Zamrzání

Zpráva

#16 Příspěvek od **Márty84** » 23 pro 2014 22:09

Vsechny tyto programy - vcetne pripadne instalace - spoustejte jako spravce (kliknete na ne pravym mysidlem a zvolte - Spustit jako spravce)

vyosek píše: T-Cleaner http://tharifas.sweb.cz/T-Cleaner.exe
Stahnete a spustte

Pro potvrzeni volby mackejte A, Enter

Po pouziti utilitu smazte

Antiviry mohou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

Stahnete OTC http://oldtimer.geekstogo.com/OTC.exe , ulozte a spustte.
Kliknete na napis CleanUp a pote OK - Po uklidu dojde k restartu pc.

Stahnete Ccleaner http://www.filehippo.com/download_ccleaner a spustte.
Pri instalaci pozor na toolbar (ci jine doplnky), jestli vam nabidne jeho instalaci, tak zruste zatrzitko.
Po spusteni se ocitnete ve funkci Cistic. Vlevo je spousta zatrzitek. Pozor dejte hlavne na kos, pokud nechate zatrzene, vzdy ho vysype.
Dale, podle toho jak je nastaven, smaze vsechna hesla ulozena na netu!!! Takze jestli mate nastavene, at si pocitac hesla pamatuje (coz neni pro bezpecnost dobre), budete je muset pak napsat znova rucne (napr mail, facebook, ruzna fora atd.)
Kliknete na Analyzovat a az dokonci analyzu, kliknete na Spustit Cleaner.
Potom kliknete vlevo na funkci Registry
Kliknete na Hledej problemy, kdyz najde, kliknete na Opravit problemy. Nabidne Vam zalohu, tu udelejte a ulozte ji tak, at ji v pripade potreby najdete.
Funkce Nastroje umoznuje odinstalovani programu. Je dukladnejsi nez samotny windows!
(Pokud je v pc vice uzivatelskych uctu, pouzijte program i v nich)

Defragmentujte disk(y) (SSD Disky ne!)
Stahnete program Defraggler http://www.stahuj.centrum.cz/utility_a_ ... efraggler/
Pri instalaci opet pozor na toolbar a dalsi nesmysly.
Po nainstalovani program spustte a kliknete na Analyzovat, po analyze kliknete na Defragmentovat a programek odvede svou praci.

Pak napiste, jak je na tom pc.

civrs · #17 Příspěvek od **civrs** » 28 pro 2014 14:31

Pc se zdá stejné,jen zase včera z ničeho nic (tedy při pouštění videa na yotube) se kousl naskočila modrá obrazovka plná nějakého psaní cca na 5 vteřin a poté naskočí ta původní jak jsem psal na začátku a na ní to zamrzne a musím knoflem natvrdo vypnout,nepomůže ani knof.restart protože se to vrátí na tu samou modrou obrazovku,myslím jestli to není od grafiky nebo desky ten nápis.

#18 Příspěvek od **Márty84** » 28 pro 2014 14:52

Kouknete do slozky C:\Windows\Minidump . Pokud tam budou nejake soubory, uplodnete je treba na leteckou postu http://leteckaposta.cz/ a sem dejte odkaz na stazeni.

Pokud nemate, zazalohujte si radeji dulezita data (fotky, dokumenty, atd.)

Nepouzivejte ComboFix bez predchozi domluvy! Je to poruseni pravidel fora a ztratite tim narok na pomoc!

Stahnete ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe a ulozte ho na plochu.
Vypnete antivir i dalsi pripadne zabezpeceni.
Kliknete na ComboFix pravym mysidlem a levym na Spustit jako spravce
Odsouhlaste licencni podminky a nechte program pracovat. Jestli vam nabidne instalaci Konzoly pro zotaveni, souhlaste.
Po dobu skenu nic nespoustejte, nikam neklikejte.
Po dokonceni skenovani (muze dojit i k restartu pc) by se mel vytvorit log, ktery bude umisteny zde C:\ComboFix.txt
Jeho obsah sem zkopirujte

Kdyby po restartu nenabehl windows, restartujte znovu, mackejte klavesu F8 a zvolte - Posledni znama funkcni konfigurace

Kdyz windows nabehne, ale pri spousteni ruznych programu bude hlasena chyba, staci restartovat pc a bude to v poradku

civrs · #19 Příspěvek od **civrs** » 28 pro 2014 15:12

Složku C:\Windows\Minidump jsem nenašel.
Jinak budu pokračovat..

#20 Příspěvek od **Márty84** » 28 pro 2014 17:34

civrs · #21 Příspěvek od **civrs** » 28 pro 2014 21:51

Sken trvá celkem dlouho
... dokončena fáze 40,a jede dál
... posláno z jiného přístroje...

