Nesmazatelné ikonky na ploche

[Skyrdis]

Dobry deň,

dúfam že mi niekto poradí. Problém sa začal tým, že sa mi do PC dostal "GoSave" ten sa mi úspešne podarilo odstrániť. Teda nemám ho ani v ProgramFiles ani v Programoch a súčastiach. Avšak, ešte pred tým ako som ho odstránila, tak som si sťahovala nejaké obrázky kvôli škole. Ale nestiahlo mi obrázok ale len nefunkčný súbor, ktorý sa nedá v ničom otvoriť, ani vymazať, premiestniť, nič proste. Vo vlastnostiach toho súboru v Typ súboru: Súbor(.GoSave)alebo niečo podobné už si nie som istá. Po tom ako som ten GoSave odstránila, zostalo tam len Súbor(.)

Screen erroru a súboru:

Na odstránenie GoSave som použila programy: Malwarebytes Anti-Malware, Hitman-Pro, MCShield Real-Time Monitor.

Ďakujem vopred za pomoc
Tereza.

Prikladám log:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Skyrdis at 2014-12-30 13:23:51
Microsoft Windows 8.1 Pro
System drive C: has 242 GB (53%) free of 456 GB
Total RAM: 3691 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:24:00, on 30.12.2014
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17239)
Boot mode: Normal

Running processes:
C:\Windows\SysWOW64\WTClient.exe
C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Users\Skyrdis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Users\Skyrdis\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\MCShield\MCShieldRTM.exe
C:\Users\Skyrdis\AppData\Local\Akamai\netsession_win.exe
C:\GIGABYTE FORCE\GIGABYTE FORCE.exe
C:\Program Files (x86)\GameVox\GameVox.exe
C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org\win32\adb.exe
C:\Program Files\trend micro\Skyrdis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GMouse] "C:\GIGABYTE FORCE\GIGABYTE FORCE.EXE" /hide
O4 - HKLM\..\Run: [mncoxtndoSrv] C:\Windows\system32\mncoxtndo.vbe
O4 - HKLM\..\Run: [ADSKAppManager] "C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe" -showminimized -checkautorun
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ADSK DLMSession] C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe
O4 - HKLM\..\Run: [WTClient] WTClient.exe
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Skyrdis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Skyrdis\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [MCShield Monitor] C:\Program Files (x86)\MCShield\mcshieldrtm.exe
O4 - Startup: GameVox.lnk = C:\Program Files (x86)\GameVox\GameVox.exe
O4 - Startup: Send to OneNote.lnk = C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~1\Office15\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Autodesk Application Manager Service (AdAppMgrSvc) - Autodesk Inc. - C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: @oem3.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service (BcmBtRSupport) - Unknown owner - C:\Windows\system32\BtwRSupportService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Garmin Core Update Service - Garmin Ltd or its subsidiaries - C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: mental ray Satellite for Autodesk 3ds Max 2015 64-bit (mi-raysat_3dsmax2015_64) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2015\NVIDIA\Satellite\raysat_3dsmax2015_64server.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginClientService.exe
O23 - Service: Corel License Validation Service V2 x64, Powered by arvato (PSI_SVC_2_x64) - arvato digital services llc - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: WinTab Service (WinTabService) - Unknown owner - C:\Windows\System32\Drivers\WTSRV.EXE (file missing)
O23 - Service: Wise Boot Assistant (WiseBootAssistant) - WiseCleaner.com - C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10708 bytes

======Listing Processes======





wininit.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
dashost.exe {2c29b473-80c3-41e5-aa981d02bd7ec5b7}
"c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe"
C:\Windows\system32\svchost.exe -k imgsvc

"C:\Windows\System32\Drivers\WTSRV.EXE"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
taskeng.exe {35F39917-5BB6-4010-8C77-01D7CE0F293D}
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe"

C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\System32\WinLogon.exe -SpecialSession
"LogonUI.exe" /flags:0x0
-hiberboot
C:\Windows\system32\wbem\wmiprvse.exe


