Prosím o kontrolu

[Petrdoktor]

Nejde smazat:
c:\Users\Petr\AppData\Roaming\7yTkNwkehPVHieo1\d4NTXbukXrEA.exe
c:\Users\Petr\AppData\Roaming\nH0vG1anrWZ5D4Fn\znNPmkU1TQw5.exe

adresáře, které šly smazat
C:\Users\Petr\AppData\Roaming\Guitar Pro 6
C:\ProgramData\Guitar Pro 6
C:\Program Files (x86)\Guitar Pro 5

momentálně projíždím antivirákem celý C disk, nicméně samostatná kontrola výše dvou uvedených souborů antivirem nebyla nalezena hrozba

[cernohous13]

Stahni Avenger zde:
http://swandog46.geekstogo.com/avenger.exe
Spusť a všude souhlas „Yes“
Hlavní okno
http://2i.cz/b9b1b69c4f
dole dej fajfku do obou čtverečků

Do pole „Input script here“ zkopíruj zelený text scriptu -> „Execute“ -> „Yes“
Bude restart a je potřeba vyčkat na otevření Notepadu a jeho obsah sem vložit. (C:\avenger.txt)

Script

Kód: Vybrat vše

Folders to delete:
c:\Users\Petr\AppData\Roaming\7yTkNwkehPVHieo1
c:\Users\Petr\AppData\Roaming\nH0vG1anrWZ5D4Fn

[Petrdoktor]

bohužel to nešlo, nejdřív to blokoval avast, když jsem dal odblokovat avas do dalšího restartu pak avenger projel, ale adresáře pořád existují

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows NT 6.1 (build 7601, Service Pack 1)
Fri Feb 13 13:00:23 2015

13:00:23: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!


//////////////////////////////////////////

[cernohous13]

Určitě jsi do okna vložil celý zelený text?

[Petrdoktor]

jj zkoušel jsem to několikrát, můžu to zkusit ještě přes uložením souboru

[Petrdoktor]

ted jsem to vyzkoušel znova přes uložením souboru, je to pořad nesmazané...
divné je že po dokončení se mi neotevřela ani avengerovská závěrečná zpráva ... hmm
avenger provede akci, pak che reboot, který potvrdím, pak je restart, po přihlášení na uživatele petr je pak cca 1 minutu tma a pak se rozjede prostředí windows

[cernohous13]

Stáhni si zde : ComboFix
a ulož ho na plochu. zatím nespuštěj

Restartuj do nouzového režimu s prací v síti.

Stáhni Rkill z jednoho z odkazů, pokud by ho vir blokoval, zkus stáhnout jiný

Rkill EXE:
http://download.bleepingcomputer.com/grinler/rkill.exe

Rkill COM:
http://download.bleepingcomputer.com/grinler/rkill.com

Rkill SCR:
http://download.bleepingcomputer.com/grinler/rkill.scr

Rkill PIF:
http://download.bleepingcomputer.com/grinler/rkill.pif

-spusť a nechej ho pracovat. Sám se ukončí.

- Teď nesmíš restartovat počítač!

Spusť ComboFix
- Po spuštění se zobrazí podmínky užití, potvrď je stiskem tlačítka Ano
- Odmítni stažení Konzole...
- Dále postupuj dle pokynů, během aplikování ComboFixu neklikej do zobrazujícího se okna a nic nespouštěj
- Po dokončení skenování by měl program vytvořit log - C:\ComboFix.txt - zkopíruj sem prosím celý jeho obsah
Pokud vyskočí hláška "Pokus použít neplatnou operaci na klíč registru, který je označen pro odstranění", tak jen restartuj PC - registr se dá do kupy
Kdyby ti po použití ComboFixu systém nenaběhl - při restartu F8 a "Poslední známá funkční konfigurace"

[Petrdoktor]