civrs · #22 Příspěvek od **civrs** » 28 pro 2014 22:32

..je to tu
ComboFix 14-12-25.01 - Admin 28.12.2014 16:17:30.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4095.1678 [GMT 1:00]
Spuštěný z: c:\users\Admin\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Admin\Documents\FAPB414.tmp
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-11-28 do 2014-12-28 )))))))))))))))))))))))))))))))
.
.
2014-12-28 21:21 . 2014-12-28 21:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-12-28 12:18 . 2014-12-28 12:18 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{13B00F8D-176B-4BD4-AF47-D11D647D64A6}\offreg.dll
2014-12-28 10:11 . 2014-12-28 10:11 -------- d-----w- c:\program files\Defraggler
2014-12-26 09:19 . 2014-12-02 10:26 11870360 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{13B00F8D-176B-4BD4-AF47-D11D647D64A6}\mpengine.dll
2014-12-26 09:10 . 2014-12-26 09:10 -------- d-----w- c:\windows\SysWow64\Adobe
2014-12-22 18:45 . 2014-12-22 18:45 -------- d-----w- c:\users\Admin\AppData\Roaming\AVAST Software
2014-12-22 18:44 . 2014-12-22 18:44 436624 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-12-22 18:44 . 2014-12-22 18:44 267632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-12-22 18:44 . 2014-12-22 18:44 116728 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-12-22 18:44 . 2014-12-22 18:44 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-12-22 18:44 . 2014-12-22 18:44 83280 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-12-22 18:44 . 2014-12-22 18:44 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-12-22 18:44 . 2014-12-22 18:44 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-12-22 18:44 . 2014-12-22 18:44 1050432 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-12-22 18:44 . 2014-12-22 18:44 364512 ----a-w- c:\windows\system32\aswBoot.exe
2014-12-22 18:44 . 2014-12-22 18:44 43152 ----a-w- c:\windows\avastSS.scr
2014-12-22 18:39 . 2014-12-22 18:39 -------- d-----w- c:\program files\AVAST Software
2014-12-22 18:37 . 2014-12-22 18:39 -------- d-----w- c:\programdata\AVAST Software
2014-12-22 12:45 . 2014-12-22 15:55 -------- d-----w- c:\users\Admin\AppData\Local\Facebook
2014-12-22 10:31 . 2014-12-22 10:31 -------- d-----w- c:\users\Admin\AppData\Local\DriverToolkit
2014-12-22 10:31 . 2014-12-22 10:34 -------- d-----w- c:\program files (x86)\DriverToolkit
2014-12-21 18:51 . 2014-12-21 18:51 -------- d-----w- c:\programdata\Malwarebytes
2014-12-21 14:13 . 2014-12-22 18:50 -------- d-----w- c:\program files\trend micro
2014-12-21 14:11 . 2014-12-28 09:46 -------- d-----w- c:\program files (x86)\trend micro
2014-12-18 16:46 . 2014-12-18 16:46 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-12-18 11:04 . 2014-12-13 05:09 144384 ----a-w- c:\windows\system32\ieUnatt.exe
2014-12-18 11:04 . 2014-12-13 03:33 115712 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2014-12-11 10:54 . 2014-12-11 10:54 -------- d-----w- c:\windows\system32\appraiser
2014-12-10 21:04 . 2014-10-18 01:33 3209728 ----a-w- c:\windows\SysWow64\mf.dll
2014-12-10 21:04 . 2014-07-07 02:06 206848 ----a-w- c:\windows\system32\mfps.dll
2014-12-10 21:04 . 2014-07-07 02:06 55808 ----a-w- c:\windows\system32\rrinstaller.exe
2014-12-10 21:04 . 2014-07-07 02:06 24576 ----a-w- c:\windows\system32\mfpmp.exe
2014-12-10 21:04 . 2014-07-07 02:02 2048 ----a-w- c:\windows\system32\mferror.dll
2014-12-10 21:04 . 2014-07-07 01:40 103424 ----a-w- c:\windows\SysWow64\mfps.dll
2014-12-10 21:04 . 2014-07-07 01:39 50176 ----a-w- c:\windows\SysWow64\rrinstaller.exe
2014-12-10 21:04 . 2014-07-07 01:39 23040 ----a-w- c:\windows\SysWow64\mfpmp.exe
2014-12-10 21:04 . 2014-07-07 01:37 2048 ----a-w- c:\windows\SysWow64\mferror.dll
2014-12-10 21:04 . 2014-10-18 02:05 4121600 ----a-w- c:\windows\system32\mf.dll
2014-12-10 12:46 . 2014-11-27 01:43 389296 ----a-w- c:\windows\system32\iedkcs32.dll
2014-12-10 12:45 . 2014-10-30 02:03 165888 ----a-w- c:\windows\system32\charmap.exe
2014-12-03 15:27 . 2014-12-27 17:15 281768 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2014-12-03 14:56 . 2014-12-03 14:56 -------- d-----w- c:\users\Admin\Patch net v1.6 a v1.7 Cod 4 Modern Warfare
2014-12-03 13:54 . 2014-12-03 13:55 -------- d-----w- c:\users\Admin\cod fix
2014-12-01 16:46 . 2014-12-01 16:46 -------- d--h--w- c:\program files (x86)\Common Files\EAInstaller
2014-12-01 16:44 . 2014-12-22 10:43 -------- d-----w- c:\programdata\Package Cache
2014-12-01 16:06 . 2014-12-01 16:06 -------- d-----w- c:\users\Admin\The.Sims.4.Cestina
2014-11-30 22:52 . 2014-11-30 22:52 -------- d-----w- c:\users\Admin\The Sims 4
2014-11-29 16:54 . 2014-11-29 16:54 -------- d--h--r- c:\users\Admin\AppData\Roaming\SecuROM
2014-11-29 16:04 . 2014-11-29 16:04 -------- d-----w- c:\programdata\EA Core
2014-11-29 16:01 . 2011-02-18 14:07 447752 ----a-w- c:\windows\SysWow64\vp6vfw.dll
2014-11-29 12:13 . 2014-12-03 16:08 -------- d-----w- c:\program files (x86)\Origin Games
2014-11-29 12:12 . 2014-12-19 06:46 -------- d-----w- c:\users\Admin\AppData\Roaming\Origin
2014-11-29 12:12 . 2014-11-29 12:13 -------- d-----w- c:\users\Admin\AppData\Local\Origin
2014-11-29 12:08 . 2014-12-23 10:11 -------- d-----w- c:\programdata\Origin
2014-11-29 12:08 . 2014-11-29 12:08 -------- d-----w- c:\programdata\Electronic Arts
2014-11-29 12:07 . 2014-12-23 14:23 -------- d-----w- c:\program files (x86)\Origin
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-12-27 17:15 . 2014-10-27 21:22 281768 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-12-27 17:15 . 2014-10-27 21:22 103736 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2014-12-10 21:07 . 2014-08-11 15:30 112710672 ----a-w- c:\windows\system32\MRT.exe
2014-12-10 16:54 . 2014-08-14 09:12 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-12-10 16:54 . 2014-08-14 09:12 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-12-03 15:17 . 2014-10-27 21:22 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2014-11-24 13:04 . 2010-11-21 03:27 275080 ------w- c:\windows\system32\MpSigStub.exe
2014-11-19 03:31 . 2014-11-19 03:31 1217192 ----a-w- c:\windows\SysWow64\FM20.DLL
2014-11-11 03:08 . 2014-11-19 12:07 241152 ----a-w- c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-19 12:07 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-11-19 12:07 186880 ----a-w- c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-19 12:07 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-11-01 14:04 . 2014-11-01 14:04 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-10-30 02:03 . 2014-12-10 12:45 165888 ----a-w- c:\windows\system32\charmap.exe
2014-10-27 20:55 . 2014-10-27 20:55 29696 ----a-w- c:\windows\system32\drivers\dtscsibus.sys
2014-10-27 20:18 . 2014-08-17 12:23 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2014-10-27 05:36 . 2014-08-29 07:17 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2014-10-25 01:57 . 2014-11-12 14:35 77824 ----a-w- c:\windows\system32\packager.dll
2014-10-25 01:32 . 2014-11-12 14:35 67584 ----a-w- c:\windows\SysWow64\packager.dll
2014-10-21 16:24 . 2014-08-17 12:23 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2014-10-18 02:05 . 2014-11-12 14:34 861696 ----a-w- c:\windows\system32\oleaut32.dll
2014-10-18 01:33 . 2014-11-12 14:34 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2014-10-14 02:16 . 2014-11-12 14:38 155064 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2014-10-14 02:13 . 2014-11-12 14:38 683520 ----a-w- c:\windows\system32\termsrv.dll
2014-10-14 02:13 . 2014-11-12 14:34 3241984 ----a-w- c:\windows\system32\msi.dll
2014-10-14 02:12 . 2014-11-12 14:38 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-10-14 02:09 . 2014-11-12 14:38 146432 ----a-w- c:\windows\system32\msaudite.dll
2014-10-14 02:07 . 2014-11-12 14:38 681984 ----a-w- c:\windows\system32\adtschema.dll
2014-10-14 01:50 . 2014-11-12 14:38 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-10-14 01:50 . 2014-11-12 14:34 2363904 ----a-w- c:\windows\SysWow64\msi.dll
2014-10-14 01:49 . 2014-11-12 14:38 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-10-14 01:47 . 2014-11-12 14:38 146432 ----a-w- c:\windows\SysWow64\msaudite.dll
2014-10-14 01:46 . 2014-11-12 14:38 681984 ----a-w- c:\windows\SysWow64\adtschema.dll
2014-10-13 21:50 . 2014-09-09 12:52 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2014-10-10 00:57 . 2014-11-12 14:35 3198976 ----a-w- c:\windows\system32\win32k.sys
2014-10-03 02:12 . 2014-11-12 14:35 500224 ----a-w- c:\windows\system32\AUDIOKSE.dll
2014-10-03 02:11 . 2014-11-12 14:35 284672 ----a-w- c:\windows\system32\EncDump.dll
2014-10-03 02:11 . 2014-11-12 14:35 680960 ----a-w- c:\windows\system32\audiosrv.dll
2014-10-03 02:11 . 2014-11-12 14:35 440832 ----a-w- c:\windows\system32\AudioEng.dll
2014-10-03 02:11 . 2014-11-12 14:35 296448 ----a-w- c:\windows\system32\AudioSes.dll
2014-10-03 01:44 . 2014-11-12 14:35 442880 ----a-w- c:\windows\SysWow64\AUDIOKSE.dll
2014-10-03 01:44 . 2014-11-12 14:35 374784 ----a-w- c:\windows\SysWow64\AudioEng.dll
2014-10-03 01:44 . 2014-11-12 14:35 195584 ----a-w- c:\windows\SysWow64\AudioSes.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2014-10-14 720064]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2014-12-12 7394584]
"GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2014-12-06 856904]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-12-22 5226600]
.
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft SharePoint Workspace.lnk - c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE /TrayOnly [2013-12-18 30814400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS;c:\windows\SYSNATIVE\MLPTDR_Q.SYS [x]
R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x]
R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x]
R3 Disc Soft Bus Service;Disc Soft Bus Service;c:\program files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe;c:\program files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 KinectCamera;Kinect for Windows Camera Driver;c:\windows\system32\Drivers\kinectcamera.sys;c:\windows\SYSNATIVE\Drivers\kinectcamera.sys [x]
R3 Origin Client Service;Origin Client Service;c:\program files (x86)\Origin\OriginClientService.exe;c:\program files (x86)\Origin\OriginClientService.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S3 dtscsibus;DAEMON Tools Virtual SCSI Bus;c:\windows\system32\DRIVERS\dtscsibus.sys;c:\windows\SYSNATIVE\DRIVERS\dtscsibus.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-12-12 11:46 1087816 ----a-w- c:\program files (x86)\Google\Chrome\Application\39.0.2171.95\Installer\chrmstp.exe
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-12-22 18:44 860984 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KONICA MINOLTA PagePro 1350WStatusDisplay"="c:\windows\system32\MSTM64_Q.EXE" [2011-03-25 247736]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~3\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~3\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.0.1 82.100.29.65
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9g7k8sqs.default\
FF - prefs.js: browser.startup.homepage - |hxxps://www.google.cz/
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\S-1-5-21-295825898-662873493-1367285107-1000\Software\SecuROM\License information*]
"datasecu"=hex:35,5a,3b,87,03,7e,92,6b,d2,68,2f,f8,13,7e,b1,0b,2a,ea,68,25,1b,
58,40,7c,d1,3e,40,81,d5,81,7e,15,f1,ab,95,e0,fa,b4,b7,53,1d,f1,7e,08,e6,a9,\
"rkeysecu"=hex:25,50,77,bc,b6,99,e6,ce,9c,d3,bc,01,20,2c,3f,15
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-12-28 22:24:14
ComboFix-quarantined-files.txt 2014-12-28 21:24
.
Před spuštěním: Volných bajtů: 354 211 549 184
Po spuštění: Volných bajtů: 354 053 591 040
.
- - End Of File - - 6721BC2EBB4645519EF060232E9BE494
A36C5E4F47E84449FF07ED3517B43A31

