\tasks\RGVBKM.job - C:\Users\Tomas\AppData\Roaming\RGVBKM.exe  /infocmdline=xH5yEmAiE2qPD8r1lvfxHDIBLuDAJW5XhNpfNFrq+Nj1sTPVqUMUIA2LyG8P/0ueptKoCfOUSHIdmvMHhybYft6V3TZOm2bWZ43FXMAHUBCnwN7bXiXcXuYBJtvlxXEqBGEhsBDqNp/Zu50pDYNSWL7Pqp3nQp+p/DcJeAHQvpVKt7ZmRVe3DC1uPV2s71wqCdL82V2LFbUsOpxL3WicOh8s7af2AnqqS2fae6WZSEDlUw6xUjE8P8aZ8MIJwioEJ9tcM0bXUhysnJF1w15KwIz0fgJ9SjST0wvgcoW0uPJ+Zcxm8+hKVkr43A4U+D6To1XKrNUlFSSiob6TcR0kXx094NOcY7u3h0w+Rvk4QoZ+1hJFjq41zYqhcVVj1EJlqtkcx6dBCRmYcTrVBo7rFZWlDNDeVKu47xkCnyKmqiy1Q/tUJuZOk6HSwn/QbkDjCdixHU+icC8Hi4q+BvHFC16dCrnWGDUAW6SAR3/0CnqA/1+Wg2eXsxCb4c+1sqCw 

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
ExplorerWnd Helper - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2014-10-22 153248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll [2014-09-12 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL [2014-01-23 707800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL [2014-11-12 1729744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll [2014-09-12 172968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-12-12 5227112]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20 1021128]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2010-03-23 495708]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-10-14 2299176]
"WindowsDriverScan86"=C:\Program Files\Adobe Arkalis\Arkalis86.lnk [2014-08-10 1501]
"WindowsDriverScan64"=C:\Program Files\Adobe Arkalis\Arkalis.lnk [2014-08-10 1419]
"EaseUS EPM tray"=C:\Program Files\EaseUS\EaseUS Partition Master 10.1\bin\EpmNews.exe []
"Cisco AnyConnect Secure Mobility Agent for Windows"=C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [2013-01-24 701872]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-02-27 558496]
"YTDownloader"=C:\Program Files\YTDownloader\YTDownloader.exe [2014-12-12 1988456]
"f552dd4c52e3"=C:\Program Files\f552dd4c52e3\b786bdb3c67d.exe [2014-12-13 2386432]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"=C:\Users\Tomas\AppData\Local\Akamai\netsession_win.exe [2014-10-29 4673432]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]
"YTDownloader"=C:\Program Files\YTDownloader\YTDownloader.exe [2014-12-12 1988456]

C:\Users\Tomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
AutoHotkey.ahk

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
""=
"NoDriveTypeAutoRun"=221

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.FMVC"=fmcodec.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install - 
.scr - config - 

======List of files/folders created in the last 1 month======

2014-12-14 14:08:25 ----D---- C:\Program Files\trend micro
2014-12-14 14:08:24 ----D---- C:\rsit
2014-12-14 12:18:51 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-12-14 12:18:17 ----D---- C:\ProgramData\Malwarebytes
2014-12-14 12:18:17 ----D---- C:\Program Files\Malwarebytes Anti-Malware
2014-12-14 12:18:17 ----A---- C:\Windows\system32\drivers\mwac.sys
2014-12-14 12:18:17 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-12-14 12:18:17 ----A---- C:\Windows\system32\drivers\mbam.sys
2014-12-14 12:02:24 ----D---- C:\Program Files\900362e1-10de-4256-962c-0f873df20e7c
2014-12-14 12:02:00 ----D---- C:\Program Files\Universal Updater
2014-12-14 12:02:00 ----D---- C:\Program Files\0ca45c95134d
2014-12-14 12:01:13 ----D---- C:\Program Files\2e22c4ac-9b78-4953-886e-3a58b4387bd4
2014-12-14 12:01:10 ----D---- C:\Program Files\f552dd4c52e3
2014-12-14 12:01:04 ----D---- C:\Program Files\YTDownloader
2014-12-14 12:00:39 ----D---- C:\Program Files\globalUpdate
2014-12-12 23:03:31 ----D---- C:\Windows\system32\appraiser
2014-12-12 14:37:51 ----A---- C:\Windows\system32\mf.dll
2014-12-11 11:07:27 ----A---- C:\Windows\system32\drivers\tdx.sys
2014-12-11 11:07:24 ----A---- C:\Windows\system32\WindowsCodecs.dll
2014-12-11 11:07:20 ----A---- C:\Windows\system32\aitstatic.exe
2014-12-11 11:07:19 ----A---- C:\Windows\system32\appraiser.dll
2014-12-11 11:07:19 ----A---- C:\Windows\system32\aepic.dll
2014-12-11 11:07:18 ----A---- C:\Windows\system32\aeinv.dll
2014-12-11 11:07:17 ----A---- C:\Windows\system32\invagent.dll
2014-12-11 11:07:15 ----A---- C:\Windows\system32\generaltel.dll
2014-12-11 11:07:15 ----A---- C:\Windows\system32\devinv.dll
2014-12-11 11:07:13 ----A---- C:\Windows\system32\aepdu.dll
2014-12-11 11:07:01 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-11 11:07:01 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-12-11 11:07:00 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-12-11 11:06:58 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-11 11:06:58 ----A---- C:\Windows\system32\jsproxy.dll
2014-12-11 11:06:57 ----A---- C:\Windows\system32\ieUnatt.exe
2014-12-11 11:06:56 ----A---- C:\Windows\system32\jscript9diag.dll
2014-12-11 11:06:56 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-12-11 11:06:56 ----A---- C:\Windows\system32\dxtmsft.dll
2014-12-11 11:06:55 ----A---- C:\Windows\system32\vbscript.dll
2014-12-11 11:06:54 ----A---- C:\Windows\system32\wininet.dll
2014-12-11 11:06:52 ----A---- C:\Windows\system32\dxtrans.dll
2014-12-11 11:06:51 ----A---- C:\Windows\system32\ieui.dll
2014-12-11 11:06:50 ----A---- C:\Windows\system32\mshtmled.dll
2014-12-11 11:06:49 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-12-11 11:06:48 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-12-11 11:06:47 ----A---- C:\Windows\system32\iertutil.dll
2014-12-11 11:06:45 ----A---- C:\Windows\system32\jscript9.dll
2014-12-11 11:06:43 ----A---- C:\Windows\system32\mshtml.dll
2014-12-11 11:06:40 ----A---- C:\Windows\system32\iernonce.dll
2014-12-11 11:06:40 ----A---- C:\Windows\system32\ie4uinit.exe
2014-12-11 11:06:39 ----A---- C:\Windows\system32\urlmon.dll
2014-12-11 11:06:39 ----A---- C:\Windows\system32\iedkcs32.dll
2014-12-11 11:06:38 ----A---- C:\Windows\system32\msfeeds.dll
2014-12-11 11:06:38 ----A---- C:\Windows\system32\ieapfltr.dll
2014-12-11 11:06:33 ----A---- C:\Windows\system32\msrating.dll
2014-12-11 11:06:32 ----A---- C:\Windows\system32\iesetup.dll
2014-12-11 11:06:31 ----A---- C:\Windows\system32\ieframe.dll
2014-12-11 11:05:52 ----A---- C:\Windows\system32\tzres.dll
2014-12-11 11:05:32 ----A---- C:\Windows\system32\charmap.exe
2014-12-11 11:05:30 ----A---- C:\Windows\system32\WsmSvc.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WsmWmiPl.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WsmAuto.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WSManHTTPConfig.exe
2014-12-08 17:03:07 ----D---- C:\Program Files\Runtime Software
2014-12-03 15:11:23 ----RASH---- C:\MSDOS.SYS
2014-12-03 15:11:23 ----RASH---- C:\IO.SYS
2014-12-03 01:40:58 ----A---- C:\Windows\system32\drivers\b786bdb3c67d.sys
2014-12-02 01:24:57 ----D---- C:\Website-Extractor
2014-12-02 01:24:57 ----D---- C:\internet
2014-12-02 00:50:00 ----D---- C:\Program Files\WinHTTrack
2014-12-01 21:11:39 ----D---- C:\Program Files\Mozilla Firefox
2014-12-01 18:38:53 ----D---- C:\Program Files\Common Files\DESIGNER
2014-12-01 18:37:25 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2014-12-01 18:35:40 ----D---- C:\Windows\PCHEALTH
2014-12-01 18:30:37 ----D---- C:\Program Files\Microsoft Analysis Services
2014-12-01 18:30:08 ----D---- C:\Program Files\Microsoft Office
2014-12-01 18:28:07 ----RHD---- C:\MSOCache
2014-12-01 18:23:10 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2014-12-01 18:23:03 ----D---- C:\Users\Tomas\AppData\Roaming\DAEMON Tools Lite
2014-12-01 18:22:56 ----D---- C:\Program Files\DAEMON Tools Lite
2014-12-01 18:21:05 ----D---- C:\ProgramData\DAEMON Tools Lite
2014-11-30 21:06:45 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2014-11-28 13:34:14 ----D---- C:\Program Files\ITSamples
2014-11-26 14:38:15 ----A---- C:\Windows\system32\aswBoot.exe
2014-11-26 14:38:10 ----A---- C:\Windows\avastSS.scr
2014-11-23 19:32:24 ----D---- C:\Program Files\Common Files\Microsoft Dynamics NAV
2014-11-23 19:32:21 ----D---- C:\Program Files\Microsoft Dynamics NAV
2014-11-23 18:24:13 ----D---- C:\Users\Tomas\AppData\Roaming\PSpad
2014-11-23 18:24:04 ----D---- C:\Program Files\PSPad editor
2014-11-23 17:55:51 ----D---- C:\Users\Tomas\AppData\Roaming\mIRC
2014-11-23 17:55:51 ----D---- C:\Program Files\mIRC
2014-11-23 17:45:11 ----D---- C:\Users\Tomas\AppData\Roaming\GitHub
2014-11-23 17:34:54 ----D---- C:\devkit
2014-11-23 17:03:42 ----D---- C:\Ruby200
2014-11-22 15:00:40 ----D---- C:\Users\Tomas\AppData\Roaming\fontconfig
2014-11-22 14:59:40 ----D---- C:\Users\Tomas\AppData\Roaming\Aegisub
2014-11-22 14:58:50 ----D---- C:\Program Files\Aegisub
2014-11-20 11:06:49 ----D---- C:\ProgramData\Cisco
2014-11-20 11:06:49 ----D---- C:\Program Files\Cisco
2014-11-19 01:14:28 ----A---- C:\Windows\system32\pku2u.dll
2014-11-19 01:14:27 ----A---- C:\Windows\system32\kerberos.dll
2014-11-18 20:47:48 ----A---- C:\Windows\system32\FM20.DLL