posílám

ComboFix 15-02-13.02 - Petr 14.02.2015 8:05.1.4 - x64 NETWORK
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4022.2840 [GMT 1:00]
Spuštěný z: c:\users\Petr\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Application X
c:\program files (x86)\Application X\PowerDVD\fo-pdvd4.exe
c:\program files (x86)\Application X\PowerDVD\ie6_48_16m.ICO
c:\program files (x86)\Common Files\Config\uninstinethnfd.exe
c:\program files (x86)\Common Files\Config\ver.xml
c:\programdata\ntuser.pol
c:\users\Petr\SetupDWGTrueView2012_32bit.exe
c:\windows\aconti.dat
c:\windows\aconti.ini
c:\windows\aconti.sdb
c:\windows\IsUn0405.exe
c:\windows\jestertb.dll
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\SYCLicense071115.dll
c:\windows\SYCLicense071115U.dll
c:\windows\SysWow64\pthreadVC.dll
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-01-14 do 2015-02-14 )))))))))))))))))))))))))))))))
.
.
2015-02-14 07:12 . 2015-02-14 07:12 -------- d-----w- c:\users\Petra\AppData\Local\temp
2015-02-14 07:12 . 2015-02-14 07:12 -------- d-----w- c:\users\Martin\AppData\Local\temp
2015-02-13 17:01 . 2015-02-13 17:01 61440 ----a-w- c:\windows\SysWow64\drivers\sqsxxi.sys
2015-02-13 13:44 . 2015-02-13 13:44 61440 ----a-w- c:\windows\SysWow64\drivers\jlrfcemd.sys
2015-02-13 13:29 . 2015-02-13 13:29 61440 ----a-w- c:\windows\SysWow64\drivers\ppoahca.sys
2015-02-13 13:23 . 2015-02-13 13:23 61440 ----a-w- c:\windows\SysWow64\drivers\lhox.sys
2015-02-13 13:15 . 2015-02-13 13:15 61440 ----a-w- c:\windows\SysWow64\drivers\zkiki.sys
2015-02-13 12:50 . 2015-02-13 12:50 61440 ----a-w- c:\windows\SysWow64\drivers\jcwwu.sys
2015-02-13 12:43 . 2015-02-13 12:43 61440 ----a-w- c:\windows\SysWow64\drivers\lcdxr.sys
2015-02-13 12:37 . 2015-02-13 12:37 61440 ----a-w- c:\windows\SysWow64\drivers\lkdj.sys
2015-02-13 12:00 . 2015-02-13 12:00 61440 ----a-w- c:\windows\SysWow64\drivers\pkoo.sys
2015-02-12 20:38 . 2014-09-05 02:11 6584320 ----a-w- c:\windows\system32\mstscax.dll
2015-02-12 20:38 . 2014-09-05 01:52 5703168 ----a-w- c:\windows\SysWow64\mstscax.dll
2015-02-12 18:16 . 2014-12-11 17:47 87040 ----a-w- c:\windows\system32\TSWbPrxy.exe
2015-02-11 22:50 . 2015-01-09 03:14 91136 ----a-w- c:\windows\system32\wdi.dll
2015-02-11 22:50 . 2015-01-09 03:14 950272 ----a-w- c:\windows\system32\perftrack.dll
2015-02-11 22:50 . 2015-01-09 03:14 29696 ----a-w- c:\windows\system32\powertracker.dll
2015-02-11 22:50 . 2015-01-09 02:48 76800 ----a-w- c:\windows\SysWow64\wdi.dll
2015-02-11 22:50 . 2015-01-23 03:43 620032 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2015-02-11 22:50 . 2015-01-23 03:17 4300800 ----a-w- c:\windows\SysWow64\jscript9.dll
2015-02-11 22:50 . 2015-01-23 04:42 814080 ----a-w- c:\windows\system32\jscript9diag.dll
2015-02-11 22:50 . 2015-01-23 04:41 6041600 ----a-w- c:\windows\system32\jscript9.dll
2015-02-11 18:27 . 2015-02-11 19:53 -------- d-----w- c:\users\Petr\AppData\Roaming\Imminent
2015-02-11 18:17 . 2015-02-11 18:24 -------- d-----w- C:\AdwCleaner
2015-02-11 18:02 . 2015-02-11 21:21 -------- d-----w- c:\program files\trend micro
2015-02-11 17:06 . 2015-01-10 06:48 86528 ----a-w- c:\windows\system32\TSpkg.dll
2015-02-11 17:04 . 2015-01-13 03:10 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-02-11 17:04 . 2015-01-13 02:49 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2015-02-11 16:55 . 2015-02-11 16:55 -------- d-----w- c:\users\Petr\AppData\Roaming\7yTkNwkehPVHieo1
2015-02-11 16:51 . 2014-12-12 05:31 1480192 ----a-w- c:\windows\system32\crypt32.dll
2015-02-11 16:51 . 2014-12-12 05:07 1174528 ----a-w- c:\windows\SysWow64\crypt32.dll
2015-02-11 16:50 . 2014-11-26 03:53 861696 ----a-w- c:\windows\system32\oleaut32.dll
2015-02-11 16:50 . 2014-11-26 03:32 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2015-02-11 16:49 . 2014-12-08 03:09 406528 ----a-w- c:\windows\system32\scesrv.dll
2015-02-11 16:49 . 2014-12-08 02:46 308224 ----a-w- c:\windows\SysWow64\scesrv.dll
2015-02-11 16:45 . 2015-01-14 06:09 5554112 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-02-11 16:45 . 2015-01-14 05:44 3972544 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2015-02-11 16:45 . 2015-01-14 05:44 3917760 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2015-02-11 16:45 . 2015-01-14 06:05 503808 ----a-w- c:\windows\system32\srcore.dll
2015-02-11 16:45 . 2015-01-14 06:04 296960 ----a-w- c:\windows\system32\rstrui.exe
2015-02-11 16:45 . 2015-01-14 06:05 50176 ----a-w- c:\windows\system32\srclient.dll
2015-02-11 16:45 . 2015-01-14 05:41 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2015-02-11 16:37 . 2015-02-11 16:38 -------- d-----w- c:\program files\CCleaner
2015-02-11 16:34 . 2015-01-09 02:03 3201536 ----a-w- c:\windows\system32\win32k.sys
2015-02-08 15:26 . 2015-02-08 15:26 320424 ----a-w- c:\windows\system32\javaws.exe
2015-02-08 15:26 . 2015-02-08 15:26 111016 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2015-02-08 15:26 . 2015-02-08 15:26 189352 ----a-w- c:\windows\system32\javaw.exe
2015-02-08 15:26 . 2015-02-08 15:26 189352 ----a-w- c:\windows\system32\java.exe
2015-02-08 15:26 . 2015-02-08 15:26 -------- d-----w- c:\program files\Java
2015-02-07 07:21 . 2015-02-07 07:21 -------- d-----w- c:\program files (x86)\pazera-software
2015-02-06 16:39 . 2015-02-06 16:39 -------- d-----w- c:\users\Petr\AppData\Roaming\nH0vG1anrWZ5D4Fn
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-13 17:54 . 2012-01-13 19:48 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2015-02-13 17:54 . 2010-12-17 13:33 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2015-02-11 22:25 . 2010-10-12 10:46 116773704 ----a-w- c:\windows\system32\MRT.exe
2015-02-09 17:03 . 2010-12-17 13:33 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2015-02-05 18:46 . 2012-04-09 16:08 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-02-05 18:46 . 2011-05-21 06:07 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-26 16:13 . 2011-01-14 16:46 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2014-12-19 03:06 . 2015-01-14 05:39 210432 ----a-w- c:\windows\system32\profsvc.dll
2014-12-19 01:46 . 2015-01-14 05:39 141312 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2014-12-06 04:17 . 2015-01-14 05:39 303616 ----a-w- c:\windows\system32\nlasvc.dll
2014-12-06 03:50 . 2015-01-14 05:39 52224 ----a-w- c:\windows\SysWow64\nlaapi.dll
2014-12-06 03:50 . 2015-01-14 05:39 156672 ----a-w- c:\windows\SysWow64\ncsi.dll
2014-11-23 19:24 . 2011-06-16 15:52 1050432 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-11-23 19:23 . 2014-11-23 19:23 364512 ----a-w- c:\windows\system32\aswBoot.exe