C:\Windows\System32\WinLogon.exe -SpecialSession
-hiberboot
atieclxx
taskeng.exe {7D2C07F8-D222-4E5A-901C-66A155780723}
taskhostex.exe
WTClient.exe
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe" -StartTray
/QuitInfo:0000000000000E74;0000000000000BB8;
/loadhooks /Parent:0000000000000044
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Users\Skyrdis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
"C:\Users\Skyrdis\AppData\Local\Akamai\netsession_win.exe"
"C:\Program Files (x86)\MCShield\MCShieldRTM.exe"
"C:/Users/Skyrdis/AppData/Local/Akamai/netsession_win.exe" --client
"C:\GIGABYTE FORCE\GIGABYTE FORCE.exe" /hide
"C:\Program Files (x86)\GameVox\GameVox.exe" -noupdate
"C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE" /tsr
"C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
taskeng.exe {40D00B96-EEBC-4D89-9C56-67ED52A9144D}
"C:\Program Files\Microsoft Office\Office15\MsoSync.exe"
"C:\Windows\system32\wuauclt.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
adb fork-server server
"C:\Program Files\Windows Defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey 6FBFCC9A-132A-5625-3383-8A2827D5AC4E -Reinvoke
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe85_ Global\UsGthrCtrlFltPipeMssGthrPipe85 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 560 564 572 65536 568
"C:\Users\Skyrdis\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\Wise Care 365.job - C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe -StartTray
C:\Windows\tasks\Wise Turbo Checker.job - C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "www.google.sk "

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.246 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/Lync,version=15.0]
"Description"=Microsoft Lync Plug-in for Firefox
"Path"=C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\adobe.com/AdobeAAMDetect]
"Description"=
"Path"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.246 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\adobe.com/AdobeAAMDetect]
"Description"=
"Path"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll


C:\Program Files (x86)\Mozilla Firefox\plugins\
npMeetingJoinPluginOC.dll
nppdf32.dll

C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\
adbhelper@mozilla.org

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01 205416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office15\URLREDIR.DLL [2012-10-01 877720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~1\MICROS~1\Office15\GROOVEEX.DLL [2012-10-01 2322576]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01 139368]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL [2012-10-01 704664]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL [2012-10-01 1720976]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-10-14 2837288]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20 444904]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"=C:\Users\Skyrdis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [2014-12-13 1676344]
"Akamai NetSession Interface"=C:\Users\Skyrdis\AppData\Local\Akamai\netsession_win.exe [2014-10-29 4673432]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]
"MCShield Monitor"=C:\Program Files (x86)\MCShield\mcshieldrtm.exe [2014-04-11 650816]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [2014-07-04 766688]
"GMouse"=C:\GIGABYTE FORCE\GIGABYTE FORCE.EXE [2011-11-08 667648]
"mncoxtndoSrv"=C:\Windows\system32\mncoxtndo.vbe []
"ADSKAppManager"=C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe [2014-09-04 488328]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20 1021128]
"ADSK DLMSession"=C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe [2014-02-05 1627032]
"WTClient"=C:\Windows\system32\WTClient.exe [2009-08-19 32768]

C:\Users\Skyrdis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
GameVox.lnk - C:\Program Files (x86)\GameVox\GameVox.exe
Send to OneNote.lnk - C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37CrusaderBoot]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=221