======List of files/folders modified in the last 1 month======

2014-12-14 14:08:41 ----D---- C:\Windows\Temp
2014-12-14 14:08:25 ----D---- C:\Program Files
2014-12-14 13:43:22 ----D---- C:\Windows\system32\Tasks
2014-12-14 13:20:56 ----D---- C:\Windows\system32\config
2014-12-14 13:04:31 ----RSD---- C:\Windows\assembly
2014-12-14 13:04:31 ----HD---- C:\ProgramData
2014-12-14 13:04:31 ----D---- C:\Windows\system32\drivers
2014-12-14 13:01:26 ----D---- C:\Program Files\Common Files
2014-12-14 13:01:23 ----D---- C:\Windows\Tasks
2014-12-14 13:01:23 ----D---- C:\Program Files\Adobe Arkalis
2014-12-14 12:02:38 ----SHD---- C:\Windows\Installer
2014-12-14 12:01:10 ----D---- C:\Program Files\Common Files\System
2014-12-14 12:00:23 ----D---- C:\Windows\Prefetch
2014-12-14 11:52:36 ----D---- C:\ProgramData\Microsoft Help
2014-12-14 11:49:48 ----SHD---- C:\System Volume Information
2014-12-14 00:38:35 ----D---- C:\Users\Tomas\AppData\Roaming\BitTorrent
2014-12-13 18:57:41 ----D---- C:\Windows\system32\drivers\etc
2014-12-13 18:49:38 ----D---- C:\Windows\system32\NDF
2014-12-13 00:55:06 ----D---- C:\Windows\rescache
2014-12-12 23:06:23 ----D---- C:\Windows\winsxs
2014-12-12 23:03:31 ----SD---- C:\Windows\system32\CompatTel
2014-12-12 23:03:31 ----D---- C:\Windows\System32
2014-12-12 23:03:31 ----D---- C:\Windows\AppCompat
2014-12-12 23:03:30 ----SD---- C:\ProgramData\Microsoft
2014-12-12 23:03:30 ----D---- C:\Windows\system32\en-US
2014-12-12 23:03:30 ----D---- C:\Windows\system32\cs-CZ
2014-12-12 23:03:30 ----D---- C:\Windows\PolicyDefinitions
2014-12-12 23:03:29 ----D---- C:\Program Files\Internet Explorer
2014-12-12 17:55:03 ----D---- C:\Users\Tomas\AppData\Roaming\Skype
2014-12-12 14:21:22 ----D---- C:\Windows\system32\MRT
2014-12-12 14:10:35 ----A---- C:\Windows\system32\MRT.exe
2014-12-11 11:01:01 ----D---- C:\Windows\system32\catroot2
2014-12-10 01:04:18 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2014-12-08 18:11:03 ----D---- C:\ProgramData\Adobe
2014-12-08 17:37:48 ----D---- C:\Users\Tomas\AppData\Roaming\Adobe
2014-12-08 17:36:36 ----RSD---- C:\Windows\Fonts
2014-12-08 17:33:53 ----D---- C:\Program Files\Common Files\Adobe
2014-12-08 17:32:56 ----D---- C:\Program Files\Adobe
2014-12-07 23:33:50 ----SD---- C:\Users\Tomas\AppData\Roaming\Microsoft
2014-12-07 22:23:58 ----D---- C:\Windows\inf
2014-12-07 22:23:58 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-12-07 22:17:11 ----D---- C:\ProgramData\ProductData
2014-12-03 15:14:26 ----D---- C:\Windows
2014-12-03 14:59:45 ----A---- C:\Windows\win.ini
2014-12-01 21:57:09 ----D---- C:\Windows\Microsoft.NET
2014-12-01 21:47:20 ----D---- C:\Windows\system32\DriverStore
2014-12-01 21:43:13 ----D---- C:\Program Files\Microsoft.NET
2014-12-01 21:42:56 ----D---- C:\Program Files\Common Files\microsoft shared
2014-12-01 18:39:16 ----D---- C:\Windows\ShellNew
2014-11-30 20:59:59 ----D---- C:\ProgramData\Package Cache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-11-26 49944]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-11-26 206248]
R0 hpdskflt;HP Filter; C:\Windows\system32\DRIVERS\hpdskflt.sys [2011-05-13 25656]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2014-11-26 81768]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2014-11-26 787800]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2014-11-26 423784]
R1 b786bdb3c67d;b786bdb3c67d; C:\Windows\system32\drivers\b786bdb3c67d.sys [2014-12-03 36352]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 ctxusbm;Citrix USB Monitor Driver; C:\Windows\system32\DRIVERS\ctxusbm.sys [2013-09-24 70440]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2014-12-01 243128]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2014-11-26 24184]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2014-11-26 70384]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2014-11-26 91496]
R2 sbmntr;SBMNTR; \??\C:\PROGRA~1\YTDOWN~1\sbmntr.sys [2014-12-12 50024]
R3 Accelerometer;HP Mobile Data Protection Sensor; C:\Windows\system32\DRIVERS\Accelerometer.sys [2011-05-13 35896]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-10-09 1096704]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-08-18 4994560]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2014-11-21 23256]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2014-12-14 114904]
R3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2014-11-21 51928]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 84992]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2010-03-23 423424]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-10-14 299312]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 acsock;acsock; C:\Windows\system32\DRIVERS\acsock.sys [2013-01-24 92112]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 Axtmvflt;Axesstel USB Filter Service; C:\Windows\system32\DRIVERS\Axtmvflt.sys [2007-03-22 3456]
S3 Axtmvmdm;Axesstel USB Modem; C:\Windows\system32\DRIVERS\Axtmvmdm.sys [2007-03-26 40064]
S3 Axtmvprt;Axesstel Diagnostic Port; C:\Windows\System32\Drivers\Axtmvprt.sys [2007-03-26 38784]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 393728]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 ggflt;SOMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2014-07-05 13528]
S3 ggsomc;SOMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsomc.sys [2014-07-05 26328]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\drivers\usb8023x.sys [2013-02-12 15872]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 vpnva;Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows; C:\Windows\system32\DRIVERS\vpnva.sys [2013-01-24 23976]
S3 vtany;vtany; \??\C:\Windows\vtany.sys []
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-03 81088]
R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe [2009-03-02 81920]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-08-18 176128]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-11-26 50344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 hpsrv;HP Service; C:\Windows\system32\Hpservice.exe [2011-05-13 26168]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-11-21 1871160]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [2014-11-21 969016]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe [2010-03-23 229458]
R2 UniversalUpdater;Universal Updater Service; C:\Program Files\0ca45c95134d\cf3e08d747e4.exe [2014-12-13 696320]
R2 vpnagent;Cisco AnyConnect Secure Mobility Agent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2013-01-24 544688]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-19 107912]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2014-04-03 315008]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10 267440]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FlexNet Licensing Service;FlexNet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2014-06-11 1064312]
S3 gupdatem;Google Update Service (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-19 107912]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-11-22 102912]
S3 ose;Office  Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 150600]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 4846168]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Sony PC Companion;Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [2013-02-04 155824]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2014-09-23 833728]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-06-02 1343400]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119557
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Kontrola logu prosím.

#2 Příspěvek od Rudy »

Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner http://www.stahuj.centrum.cz/utility_a_ ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve >Scan< a potom na >Clean< (smazat)
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Sxmanek
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 14 pro 2014 14:12

Re: Kontrola logu prosím.