2014-11-23 19:23 . 2014-04-29 21:13 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-11-23 19:23 . 2013-12-30 19:50 116728 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-11-23 19:23 . 2013-04-01 06:05 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-11-23 19:23 . 2013-04-01 06:05 267632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-11-23 19:23 . 2010-10-25 17:58 436624 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-11-23 19:23 . 2010-10-25 17:58 83280 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-11-23 19:23 . 2012-02-26 09:04 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-11-23 19:23 . 2014-11-23 19:23 43152 ----a-w- c:\windows\avastSS.scr
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-08-16 2736128]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"AutoStartNPSAgent"="c:\program files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-01-20 7404312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files (x86)\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-09 29984]
"IndexSearch"="c:\program files (x86)\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-09 46368]
"PPort11reminder"="c:\program files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"AvastUI.exe"="c:\program files\Alwil Software\Avast5\AvastUI.exe" [2015-01-27 5227112]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"BlueStacks Agent"="c:\program files (x86)\BlueStacks\HD-Agent.exe" [2014-08-13 835288]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888]
"PDFPrint"="c:\program files (x86)\pdf24\pdf24.exe" [2014-10-13 193568]
"PROFIS AutoUpdate"="c:\program files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe" [2014-09-01 525312]
.
c:\users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Total Commander.lnk - c:\program files (x86)\totalcmd\TOTALCMD.EXE [2010-10-12 3687736]
.
c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Total Commander.lnk - c:\program files (x86)\totalcmd\TOTALCMD.EXE [2010-10-12 3687736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AVer HID Receiver.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2011-12-24 155648]
ImageBrowser EX Agent.lnk - c:\program files (x86)\Canon\ImageBrowser EX\MFManager.exe [2012-8-30 69120]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
R0 akpdj;akpdj;c:\windows\system32\drivers\zkiki.sys;c:\windows\SYSNATIVE\drivers\zkiki.sys [x]
R0 aswRvrt;avast! Revert; [x]
R0 aswVmm;avast! VM Monitor; [x]
R0 csen;csen;c:\windows\system32\drivers\jlrfcemd.sys;c:\windows\SYSNATIVE\drivers\jlrfcemd.sys [x]
R0 dfhdnm;dfhdnm;c:\windows\system32\drivers\jcwwu.sys;c:\windows\SYSNATIVE\drivers\jcwwu.sys [x]
R0 gsoldsxm;gsoldsxm;c:\windows\system32\drivers\lhox.sys;c:\windows\SYSNATIVE\drivers\lhox.sys [x]
R0 jdnsebxw;jdnsebxw;c:\windows\system32\drivers\lkdj.sys;c:\windows\SYSNATIVE\drivers\lkdj.sys [x]
R0 mfvhzoyu;mfvhzoyu;c:\windows\system32\drivers\ppoahca.sys;c:\windows\SYSNATIVE\drivers\ppoahca.sys [x]
R0 opuyb;opuyb;c:\windows\system32\drivers\pkoo.sys;c:\windows\SYSNATIVE\drivers\pkoo.sys [x]
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
R0 vjdt;vjdt;c:\windows\system32\drivers\lcdxr.sys;c:\windows\SYSNATIVE\drivers\lcdxr.sys [x]
R0 wcvsxiup;wcvsxiup;c:\windows\system32\drivers\sqsxxi.sys;c:\windows\SYSNATIVE\drivers\sqsxxi.sys [x]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
R2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 AVerRemote;AVerRemote;c:\program files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe;c:\program files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [x]
R2 AVerScheduleService;AVerScheduleService;c:\program files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe;c:\program files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [x]
R2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]
R2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
R2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [x]
R2 BstHdUpdaterSvc;BlueStacks Updater Service;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Hilti PROFIS AutoUpdate Service;Hilti PROFIS AutoUpdate Service;c:\program files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe;c:\program files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe [x]
R2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
R2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
R2 VBoxAswDrv;VBoxAsw Support Driver;c:\program files\Alwil Software\Avast5\ng\vbox\VBoxAswDrv.sys;c:\program files\Alwil Software\Avast5\ng\vbox\VBoxAswDrv.sys [x]
R3 AvastVBoxSvc;AvastVBox COM Service;c:\program files\Alwil Software\Avast5\ng\vbox\AvastVBoxSVC.exe;c:\program files\Alwil Software\Avast5\ng\vbox\AvastVBoxSVC.exe [x]
R3 AVerAF35;AVerMedia A835 USB DVB-T;c:\windows\system32\Drivers\AVerAF35.sys;c:\windows\SYSNATIVE\Drivers\AVerAF35.sys [x]
R3 DialComService;DIAL Communication Service;c:\program files (x86)\DIAL GmbH\DIAL Communication Framework\DialComService.exe;c:\program files (x86)\DIAL GmbH\DIAL Communication Framework\DialComService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\DRIVERS\LVUSBS64.sys;c:\windows\SYSNATIVE\DRIVERS\LVUSBS64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SMARTMouseFilterx64;HID-compliant mouse;c:\windows\system32\DRIVERS\SMARTMouseFilterx64.sys;c:\windows\SYSNATIVE\DRIVERS\SMARTMouseFilterx64.sys [x]
R3 SMARTVHidMiniVistaAmd64;SMART HID Device;c:\windows\system32\DRIVERS\SMARTVHidMiniVistaAmd64.sys;c:\windows\SYSNATIVE\DRIVERS\SMARTVHidMiniVistaAmd64.sys [x]
R3 SMARTVTabletPCx64;SMART Virtual TabletPC;c:\windows\system32\DRIVERS\SMARTVTabletPCx64.sys;c:\windows\SYSNATIVE\DRIVERS\SMARTVTabletPCx64.sys [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdm.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys;c:\windows\SYSNATIVE\Drivers\TFsExDisk.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k62x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-08-16 11:43 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-02-06 06:05 1086280 ----a-w- c:\program files (x86)\Google\Chrome\Application\40.0.2214.111\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2015-02-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 18:46]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-11-23 19:23 860984 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-07 11465832]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1712672]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com
mStart Page = https://www.seznam.cz/?clid=22668
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}
mSearch Bar = https://www.seznam.cz/?clid=22668
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKLM-Run-NPSStartup - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-NEXIS32 3.40.13 - c:\windows\IsUn0405.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2015-02-14 08:15:29
ComboFix-quarantined-files.txt 2015-02-14 07:15
.
Před spuštěním: Volných bajtů: 42 926 587 904
Po spuštění: Volných bajtů: 42 349 592 576
.
- - End Of File - - 62E64DCA3C88568B0B080E79B5CBBBA6
A36C5E4F47E84449FF07ED3517B43A31