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-12-30 13:23:51 ----D---- C:\rsit
2014-12-30 13:23:51 ----D---- C:\Program Files\trend micro
2014-12-22 14:13:42 ----D---- C:\Users\Skyrdis\AppData\Roaming\Stronghold Crusader 2
2014-12-22 13:49:40 ----D---- C:\Program Files (x86)\R.G. Mechanics
2014-12-21 19:13:22 ----D---- C:\Program Files (x86)\GameVox
2014-12-19 11:54:05 ----D---- C:\Program Files (x86)\TABLET
2014-12-18 21:50:49 ----D---- C:\Users\Skyrdis\AppData\Roaming\com.adobe.DC3Module.AdobeADC
2014-12-17 23:01:42 ----A---- C:\Windows\Tablet8000x6000M.ini
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\WTClient.exe
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\ST~DBC0.tmp
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\ST~AB1C.tmp
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\ST~777.tmp
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\ST~372D.tmp
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\ST~3430.tmp
2014-12-15 17:10:17 ----A---- C:\Windows\system32\WTClient.exe
2014-12-15 17:10:16 ----A---- C:\Windows\system32\WinTab32.dll
2014-12-15 17:10:16 ----A---- C:\Windows\system32\UCMfg.exe
2014-12-15 17:10:16 ----A---- C:\Windows\system32\ucinst32.dll
2014-12-15 17:10:15 ----A---- C:\Windows\SYSWOW64\tabcfg.exe
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\WTSrv.exe
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\UCTblHid.sys
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\TClass2k.sys
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\ST~D71C.tmp
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\ST~A6D5.tmp
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\ST~321B.tmp
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\ST~2F4D.tmp
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\ST~246.tmp
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\PTSimHid.sys
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\PTSimBus.sys
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\WinTab32.dll
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\ST~DC4E.tmp
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\ST~AB9A.tmp
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\ST~7F5.tmp
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\ST~37AB.tmp
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\ST~34AE.tmp
2014-12-15 17:10:08 ----A---- C:\Windows\SetupX32.EXE
2014-12-15 17:10:07 ----A---- C:\Windows\SYSWOW64\lhtool.exe
2014-12-15 17:10:06 ----A---- C:\Windows\SYSWOW64\HCCall.exe
2014-12-15 17:10:05 ----D---- C:\download
2014-12-15 14:43:51 ----D---- C:\ProgramData\MCShield
2014-12-15 14:43:51 ----D---- C:\Program Files (x86)\MCShield
2014-12-15 12:46:22 ----A---- C:\Windows\system32\drivers\hitmanpro37.sys
2014-12-15 12:34:40 ----D---- C:\Program Files\HitmanPro
2014-12-15 12:34:24 ----D---- C:\ProgramData\HitmanPro
2014-12-15 11:57:15 ----D---- C:\AdwCleaner
2014-12-15 11:02:50 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-12-15 11:01:59 ----A---- C:\Windows\system32\drivers\mwac.sys
2014-12-15 11:01:59 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-12-15 11:01:58 ----D---- C:\ProgramData\Malwarebytes
2014-12-15 11:01:58 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-12-15 11:01:58 ----A---- C:\Windows\system32\drivers\mbam.sys
2014-12-09 16:52:17 ----D---- C:\Program Files (x86)\Mozilla Firefox
2014-12-02 14:58:15 ----D---- C:\ProgramData\Steam
2014-12-02 14:44:58 ----D---- C:\Program Files (x86)\Sid Meiers Civilization Beyond Earth
2014-12-01 14:28:57 ----D---- C:\Program Files (x86)\Electronic Arts