#3 Příspěvek od Sxmanek »

Log z Adw

Kód: Vybrat vše

# AdwCleaner v4.105 - Report created 14/12/2014 at 15:06:58
# Updated 08/12/2014 by Xplode
# Database : 2014-12-13.4 [Live]
# Operating System : Windows 7 Professional Service Pack 1 (32 bits)
# Username : Tomas - TOMAS-PC
# Running from : C:\Users\Tomas\Desktop\adwcleaner_4.105.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : sbmntr
Service Deleted : UniversalUpdater
Service Deleted : b786bdb3c67d

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files\globalUpdate
Folder Deleted : C:\Program Files\Universal Updater
Folder Deleted : C:\Program Files\YTDownloader
Folder Deleted : C:\Program Files\f552dd4c52e3
Folder Deleted : C:\Users\Public\Documents\ShopperPro
Folder Deleted : C:\Users\Tomas\AppData\Local\globalUpdate
Folder Deleted : C:\Users\Tomas\AppData\Local\CrashRpt
Folder Deleted : C:\Users\Tomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\YTDownloader
File Deleted : C:\Users\Tomas\Desktop\YTDownloader.lnk
File Deleted : C:\Users\Tomas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
File Deleted : C:\Users\Tomas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
File Deleted : C:\Users\Tomas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage
File Deleted : C:\Users\Tomas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage-journal
File Deleted : C:\Users\Tomas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage
File Deleted : C:\Users\Tomas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage-journal

***** [ Scheduled Tasks ] *****

Task Deleted : SMupdate1
Task Deleted : YTDownloader

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Key Deleted : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Value Deleted : HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [YTDownloader]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA0C978D-D909-49B6-AFE2-8BDE245DC7E6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\GlobalUpdate
Key Deleted : HKCU\Software\InstalledBrowserExtensions
Key Deleted : HKCU\Software\iWebar-nv
Key Deleted : HKCU\Software\YTDownloader
Key Deleted : HKCU\Software\AppDataLow\Software\Object Browser
Key Deleted : HKLM\SOFTWARE\GlobalUpdate
Key Deleted : HKLM\SOFTWARE\InstalledBrowserExtensions
Key Deleted : HKLM\SOFTWARE\iWebar-nv
Key Deleted : HKLM\SOFTWARE\YTDownloader
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Salus
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YTDownloader

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Google Chrome v39.0.2171.95


*************************

AdwCleaner[R0].txt - [6897 octets] - [14/12/2014 15:00:59]
AdwCleaner[R1].txt - [12965 octets] - [14/12/2014 15:04:01]
AdwCleaner[S0].txt - [7045 octets] - [14/12/2014 15:06:58]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7105 octets] ##########

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119557
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Kontrola logu prosím.

#4 Příspěvek od Rudy »

Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Sxmanek
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 14 pro 2014 14:12

Re: Kontrola logu prosím.

#5 Příspěvek od Sxmanek »

Kód: Vybrat vše

Logfile of random's system information tool 1.10 (written by random/random)
Run by Tomas at 2014-12-14 15:45:41
Microsoft Windows 7 Professional  Service Pack 1
System drive C: has 80 GB (52%) free of 153 GB
Total RAM: 2046 MB (37% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:46:18, on 14/12/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17496)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
C:\Users\Tomas\AppData\Local\Akamai\netsession_win.exe
C:\Users\Tomas\AppData\Local\Akamai\netsession_win.exe
C:\Program Files\AutoHotkey\AutoHotkey.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\Tomas\Downloads\RSIT.exe
C:\XAMPP\xampp-control.exe
C:\Program Files\trend micro\Tomas.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: 54.235.90.58 hjjjegfhiceggepdokloeepnhlfnedkk
O2 - BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (file missing)
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WindowsDriverScan86] C:\Program Files\Adobe Arkalis\Arkalis86.lnk
O4 - HKLM\..\Run: [WindowsDriverScan64] C:\Program Files\Adobe Arkalis\Arkalis.lnk
O4 - HKLM\..\Run: [EaseUS EPM tray] C:\Program Files\EaseUS\EaseUS Partition Master 10.1\bin\EpmNews.exe
O4 - HKLM\..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [YTDownloader] "C:\Program Files\YTDownloader\YTDownloader.exe" /boot
O4 - HKLM\..\Run: [f552dd4c52e3] C:\Program Files\f552dd4c52e3\b786bdb3c67d.exe
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Tomas\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: AutoHotkey.ahk
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~1\MICROS~3\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do OneNotu - res://C:\PROGRA~1\MICROS~3\Office15\ONBttnIE.dll/105
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{F95BE2F3-86C9-4C92-9B82-A09C88FE4DC4}: NameServer = 78.136.128.4 78.136.128.12
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: FlexNet Licensing Service - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Company - C:\Windows\system32\Hpservice.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files\Sony\Sony PC Companion\PCCService.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Cisco AnyConnect Secure Mobility Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

--
End of file - 10850 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe  
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files\Google\Update\GoogleUpdate.exe  /c 
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files\Google\Update\GoogleUpdate.exe  /ua /installsource scheduler 
C:\Windows\tasks\IFE.job - C:\Users\Tomas\AppData\Roaming\IFE.exe  /infocmdline=s/ThzX2kSv+d0HGvyLZUZPYqGOBpdXT/rWeUaiLh4FNuizedl/t6905o6KcLZnLao6ZsOM1DsAtXhrv66Q/QsvJQ8utEssJHAKK/8GPYyqtTxwj8TDxAgKbAMTi54U/56pj/MNyKohjPgCJZKKTWNApZ7CUriBfKDTbHwc3YHdtc9V4+h7evHcuwmXZxLYzUFEA52F8m9d1BGagFetDV2nLXWzVWpGdKoRbcfzBi/2DMWHwaobdHCtK9NnlloFaKa/gpiU5g2E+goYhHkUiMdif3PVWUIMy6/KJzUsvwdmCCK6aWsArADJ8BSvRLSra+oO6ykBiwYWUS73/QC1nNkalcbvtCNNCk9MvTDvMCRhZkhS039zq5/A3zzqC06FRrI6g4T+J/PWBVhLfSSCqzYA3T1ZpIRN+a0rR4CxnjoUJYmD80jO/NAy2VJNGh199LVJzeVniWW2Bj7aP1kbipOUA5lRd9i4em43i94XMhorBoV1BzP5IkZmyr+3AUK4HT 
C:\Windows\tasks\RGVBKM.job - C:\Users\Tomas\AppData\Roaming\RGVBKM.exe  /infocmdline=xH5yEmAiE2qPD8r1lvfxHDIBLuDAJW5XhNpfNFrq+Nj1sTPVqUMUIA2LyG8P/0ueptKoCfOUSHIdmvMHhybYft6V3TZOm2bWZ43FXMAHUBCnwN7bXiXcXuYBJtvlxXEqBGEhsBDqNp/Zu50pDYNSWL7Pqp3nQp+p/DcJeAHQvpVKt7ZmRVe3DC1uPV2s71wqCdL82V2LFbUsOpxL3WicOh8s7af2AnqqS2fae6WZSEDlUw6xUjE8P8aZ8MIJwioEJ9tcM0bXUhysnJF1w15KwIz0fgJ9SjST0wvgcoW0uPJ+Zcxm8+hKVkr43A4U+D6To1XKrNUlFSSiob6TcR0kXx094NOcY7u3h0w+Rvk4QoZ+1hJFjq41zYqhcVVj1EJlqtkcx6dBCRmYcTrVBo7rFZWlDNDeVKu47xkCnyKmqiy1Q/tUJuZOk6HSwn/QbkDjCdixHU+icC8Hi4q+BvHFC16dCrnWGDUAW6SAR3/0CnqA/1+Wg2eXsxCb4c+1sqCw 

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
ExplorerWnd Helper - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2014-10-22 153248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll [2014-09-12 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL [2014-01-23 707800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL [2014-11-12 1729744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll [2014-09-12 172968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-12-12 5227112]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20 1021128]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2010-03-23 495708]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-10-14 2299176]
"WindowsDriverScan86"=C:\Program Files\Adobe Arkalis\Arkalis86.lnk [2014-08-10 1501]
"WindowsDriverScan64"=C:\Program Files\Adobe Arkalis\Arkalis.lnk [2014-08-10 1419]
"EaseUS EPM tray"=C:\Program Files\EaseUS\EaseUS Partition Master 10.1\bin\EpmNews.exe []
"Cisco AnyConnect Secure Mobility Agent for Windows"=C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [2013-01-24 701872]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-02-27 558496]
"YTDownloader"=C:\Program Files\YTDownloader\YTDownloader.exe /boot []
"f552dd4c52e3"=C:\Program Files\f552dd4c52e3\b786bdb3c67d.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"=C:\Users\Tomas\AppData\Local\Akamai\netsession_win.exe [2014-10-29 4673432]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]

C:\Users\Tomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
AutoHotkey.ahk

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
""=
"NoDriveTypeAutoRun"=221

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.FMVC"=fmcodec.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install - 
.scr - config - 