[Petrdoktor]

super moc díky.
adresář se souborem
c:\Users\Petr\AppData\Roaming\7yTkNwkehPVHieo1\d4NTXbukXrEA.exe
sice na disku zůstal, ale jde už vymazat normálně....

[cernohous13]

Pokud nemáš ComboFix na ploše, přesuň jej tam.
Otevři Poznámkový blok (Notepad) a zkopíruj celý zelený text z "CFScriptu".
Soubor ulož na plochu jako CFScript.txt a jeho ikonu přetáhni myší nad ikonu ComboFixu - tam pusť.

ComboFix se spustí - počkej na log a vlož ho sem.

CFScript

Kód: Vybrat vše

KillAll::

File::
c:\windows\SysWow64\drivers\sqsxxi.sys
c:\windows\SysWow64\drivers\jlrfcemd.sys
c:\windows\SysWow64\drivers\ppoahca.sys
c:\windows\SysWow64\drivers\lhox.sys
c:\windows\SysWow64\drivers\zkiki.sys
c:\windows\SysWow64\drivers\jcwwu.sys
c:\windows\SysWow64\drivers\lcdxr.sys
c:\windows\SysWow64\drivers\lkdj.sys
c:\windows\SysWow64\drivers\pkoo.sys
c:\windows\SYSNATIVE\drivers\zkiki.sys
c:\windows\SYSNATIVE\drivers\jlrfcemd.sys
c:\windows\SYSNATIVE\drivers\jcwwu.sys
c:\windows\SYSNATIVE\drivers\lhox.sys
c:\windows\SYSNATIVE\drivers\lkdj.sys
c:\windows\SYSNATIVE\drivers\ppoahca.sys
c:\windows\SYSNATIVE\drivers\pkoo.sys
c:\windows\SYSNATIVE\drivers\lcdxr.sys
c:\windows\SYSNATIVE\drivers\sqsxxi.sys

Driver::
sqsxxi.sys
jlrfcemd.sys
ppoahca.sys
lhox.sys
zkiki.sys
jcwwu.sys
lcdxr.sys
lkdj.sys
pkoo.sys
csen
dfhdnm
gsoldsxm
jdnsebxw
mfvhzoyu
opuyb
akpdj
vjdt
wcvsxiup

Folder::
c:\users\Petr\AppData\Roaming\nH0vG1anrWZ5D4Fn

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

[Petrdoktor]