======List of files/folders modified in the last 1 month======

2014-12-30 13:23:51 ----RD---- C:\Program Files
2014-12-30 13:18:10 ----D---- C:\Windows\Temp
2014-12-30 13:05:45 ----D---- C:\Users\Skyrdis\AppData\Roaming\GameVox
2014-12-30 13:04:49 ----D---- C:\Windows\system32\sru
2014-12-29 23:14:48 ----D---- C:\Users\Skyrdis\AppData\Roaming\uTorrent
2014-12-29 13:08:55 ----D---- C:\Windows\Inf
2014-12-29 11:36:35 ----D---- C:\Windows\system32\DriverStore
2014-12-29 11:36:32 ----RD---- C:\Windows\System32
2014-12-29 11:36:29 ----D---- C:\Windows\SysWOW64
2014-12-29 11:36:28 ----D---- C:\Windows\system32\drivers
2014-12-29 11:36:24 ----D---- C:\Windows
2014-12-28 20:17:38 ----D---- C:\Windows\Microsoft.NET
2014-12-27 12:44:59 ----D---- C:\Users\Skyrdis\AppData\Roaming\Wise Care 365
2014-12-26 16:43:15 ----D---- C:\Windows\AppReadiness
2014-12-26 13:05:24 ----D---- C:\Windows\WinSxS
2014-12-26 13:03:42 ----D---- C:\Windows\system32\config
2014-12-22 22:25:53 ----D---- C:\Users\Skyrdis\AppData\Roaming\Spotify
2014-12-22 14:13:41 ----SHD---- C:\Windows\Installer
2014-12-22 14:11:35 ----SHD---- C:\System Volume Information
2014-12-22 14:10:32 ----D---- C:\Windows\Logs
2014-12-22 13:49:40 ----RD---- C:\Program Files (x86)
2014-12-21 19:13:30 ----D---- C:\ProgramData\Package Cache
2014-12-20 13:39:24 ----D---- C:\Users\Skyrdis\AppData\Roaming\vlc
2014-12-20 13:12:56 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-12-19 11:51:33 ----D---- C:\Windows\system32\catroot2
2014-12-18 21:50:33 ----D---- C:\Users\Skyrdis\AppData\Roaming\Adobe
2014-12-18 21:17:29 ----SD---- C:\Users\Skyrdis\AppData\Roaming\Microsoft
2014-12-18 14:24:57 ----D---- C:\ProgramData\Origin
2014-12-18 14:24:48 ----D---- C:\Program Files (x86)\Origin
2014-12-18 14:21:27 ----D---- C:\Windows\system32\Tasks
2014-12-18 13:22:24 ----RSD---- C:\Windows\assembly
2014-12-18 13:03:38 ----HD---- C:\Program Files\WindowsApps
2014-12-16 20:07:08 ----D---- C:\Users\Skyrdis\AppData\Roaming\Mumble
2014-12-15 14:43:51 ----HD---- C:\ProgramData
2014-12-15 14:36:35 ----D---- C:\Windows\SYSWOW64\config
2014-12-15 14:27:55 ----D---- C:\Windows\SoftwareDistribution
2014-12-15 14:27:40 ----D---- C:\Windows\debug
2014-12-15 13:50:52 ----D---- C:\Users\Skyrdis\AppData\Roaming\DAEMON Tools Lite
2014-12-15 11:49:53 ----D---- C:\Windows\DigitalLocker
2014-12-14 10:24:57 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-10 20:48:02 ----D---- C:\Program Files (x86)\Battle.net
2014-12-06 20:14:12 ----D---- C:\Program Files (x86)\Hearthstone
2014-12-06 14:12:16 ----D---- C:\Program Files\KMSpico
2014-12-01 14:28:57 ----D---- C:\Program Files (x86)\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 dtsoftbus01;@oem5.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\Windows\System32\drivers\dtsoftbus01.sys [2014-08-09 283064]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\Windows\system32\DRIVERS\vwififlt.sys [2014-04-30 71680]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-06-27 88632]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2014-07-21 13209088]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2014-07-21 626688]
R3 bcbtums;@oem3.inf,%BCBTUMS.SvcDesc%;Bluetooth RAM Firmware Download USB Filter; C:\Windows\system32\drivers\bcbtums.sys [2013-09-04 170712]
R3 BCM43XX;@netbc64.inf,%BCM43XX_Service_DispName%;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl63a.sys [2013-07-01 8536752]
R3 BthEnum;@bth.inf,%BthEnum.SVCDESC%;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2013-08-22 53248]
R3 BthLEEnum;@bthleenum.inf,%BthLEEnum.SVCDESC%;Bluetooth Low Energy Driver; C:\Windows\system32\DRIVERS\BthLEEnum.sys [2014-03-18 226304]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2013-08-22 118272]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2014-03-18 81920]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2014-11-21 25816]