#23 Příspěvek od **Márty84** » 29 pro 2014 02:43

Vypnete trvale Windows Defender

Otevrete si poznamkovy blok a zkopirujte do nej tento skript

Kód: Vybrat vše

KillAll::

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeSyncProcess"=-
"CCleaner Monitoring"=-
"GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C"=-

Regnull::
[HKEY_USERS\S-1-5-21-295825898-662873493-1367285107-1000\Software\SecuROM\License information*]

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Reboot::

Vlevo nahore kliknete na napis Soubor
Kliknete na napis Ulozit jako...
Napiste spravne ten cerveny nazev CFScript a ulozte na plochu.
Vypnete antivir i dalsi pripadne zabezpeceni.
Pretahntete mysi tento vytvoreny textovy dokument nad ikonu ComboFix a pustte.
ComboFix by se mel spustit a vykonat prikazy.
Az skonci (muze dojit k restartu pc), mel by se objevit novy log, ten mi sem zase zkopirujte.

Kdyby po restartu nenabehl windows, restartujte znovu, mackejte klavesu F8 a zvolte - Posledni znama funkcni konfigurace

Kdyz windows nabehne, ale pri spousteni ruznych programu bude hlasena chyba, staci restartovat pc a bude to v poradku

civrs · #24 Příspěvek od **civrs** » 29 pro 2014 12:05

Restart neproběhl

ComboFix 14-12-25.01 - Admin 29.12.2014 10:14:56.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4095.2276 [GMT 1:00]
Spuštěný z: c:\users\Admin\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Admin\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-11-28 do 2014-12-29 )))))))))))))))))))))))))))))))
.
.
2014-12-28 10:11 . 2014-12-28 10:11 -------- d-----w- c:\program files\Defraggler
2014-12-26 09:19 . 2014-12-02 10:26 11870360 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{13B00F8D-176B-4BD4-AF47-D11D647D64A6}\mpengine.dll
2014-12-26 09:10 . 2014-12-26 09:10 -------- d-----w- c:\windows\SysWow64\Adobe
2014-12-22 18:45 . 2014-12-22 18:45 -------- d-----w- c:\users\Admin\AppData\Roaming\AVAST Software
2014-12-22 18:44 . 2014-12-22 18:44 436624 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-12-22 18:44 . 2014-12-22 18:44 267632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-12-22 18:44 . 2014-12-22 18:44 116728 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-12-22 18:44 . 2014-12-22 18:44 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-12-22 18:44 . 2014-12-22 18:44 83280 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-12-22 18:44 . 2014-12-22 18:44 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-12-22 18:44 . 2014-12-22 18:44 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-12-22 18:44 . 2014-12-22 18:44 1050432 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-12-22 18:44 . 2014-12-22 18:44 364512 ----a-w- c:\windows\system32\aswBoot.exe
2014-12-22 18:44 . 2014-12-22 18:44 43152 ----a-w- c:\windows\avastSS.scr
2014-12-22 18:39 . 2014-12-22 18:39 -------- d-----w- c:\program files\AVAST Software
2014-12-22 18:37 . 2014-12-22 18:39 -------- d-----w- c:\programdata\AVAST Software
2014-12-22 12:45 . 2014-12-22 15:55 -------- d-----w- c:\users\Admin\AppData\Local\Facebook
2014-12-22 10:31 . 2014-12-22 10:31 -------- d-----w- c:\users\Admin\AppData\Local\DriverToolkit
2014-12-22 10:31 . 2014-12-22 10:34 -------- d-----w- c:\program files (x86)\DriverToolkit
2014-12-21 18:51 . 2014-12-21 18:51 -------- d-----w- c:\programdata\Malwarebytes
2014-12-21 14:13 . 2014-12-22 18:50 -------- d-----w- c:\program files\trend micro
2014-12-21 14:11 . 2014-12-28 09:46 -------- d-----w- c:\program files (x86)\trend micro
2014-12-18 16:46 . 2014-12-18 16:46 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-12-18 11:04 . 2014-12-13 05:09 144384 ----a-w- c:\windows\system32\ieUnatt.exe
2014-12-18 11:04 . 2014-12-13 03:33 115712 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2014-12-11 10:54 . 2014-12-11 10:54 -------- d-----w- c:\windows\system32\appraiser
2014-12-10 21:04 . 2014-10-18 01:33 3209728 ----a-w- c:\windows\SysWow64\mf.dll
2014-12-10 21:04 . 2014-07-07 02:06 206848 ----a-w- c:\windows\system32\mfps.dll
2014-12-10 21:04 . 2014-07-07 02:06 55808 ----a-w- c:\windows\system32\rrinstaller.exe
2014-12-10 21:04 . 2014-07-07 02:06 24576 ----a-w- c:\windows\system32\mfpmp.exe
2014-12-10 21:04 . 2014-07-07 02:02 2048 ----a-w- c:\windows\system32\mferror.dll
2014-12-10 21:04 . 2014-07-07 01:40 103424 ----a-w- c:\windows\SysWow64\mfps.dll
2014-12-10 21:04 . 2014-07-07 01:39 50176 ----a-w- c:\windows\SysWow64\rrinstaller.exe
2014-12-10 21:04 . 2014-07-07 01:39 23040 ----a-w- c:\windows\SysWow64\mfpmp.exe
2014-12-10 21:04 . 2014-07-07 01:37 2048 ----a-w- c:\windows\SysWow64\mferror.dll
2014-12-10 21:04 . 2014-10-18 02:05 4121600 ----a-w- c:\windows\system32\mf.dll
2014-12-10 12:46 . 2014-11-27 01:43 389296 ----a-w- c:\windows\system32\iedkcs32.dll
2014-12-10 12:45 . 2014-10-30 02:03 165888 ----a-w- c:\windows\system32\charmap.exe
2014-12-03 15:27 . 2014-12-27 17:15 281768 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2014-12-03 14:56 . 2014-12-03 14:56 -------- d-----w- c:\users\Admin\Patch net v1.6 a v1.7 Cod 4 Modern Warfare
2014-12-03 13:54 . 2014-12-03 13:55 -------- d-----w- c:\users\Admin\cod fix
2014-12-01 16:46 . 2014-12-01 16:46 -------- d--h--w- c:\program files (x86)\Common Files\EAInstaller
2014-12-01 16:44 . 2014-12-22 10:43 -------- d-----w- c:\programdata\Package Cache
2014-12-01 16:06 . 2014-12-01 16:06 -------- d-----w- c:\users\Admin\The.Sims.4.Cestina
2014-11-30 22:52 . 2014-11-30 22:52 -------- d-----w- c:\users\Admin\The Sims 4
2014-11-29 16:54 . 2014-11-29 16:54 -------- d--h--r- c:\users\Admin\AppData\Roaming\SecuROM
2014-11-29 16:04 . 2014-11-29 16:04 -------- d-----w- c:\programdata\EA Core
2014-11-29 16:01 . 2011-02-18 14:07 447752 ----a-w- c:\windows\SysWow64\vp6vfw.dll
2014-11-29 12:13 . 2014-12-03 16:08 -------- d-----w- c:\program files (x86)\Origin Games
2014-11-29 12:12 . 2014-12-19 06:46 -------- d-----w- c:\users\Admin\AppData\Roaming\Origin
2014-11-29 12:12 . 2014-11-29 12:13 -------- d-----w- c:\users\Admin\AppData\Local\Origin
2014-11-29 12:08 . 2014-12-23 10:11 -------- d-----w- c:\programdata\Origin
2014-11-29 12:08 . 2014-11-29 12:08 -------- d-----w- c:\programdata\Electronic Arts