ComboFix 15-02-13.02 - Petr 14.02.2015 20:26:11.2.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.4022.521 [GMT 1:00]
Spuštěný z: c:\users\Petr\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Petr\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\drivers\jcwwu.sys"
"c:\windows\system32\drivers\jlrfcemd.sys"
"c:\windows\system32\drivers\lcdxr.sys"
"c:\windows\system32\drivers\lhox.sys"
"c:\windows\system32\drivers\lkdj.sys"
"c:\windows\system32\drivers\pkoo.sys"
"c:\windows\system32\drivers\ppoahca.sys"
"c:\windows\system32\drivers\sqsxxi.sys"
"c:\windows\system32\drivers\zkiki.sys"
"c:\windows\SysWow64\drivers\jcwwu.sys"
"c:\windows\SysWow64\drivers\jlrfcemd.sys"
"c:\windows\SysWow64\drivers\lcdxr.sys"
"c:\windows\SysWow64\drivers\lhox.sys"
"c:\windows\SysWow64\drivers\lkdj.sys"
"c:\windows\SysWow64\drivers\pkoo.sys"
"c:\windows\SysWow64\drivers\ppoahca.sys"
"c:\windows\SysWow64\drivers\sqsxxi.sys"
"c:\windows\SysWow64\drivers\zkiki.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_akpdj
-------\Service_csen
-------\Service_dfhdnm
-------\Service_gsoldsxm
-------\Service_jdnsebxw
-------\Service_mfvhzoyu
-------\Service_opuyb
-------\Service_vjdt
-------\Service_wcvsxiup
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-01-14 do 2015-02-14 )))))))))))))))))))))))))))))))
.
.
2015-02-14 19:38 . 2015-02-14 19:38 -------- d-----w- c:\users\Martin\AppData\Local\temp
2015-02-14 19:38 . 2015-02-14 19:38 -------- d-----w- c:\users\Jan\AppData\Local\temp
2015-02-14 19:38 . 2015-02-14 19:38 -------- d-----w- c:\users\Jan Svadbík\AppData\Local\temp
2015-02-14 19:38 . 2015-02-14 19:38 -------- d-----w- c:\users\Ema\AppData\Local\temp
2015-02-14 19:38 . 2015-02-14 19:38 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-02-14 19:38 . 2015-02-14 19:38 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2015-02-14 07:15 . 2015-02-14 19:38 -------- d-----w- c:\users\Petra\AppData\Local\temp
2015-02-13 17:01 . 2015-02-13 17:01 61440 ----a-w- c:\windows\SysWow64\drivers\sqsxxi.sys
2015-02-13 13:44 . 2015-02-13 13:44 61440 ----a-w- c:\windows\SysWow64\drivers\jlrfcemd.sys
2015-02-13 13:29 . 2015-02-13 13:29 61440 ----a-w- c:\windows\SysWow64\drivers\ppoahca.sys
2015-02-13 13:23 . 2015-02-13 13:23 61440 ----a-w- c:\windows\SysWow64\drivers\lhox.sys
2015-02-13 13:15 . 2015-02-13 13:15 61440 ----a-w- c:\windows\SysWow64\drivers\zkiki.sys
2015-02-13 12:50 . 2015-02-13 12:50 61440 ----a-w- c:\windows\SysWow64\drivers\jcwwu.sys
2015-02-13 12:43 . 2015-02-13 12:43 61440 ----a-w- c:\windows\SysWow64\drivers\lcdxr.sys
2015-02-13 12:37 . 2015-02-13 12:37 61440 ----a-w- c:\windows\SysWow64\drivers\lkdj.sys
2015-02-13 12:00 . 2015-02-13 12:00 61440 ----a-w- c:\windows\SysWow64\drivers\pkoo.sys
2015-02-12 20:38 . 2014-09-05 02:11 6584320 ----a-w- c:\windows\system32\mstscax.dll
2015-02-12 20:38 . 2014-09-05 01:52 5703168 ----a-w- c:\windows\SysWow64\mstscax.dll
2015-02-12 18:16 . 2014-12-11 17:47 87040 ----a-w- c:\windows\system32\TSWbPrxy.exe
2015-02-11 22:50 . 2015-01-09 03:14 91136 ----a-w- c:\windows\system32\wdi.dll
2015-02-11 22:50 . 2015-01-09 03:14 950272 ----a-w- c:\windows\system32\perftrack.dll
2015-02-11 22:50 . 2015-01-09 03:14 29696 ----a-w- c:\windows\system32\powertracker.dll
2015-02-11 22:50 . 2015-01-09 02:48 76800 ----a-w- c:\windows\SysWow64\wdi.dll
2015-02-11 22:50 . 2015-01-23 03:43 620032 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2015-02-11 22:50 . 2015-01-23 03:17 4300800 ----a-w- c:\windows\SysWow64\jscript9.dll
2015-02-11 22:50 . 2015-01-23 04:42 814080 ----a-w- c:\windows\system32\jscript9diag.dll
2015-02-11 22:50 . 2015-01-23 04:41 6041600 ----a-w- c:\windows\system32\jscript9.dll
2015-02-11 18:27 . 2015-02-11 19:53 -------- d-----w- c:\users\Petr\AppData\Roaming\Imminent
2015-02-11 18:17 . 2015-02-11 18:24 -------- d-----w- C:\AdwCleaner
2015-02-11 18:02 . 2015-02-11 21:21 -------- d-----w- c:\program files\trend micro
2015-02-11 17:06 . 2015-01-10 06:48 86528 ----a-w- c:\windows\system32\TSpkg.dll
2015-02-11 17:04 . 2015-01-13 03:10 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-02-11 17:04 . 2015-01-13 02:49 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2015-02-11 16:51 . 2014-12-12 05:31 1480192 ----a-w- c:\windows\system32\crypt32.dll
2015-02-11 16:51 . 2014-12-12 05:07 1174528 ----a-w- c:\windows\SysWow64\crypt32.dll
2015-02-11 16:50 . 2014-11-26 03:53 861696 ----a-w- c:\windows\system32\oleaut32.dll
2015-02-11 16:50 . 2014-11-26 03:32 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2015-02-11 16:49 . 2014-12-08 03:09 406528 ----a-w- c:\windows\system32\scesrv.dll
2015-02-11 16:49 . 2014-12-08 02:46 308224 ----a-w- c:\windows\SysWow64\scesrv.dll
2015-02-11 16:45 . 2015-01-14 06:09 5554112 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-02-11 16:45 . 2015-01-14 05:44 3972544 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2015-02-11 16:45 . 2015-01-14 05:44 3917760 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2015-02-11 16:45 . 2015-01-14 06:05 503808 ----a-w- c:\windows\system32\srcore.dll
2015-02-11 16:45 . 2015-01-14 06:04 296960 ----a-w- c:\windows\system32\rstrui.exe
2015-02-11 16:45 . 2015-01-14 06:05 50176 ----a-w- c:\windows\system32\srclient.dll
2015-02-11 16:45 . 2015-01-14 05:41 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2015-02-11 16:37 . 2015-02-11 16:38 -------- d-----w- c:\program files\CCleaner
2015-02-11 16:34 . 2015-01-09 02:03 3201536 ----a-w- c:\windows\system32\win32k.sys
2015-02-08 15:26 . 2015-02-08 15:26 320424 ----a-w- c:\windows\system32\javaws.exe
2015-02-08 15:26 . 2015-02-08 15:26 111016 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2015-02-08 15:26 . 2015-02-08 15:26 189352 ----a-w- c:\windows\system32\javaw.exe
2015-02-08 15:26 . 2015-02-08 15:26 189352 ----a-w- c:\windows\system32\java.exe
2015-02-08 15:26 . 2015-02-08 15:26 -------- d-----w- c:\program files\Java
2015-02-07 07:21 . 2015-02-07 07:21 -------- d-----w- c:\program files (x86)\pazera-software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-14 15:25 . 2010-12-17 13:33 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2015-02-13 17:54 . 2012-01-13 19:48 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2015-02-13 17:54 . 2010-12-17 13:33 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2015-02-11 22:25 . 2010-10-12 10:46 116773704 ----a-w- c:\windows\system32\MRT.exe
2015-02-05 18:46 . 2012-04-09 16:08 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-02-05 18:46 . 2011-05-21 06:07 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-26 16:13 . 2011-01-14 16:46 483952 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2014-12-19 03:06 . 2015-01-14 05:39 210432 ----a-w- c:\windows\system32\profsvc.dll