R3 PTSimBus;@oem19.inf,%PTSimBus.SVCDESC%;PenTablet Bus Enumerator; C:\Windows\System32\drivers\PTSimBus.sys [2009-06-18 27304]
R3 PTSimHid;@oem18.inf,%PTSimHid.SVCDESC%;PenTablet Simulated HID MiniDriver; C:\Windows\System32\drivers\PTSimHid.sys [2009-06-18 17064]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2014-03-18 167424]
R3 RSPCIESTOR;@oem1.inf,%Rts5208%;Realtek PCIE CardReader Driver; C:\Windows\system32\DRIVERS\RtsPStor.sys [2012-03-29 342632]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\Windows\system32\DRIVERS\Rt630x64.sys [2013-06-18 591360]
R3 SynTP;@oem2.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-10-14 396848]
R3 TClass2k;@oem17.inf,%TClass2k.SvcDesc%;Tablet Class Driver; C:\Windows\system32\DRIVERS\TClass2k.sys [2009-06-18 27304]
R3 UCTblHid;@oem17.inf,%UCTblHid.SvcDesc%;HID Tablet Port Driver; C:\Windows\system32\DRIVERS\UCTblHid.sys [2009-06-18 22696]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2013-08-22 212224]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\Windows\system32\DRIVERS\vwifimp.sys [2014-04-30 38912]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2014-05-15 1200128]
S3 btwampfl;@oem3.inf,%btwampfl.ServiceName%;btwampfl; C:\Windows\system32\DRIVERS\btwampfl.sys [2013-09-04 166104]
S3 hitmanpro37;HitmanPro 3.7 Support Driver; \??\C:\Windows\system32\drivers\hitmanpro37.sys [2014-12-15 43664]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2014-12-15 129752]
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2014-11-21 64216]
S3 Tablet2k;Serial Tablet Port Driver; C:\Windows\System32\Drivers\Tablet2k.sys []
S3 usbscan;@sti.inf,%usbscan.SvcDesc%;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2013-08-22 44544]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdAppMgrSvc;Autodesk Application Manager Service; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [2014-09-04 597896]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-03 81088]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2014-07-21 239616]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2014-07-04 344064]
R2 PSI_SVC_2_x64;Corel License Validation Service V2 x64, Powered by arvato; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2013-09-13 337776]
S2 BcmBtRSupport;@oem3.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service; C:\Windows\system32\BtwRSupportService.exe [2013-09-04 2252504]
S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-03 107912]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2014-11-21 969016]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-09 267440]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-10-14 1357104]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2014-09-15 655624]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2013-08-22 43696]
S3 Garmin Core Update Service;Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2014-08-27 441176]
S3 gupdatem;Google Update Service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-03 107912]
S3 mi-raysat_3dsmax2015_64;mental ray Satellite for Autodesk 3ds Max 2015 64-bit; C:\Program Files\Autodesk\3ds Max 2015\NVIDIA\Satellite\raysat_3dsmax2015_64server.exe [2011-09-15 86016]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-12-09 114800]
S3 Origin Client Service;Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2014-12-18 1903472]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-10-01 178824]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-08-13 833728]
S4 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-11-21 1871160]