======List of files/folders created in the last 1 month======

2014-12-14 15:00:57 ----D---- C:\AdwCleaner
2014-12-14 14:08:25 ----D---- C:\Program Files\trend micro
2014-12-14 14:08:24 ----D---- C:\rsit
2014-12-14 12:18:51 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-12-14 12:18:17 ----D---- C:\ProgramData\Malwarebytes
2014-12-14 12:18:17 ----D---- C:\Program Files\Malwarebytes Anti-Malware
2014-12-14 12:18:17 ----A---- C:\Windows\system32\drivers\mwac.sys
2014-12-14 12:18:17 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-12-14 12:18:17 ----A---- C:\Windows\system32\drivers\mbam.sys
2014-12-14 12:02:24 ----D---- C:\Program Files\900362e1-10de-4256-962c-0f873df20e7c
2014-12-14 12:02:00 ----D---- C:\Program Files\0ca45c95134d
2014-12-14 12:01:13 ----D---- C:\Program Files\2e22c4ac-9b78-4953-886e-3a58b4387bd4
2014-12-12 23:03:31 ----D---- C:\Windows\system32\appraiser
2014-12-12 14:37:51 ----A---- C:\Windows\system32\mf.dll
2014-12-11 11:07:27 ----A---- C:\Windows\system32\drivers\tdx.sys
2014-12-11 11:07:24 ----A---- C:\Windows\system32\WindowsCodecs.dll
2014-12-11 11:07:20 ----A---- C:\Windows\system32\aitstatic.exe
2014-12-11 11:07:19 ----A---- C:\Windows\system32\appraiser.dll
2014-12-11 11:07:19 ----A---- C:\Windows\system32\aepic.dll
2014-12-11 11:07:18 ----A---- C:\Windows\system32\aeinv.dll
2014-12-11 11:07:17 ----A---- C:\Windows\system32\invagent.dll
2014-12-11 11:07:15 ----A---- C:\Windows\system32\generaltel.dll
2014-12-11 11:07:15 ----A---- C:\Windows\system32\devinv.dll
2014-12-11 11:07:13 ----A---- C:\Windows\system32\aepdu.dll
2014-12-11 11:07:01 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-11 11:07:01 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-12-11 11:07:00 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-12-11 11:06:58 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-11 11:06:58 ----A---- C:\Windows\system32\jsproxy.dll
2014-12-11 11:06:57 ----A---- C:\Windows\system32\ieUnatt.exe
2014-12-11 11:06:56 ----A---- C:\Windows\system32\jscript9diag.dll
2014-12-11 11:06:56 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-12-11 11:06:56 ----A---- C:\Windows\system32\dxtmsft.dll
2014-12-11 11:06:55 ----A---- C:\Windows\system32\vbscript.dll
2014-12-11 11:06:54 ----A---- C:\Windows\system32\wininet.dll
2014-12-11 11:06:52 ----A---- C:\Windows\system32\dxtrans.dll
2014-12-11 11:06:51 ----A---- C:\Windows\system32\ieui.dll
2014-12-11 11:06:50 ----A---- C:\Windows\system32\mshtmled.dll
2014-12-11 11:06:49 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-12-11 11:06:48 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-12-11 11:06:47 ----A---- C:\Windows\system32\iertutil.dll
2014-12-11 11:06:45 ----A---- C:\Windows\system32\jscript9.dll
2014-12-11 11:06:43 ----A---- C:\Windows\system32\mshtml.dll
2014-12-11 11:06:40 ----A---- C:\Windows\system32\iernonce.dll
2014-12-11 11:06:40 ----A---- C:\Windows\system32\ie4uinit.exe
2014-12-11 11:06:39 ----A---- C:\Windows\system32\urlmon.dll
2014-12-11 11:06:39 ----A---- C:\Windows\system32\iedkcs32.dll
2014-12-11 11:06:38 ----A---- C:\Windows\system32\msfeeds.dll
2014-12-11 11:06:38 ----A---- C:\Windows\system32\ieapfltr.dll
2014-12-11 11:06:33 ----A---- C:\Windows\system32\msrating.dll
2014-12-11 11:06:32 ----A---- C:\Windows\system32\iesetup.dll
2014-12-11 11:06:31 ----A---- C:\Windows\system32\ieframe.dll
2014-12-11 11:05:52 ----A---- C:\Windows\system32\tzres.dll
2014-12-11 11:05:32 ----A---- C:\Windows\system32\charmap.exe
2014-12-11 11:05:30 ----A---- C:\Windows\system32\WsmSvc.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WsmWmiPl.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WsmAuto.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WSManHTTPConfig.exe
2014-12-08 17:03:07 ----D---- C:\Program Files\Runtime Software
2014-12-03 15:11:23 ----RASH---- C:\MSDOS.SYS
2014-12-03 15:11:23 ----RASH---- C:\IO.SYS
2014-12-03 01:40:58 ----A---- C:\Windows\system32\drivers\b786bdb3c67d.sys
2014-12-02 01:24:57 ----D---- C:\Website-Extractor
2014-12-02 01:24:57 ----D---- C:\internet
2014-12-02 00:50:00 ----D---- C:\Program Files\WinHTTrack
2014-12-01 21:11:39 ----D---- C:\Program Files\Mozilla Firefox
2014-12-01 18:38:53 ----D---- C:\Program Files\Common Files\DESIGNER
2014-12-01 18:37:25 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2014-12-01 18:35:40 ----D---- C:\Windows\PCHEALTH
2014-12-01 18:30:37 ----D---- C:\Program Files\Microsoft Analysis Services
2014-12-01 18:30:08 ----D---- C:\Program Files\Microsoft Office
2014-12-01 18:28:07 ----RHD---- C:\MSOCache
2014-12-01 18:23:10 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2014-12-01 18:23:03 ----D---- C:\Users\Tomas\AppData\Roaming\DAEMON Tools Lite
2014-12-01 18:22:56 ----D---- C:\Program Files\DAEMON Tools Lite
2014-12-01 18:21:05 ----D---- C:\ProgramData\DAEMON Tools Lite
2014-11-30 21:06:45 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2014-11-28 13:34:14 ----D---- C:\Program Files\ITSamples
2014-11-26 14:38:15 ----A---- C:\Windows\system32\aswBoot.exe
2014-11-26 14:38:10 ----A---- C:\Windows\avastSS.scr
2014-11-23 19:32:24 ----D---- C:\Program Files\Common Files\Microsoft Dynamics NAV
2014-11-23 19:32:21 ----D---- C:\Program Files\Microsoft Dynamics NAV
2014-11-23 18:24:13 ----D---- C:\Users\Tomas\AppData\Roaming\PSpad
2014-11-23 18:24:04 ----D---- C:\Program Files\PSPad editor
2014-11-23 17:55:51 ----D---- C:\Users\Tomas\AppData\Roaming\mIRC
2014-11-23 17:55:51 ----D---- C:\Program Files\mIRC
2014-11-23 17:45:11 ----D---- C:\Users\Tomas\AppData\Roaming\GitHub
2014-11-23 17:34:54 ----D---- C:\devkit
2014-11-23 17:03:42 ----D---- C:\Ruby200
2014-11-22 15:00:40 ----D---- C:\Users\Tomas\AppData\Roaming\fontconfig
2014-11-22 14:59:40 ----D---- C:\Users\Tomas\AppData\Roaming\Aegisub
2014-11-22 14:58:50 ----D---- C:\Program Files\Aegisub
2014-11-20 11:06:49 ----D---- C:\ProgramData\Cisco
2014-11-20 11:06:49 ----D---- C:\Program Files\Cisco
2014-11-19 01:14:28 ----A---- C:\Windows\system32\pku2u.dll
2014-11-19 01:14:27 ----A---- C:\Windows\system32\kerberos.dll
2014-11-18 20:47:48 ----A---- C:\Windows\system32\FM20.DLL

======List of files/folders modified in the last 1 month======

2014-12-14 15:45:49 ----D---- C:\Windows\Temp
2014-12-14 15:23:45 ----D---- C:\Windows\system32\config
2014-12-14 15:07:10 ----D---- C:\Windows\system32\Tasks
2014-12-14 15:07:07 ----D---- C:\Program Files
2014-12-14 14:29:41 ----D---- C:\Windows\system32\drivers\etc
2014-12-14 13:04:31 ----RSD---- C:\Windows\assembly
2014-12-14 13:04:31 ----HD---- C:\ProgramData
2014-12-14 13:04:31 ----D---- C:\Windows\system32\drivers
2014-12-14 13:01:26 ----D---- C:\Program Files\Common Files
2014-12-14 13:01:23 ----D---- C:\Windows\Tasks
2014-12-14 13:01:23 ----D---- C:\Program Files\Adobe Arkalis
2014-12-14 12:02:38 ----SHD---- C:\Windows\Installer
2014-12-14 12:01:10 ----D---- C:\Program Files\Common Files\System
2014-12-14 12:00:23 ----D---- C:\Windows\Prefetch
2014-12-14 11:52:36 ----D---- C:\ProgramData\Microsoft Help
2014-12-14 11:49:48 ----SHD---- C:\System Volume Information
2014-12-14 00:38:35 ----D---- C:\Users\Tomas\AppData\Roaming\BitTorrent
2014-12-13 18:49:38 ----D---- C:\Windows\system32\NDF
2014-12-13 00:55:06 ----D---- C:\Windows\rescache
2014-12-12 23:06:23 ----D---- C:\Windows\winsxs
2014-12-12 23:03:31 ----SD---- C:\Windows\system32\CompatTel
2014-12-12 23:03:31 ----D---- C:\Windows\System32
2014-12-12 23:03:31 ----D---- C:\Windows\AppCompat
2014-12-12 23:03:30 ----SD---- C:\ProgramData\Microsoft
2014-12-12 23:03:30 ----D---- C:\Windows\system32\en-US
2014-12-12 23:03:30 ----D---- C:\Windows\system32\cs-CZ
2014-12-12 23:03:30 ----D---- C:\Windows\PolicyDefinitions
2014-12-12 23:03:29 ----D---- C:\Program Files\Internet Explorer
2014-12-12 17:55:03 ----D---- C:\Users\Tomas\AppData\Roaming\Skype
2014-12-12 14:21:22 ----D---- C:\Windows\system32\MRT
2014-12-12 14:10:35 ----A---- C:\Windows\system32\MRT.exe
2014-12-11 11:01:01 ----D---- C:\Windows\system32\catroot2
2014-12-10 01:04:18 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2014-12-08 18:11:03 ----D---- C:\ProgramData\Adobe
2014-12-08 17:37:48 ----D---- C:\Users\Tomas\AppData\Roaming\Adobe
2014-12-08 17:36:36 ----RSD---- C:\Windows\Fonts
2014-12-08 17:33:53 ----D---- C:\Program Files\Common Files\Adobe
2014-12-08 17:32:56 ----D---- C:\Program Files\Adobe
2014-12-07 23:33:50 ----SD---- C:\Users\Tomas\AppData\Roaming\Microsoft
2014-12-07 22:23:58 ----D---- C:\Windows\inf
2014-12-07 22:23:58 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-12-07 22:17:11 ----D---- C:\ProgramData\ProductData
2014-12-03 15:14:26 ----D---- C:\Windows
2014-12-03 14:59:45 ----A---- C:\Windows\win.ini
2014-12-01 21:57:09 ----D---- C:\Windows\Microsoft.NET
2014-12-01 21:47:20 ----D---- C:\Windows\system32\DriverStore
2014-12-01 21:43:13 ----D---- C:\Program Files\Microsoft.NET
2014-12-01 21:42:56 ----D---- C:\Program Files\Common Files\microsoft shared
2014-12-01 18:39:16 ----D---- C:\Windows\ShellNew
2014-11-30 20:59:59 ----D---- C:\ProgramData\Package Cache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-11-26 49944]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-11-26 206248]
R0 hpdskflt;HP Filter; C:\Windows\system32\DRIVERS\hpdskflt.sys [2011-05-13 25656]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2014-11-26 81768]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2014-11-26 787800]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2014-11-26 423784]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 ctxusbm;Citrix USB Monitor Driver; C:\Windows\system32\DRIVERS\ctxusbm.sys [2013-09-24 70440]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2014-12-01 243128]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2014-11-26 24184]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2014-11-26 70384]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2014-11-26 91496]
R3 Accelerometer;HP Mobile Data Protection Sensor; C:\Windows\system32\DRIVERS\Accelerometer.sys [2011-05-13 35896]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-10-09 1096704]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-08-18 4994560]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2014-11-21 23256]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2014-12-14 114904]
R3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2014-11-21 51928]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 84992]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2010-03-23 423424]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-10-14 299312]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 acsock;acsock; C:\Windows\system32\DRIVERS\acsock.sys [2013-01-24 92112]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 Axtmvflt;Axesstel USB Filter Service; C:\Windows\system32\DRIVERS\Axtmvflt.sys [2007-03-22 3456]
S3 Axtmvmdm;Axesstel USB Modem; C:\Windows\system32\DRIVERS\Axtmvmdm.sys [2007-03-26 40064]
S3 Axtmvprt;Axesstel Diagnostic Port; C:\Windows\System32\Drivers\Axtmvprt.sys [2007-03-26 38784]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 393728]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 ggflt;SOMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2014-07-05 13528]
S3 ggsomc;SOMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsomc.sys [2014-07-05 26328]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\drivers\usb8023x.sys [2013-02-12 15872]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 vpnva;Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows; C:\Windows\system32\DRIVERS\vpnva.sys [2013-01-24 23976]
S3 vtany;vtany; \??\C:\Windows\vtany.sys []
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S3 xhunter1;xhunter1; \??\C:\Windows\xhunter1.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-03 81088]
R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe [2009-03-02 81920]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-08-18 176128]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-11-26 50344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 hpsrv;HP Service; C:\Windows\system32\Hpservice.exe [2011-05-13 26168]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-11-21 1871160]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [2014-11-21 969016]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe [2010-03-23 229458]
R2 vpnagent;Cisco AnyConnect Secure Mobility Agent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2013-01-24 544688]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-19 107912]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2014-04-03 315008]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10 267440]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FlexNet Licensing Service;FlexNet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2014-06-11 1064312]
S3 gupdatem;Google Update Service (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-19 107912]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-11-22 102912]
S3 ose;Office  Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 150600]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 4846168]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Sony PC Companion;Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [2013-02-04 155824]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2014-09-23 833728]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-06-02 1343400]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119557
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Kontrola logu prosím.