2014-11-29 12:07 . 2014-12-23 14:23 -------- d-----w- c:\program files (x86)\Origin
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-12-28 22:13 . 2014-08-17 12:23 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2014-12-27 17:15 . 2014-10-27 21:22 281768 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-12-27 17:15 . 2014-10-27 21:22 103736 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2014-12-10 21:07 . 2014-08-11 15:30 112710672 ----a-w- c:\windows\system32\MRT.exe
2014-12-10 16:54 . 2014-08-14 09:12 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-12-10 16:54 . 2014-08-14 09:12 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-12-03 15:17 . 2014-10-27 21:22 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2014-11-24 13:04 . 2010-11-21 03:27 275080 ------w- c:\windows\system32\MpSigStub.exe
2014-11-19 03:31 . 2014-11-19 03:31 1217192 ----a-w- c:\windows\SysWow64\FM20.DLL
2014-11-11 03:08 . 2014-11-19 12:07 241152 ----a-w- c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-19 12:07 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-11-19 12:07 186880 ----a-w- c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-19 12:07 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-11-01 14:04 . 2014-11-01 14:04 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-10-30 02:03 . 2014-12-10 12:45 165888 ----a-w- c:\windows\system32\charmap.exe
2014-10-27 20:55 . 2014-10-27 20:55 29696 ----a-w- c:\windows\system32\drivers\dtscsibus.sys
2014-10-27 20:18 . 2014-08-17 12:23 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2014-10-27 05:36 . 2014-08-29 07:17 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2014-10-25 01:57 . 2014-11-12 14:35 77824 ----a-w- c:\windows\system32\packager.dll
2014-10-25 01:32 . 2014-11-12 14:35 67584 ----a-w- c:\windows\SysWow64\packager.dll
2014-10-18 02:05 . 2014-11-12 14:34 861696 ----a-w- c:\windows\system32\oleaut32.dll
2014-10-18 01:33 . 2014-11-12 14:34 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2014-10-14 02:16 . 2014-11-12 14:38 155064 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2014-10-14 02:13 . 2014-11-12 14:38 683520 ----a-w- c:\windows\system32\termsrv.dll
2014-10-14 02:13 . 2014-11-12 14:34 3241984 ----a-w- c:\windows\system32\msi.dll
2014-10-14 02:12 . 2014-11-12 14:38 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-10-14 02:09 . 2014-11-12 14:38 146432 ----a-w- c:\windows\system32\msaudite.dll
2014-10-14 02:07 . 2014-11-12 14:38 681984 ----a-w- c:\windows\system32\adtschema.dll
2014-10-14 01:50 . 2014-11-12 14:38 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-10-14 01:50 . 2014-11-12 14:34 2363904 ----a-w- c:\windows\SysWow64\msi.dll
2014-10-14 01:49 . 2014-11-12 14:38 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-10-14 01:47 . 2014-11-12 14:38 146432 ----a-w- c:\windows\SysWow64\msaudite.dll
2014-10-14 01:46 . 2014-11-12 14:38 681984 ----a-w- c:\windows\SysWow64\adtschema.dll
2014-10-13 21:50 . 2014-09-09 12:52 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2014-10-10 00:57 . 2014-11-12 14:35 3198976 ----a-w- c:\windows\system32\win32k.sys
2014-10-03 02:12 . 2014-11-12 14:35 500224 ----a-w- c:\windows\system32\AUDIOKSE.dll
2014-10-03 02:11 . 2014-11-12 14:35 284672 ----a-w- c:\windows\system32\EncDump.dll
2014-10-03 02:11 . 2014-11-12 14:35 680960 ----a-w- c:\windows\system32\audiosrv.dll
2014-10-03 02:11 . 2014-11-12 14:35 440832 ----a-w- c:\windows\system32\AudioEng.dll
2014-10-03 02:11 . 2014-11-12 14:35 296448 ----a-w- c:\windows\system32\AudioSes.dll
2014-10-03 01:44 . 2014-11-12 14:35 442880 ----a-w- c:\windows\SysWow64\AUDIOKSE.dll
2014-10-03 01:44 . 2014-11-12 14:35 374784 ----a-w- c:\windows\SysWow64\AudioEng.dll
2014-10-03 01:44 . 2014-11-12 14:35 195584 ----a-w- c:\windows\SysWow64\AudioSes.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-12-22 5226600]
.
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft SharePoint Workspace.lnk - c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE /TrayOnly [2013-12-18 30814400]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS;c:\windows\SYSNATIVE\MLPTDR_Q.SYS [x]
R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x]
R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x]
R3 Disc Soft Bus Service;Disc Soft Bus Service;c:\program files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe;c:\program files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 KinectCamera;Kinect for Windows Camera Driver;c:\windows\system32\Drivers\kinectcamera.sys;c:\windows\SYSNATIVE\Drivers\kinectcamera.sys [x]
R3 Origin Client Service;Origin Client Service;c:\program files (x86)\Origin\OriginClientService.exe;c:\program files (x86)\Origin\OriginClientService.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S3 dtscsibus;DAEMON Tools Virtual SCSI Bus;c:\windows\system32\DRIVERS\dtscsibus.sys;c:\windows\SYSNATIVE\DRIVERS\dtscsibus.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-12-12 11:46 1087816 ----a-w- c:\program files (x86)\Google\Chrome\Application\39.0.2171.95\Installer\chrmstp.exe
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-12-22 18:44 860984 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-10-21 16:52 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KONICA MINOLTA PagePro 1350WStatusDisplay"="c:\windows\system32\MSTM64_Q.EXE" [2011-03-25 247736]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~3\MICROS~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~3\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.0.1 82.100.29.65
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9g7k8sqs.default\
FF - prefs.js: browser.startup.homepage - |hxxps://www.google.cz/
.
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Google\Update\GoogleUpdate.exe
.
**************************************************************************
.
Celkový čas: 2014-12-29 12:04:12 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-12-29 11:04
ComboFix2.txt 2014-12-28 21:24
.
Před spuštěním: Volných bajtů: 354 017 980 416
Po spuštění: Volných bajtů: 353 620 553 728
.
- - End Of File - - 48A7B87EA7781C5069E19E45402311E3
A36C5E4F47E84449FF07ED3517B43A31