-----------------EOF-----------------

[motji]

Zdravím
Stáhněte AdwCleaner http://www.bleepingcomputer.com/download/adwcleaner/
-Uložte program na plochu a ukončete všechny spuštěné programy .
-spusťte AdwCleaner, klikněte na Scan a po dokončení skenu na Clean
- provede se oprava, restartuje se pc - (případně restartujte) a objeví se log C:\AdwCleaner\AdwCleaner.txt , obsah logu zkopírujte zde.

[Skyrdis]

Zmazalo to niečo ale tých súborov sa to ani nedotklo
( a ďakujem za váš čas )

# AdwCleaner v4.106 - Report created 30/12/2014 at 16:47:30
# Updated 21/12/2014 by Xplode
# Database : 2014-12-28.1 [Live]
# Operating System : Windows 8.1 Pro (64 bits)
# Username : Skyrdis - TEREZA
# Running from : C:\Users\Skyrdis\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Skyrdis\Desktop\Tutorials

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v34.0.5 (x86 sk)


-\\ Google Chrome v38.0.2125.111


-\\ Comodo Dragon v


*************************

AdwCleaner[R0].txt - [13395 octets] - [15/12/2014 11:57:17]
AdwCleaner[R1].txt - [968 octets] - [30/12/2014 16:42:37]
AdwCleaner[S0].txt - [13239 octets] - [15/12/2014 12:00:26]
AdwCleaner[S1].txt - [892 octets] - [30/12/2014 16:47:30]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [951 octets] ##########

[motji]

Použijte ZOEK - návod od kolegy Vyoska

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
• Do okna vlozte skript nize

• Kód: Vybrat vše

  autoclean;
  resethosts;
  emptyclsid;
  IEdefaults;
  FFdefaults;
  CHRdefaults;
  emptyIEcache;
  emptyFFcache;
  emptyCHRcache;
  emptyalltemp;
  emptyflash;
  emptyjava;
  emptyrecycle.bin;
  

• Nasledne kliknete na Run Script
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

[Skyrdis]

Zoek.exe v5.0.0.0 Updated 28-12-2014
Tool run by Skyrdis on st 31.12.2014 at 10:43:55,70.
Microsoft Windows 8.1 Pro 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Skyrdis\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

31.12.2014 10:46:58 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Empty Folders Check ======================

C:\PROGRA~3\ALM deleted successfully
C:\PROGRA~3\CorelDRAW Graphics Suite X7 x64 deleted successfully
C:\Users\Skyrdis\AppData\Local\DriverToolkit deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_CLASSES_ROOT\CLSID\{31264a33-a653-46c4-af49-1232c59a7da5} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-4212868944-649435043-1964981586-1001\Software\Microsoft\Internet Explorer\Approved Extensions\{31264a33-a653-46c4-af49-1232c59a7da5} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\prefs.js:
user_pref("browser.startup.homepage", "www.google.sk ");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\prefs.js:

ProfilePath: C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_31.12.2014_1110_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~3\CorelDRAW Graphics Suite X7 x64 not found
C:\Users\Skyrdis\.android deleted
C:\Users\Skyrdis\AppData\Roaming\Thinstall deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Skyrdis\AppData\Local\Thinstall deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\BS_Player_ControlBar_B deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\GPT.INI deleted
C:\Windows\Syswow64\GroupPolicy\gpt.ini deleted
C:\Windows\Syswow64\ST~3430.tmp deleted
C:\Windows\Syswow64\ST~34AE.tmp deleted
C:\Windows\Syswow64\ST~372D.tmp deleted
C:\Windows\Syswow64\ST~37AB.tmp deleted
C:\Windows\Syswow64\ST~777.tmp deleted
C:\Windows\Syswow64\ST~7F5.tmp deleted
C:\Windows\Syswow64\ST~AB1C.tmp deleted
C:\Windows\Syswow64\ST~AB9A.tmp deleted
C:\Windows\Syswow64\ST~DBC0.tmp deleted
C:\Windows\Syswow64\ST~DC4E.tmp deleted
C:\Windows\SysWow64\AI_RecycleBin deleted
"C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org\win32\adb.exe" deleted
"C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org\win32\AdbWinApi.dll" deleted
"C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org\win32\AdbWinUsbApi.dll" deleted
"C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org" deleted
"C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org\win32" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default
9860727E477F17B88E39AF8B69B0407A - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll - Shockwave Flash
F59A3BE52327B91541CA61A783741595 - C:\Users\Skyrdis\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player


==== Fake Chromium Profiles Check ======================

Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Administrator\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Guest\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Guest\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Guest\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Skyrdis\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Skyrdis\AppData\Local\Comodo\Dragon deleted

==== Chromium Look ======================

Google Chrome Version: 38.0.2125.111 (Possible outdated, latest Stable version: 39.0.2171.95)



==== Chromium Startpages ======================

C:\Users\Skyrdis\AppData\Local\Google\Chrome\User Data\Default\Preferences
"startup_urls": [ "http://www.google.sk/" ],


==== Chromium Fix ======================

C:\Users\Skyrdis\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_websearch.searc-hall.info_0.localstorage deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"

==== Reset Google Chrome ======================

C:\Users\Skyrdis\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Skyrdis\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Skyrdis\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Skyrdis\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Skyrdis\AppData\Local\Mozilla\Firefox\Profiles\vs2smeiw.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Skyrdis\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=125 folders=129 95353803 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Skyrdis\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Skyrdis\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun.log" not found

==== EOF on st 31.12.2014 at 11:24:17,56 ======================

[motji]

Změnilo se něco?