#6 Příspěvek od Rudy »

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\Program Files\YTDownloader
C:\Program Files\f552dd4c52e3\b786bdb3c67d.exe
C:\Users\Tomas\AppData\Local\Akamai
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\IFE.job
C:\Windows\tasks\RGVBKM.job

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"YTDownloader"=-
"f552dd4c52e3"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"=-

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Sxmanek
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 14 pro 2014 14:12

Re: Kontrola logu prosím.

#7 Příspěvek od Sxmanek »

Kód: Vybrat vše

Logfile of random's system information tool 1.10 (written by random/random)
Run by Tomas at 2014-12-14 16:09:45
Microsoft Windows 7 Professional  Service Pack 1
System drive C: has 89 GB (58%) free of 153 GB
Total RAM: 2046 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:10:05, on 14/12/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17496)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Microsoft Office\Office15\MsoSync.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
C:\Program Files\AutoHotkey\AutoHotkey.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\Tomas\Downloads\RSIT.exe
C:\Program Files\trend micro\Tomas.exe
C:\Program Files\Google\Chrome\Application\chrome.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: 54.235.90.58 hjjjegfhiceggepdokloeepnhlfnedkk
O2 - BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (file missing)
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WindowsDriverScan86] C:\Program Files\Adobe Arkalis\Arkalis86.lnk
O4 - HKLM\..\Run: [WindowsDriverScan64] C:\Program Files\Adobe Arkalis\Arkalis.lnk
O4 - HKLM\..\Run: [EaseUS EPM tray] C:\Program Files\EaseUS\EaseUS Partition Master 10.1\bin\EpmNews.exe
O4 - HKLM\..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: AutoHotkey.ahk
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~1\MICROS~3\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do OneNotu - res://C:\PROGRA~1\MICROS~3\Office15\ONBttnIE.dll/105
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{F95BE2F3-86C9-4C92-9B82-A09C88FE4DC4}: NameServer = 78.136.128.4 78.136.128.12
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: FlexNet Licensing Service - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Company - C:\Windows\system32\Hpservice.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files\Sony\Sony PC Companion\PCCService.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Cisco AnyConnect Secure Mobility Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

--
End of file - 10468 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe  

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
ExplorerWnd Helper - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2014-10-22 153248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll [2014-09-12 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL [2014-01-23 707800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL [2014-11-12 1729744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll [2014-09-12 172968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-12-12 5227112]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20 1021128]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2010-03-23 495708]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-10-14 2299176]
"WindowsDriverScan86"=C:\Program Files\Adobe Arkalis\Arkalis86.lnk [2014-08-10 1501]
"WindowsDriverScan64"=C:\Program Files\Adobe Arkalis\Arkalis.lnk [2014-08-10 1419]
"EaseUS EPM tray"=C:\Program Files\EaseUS\EaseUS Partition Master 10.1\bin\EpmNews.exe []
"Cisco AnyConnect Secure Mobility Agent for Windows"=C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [2013-01-24 701872]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-02-27 558496]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]

C:\Users\Tomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
AutoHotkey.ahk

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
""=
"NoDriveTypeAutoRun"=221

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.FMVC"=fmcodec.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install - 
.scr - config - 

======List of files/folders created in the last 1 month======

2014-12-14 16:03:43 ----D---- C:\_OTM
2014-12-14 15:00:57 ----D---- C:\AdwCleaner
2014-12-14 14:08:25 ----D---- C:\Program Files\trend micro
2014-12-14 14:08:24 ----D---- C:\rsit
2014-12-14 12:18:51 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-12-14 12:18:17 ----D---- C:\ProgramData\Malwarebytes
2014-12-14 12:18:17 ----D---- C:\Program Files\Malwarebytes Anti-Malware
2014-12-14 12:18:17 ----A---- C:\Windows\system32\drivers\mwac.sys
2014-12-14 12:18:17 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-12-14 12:18:17 ----A---- C:\Windows\system32\drivers\mbam.sys
2014-12-14 12:02:24 ----D---- C:\Program Files\900362e1-10de-4256-962c-0f873df20e7c
2014-12-14 12:02:00 ----D---- C:\Program Files\0ca45c95134d
2014-12-14 12:01:13 ----D---- C:\Program Files\2e22c4ac-9b78-4953-886e-3a58b4387bd4
2014-12-12 23:03:31 ----D---- C:\Windows\system32\appraiser
2014-12-12 14:37:51 ----A---- C:\Windows\system32\mf.dll
2014-12-11 11:07:27 ----A---- C:\Windows\system32\drivers\tdx.sys
2014-12-11 11:07:24 ----A---- C:\Windows\system32\WindowsCodecs.dll
2014-12-11 11:07:20 ----A---- C:\Windows\system32\aitstatic.exe
2014-12-11 11:07:19 ----A---- C:\Windows\system32\appraiser.dll
2014-12-11 11:07:19 ----A---- C:\Windows\system32\aepic.dll
2014-12-11 11:07:18 ----A---- C:\Windows\system32\aeinv.dll
2014-12-11 11:07:17 ----A---- C:\Windows\system32\invagent.dll
2014-12-11 11:07:15 ----A---- C:\Windows\system32\generaltel.dll
2014-12-11 11:07:15 ----A---- C:\Windows\system32\devinv.dll
2014-12-11 11:07:13 ----A---- C:\Windows\system32\aepdu.dll
2014-12-11 11:07:01 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-11 11:07:01 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-12-11 11:07:00 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-12-11 11:06:58 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-11 11:06:58 ----A---- C:\Windows\system32\jsproxy.dll
2014-12-11 11:06:57 ----A---- C:\Windows\system32\ieUnatt.exe
2014-12-11 11:06:56 ----A---- C:\Windows\system32\jscript9diag.dll
2014-12-11 11:06:56 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-12-11 11:06:56 ----A---- C:\Windows\system32\dxtmsft.dll
2014-12-11 11:06:55 ----A---- C:\Windows\system32\vbscript.dll
2014-12-11 11:06:54 ----A---- C:\Windows\system32\wininet.dll
2014-12-11 11:06:52 ----A---- C:\Windows\system32\dxtrans.dll
2014-12-11 11:06:51 ----A---- C:\Windows\system32\ieui.dll
2014-12-11 11:06:50 ----A---- C:\Windows\system32\mshtmled.dll
2014-12-11 11:06:49 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-12-11 11:06:48 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-12-11 11:06:47 ----A---- C:\Windows\system32\iertutil.dll
2014-12-11 11:06:45 ----A---- C:\Windows\system32\jscript9.dll
2014-12-11 11:06:43 ----A---- C:\Windows\system32\mshtml.dll
2014-12-11 11:06:40 ----A---- C:\Windows\system32\iernonce.dll
2014-12-11 11:06:40 ----A---- C:\Windows\system32\ie4uinit.exe
2014-12-11 11:06:39 ----A---- C:\Windows\system32\urlmon.dll
2014-12-11 11:06:39 ----A---- C:\Windows\system32\iedkcs32.dll
2014-12-11 11:06:38 ----A---- C:\Windows\system32\msfeeds.dll
2014-12-11 11:06:38 ----A---- C:\Windows\system32\ieapfltr.dll
2014-12-11 11:06:33 ----A---- C:\Windows\system32\msrating.dll
2014-12-11 11:06:32 ----A---- C:\Windows\system32\iesetup.dll
2014-12-11 11:06:31 ----A---- C:\Windows\system32\ieframe.dll
2014-12-11 11:05:52 ----A---- C:\Windows\system32\tzres.dll
2014-12-11 11:05:32 ----A---- C:\Windows\system32\charmap.exe
2014-12-11 11:05:30 ----A---- C:\Windows\system32\WsmSvc.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WsmWmiPl.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WsmAuto.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WSManHTTPConfig.exe
2014-12-08 17:03:07 ----D---- C:\Program Files\Runtime Software
2014-12-03 15:11:23 ----RASH---- C:\MSDOS.SYS
2014-12-03 15:11:23 ----RASH---- C:\IO.SYS
2014-12-03 01:40:58 ----A---- C:\Windows\system32\drivers\b786bdb3c67d.sys
2014-12-02 01:24:57 ----D---- C:\Website-Extractor
2014-12-02 01:24:57 ----D---- C:\internet
2014-12-02 00:50:00 ----D---- C:\Program Files\WinHTTrack
2014-12-01 21:11:39 ----D---- C:\Program Files\Mozilla Firefox
2014-12-01 18:38:53 ----D---- C:\Program Files\Common Files\DESIGNER
2014-12-01 18:37:25 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2014-12-01 18:35:40 ----D---- C:\Windows\PCHEALTH
2014-12-01 18:30:37 ----D---- C:\Program Files\Microsoft Analysis Services
2014-12-01 18:30:08 ----D---- C:\Program Files\Microsoft Office
2014-12-01 18:28:07 ----RHD---- C:\MSOCache
2014-12-01 18:23:10 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2014-12-01 18:23:03 ----D---- C:\Users\Tomas\AppData\Roaming\DAEMON Tools Lite
2014-12-01 18:22:56 ----D---- C:\Program Files\DAEMON Tools Lite
2014-12-01 18:21:05 ----D---- C:\ProgramData\DAEMON Tools Lite
2014-11-30 21:06:45 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2014-11-28 13:34:14 ----D---- C:\Program Files\ITSamples
2014-11-26 14:38:15 ----A---- C:\Windows\system32\aswBoot.exe
2014-11-26 14:38:10 ----A---- C:\Windows\avastSS.scr
2014-11-23 19:32:24 ----D---- C:\Program Files\Common Files\Microsoft Dynamics NAV
2014-11-23 19:32:21 ----D---- C:\Program Files\Microsoft Dynamics NAV
2014-11-23 18:24:13 ----D---- C:\Users\Tomas\AppData\Roaming\PSpad
2014-11-23 18:24:04 ----D---- C:\Program Files\PSPad editor
2014-11-23 17:55:51 ----D---- C:\Users\Tomas\AppData\Roaming\mIRC
2014-11-23 17:55:51 ----D---- C:\Program Files\mIRC
2014-11-23 17:45:11 ----D---- C:\Users\Tomas\AppData\Roaming\GitHub
2014-11-23 17:34:54 ----D---- C:\devkit
2014-11-23 17:03:42 ----D---- C:\Ruby200
2014-11-22 15:00:40 ----D---- C:\Users\Tomas\AppData\Roaming\fontconfig
2014-11-22 14:59:40 ----D---- C:\Users\Tomas\AppData\Roaming\Aegisub
2014-11-22 14:58:50 ----D---- C:\Program Files\Aegisub
2014-11-20 11:06:49 ----D---- C:\ProgramData\Cisco
2014-11-20 11:06:49 ----D---- C:\Program Files\Cisco
2014-11-19 01:14:28 ----A---- C:\Windows\system32\pku2u.dll
2014-11-19 01:14:27 ----A---- C:\Windows\system32\kerberos.dll
2014-11-18 20:47:48 ----A---- C:\Windows\system32\FM20.DLL