#25 Příspěvek od **Márty84** » 29 pro 2014 12:22

Vsechny tyto programy - vcetne pripadne instalace - spoustejte jako spravce (kliknete na ne pravym mysidlem a zvolte - Spustit jako spravce)

Prejmenujte ComboFix na Uninstall a spustte ho. CF by se mel odinstalovat.

vyosek píše: DelFix https://toolslib.net/downloads/finish/2/
Stahnete a spustte

Ponechte zatrzitkou pouze u volby Remote disinfection tools

Kliknete na Run

Nastala nejaka zmena?

civrs · #26 Příspěvek od **civrs** » 29 pro 2014 13:11

civrs píše:Pc se zdá stejné,jen zase včera z ničeho nic (tedy při pouštění videa na yotube) se kousl naskočila modrá obrazovka plná nějakého psaní cca na 5 vteřin a poté naskočí ta původní jak jsem psal na začátku a na ní to zamrzne a musím knoflem natvrdo vypnout,nepomůže ani knof.restart protože se to vrátí na tu samou modrou obrazovku,myslím jestli to není od grafiky nebo desky ten nápis.

od toho 27.12. se nic nestalo takže žádná změna ale je fakt že moc nepracoval spíš řádil ComboFix.
Tak ho trošku zatížim a dám vědět.
Byl tam nějaký bordel?A co ten defendr,myslel jsem že je dobrý nástroj..

#27 Příspěvek od **Márty84** » 29 pro 2014 19:35

civrs píše:Tak ho trošku zatížim a dám vědět.

OK

civrs píše:A co ten defendr,myslel jsem že je dobrý nástroj..

Defender je k nicemu. Nechte ho vypnuty. Krom toho, ze nic nenajde, mohl by byt v kolizi s Avastem.

civrs · #28 Příspěvek od **civrs** » 31 pro 2014 19:52

...Márty84 tak se letos ještě musím ozvat,pc se zdá v pořádku,zatím nespadlo a zdá se takové rychlejší,snad,mám takový pocit.Takže zatím v poho,hezký zbytek roku a do nového hodně štěstí zdraví.
Ps:když tak písnu

#29 Příspěvek od **Márty84** » 31 pro 2014 21:10

Dekuji za prani

I ja vam preji do noveho roku jen to nejlepsi

Jasne, necham to jeste chvili otevrene. Pak to zamknu. Kdyby to totiz bylo po delsi dobe, muselo by se zacit zase od zacatku.

Zatim se mejte

civrs · #30 Příspěvek od **civrs** » 08 led 2015 20:07

civrs píše:
civrs píše:Pc se zdá stejné,jen zase včera z ničeho nic (tedy při pouštění videa na yotube) se kousl naskočila modrá obrazovka plná nějakého psaní cca na 5 vteřin a poté naskočí ta původní jak jsem psal na začátku a na ní to zamrzne a musím knoflem natvrdo vypnout,nepomůže ani knof.restart protože se to vrátí na tu samou modrou obrazovku,myslím jestli to není od grafiky nebo desky ten nápis.