[Skyrdis]

no zbavilo to všetkých doplnkov prehliadače a to je všetko také čo som si všimla z vizuálnej stránky, ale súbory tam stale sú

[motji]

Máte systém legální?


Otevřete poznámkový blok a vložte do něj:

Kód: Vybrat vše

O4 - HKLM\..\Run: [mncoxtndoSrv] C:\Windows\system32\mncoxtndo.vbe
C:\Windows\system32\mncoxtndo.vbe

-uložte jako fixlist.txt. vedle Frstu.
-otřevřete Frst a klikněte na Fix.


klikněte pravým myšítkem na disk C :, vlastnosti - vyberte kontrolu disku a nechte naplánovat. Po restartu proběhne kontrola disku.

[Skyrdis]

No systém mam momentálne na skúšku nelegálny win 8.1. mohol by byť problém v tom?

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-12-2014
Ran by Skyrdis at 2015-01-01 11:29:17 Run:1
Running from C:\Users\Skyrdis\Desktop
Loaded Profile: Skyrdis (Available profiles: Skyrdis)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
O4 - HKLM\..\Run: [mncoxtndoSrv] C:\Windows\system32\mncoxtndo.vbe
C:\Windows\system32\mncoxtndo.vbe
*****************

O4 - HKLM\..\Run: [mncoxtndoSrv] C:\Windows\system32\mncoxtndo.vbe => Error: No automatic fix found for this entry.
"C:\Windows\system32\mncoxtndo.vbe" => File/Directory not found.

==== End of Fixlog 11:29:17 ====

[Pavuk29]

No systém mam momentálne na skúšku nelegálny win 8.1. mohol by byť problém v tom?

Tak co tu saskujeme?
Cital si pravidla fora a preco plytvas vzacnym casom nasej moderatorky?

[motji]

Dle pravidel fora se zde nelegálními systémy nezabýváme.

[Skyrdis]

2) Pokud stroj uživatele prokazatelně obsahuje nelegální hostitelský čí ochranný software
(operační systém, antivir, firewall, atd.), je nutné navést uživatele k nápravě, např. skrze neplacený software,
a začít řešit, až v době kdy je PC "v pořádku". V případě že uživatel nechce na pravidla přistoupit,
je nutné jej vyzvat ať fórum opustí, a vrátí se až je splní.

Aj tak dakujem za váš čas a aj z vašej strany za slušné "navedenie uživateľa k náprave"
prajem krásny nový rok

[Pavuk29]

2) Pokud stroj uživatele prokazatelně obsahuje nelegální hostitelský čí ochranný software
(operační systém, antivir, firewall, atd.), je nutné navést uživatele k nápravě, např. skrze neplacený software,
a začít řešit, až v době kdy je PC "v pořádku". V případě že uživatel nechce na pravidla přistoupit,
je nutné jej vyzvat ať fórum opustí, a vrátí se až je splní.

Aj tak dakujem za váš čas a aj z vašej strany za slušné "navedenie uživateľa k náprave"
prajem krásny nový rok

Ma nezaujima tvoj vyklad pravidiel. Aj ja mam napriklad na skusku W 10.
Legalne.

Krasny novy rok a prid, ked budes mat vsetko ako ma byt.
Slonik nas zamkne?

[motji]

Až si zakoupíte legální operační systém, rádi Vám tu pomůžeme. Pro verzi si určitě kupovat kvůli škole nebudete.
Hezký Nový rok