======List of files/folders modified in the last 1 month======

2014-12-14 16:09:49 ----D---- C:\Windows\Temp
2014-12-14 16:05:44 ----D---- C:\Windows\system32\config
2014-12-14 16:03:48 ----D---- C:\Windows\Tasks
2014-12-14 15:07:10 ----D---- C:\Windows\system32\Tasks
2014-12-14 15:07:07 ----D---- C:\Program Files
2014-12-14 14:29:41 ----D---- C:\Windows\system32\drivers\etc
2014-12-14 13:04:31 ----RSD---- C:\Windows\assembly
2014-12-14 13:04:31 ----HD---- C:\ProgramData
2014-12-14 13:04:31 ----D---- C:\Windows\system32\drivers
2014-12-14 13:01:26 ----D---- C:\Program Files\Common Files
2014-12-14 13:01:23 ----D---- C:\Program Files\Adobe Arkalis
2014-12-14 12:02:38 ----SHD---- C:\Windows\Installer
2014-12-14 12:01:10 ----D---- C:\Program Files\Common Files\System
2014-12-14 12:00:23 ----D---- C:\Windows\Prefetch
2014-12-14 11:52:36 ----D---- C:\ProgramData\Microsoft Help
2014-12-14 11:49:48 ----SHD---- C:\System Volume Information
2014-12-14 00:38:35 ----D---- C:\Users\Tomas\AppData\Roaming\BitTorrent
2014-12-13 18:49:38 ----D---- C:\Windows\system32\NDF
2014-12-13 00:55:06 ----D---- C:\Windows\rescache
2014-12-12 23:06:23 ----D---- C:\Windows\winsxs
2014-12-12 23:03:31 ----SD---- C:\Windows\system32\CompatTel
2014-12-12 23:03:31 ----D---- C:\Windows\System32
2014-12-12 23:03:31 ----D---- C:\Windows\AppCompat
2014-12-12 23:03:30 ----SD---- C:\ProgramData\Microsoft
2014-12-12 23:03:30 ----D---- C:\Windows\system32\en-US
2014-12-12 23:03:30 ----D---- C:\Windows\system32\cs-CZ
2014-12-12 23:03:30 ----D---- C:\Windows\PolicyDefinitions
2014-12-12 23:03:29 ----D---- C:\Program Files\Internet Explorer
2014-12-12 17:55:03 ----D---- C:\Users\Tomas\AppData\Roaming\Skype
2014-12-12 14:21:22 ----D---- C:\Windows\system32\MRT
2014-12-12 14:10:35 ----A---- C:\Windows\system32\MRT.exe
2014-12-11 11:01:01 ----D---- C:\Windows\system32\catroot2
2014-12-10 01:04:18 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2014-12-08 18:11:03 ----D---- C:\ProgramData\Adobe
2014-12-08 17:37:48 ----D---- C:\Users\Tomas\AppData\Roaming\Adobe
2014-12-08 17:36:36 ----RSD---- C:\Windows\Fonts
2014-12-08 17:33:53 ----D---- C:\Program Files\Common Files\Adobe
2014-12-08 17:32:56 ----D---- C:\Program Files\Adobe
2014-12-07 23:33:50 ----SD---- C:\Users\Tomas\AppData\Roaming\Microsoft
2014-12-07 22:23:58 ----D---- C:\Windows\inf
2014-12-07 22:23:58 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-12-07 22:17:11 ----D---- C:\ProgramData\ProductData
2014-12-03 15:14:26 ----D---- C:\Windows
2014-12-03 14:59:45 ----A---- C:\Windows\win.ini
2014-12-01 21:57:09 ----D---- C:\Windows\Microsoft.NET
2014-12-01 21:47:20 ----D---- C:\Windows\system32\DriverStore
2014-12-01 21:43:13 ----D---- C:\Program Files\Microsoft.NET
2014-12-01 21:42:56 ----D---- C:\Program Files\Common Files\microsoft shared
2014-12-01 18:39:16 ----D---- C:\Windows\ShellNew
2014-11-30 20:59:59 ----D---- C:\ProgramData\Package Cache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-11-26 49944]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-11-26 206248]
R0 hpdskflt;HP Filter; C:\Windows\system32\DRIVERS\hpdskflt.sys [2011-05-13 25656]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2014-11-26 81768]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2014-11-26 787800]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2014-11-26 423784]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 ctxusbm;Citrix USB Monitor Driver; C:\Windows\system32\DRIVERS\ctxusbm.sys [2013-09-24 70440]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2014-12-01 243128]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2014-11-26 24184]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2014-11-26 70384]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2014-11-26 91496]
R3 Accelerometer;HP Mobile Data Protection Sensor; C:\Windows\system32\DRIVERS\Accelerometer.sys [2011-05-13 35896]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-10-09 1096704]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-08-18 4994560]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2014-11-21 23256]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2014-12-14 114904]
R3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2014-11-21 51928]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 84992]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2010-03-23 423424]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-10-14 299312]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 acsock;acsock; C:\Windows\system32\DRIVERS\acsock.sys [2013-01-24 92112]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 Axtmvflt;Axesstel USB Filter Service; C:\Windows\system32\DRIVERS\Axtmvflt.sys [2007-03-22 3456]
S3 Axtmvmdm;Axesstel USB Modem; C:\Windows\system32\DRIVERS\Axtmvmdm.sys [2007-03-26 40064]
S3 Axtmvprt;Axesstel Diagnostic Port; C:\Windows\System32\Drivers\Axtmvprt.sys [2007-03-26 38784]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 393728]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 ggflt;SOMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2014-07-05 13528]
S3 ggsomc;SOMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsomc.sys [2014-07-05 26328]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\drivers\usb8023x.sys [2013-02-12 15872]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 vpnva;Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows; C:\Windows\system32\DRIVERS\vpnva.sys [2013-01-24 23976]
S3 vtany;vtany; \??\C:\Windows\vtany.sys []
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S3 xhunter1;xhunter1; \??\C:\Windows\xhunter1.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-03 81088]
R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe [2009-03-02 81920]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-08-18 176128]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-11-26 50344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 hpsrv;HP Service; C:\Windows\system32\Hpservice.exe [2011-05-13 26168]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-11-21 1871160]
R2 MBAMService;MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [2014-11-21 969016]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe [2010-03-23 229458]
R2 vpnagent;Cisco AnyConnect Secure Mobility Agent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2013-01-24 544688]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-19 107912]
S2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2014-04-03 315008]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10 267440]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FlexNet Licensing Service;FlexNet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2014-06-11 1064312]
S3 gupdatem;Google Update Service (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-19 107912]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-11-22 102912]
S3 ose;Office  Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 150600]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 4846168]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Sony PC Companion;Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [2013-02-04 155824]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2014-09-23 833728]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-06-02 1343400]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119557
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Kontrola logu prosím.