2014-12-19 01:46 . 2015-01-14 05:39 141312 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2014-12-06 04:17 . 2015-01-14 05:39 303616 ----a-w- c:\windows\system32\nlasvc.dll
2014-12-06 03:50 . 2015-01-14 05:39 52224 ----a-w- c:\windows\SysWow64\nlaapi.dll
2014-12-06 03:50 . 2015-01-14 05:39 156672 ----a-w- c:\windows\SysWow64\ncsi.dll
2014-11-23 19:24 . 2011-06-16 15:52 1050432 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-11-23 19:23 . 2014-11-23 19:23 364512 ----a-w- c:\windows\system32\aswBoot.exe
2014-11-23 19:23 . 2014-04-29 21:13 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-11-23 19:23 . 2013-12-30 19:50 116728 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-11-23 19:23 . 2013-04-01 06:05 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-11-23 19:23 . 2013-04-01 06:05 267632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-11-23 19:23 . 2010-10-25 17:58 436624 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-11-23 19:23 . 2010-10-25 17:58 83280 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-11-23 19:23 . 2012-02-26 09:04 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-11-23 19:23 . 2014-11-23 19:23 43152 ----a-w- c:\windows\avastSS.scr
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-08-16 2736128]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"AutoStartNPSAgent"="c:\program files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-01-20 7404312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files (x86)\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-09 29984]
"IndexSearch"="c:\program files (x86)\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-09 46368]
"PPort11reminder"="c:\program files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"AvastUI.exe"="c:\program files\Alwil Software\Avast5\AvastUI.exe" [2015-01-27 5227112]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"BlueStacks Agent"="c:\program files (x86)\BlueStacks\HD-Agent.exe" [2014-08-13 835288]
"PDFPrint"="c:\program files (x86)\pdf24\pdf24.exe" [2014-10-13 193568]
"PROFIS AutoUpdate"="c:\program files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe" [2014-09-01 525312]
.
c:\users\Petra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Total Commander.lnk - c:\program files (x86)\totalcmd\TOTALCMD.EXE [2010-10-12 3687736]
.
c:\users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Total Commander.lnk - c:\program files (x86)\totalcmd\TOTALCMD.EXE [2010-10-12 3687736]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AVer HID Receiver.lnk - c:\program files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2011-12-24 155648]
ImageBrowser EX Agent.lnk - c:\program files (x86)\Canon\ImageBrowser EX\MFManager.exe [2012-8-30 69120]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
R2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 DialComService;DIAL Communication Service;c:\program files (x86)\DIAL GmbH\DIAL Communication Framework\DialComService.exe;c:\program files (x86)\DIAL GmbH\DIAL Communication Framework\DialComService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SMARTMouseFilterx64;HID-compliant mouse;c:\windows\system32\DRIVERS\SMARTMouseFilterx64.sys;c:\windows\SYSNATIVE\DRIVERS\SMARTMouseFilterx64.sys [x]
R3 SMARTVHidMiniVistaAmd64;SMART HID Device;c:\windows\system32\DRIVERS\SMARTVHidMiniVistaAmd64.sys;c:\windows\SYSNATIVE\DRIVERS\SMARTVHidMiniVistaAmd64.sys [x]
R3 SMARTVTabletPCx64;SMART Virtual TabletPC;c:\windows\system32\DRIVERS\SMARTVTabletPCx64.sys;c:\windows\SYSNATIVE\DRIVERS\SMARTVTabletPCx64.sys [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdm.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys;c:\windows\SYSNATIVE\Drivers\TFsExDisk.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S2 AVerRemote;AVerRemote;c:\program files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe;c:\program files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [x]
S2 AVerScheduleService;AVerScheduleService;c:\program files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe;c:\program files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [x]
S2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [x]
S2 BstHdUpdaterSvc;BlueStacks Updater Service;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe;c:\program files (x86)\BlueStacks\HD-UpdaterService.exe [x]
S2 Hilti PROFIS AutoUpdate Service;Hilti PROFIS AutoUpdate Service;c:\program files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe;c:\program files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe [x]
S2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
S3 AvastVBoxSvc;AvastVBox COM Service;c:\program files\Alwil Software\Avast5\ng\vbox\AvastVBoxSVC.exe;c:\program files\Alwil Software\Avast5\ng\vbox\AvastVBoxSVC.exe [x]
S3 AVerAF35;AVerMedia A835 USB DVB-T;c:\windows\system32\Drivers\AVerAF35.sys;c:\windows\SYSNATIVE\Drivers\AVerAF35.sys [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k62x64.sys [x]
S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\DRIVERS\LVUSBS64.sys;c:\windows\SYSNATIVE\DRIVERS\LVUSBS64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-08-16 11:43 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-02-06 06:05 1086280 ----a-w- c:\program files (x86)\Google\Chrome\Application\40.0.2214.111\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2015-02-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-09 18:46]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-11-23 19:23 860984 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-07 11465832]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1712672]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com
mStart Page = https://www.seznam.cz/?clid=22668
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}
mSearch Bar = https://www.seznam.cz/?clid=22668
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-NEXIS32 3.40.13 - c:\windows\IsUn0405.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_305.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files (x86)\Google\Update\GoogleUpdate.exe
c:\windows\SysWOW64\IoctlSvc.exe
.
**************************************************************************
.
Celkový čas: 2015-02-14 20:52:29 - počítač byl restartován
ComboFix-quarantined-files.txt 2015-02-14 19:52
ComboFix2.txt 2015-02-14 07:15
.
Před spuštěním: Volných bajtů: 39 247 667 200
Po spuštění: Volných bajtů: 39 335 317 504
.
- - End Of File - - 3DF1A37BF9CE6A25FBC247AD55C0704E
A36C5E4F47E84449FF07ED3517B43A31