...tak je to tu znovu,dnes dopoledne se zase kousl amusel jsem natvrdo vypnout

Logfile of random's system information tool 1.10 (written by random/random)
Run by Admin at 2015-01-08 20:06:58
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 326 GB (68%) free of 477 GB
Total RAM: 4095 MB (43% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:06:59, on 8.1.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17496)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTray.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
C:\Program Files\trend micro\Admin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~3\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~3\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
O4 - HKCU\..\Run: [OfficeSyncProcess] "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] C:\PROGRAM FILES\ZONER\PHOTO STUDIO 15\Program32\ZPSTRAY.EXE
O4 - Startup: Microsoft SharePoint Workspace.lnk = C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~3\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~3\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Disc Soft Bus Service - Disc Soft Ltd - C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginClientService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8487 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
taskeng.exe {8B837155-EDEE-4E22-9B6A-F42468B67108}
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\System32\MSTM64_Q.EXE"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window
"C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
"C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTray.exe"
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /TrayOnly
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="740.0.398774332\1918813830" --disable-d3d11 --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,6,17,38 --gpu-vendor-id=0x1002 --gpu-device-id=0x9490 --gpu-driver-vendor="ATI Technologies Inc." --gpu-driver-version=8.632.1.2000 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group2 pct:10b stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/OldAvatarMenu/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/QUIC/Disabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-1-Percent/group_32/UMA-Uniformity-Trial-10-Percent/group_01/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_02/UMA-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="740.1.1413429688\505090557" /prefetch:673131151
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group2 pct:10b stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/NewProfileManagement/OldAvatarMenu/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/QUIC/Disabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-1-Percent/group_32/UMA-Uniformity-Trial-10-Percent/group_01/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_02/UMA-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="740.2.1667797109\1223706552" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group2 pct:10b stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GCM/Enabled/GoogleNow/Enable/NewProfileManagement/OldAvatarMenu/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/QUIC/Disabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-1-Percent/group_32/UMA-Uniformity-Trial-10-Percent/group_01/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_02/UMA-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="740.3.1427103154\11782207" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group2 pct:10b stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GCM/Enabled/GoogleNow/Enable/NewProfileManagement/OldAvatarMenu/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/QUIC/Disabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-1-Percent/group_32/UMA-Uniformity-Trial-10-Percent/group_01/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_02/UMA-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="740.4.2027747019\1571567811" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group2 pct:10b stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GCM/Enabled/GoogleNow/Enable/NewProfileManagement/OldAvatarMenu/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/QUIC/Disabled/RememberCertificateErrorDecisions/Default/SPDY/DefaultSpdy31Enabled/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-1-Percent/group_32/UMA-Uniformity-Trial-10-Percent/group_01/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_02/UMA-Uniformity-Trial-5-Percent/group_14/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="740.5.533119919\1081680399" /prefetch:673131151
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=5236.23ad6ae0.218554650 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" E7CF176E110C211B 5236 "\\.\pipe\gecko-crash-server-pipe.5236" plugin
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe" --proxy-stub-channel=Flash5624.5BC76188.5896 --host-broker-channel=Flash5624.5BC76188.26239 --host-pid=5624 --host-npapi-version=27 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll"
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe" --channel=5664.003FF14C.1780333727 --proxy-stub-channel=Flash5624.5BC76188.5896 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll" --host-npapi-version=27 --type=renderer

"C:\Users\Admin\Downloads\RSITx64.exe"
taskhost.exe $(Arg0)
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Admin\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9g7k8sqs.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "|https://www.google.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 16.0.0.235 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1215155.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.25.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.25.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~3\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~3\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 16.0.0.235 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2013-12-18 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-12-22 705448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~3\MICROS~1\Office14\GROOVEEX.DLL [2013-12-18 4171480]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-01 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-12-22 586968]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~3\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-01 172968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"KONICA MINOLTA PagePro 1350WStatusDisplay"=C:\Windows\system32\MSTM64_Q.EXE [2011-03-25 247736]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C"=C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [2014-12-06 856904]
"OfficeSyncProcess"=C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [2014-10-14 720064]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2014-12-12 7394584]
"Zoner Photo Studio Autoupdate"=C:\PROGRAM FILES\ZONER\PHOTO STUDIO 15\Program32\ZPSTRAY.EXE [2014-03-13 779776]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-12-22 5226600]