#8 Příspěvek od Rudy »

Ještě jednou spusťte OTM tímto skriptem:
:commands
[Emptytemp]
[Emptyflash]
[Resethosts]
a klikněte na >MoveIt!<. Před skenem vypněte antivir a po něm restartujte PC. Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Sxmanek
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 14 pro 2014 14:12

Re: Kontrola logu prosím.

#9 Příspěvek od Sxmanek »

Už to běží skoro na 100%, pořád mám defaultní prohlížeč mystartsearch, i když v nastavení mám google.

Kód: Vybrat vše

Logfile of random's system information tool 1.10 (written by random/random)
Run by Tomas at 2014-12-14 17:18:28
Microsoft Windows 7 Professional  Service Pack 1
System drive C: has 89 GB (58%) free of 153 GB
Total RAM: 2046 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:18:59, on 14/12/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17496)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Adobe\Reader 11.0\Reader\Reader_sl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\Program Files\AutoHotkey\AutoHotkey.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Microsoft Office\Office15\MsoSync.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\Tomas\Downloads\RSIT.exe
C:\Program Files\trend micro\Tomas.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ÿþ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (file missing)
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WindowsDriverScan86] C:\Program Files\Adobe Arkalis\Arkalis86.lnk
O4 - HKLM\..\Run: [WindowsDriverScan64] C:\Program Files\Adobe Arkalis\Arkalis.lnk
O4 - HKLM\..\Run: [EaseUS EPM tray] C:\Program Files\EaseUS\EaseUS Partition Master 10.1\bin\EpmNews.exe
O4 - HKLM\..\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: AutoHotkey.ahk
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~1\MICROS~3\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do OneNotu - res://C:\PROGRA~1\MICROS~3\Office15\ONBttnIE.dll/105
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{F95BE2F3-86C9-4C92-9B82-A09C88FE4DC4}: NameServer = 78.136.128.4 78.136.128.12
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: FlexNet Licensing Service - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Company - C:\Windows\system32\Hpservice.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files\Sony\Sony PC Companion\PCCService.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Cisco AnyConnect Secure Mobility Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe

--
End of file - 10327 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe  

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
ExplorerWnd Helper - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2014-10-22 153248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_20\bin\ssv.dll [2014-09-12 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL [2014-01-23 707800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL [2014-11-12 1729744]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_20\bin\jp2ssv.dll [2014-09-12 172968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-12-12 5227112]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20 1021128]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2010-03-23 495708]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-10-14 2299176]
"WindowsDriverScan86"=C:\Program Files\Adobe Arkalis\Arkalis86.lnk [2014-08-10 1501]
"WindowsDriverScan64"=C:\Program Files\Adobe Arkalis\Arkalis.lnk [2014-08-10 1419]
"EaseUS EPM tray"=C:\Program Files\EaseUS\EaseUS Partition Master 10.1\bin\EpmNews.exe []
"Cisco AnyConnect Secure Mobility Agent for Windows"=C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [2013-01-24 701872]
"AdobeAAMUpdater-1.0"=C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2014-02-27 558496]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]

C:\Users\Tomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
AutoHotkey.ahk

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
""=
"NoDriveTypeAutoRun"=221

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"VIDC.FMVC"=fmcodec.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install - 
.scr - config - 

======List of files/folders created in the last 1 month======

2014-12-14 16:03:43 ----D---- C:\_OTM
2014-12-14 15:00:57 ----D---- C:\AdwCleaner
2014-12-14 14:08:25 ----D---- C:\Program Files\trend micro
2014-12-14 14:08:24 ----D---- C:\rsit
2014-12-14 12:18:17 ----D---- C:\ProgramData\Malwarebytes
2014-12-14 12:02:24 ----D---- C:\Program Files\900362e1-10de-4256-962c-0f873df20e7c
2014-12-14 12:02:00 ----D---- C:\Program Files\0ca45c95134d
2014-12-14 12:01:13 ----D---- C:\Program Files\2e22c4ac-9b78-4953-886e-3a58b4387bd4
2014-12-12 23:03:31 ----D---- C:\Windows\system32\appraiser
2014-12-12 14:37:51 ----A---- C:\Windows\system32\mf.dll
2014-12-11 11:07:27 ----A---- C:\Windows\system32\drivers\tdx.sys
2014-12-11 11:07:24 ----A---- C:\Windows\system32\WindowsCodecs.dll
2014-12-11 11:07:20 ----A---- C:\Windows\system32\aitstatic.exe
2014-12-11 11:07:19 ----A---- C:\Windows\system32\appraiser.dll
2014-12-11 11:07:19 ----A---- C:\Windows\system32\aepic.dll
2014-12-11 11:07:18 ----A---- C:\Windows\system32\aeinv.dll
2014-12-11 11:07:17 ----A---- C:\Windows\system32\invagent.dll
2014-12-11 11:07:15 ----A---- C:\Windows\system32\generaltel.dll
2014-12-11 11:07:15 ----A---- C:\Windows\system32\devinv.dll
2014-12-11 11:07:13 ----A---- C:\Windows\system32\aepdu.dll
2014-12-11 11:07:01 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-11 11:07:01 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-12-11 11:07:00 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-12-11 11:06:58 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-11 11:06:58 ----A---- C:\Windows\system32\jsproxy.dll
2014-12-11 11:06:57 ----A---- C:\Windows\system32\ieUnatt.exe
2014-12-11 11:06:56 ----A---- C:\Windows\system32\jscript9diag.dll
2014-12-11 11:06:56 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-12-11 11:06:56 ----A---- C:\Windows\system32\dxtmsft.dll
2014-12-11 11:06:55 ----A---- C:\Windows\system32\vbscript.dll
2014-12-11 11:06:54 ----A---- C:\Windows\system32\wininet.dll
2014-12-11 11:06:52 ----A---- C:\Windows\system32\dxtrans.dll
2014-12-11 11:06:51 ----A---- C:\Windows\system32\ieui.dll
2014-12-11 11:06:50 ----A---- C:\Windows\system32\mshtmled.dll
2014-12-11 11:06:49 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-12-11 11:06:48 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-12-11 11:06:47 ----A---- C:\Windows\system32\iertutil.dll
2014-12-11 11:06:45 ----A---- C:\Windows\system32\jscript9.dll
2014-12-11 11:06:43 ----A---- C:\Windows\system32\mshtml.dll
2014-12-11 11:06:40 ----A---- C:\Windows\system32\iernonce.dll
2014-12-11 11:06:40 ----A---- C:\Windows\system32\ie4uinit.exe
2014-12-11 11:06:39 ----A---- C:\Windows\system32\urlmon.dll
2014-12-11 11:06:39 ----A---- C:\Windows\system32\iedkcs32.dll
2014-12-11 11:06:38 ----A---- C:\Windows\system32\msfeeds.dll
2014-12-11 11:06:38 ----A---- C:\Windows\system32\ieapfltr.dll
2014-12-11 11:06:33 ----A---- C:\Windows\system32\msrating.dll
2014-12-11 11:06:32 ----A---- C:\Windows\system32\iesetup.dll
2014-12-11 11:06:31 ----A---- C:\Windows\system32\ieframe.dll
2014-12-11 11:05:52 ----A---- C:\Windows\system32\tzres.dll
2014-12-11 11:05:32 ----A---- C:\Windows\system32\charmap.exe
2014-12-11 11:05:30 ----A---- C:\Windows\system32\WsmSvc.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WsmWmiPl.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WsmAuto.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-11 11:05:29 ----A---- C:\Windows\system32\WSManHTTPConfig.exe
2014-12-08 17:03:07 ----D---- C:\Program Files\Runtime Software
2014-12-03 15:11:23 ----RASH---- C:\MSDOS.SYS
2014-12-03 15:11:23 ----RASH---- C:\IO.SYS
2014-12-03 01:40:58 ----A---- C:\Windows\system32\drivers\b786bdb3c67d.sys
2014-12-02 01:24:57 ----D---- C:\Website-Extractor
2014-12-02 01:24:57 ----D---- C:\internet
2014-12-02 00:50:00 ----D---- C:\Program Files\WinHTTrack
2014-12-01 21:11:39 ----D---- C:\Program Files\Mozilla Firefox
2014-12-01 18:38:53 ----D---- C:\Program Files\Common Files\DESIGNER
2014-12-01 18:37:25 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2014-12-01 18:35:40 ----D---- C:\Windows\PCHEALTH
2014-12-01 18:30:37 ----D---- C:\Program Files\Microsoft Analysis Services
2014-12-01 18:30:08 ----D---- C:\Program Files\Microsoft Office
2014-12-01 18:28:07 ----RHD---- C:\MSOCache
2014-12-01 18:23:10 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2014-12-01 18:23:03 ----D---- C:\Users\Tomas\AppData\Roaming\DAEMON Tools Lite
2014-12-01 18:22:56 ----D---- C:\Program Files\DAEMON Tools Lite
2014-12-01 18:21:05 ----D---- C:\ProgramData\DAEMON Tools Lite
2014-11-30 21:06:45 ----D---- C:\ProgramData\regid.1986-12.com.adobe
2014-11-28 13:34:14 ----D---- C:\Program Files\ITSamples
2014-11-26 14:38:15 ----A---- C:\Windows\system32\aswBoot.exe
2014-11-26 14:38:10 ----A---- C:\Windows\avastSS.scr
2014-11-23 19:32:24 ----D---- C:\Program Files\Common Files\Microsoft Dynamics NAV
2014-11-23 19:32:21 ----D---- C:\Program Files\Microsoft Dynamics NAV
2014-11-23 18:24:13 ----D---- C:\Users\Tomas\AppData\Roaming\PSpad
2014-11-23 18:24:04 ----D---- C:\Program Files\PSPad editor
2014-11-23 17:55:51 ----D---- C:\Users\Tomas\AppData\Roaming\mIRC
2014-11-23 17:55:51 ----D---- C:\Program Files\mIRC
2014-11-23 17:45:11 ----D---- C:\Users\Tomas\AppData\Roaming\GitHub
2014-11-23 17:34:54 ----D---- C:\devkit
2014-11-23 17:03:42 ----D---- C:\Ruby200
2014-11-22 15:00:40 ----D---- C:\Users\Tomas\AppData\Roaming\fontconfig
2014-11-22 14:59:40 ----D---- C:\Users\Tomas\AppData\Roaming\Aegisub
2014-11-22 14:58:50 ----D---- C:\Program Files\Aegisub
2014-11-20 11:06:49 ----D---- C:\ProgramData\Cisco
2014-11-20 11:06:49 ----D---- C:\Program Files\Cisco
2014-11-19 01:14:28 ----A---- C:\Windows\system32\pku2u.dll
2014-11-19 01:14:27 ----A---- C:\Windows\system32\kerberos.dll
2014-11-18 20:47:48 ----A---- C:\Windows\system32\FM20.DLL