[cernohous13]

dej nový RSIT a napiš něco o problémech

[Petrdoktor]

problémy nejsou, nesmazatelné soubory byly smazány, díky za pomoc
počítač zdá se šlape...
posílám log z Rsitu. Je to teda OK?

Logfile of random's system information tool 1.10 (written by random/random)
Run by Petr at 2015-02-15 09:22:42
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 38 GB (16%) free of 238 GB
Total RAM: 4022 MB (48% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:22:45, on 15.2.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17631)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe
C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Alwil Software\Avast5\avastui.exe
C:\Program Files (x86)\BlueStacks\HD-Agent.exe
C:\Program Files (x86)\pdf24\pdf24.exe
C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe
C:\Program Files (x86)\Opera\27.0.1689.69\opera_crashreporter.exe
C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe
C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe
C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe
C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe
C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe
C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Windows\sysWow64\SearchProtocolHost.exe
C:\Program Files\trend micro\Petr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.seznam.cz/?sourceid=quick ... earchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [BlueStacks Agent] C:\Program Files (x86)\BlueStacks\HD-Agent.exe
O4 - HKLM\..\Run: [PDFPrint] C:\Program Files (x86)\pdf24\pdf24.exe
O4 - HKLM\..\Run: [PROFIS AutoUpdate] C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe -hidden
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - Startup: Total Commander.lnk = C:\Program Files (x86)\totalcmd\TOTALCMD.EXE
O4 - Global Startup: AVer HID Receiver.lnk = C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
O4 - Global Startup: ImageBrowser EX Agent.lnk = C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - (no file)
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/s ... wflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - C:\Program Files\Alwil Software\Avast5\ng\vbox\AvastVBoxSVC.exe
O23 - Service: AVerRemote - AVerMedia - C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
O23 - Service: AVerScheduleService - Unknown owner - C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
O23 - Service: BlueStacks Android Service (BstHdAndroidSvc) - BlueStack Systems, Inc. - C:\Program Files (x86)\BlueStacks\HD-Service.exe
O23 - Service: BlueStacks Log Rotator Service (BstHdLogRotatorSvc) - BlueStack Systems, Inc. - C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
O23 - Service: BlueStacks Updater Service (BstHdUpdaterSvc) - BlueStack Systems, Inc. - C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe
O23 - Service: DIAL Communication Service (DialComService) - Unknown owner - C:\Program Files (x86)\DIAL GmbH\DIAL Communication Framework\DialComService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Hilti PROFIS AutoUpdate Service - Hilti Corporation - C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Performance Driver Service - Unknown owner - C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\SysWOW64\IoctlSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TeamViewer 9 (TeamViewer9) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11088 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\Alwil Software\Avast5\AvastSvc.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe"
"C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe"
"C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe"
"C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe"
"taskhost.exe"
taskeng.exe {969DD9CC-8219-4809-9CF9-7E6D86D389EE}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"
"C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe"
C:\Windows\SysWOW64\IoctlSvc.exe
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" -hidden
"C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
"C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe"
"C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe"
"C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe"
"C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe"
"C:\Program Files\Alwil Software\Avast5\avastui.exe" /nogui
"C:\Program Files (x86)\BlueStacks\HD-Agent.exe"
"C:\Program Files (x86)\pdf24\pdf24.exe"
"C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe" -hidden
"C:\Program Files (x86)\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe" --ran-launcher
"C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe" --ran-launcher /crash-reporter-parent-id=4544
"C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe" --type=gpu-process --channel="4544.0.692465241\1811931011" --enable-proprietary-media-types-playback --crash-reporter-pid=4572 --disable-d3d11 --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,6,19,40,49 --gpu-vendor-id=0x10de --gpu-device-id=0x0659 --gpu-driver-vendor=NVIDIA --gpu-driver-version=8.15.11.9038 --enable-proprietary-media-types-playback --crash-reporter-pid=4572 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe" --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=cs --enable-proprietary-media-types-playback --extension-process --enable-webrtc-hw-h264-encoding --disable-client-side-phishing-detection --ppapi-flash-path="C:\Windows\SysWOW64\Macromed\Flash\pepflashplayer32_16_0_0_305.dll" --ppapi-flash-version=16.0.0.305 --with-feature:enhanced-autofill --crash-reporter-pid=4572 --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="4544.3.405482022\306468855" /prefetch:673131151
"C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe" --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=cs --enable-proprietary-media-types-playback --extension-process --enable-webrtc-hw-h264-encoding --disable-client-side-phishing-detection --ppapi-flash-path="C:\Windows\SysWOW64\Macromed\Flash\pepflashplayer32_16_0_0_305.dll" --ppapi-flash-version=16.0.0.305 --with-feature:enhanced-autofill --crash-reporter-pid=4572 --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="4544.4.1759118254\2009655437" /prefetch:673131151
"C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe" --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=cs --enable-proprietary-media-types-playback --disable-client-side-phishing-detection --ppapi-flash-path="C:\Windows\SysWOW64\Macromed\Flash\pepflashplayer32_16_0_0_305.dll" --ppapi-flash-version=16.0.0.305 --with-feature:enhanced-autofill --crash-reporter-pid=4572 --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="4544.5.821603856\1226382887" /prefetch:673131151
"C:\Program Files (x86)\Opera\27.0.1689.69\opera.exe" --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=cs --enable-proprietary-media-types-playback --disable-client-side-phishing-detection --ppapi-flash-path="C:\Windows\SysWOW64\Macromed\Flash\pepflashplayer32_16_0_0_305.dll" --ppapi-flash-version=16.0.0.305 --with-feature:enhanced-autofill --crash-reporter-pid=4572 --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="4544.8.251073240\104290657" /prefetch:673131151
"C:\Program Files\Alwil Software\Avast5\ng\vbox\AvastVBoxSVC.exe"
"C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe" -Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
ngservice.exe pipeserver
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\splwow64.exe 8192
"C:\Program Files (x86)\BlueStacks\HD-Network.exe"
\??\C:\Windows\system32\conhost.exe "-1435483313-1667299688-1202006720-906847801569759242142111954018572117641047623137
"C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe"
\??\C:\Windows\system32\conhost.exe "3459634771851961453-971556178-63544809111246769349137359131004854358-1522379290
"C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe"
\??\C:\Windows\system32\conhost.exe "1083345091207055293413989695085655685021242611602104849355-1543509786-1610841634
"C:\Windows\sysWow64\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2143279821-4074357603-3600502581-10023_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2143279821-4074357603-3600502581-10023 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
C:\Windows\explorer.exe /factory,{ceff45ee-c862-41de-aee2-a022c81eda92} -Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

"C:\Users\Petr\Desktop\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2015-02-08 553896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2014-11-23 705448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2015-02-08 211880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFCB3198-32F3-4E8B-9539-4324694ED664}]
Adblock Plus for IE Browser Helper Object - C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2014-12-16 725768]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2014-11-23 586968]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFCB3198-32F3-4E8B-9539-4324694ED664}]
Adblock Plus for IE Browser Helper Object - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2014-12-16 615688]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -
{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-09-07 11465832]
"nwiz"=C:\Program Files\NVIDIA Corporation\nView\nwiz.exe [2009-07-09 1712672]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2010-08-16 2736128]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [2008-01-22 152872]
"AutoStartNPSAgent"=C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [2010-07-04 95576]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-01-20 7404312]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SSBkgdUpdate"=C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472]
"PaperPort PTD"=C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [2008-07-09 29984]
"IndexSearch"=C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [2008-07-09 46368]
"PPort11reminder"=C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [2007-08-31 328992]
"AvastUI.exe"=C:\Program Files\Alwil Software\Avast5\AvastUI.exe [2015-01-27 5227112]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2013-04-21 59720]
"BlueStacks Agent"=C:\Program Files (x86)\BlueStacks\HD-Agent.exe [2014-08-13 835288]
"PDFPrint"=C:\Program Files (x86)\pdf24\pdf24.exe [2014-10-13 193568]
"PROFIS AutoUpdate"=C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe [2014-09-01 525312]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
AVer HID Receiver.lnk - C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
ImageBrowser EX Agent.lnk - C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe