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Microsoft SharePoint Workspace.lnk - C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL [2013-12-18 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~3\MICROS~1\Office14\GROOVEEX.DLL [2013-12-18 4171480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2015-01-08 20:01:45 ----D---- C:\rsit
2015-01-06 21:25:20 ----A---- C:\Windows\system32\MUNT64_Q.EXE
2015-01-06 21:25:20 ----A---- C:\Windows\system32\MTAG64_Q.DLL
2015-01-06 21:25:20 ----A---- C:\Windows\system32\MSTM64_Q.EXE
2015-01-06 21:25:20 ----A---- C:\Windows\system32\MSTM64_Q.DLL
2015-01-06 21:25:20 ----A---- C:\Windows\system32\MSPO64_Q.DLL
2015-01-06 21:25:20 ----A---- C:\Windows\system32\MLMN64_Q.DLL
2015-01-06 21:25:20 ----A---- C:\Windows\system32\MIMF64_Q.DLL
2015-01-06 21:25:20 ----A---- C:\Windows\system32\MICM64_Q.DLL
2015-01-06 21:25:20 ----A---- C:\Windows\system32\MGDI64_Q.DLL
2015-01-06 21:25:20 ----A---- C:\Windows\system32\MCMM64_Q.DLL
2015-01-06 21:25:20 ----A---- C:\Windows\MSUM64_Q.INI
2015-01-06 21:25:20 ----A---- C:\Windows\MSTM64_Q.INI
2015-01-06 21:25:20 ----A---- C:\Windows\MREADM_Q.TXT
2015-01-06 17:31:48 ----A---- C:\Windows\system32\aswBoot.exe
2015-01-04 16:27:01 ----D---- C:\ProgramData\Google
2014-12-29 16:52:52 ----SHD---- C:\$RECYCLE.BIN
2014-12-29 13:06:08 ----A---- C:\DelFix.txt
2014-12-28 16:12:23 ----D---- C:\Windows\erdnt
2014-12-28 11:11:51 ----D---- C:\Program Files\Defraggler
2014-12-26 10:10:32 ----D---- C:\Windows\SYSWOW64\Adobe
2014-12-22 19:45:47 ----D---- C:\Users\Admin\AppData\Roaming\AVAST Software
2014-12-22 19:44:25 ----A---- C:\Windows\system32\drivers\aswVmm.sys
2014-12-22 19:44:25 ----A---- C:\Windows\system32\drivers\aswStm.sys
2014-12-22 19:44:25 ----A---- C:\Windows\system32\drivers\aswSP.sys
2014-12-22 19:44:24 ----A---- C:\Windows\system32\drivers\aswRvrt.sys
2014-12-22 19:44:24 ----A---- C:\Windows\system32\drivers\aswRdr2.sys
2014-12-22 19:44:24 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2014-12-22 19:44:24 ----A---- C:\Windows\system32\drivers\aswHwid.sys
2014-12-22 19:44:22 ----A---- C:\Windows\system32\drivers\aswsnx.sys
2014-12-22 19:44:14 ----A---- C:\Windows\avastSS.scr
2014-12-22 19:39:12 ----D---- C:\Program Files\AVAST Software
2014-12-22 19:37:25 ----D---- C:\ProgramData\AVAST Software
2014-12-22 11:31:51 ----D---- C:\Program Files (x86)\DriverToolkit
2014-12-21 19:51:13 ----D---- C:\ProgramData\Malwarebytes
2014-12-21 15:13:56 ----D---- C:\Program Files\trend micro
2014-12-21 15:11:44 ----D---- C:\Program Files (x86)\trend micro
2014-12-18 12:04:05 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2014-12-18 12:04:05 ----A---- C:\Windows\system32\ieUnatt.exe
2014-12-11 11:54:57 ----D---- C:\Windows\system32\appraiser
2014-12-10 22:04:41 ----A---- C:\Windows\SYSWOW64\rrinstaller.exe
2014-12-10 22:04:41 ----A---- C:\Windows\SYSWOW64\mfps.dll
2014-12-10 22:04:41 ----A---- C:\Windows\SYSWOW64\mfpmp.exe
2014-12-10 22:04:41 ----A---- C:\Windows\SYSWOW64\mferror.dll
2014-12-10 22:04:41 ----A---- C:\Windows\SYSWOW64\mf.dll
2014-12-10 22:04:41 ----A---- C:\Windows\system32\rrinstaller.exe
2014-12-10 22:04:41 ----A---- C:\Windows\system32\mfps.dll
2014-12-10 22:04:41 ----A---- C:\Windows\system32\mfpmp.exe
2014-12-10 22:04:41 ----A---- C:\Windows\system32\mferror.dll
2014-12-10 22:04:40 ----A---- C:\Windows\system32\mf.dll
2014-12-10 13:47:32 ----A---- C:\Windows\system32\aitstatic.exe
2014-12-10 13:47:31 ----A---- C:\Windows\system32\invagent.dll
2014-12-10 13:47:31 ----A---- C:\Windows\system32\appraiser.dll
2014-12-10 13:47:31 ----A---- C:\Windows\system32\aepic.dll
2014-12-10 13:47:31 ----A---- C:\Windows\system32\aeinv.dll
2014-12-10 13:47:30 ----A---- C:\Windows\system32\generaltel.dll
2014-12-10 13:47:30 ----A---- C:\Windows\system32\devinv.dll
2014-12-10 13:47:30 ----A---- C:\Windows\system32\aepdu.dll
2014-12-10 13:47:15 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2014-12-10 13:47:15 ----A---- C:\Windows\system32\WindowsCodecs.dll
2014-12-10 13:47:08 ----A---- C:\Windows\system32\drivers\tdx.sys
2014-12-10 13:47:01 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2014-12-10 13:47:01 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2014-12-10 13:47:01 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2014-12-10 13:47:01 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-12-10 13:47:01 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-12-10 13:47:00 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2014-12-10 13:47:00 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2014-12-10 13:47:00 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2014-12-10 13:47:00 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2014-12-10 13:47:00 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2014-12-10 13:47:00 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2014-12-10 13:47:00 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-10 13:47:00 ----A---- C:\Windows\system32\iernonce.dll
2014-12-10 13:47:00 ----A---- C:\Windows\system32\ie4uinit.exe
2014-12-10 13:46:58 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2014-12-10 13:46:58 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2014-12-10 13:46:58 ----A---- C:\Windows\system32\urlmon.dll
2014-12-10 13:46:58 ----A---- C:\Windows\system32\iedkcs32.dll
2014-12-10 13:46:57 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2014-12-10 13:46:57 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2014-12-10 13:46:57 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2014-12-10 13:46:57 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-10 13:46:57 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-12-10 13:46:56 ----A---- C:\Windows\SYSWOW64\ieui.dll
2014-12-10 13:46:56 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2014-12-10 13:46:56 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2014-12-10 13:46:56 ----A---- C:\Windows\system32\msfeeds.dll
2014-12-10 13:46:56 ----A---- C:\Windows\system32\dxtrans.dll
2014-12-10 13:46:55 ----A---- C:\Windows\system32\iesetup.dll
2014-12-10 13:46:55 ----A---- C:\Windows\system32\ieapfltr.dll
2014-12-10 13:46:53 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2014-12-10 13:46:53 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2014-12-10 13:46:53 ----A---- C:\Windows\system32\iertutil.dll
2014-12-10 13:46:52 ----A---- C:\Windows\SYSWOW64\wininet.dll
2014-12-10 13:46:52 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2014-12-10 13:46:52 ----A---- C:\Windows\SYSWOW64\msrating.dll
2014-12-10 13:46:52 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2014-12-10 13:46:52 ----A---- C:\Windows\system32\jsproxy.dll
2014-12-10 13:46:51 ----A---- C:\Windows\system32\dxtmsft.dll
2014-12-10 13:46:49 ----A---- C:\Windows\system32\ieui.dll
2014-12-10 13:46:49 ----A---- C:\Windows\system32\ieframe.dll
2014-12-10 13:46:48 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-12-10 13:46:48 ----A---- C:\Windows\system32\mshtmled.dll
2014-12-10 13:46:48 ----A---- C:\Windows\system32\jscript9diag.dll
2014-12-10 13:46:48 ----A---- C:\Windows\system32\jscript9.dll
2014-12-10 13:46:47 ----A---- C:\Windows\system32\wininet.dll