======List of files/folders modified in the last 1 month======

2014-12-14 17:18:34 ----D---- C:\Windows\Temp
2014-12-14 17:15:25 ----D---- C:\Windows\system32\drivers\etc
2014-12-14 16:24:41 ----D---- C:\Program Files
2014-12-14 16:24:32 ----D---- C:\Windows\system32\drivers
2014-12-14 16:05:44 ----D---- C:\Windows\system32\config
2014-12-14 16:03:48 ----D---- C:\Windows\Tasks
2014-12-14 15:07:10 ----D---- C:\Windows\system32\Tasks
2014-12-14 13:04:31 ----RSD---- C:\Windows\assembly
2014-12-14 13:04:31 ----HD---- C:\ProgramData
2014-12-14 13:01:26 ----D---- C:\Program Files\Common Files
2014-12-14 13:01:23 ----D---- C:\Program Files\Adobe Arkalis
2014-12-14 12:02:38 ----SHD---- C:\Windows\Installer
2014-12-14 12:01:10 ----D---- C:\Program Files\Common Files\System
2014-12-14 12:00:23 ----D---- C:\Windows\Prefetch
2014-12-14 11:52:36 ----D---- C:\ProgramData\Microsoft Help
2014-12-14 11:49:48 ----SHD---- C:\System Volume Information
2014-12-14 00:38:35 ----D---- C:\Users\Tomas\AppData\Roaming\BitTorrent
2014-12-13 18:49:38 ----D---- C:\Windows\system32\NDF
2014-12-13 00:55:06 ----D---- C:\Windows\rescache
2014-12-12 23:06:23 ----D---- C:\Windows\winsxs
2014-12-12 23:03:31 ----SD---- C:\Windows\system32\CompatTel
2014-12-12 23:03:31 ----D---- C:\Windows\System32
2014-12-12 23:03:31 ----D---- C:\Windows\AppCompat
2014-12-12 23:03:30 ----SD---- C:\ProgramData\Microsoft
2014-12-12 23:03:30 ----D---- C:\Windows\system32\en-US
2014-12-12 23:03:30 ----D---- C:\Windows\system32\cs-CZ
2014-12-12 23:03:30 ----D---- C:\Windows\PolicyDefinitions
2014-12-12 23:03:29 ----D---- C:\Program Files\Internet Explorer
2014-12-12 17:55:03 ----D---- C:\Users\Tomas\AppData\Roaming\Skype
2014-12-12 14:21:22 ----D---- C:\Windows\system32\MRT
2014-12-12 14:10:35 ----A---- C:\Windows\system32\MRT.exe
2014-12-11 11:01:01 ----D---- C:\Windows\system32\catroot2
2014-12-10 01:04:18 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2014-12-08 18:11:03 ----D---- C:\ProgramData\Adobe
2014-12-08 17:37:48 ----D---- C:\Users\Tomas\AppData\Roaming\Adobe
2014-12-08 17:36:36 ----RSD---- C:\Windows\Fonts
2014-12-08 17:33:53 ----D---- C:\Program Files\Common Files\Adobe
2014-12-08 17:32:56 ----D---- C:\Program Files\Adobe
2014-12-07 23:33:50 ----SD---- C:\Users\Tomas\AppData\Roaming\Microsoft
2014-12-07 22:23:58 ----D---- C:\Windows\inf
2014-12-07 22:23:58 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-12-07 22:17:11 ----D---- C:\ProgramData\ProductData
2014-12-03 15:14:26 ----D---- C:\Windows
2014-12-03 14:59:45 ----A---- C:\Windows\win.ini
2014-12-01 21:57:09 ----D---- C:\Windows\Microsoft.NET
2014-12-01 21:47:20 ----D---- C:\Windows\system32\DriverStore
2014-12-01 21:43:13 ----D---- C:\Program Files\Microsoft.NET
2014-12-01 21:42:56 ----D---- C:\Program Files\Common Files\microsoft shared
2014-12-01 18:39:16 ----D---- C:\Windows\ShellNew
2014-11-30 20:59:59 ----D---- C:\ProgramData\Package Cache

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-11-26 49944]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-11-26 206248]
R0 hpdskflt;HP Filter; C:\Windows\system32\DRIVERS\hpdskflt.sys [2011-05-13 25656]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2014-11-26 81768]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2014-11-26 787800]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2014-11-26 423784]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 388096]
R1 ctxusbm;Citrix USB Monitor Driver; C:\Windows\system32\DRIVERS\ctxusbm.sys [2013-09-24 70440]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2014-12-01 243128]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 48128]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2014-11-26 24184]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2014-11-26 70384]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2014-11-26 91496]
R3 Accelerometer;HP Mobile Data Protection Sensor; C:\Windows\system32\DRIVERS\Accelerometer.sys [2011-05-13 35896]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2009-10-09 1096704]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-08-18 4994560]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 34816]
R3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 93696]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 60416]
R3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 129536]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 84992]
R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2010-03-23 423424]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-10-14 299312]
S2 Parvdm;Parvdm; C:\Windows\system32\drivers\parvdm.sys [2009-07-14 8704]
S3 acsock;acsock; C:\Windows\system32\DRIVERS\acsock.sys [2013-01-24 92112]
S3 aic78xx;aic78xx; C:\Windows\system32\drivers\djsvs.sys [2009-07-14 70720]
S3 amdagp;AMD AGP Bus Filter Driver; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 Axtmvflt;Axesstel USB Filter Service; C:\Windows\system32\DRIVERS\Axtmvflt.sys [2007-03-22 3456]
S3 Axtmvmdm;Axesstel USB Modem; C:\Windows\system32\DRIVERS\Axtmvmdm.sys [2007-03-26 40064]
S3 Axtmvprt;Axesstel Diagnostic Port; C:\Windows\System32\Drivers\Axtmvprt.sys [2007-03-26 38784]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2009-07-13 229888]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 393728]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
S3 ggflt;SOMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2014-07-05 13528]
S3 ggsomc;SOMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsomc.sys [2014-07-05 26328]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 133632]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 5632]
S3 sisagp;SIS AGP Bus Filter; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 28032]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\drivers\usb8023x.sys [2013-02-12 15872]
S3 viaagp;VIA AGP Bus Filter; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\drivers\viac7.sys [2009-07-14 52736]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 175360]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 17920]
S3 vpnva;Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows; C:\Windows\system32\DRIVERS\vpnva.sys [2013-01-24 23976]
S3 vtany;vtany; \??\C:\Windows\vtany.sys []
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S3 xhunter1;xhunter1; \??\C:\Windows\xhunter1.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-03 81088]
R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe [2009-03-02 81920]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-08-18 176128]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-11-26 50344]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 hpsrv;HP Service; C:\Windows\system32\Hpservice.exe [2011-05-13 26168]
R2 SkypeUpdate;Skype Updater; C:\Program Files\Skype\Updater\Updater.exe [2014-04-03 315008]
R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe [2010-03-23 229458]
R2 vpnagent;Cisco AnyConnect Secure Mobility Agent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2013-01-24 544688]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-19 107912]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-10 267440]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 20992]
S3 FlexNet Licensing Service;FlexNet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2014-06-11 1064312]
S3 gupdatem;Google Update Service (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-19 107912]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-11-22 102912]
S3 ose;Office  Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 150600]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 4846168]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 Sony PC Companion;Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [2013-02-04 155824]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2014-09-23 833728]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 20992]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-06-02 1343400]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2013-09-11 46688]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119557
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Kontrola logu prosím.

#10 Příspěvek od Rudy »

Smazáno. Znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Sxmanek
Návštěvník
Návštěvník
Příspěvky: 24
Registrován: 14 pro 2014 14:12

Re: Kontrola logu prosím.

#11 Příspěvek od Sxmanek »

Jo vše v pořádku, měl jsem jen blbě nastavenou úvodní stránku, díky moc.

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119557
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Kontrola logu prosím.

#12 Příspěvek od Rudy »

Rádo se stalo! :)
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Zamčeno