2014-12-10 13:46:47 ----A---- C:\Windows\system32\vbscript.dll
2014-12-10 13:46:46 ----A---- C:\Windows\system32\msrating.dll
2014-12-10 13:46:46 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-12-10 13:46:45 ----A---- C:\Windows\system32\mshtml.dll
2014-12-10 13:45:44 ----A---- C:\Windows\SYSWOW64\charmap.exe
2014-12-10 13:45:44 ----A---- C:\Windows\system32\charmap.exe
2014-12-10 13:45:42 ----A---- C:\Windows\system32\WsmSvc.dll
2014-12-10 13:45:41 ----A---- C:\Windows\SYSWOW64\WsmWmiPl.dll
2014-12-10 13:45:41 ----A---- C:\Windows\SYSWOW64\WsmSvc.dll
2014-12-10 13:45:41 ----A---- C:\Windows\SYSWOW64\WSManMigrationPlugin.dll
2014-12-10 13:45:41 ----A---- C:\Windows\SYSWOW64\WSManHTTPConfig.exe
2014-12-10 13:45:41 ----A---- C:\Windows\system32\WsmWmiPl.dll
2014-12-10 13:45:41 ----A---- C:\Windows\system32\WsmAuto.dll
2014-12-10 13:45:41 ----A---- C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-10 13:45:41 ----A---- C:\Windows\system32\WSManHTTPConfig.exe
2014-12-10 13:45:40 ----A---- C:\Windows\SYSWOW64\WsmAuto.dll
2014-12-10 13:45:36 ----A---- C:\Windows\SYSWOW64\tzres.dll
2014-12-10 13:45:36 ----A---- C:\Windows\system32\tzres.dll
2014-12-09 15:48:04 ----D---- C:\Program Files (x86)\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2015-01-08 18:20:28 ----D---- C:\Windows\Temp
2015-01-08 17:39:30 ----D---- C:\Windows\SysWOW64
2015-01-08 17:39:26 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2015-01-08 17:10:17 ----D---- C:\Users\Admin\AppData\Roaming\Skype
2015-01-08 12:28:26 ----D---- C:\Windows\system32\config
2015-01-06 21:42:05 ----D---- C:\Windows\System32
2015-01-06 21:42:03 ----D---- C:\Windows
2015-01-06 21:42:00 ----D---- C:\Windows\system32\DriverStore
2015-01-06 21:41:59 ----D---- C:\Windows\inf
2015-01-06 21:41:45 ----SHD---- C:\System Volume Information
2015-01-06 21:33:30 ----D---- C:\Windows\system32\FxsTmp
2015-01-06 17:32:22 ----D---- C:\Windows\Prefetch
2015-01-06 17:32:16 ----D---- C:\Windows\system32\Tasks
2015-01-06 17:28:31 ----D---- C:\Windows\system32\drivers
2015-01-06 17:28:09 ----D---- C:\Windows\system32\wbem
2015-01-06 17:27:09 ----D---- C:\Windows\Tasks
2015-01-06 17:27:09 ----D---- C:\Windows\system32\wfp
2015-01-06 17:27:09 ----D---- C:\Windows\system32\catroot2
2015-01-06 17:27:02 ----D---- C:\Windows\registration
2015-01-06 17:26:47 ----D---- C:\ProgramData
2015-01-06 17:26:23 ----D---- C:\Program Files (x86)\Google
2015-01-04 16:25:04 ----SHD---- C:\Windows\Installer
2015-01-01 13:42:53 ----RD---- C:\Program Files (x86)
2015-01-01 13:42:02 ----D---- C:\Windows\system32\NDF
2015-01-01 13:27:25 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2014-12-29 11:59:57 ----A---- C:\Windows\system.ini
2014-12-29 11:59:45 ----D---- C:\Windows\system32\drivers\etc
2014-12-29 11:38:01 ----D---- C:\Windows\SYSWOW64\drivers
2014-12-29 11:38:01 ----D---- C:\Windows\AppPatch
2014-12-29 11:37:59 ----D---- C:\Program Files (x86)\Common Files
2014-12-28 11:11:51 ----RD---- C:\Program Files
2014-12-28 11:04:54 ----D---- C:\Program Files (x86)\Steam
2014-12-28 11:04:49 ----D---- C:\Windows\debug
2014-12-28 11:02:01 ----D---- C:\Program Files\CCleaner
2014-12-26 10:10:39 ----D---- C:\Windows\winsxs
2014-12-23 16:28:12 ----SD---- C:\Users\Admin\AppData\Roaming\Microsoft
2014-12-23 15:23:34 ----D---- C:\Program Files (x86)\Origin
2014-12-23 11:11:21 ----D---- C:\ProgramData\Origin
2014-12-22 23:11:20 ----D---- C:\Windows\system32\catroot
2014-12-22 19:20:09 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-12-22 14:53:31 ----RSD---- C:\Windows\assembly
2014-12-22 11:57:45 ----D---- C:\ProgramData\Skype
2014-12-22 11:43:36 ----D---- C:\ProgramData\Package Cache
2014-12-22 11:42:58 ----D---- C:\Program Files\Common Files\Microsoft Shared
2014-12-19 07:46:55 ----D---- C:\Users\Admin\AppData\Roaming\Origin
2014-12-18 17:46:48 ----RD---- C:\Program Files (x86)\Skype
2014-12-16 14:39:41 ----D---- C:\Program Files (x86)\PokerStars
2014-12-13 18:09:47 ----D---- C:\Windows\rescache
2014-12-13 17:15:53 ----D---- C:\Windows\system32\wdi
2014-12-13 11:18:15 ----D---- C:\Windows\SYSWOW64\cs-CZ
2014-12-13 11:18:15 ----D---- C:\Windows\system32\cs-CZ
2014-12-11 11:54:58 ----SD---- C:\Windows\system32\CompatTel
2014-12-11 11:54:58 ----D---- C:\Windows\AppCompat
2014-12-11 11:54:57 ----SD---- C:\ProgramData\Microsoft
2014-12-11 11:54:55 ----D---- C:\Windows\SYSWOW64\en-US
2014-12-11 11:54:55 ----D---- C:\Program Files\Internet Explorer
2014-12-11 11:54:54 ----D---- C:\Windows\system32\en-US
2014-12-11 11:54:54 ----D---- C:\Windows\PolicyDefinitions
2014-12-11 11:54:53 ----D---- C:\Program Files (x86)\Internet Explorer
2014-12-10 22:12:56 ----D---- C:\ProgramData\Microsoft Help
2014-12-10 22:11:01 ----D---- C:\Windows\system32\MRT
2014-12-10 22:07:30 ----A---- C:\Windows\system32\MRT.exe
2014-12-10 13:30:32 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-12-22 65776]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-12-22 267632]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2014-10-27 871408]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2014-12-22 93568]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2014-12-22 1050432]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2014-12-22 436624]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2014-12-22 29208]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2014-12-22 83280]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2014-12-22 116728]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-08-18 6037504]
R3 dtscsibus;DAEMON Tools Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtscsibus.sys [2014-10-27 29696]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S2 MLPTDR_Q;MLPTDR_Q; \??\C:\Windows\syswow64\MLPTDR_Q.SYS [2003-07-22 18848]
S3 AndNetDiag;LGE AndroidNet USB Serial Port; C:\Windows\system32\DRIVERS\lgandnetdiag64.sys []
S3 ANDNetModem;LGE AndroidNet USB Modem; C:\Windows\system32\DRIVERS\lgandnetmodem64.sys []
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 KinectCamera;Kinect for Windows Camera Driver; C:\Windows\System32\Drivers\kinectcamera.sys [2012-09-20 192512]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WinUsb;Kinect for Windows Security Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-08-18 203264]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-12-22 50344]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2014-12-03 76888]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-01 267440]
S3 Disc Soft Bus Service;Disc Soft Bus Service; C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe [2013-11-14 723192]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-11-22 114688]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2013-12-18 30814400]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-12-09 114800]
S3 Origin Client Service;Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2014-12-18 1903472]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-11-18 833728]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-08-11 1255736]
S4 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

VIRY.CZ

Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání

Re: Zamrzání