C:\Users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Total Commander.lnk - C:\Program Files (x86)\totalcmd\TOTALCMD.EXE

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"LogonHoursAction"=2
"DontDisplayLogonHoursWarnings"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=lvcod64.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"MSVideo"=vfwwdm32.dll
"MSVideo8"=VfWWDM32.dll
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.scr - open - "C:\Windows\notepad.exe" "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2015-02-15 09:22:41 ----D---- C:\rsit
2015-02-14 20:52:30 ----A---- C:\ComboFix.txt
2015-02-14 20:46:01 ----SHD---- C:\$RECYCLE.BIN
2015-02-14 08:15:35 ----D---- C:\Windows\temp
2015-02-14 08:01:25 ----A---- C:\Windows\zip.exe
2015-02-14 08:01:25 ----A---- C:\Windows\SWSC.exe
2015-02-14 08:01:25 ----A---- C:\Windows\SWREG.exe
2015-02-14 08:01:25 ----A---- C:\Windows\sed.exe
2015-02-14 08:01:25 ----A---- C:\Windows\PEV.exe
2015-02-14 08:01:25 ----A---- C:\Windows\NIRCMD.exe
2015-02-14 08:01:25 ----A---- C:\Windows\MBR.exe
2015-02-14 08:01:25 ----A---- C:\Windows\grep.exe
2015-02-14 07:56:56 ----D---- C:\Qoobox
2015-02-14 07:56:39 ----D---- C:\Windows\erdnt
2015-02-14 07:46:07 ----A---- C:\Windows\ntbtlog.txt
2015-02-13 18:01:27 ----A---- C:\Windows\SYSWOW64\drivers\sqsxxi.sys
2015-02-13 18:01:27 ----A---- C:\Windows\SYSWOW64\cechxh.txt
2015-02-13 14:44:09 ----A---- C:\Windows\SYSWOW64\drivers\jlrfcemd.sys
2015-02-13 14:44:09 ----A---- C:\Windows\bfxkwnm.txt
2015-02-13 14:29:31 ----A---- C:\Windows\SYSWOW64\drivers\ppoahca.sys
2015-02-13 14:29:31 ----A---- C:\Windows\qlha.txt
2015-02-13 14:23:40 ----A---- C:\Windows\SYSWOW64\qmxsresg.txt
2015-02-13 14:23:40 ----A---- C:\Windows\SYSWOW64\drivers\lhox.sys
2015-02-13 14:15:07 ----A---- C:\Windows\SYSWOW64\drivers\zkiki.sys
2015-02-13 14:15:07 ----A---- C:\Windows\iahz.txt
2015-02-13 13:50:48 ----A---- C:\Windows\SYSWOW64\drivers\jcwwu.sys
2015-02-13 13:50:48 ----A---- C:\Windows\svjxxrf.txt
2015-02-13 13:43:43 ----A---- C:\Windows\SYSWOW64\drivers\lcdxr.sys
2015-02-13 13:37:21 ----A---- C:\Windows\SYSWOW64\drivers\lkdj.sys
2015-02-13 13:37:21 ----A---- C:\Windows\iqcf.txt
2015-02-13 13:00:29 ----A---- C:\Windows\SYSWOW64\drivers\pkoo.sys
2015-02-12 21:38:57 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2015-02-12 21:38:57 ----A---- C:\Windows\system32\mstscax.dll
2015-02-12 19:16:14 ----A---- C:\Windows\system32\TSWbPrxy.exe
2015-02-12 00:01:27 ----A---- C:\Windows\system32\TsUsbGDCoInstaller.dll
2015-02-12 00:01:22 ----A---- C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2015-02-12 00:01:22 ----A---- C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2015-02-12 00:01:22 ----A---- C:\Windows\system32\drivers\TsUsbFlt.sys
2015-02-12 00:01:20 ----A---- C:\Windows\SYSWOW64\wksprtPS.dll
2015-02-12 00:01:20 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2015-02-12 00:01:20 ----A---- C:\Windows\SYSWOW64\MsRdpWebAccess.dll
2015-02-12 00:01:20 ----A---- C:\Windows\system32\wksprtPS.dll
2015-02-12 00:01:20 ----A---- C:\Windows\system32\wksprt.exe
2015-02-12 00:01:20 ----A---- C:\Windows\system32\tsgqec.dll
2015-02-12 00:01:20 ----A---- C:\Windows\system32\MsRdpWebAccess.dll
2015-02-12 00:01:19 ----A---- C:\Windows\SYSWOW64\mstsc.exe
2015-02-12 00:01:19 ----A---- C:\Windows\system32\mstsc.exe
2015-02-12 00:01:18 ----A---- C:\Windows\SYSWOW64\rdvidcrl.dll
2015-02-12 00:01:18 ----A---- C:\Windows\system32\rdvidcrl.dll
2015-02-11 23:53:25 ----D---- C:\Config.Msi
2015-02-11 23:50:23 ----A---- C:\Windows\SYSWOW64\wdi.dll
2015-02-11 23:50:23 ----A---- C:\Windows\system32\wdi.dll
2015-02-11 23:50:23 ----A---- C:\Windows\system32\powertracker.dll
2015-02-11 23:50:23 ----A---- C:\Windows\system32\perftrack.dll
2015-02-11 23:50:22 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-02-11 23:50:22 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-02-11 23:50:21 ----A---- C:\Windows\system32\jscript9diag.dll
2015-02-11 23:50:21 ----A---- C:\Windows\system32\jscript9.dll
2015-02-11 19:27:38 ----D---- C:\Users\Petr\AppData\Roaming\Imminent
2015-02-11 19:17:37 ----D---- C:\AdwCleaner
2015-02-11 19:02:06 ----D---- C:\Program Files\trend micro
2015-02-11 18:07:48 ----D---- C:\Program Files (x86)\trend micro
2015-02-11 18:07:19 ----A---- C:\Windows\system32\invagent.dll
2015-02-11 18:07:19 ----A---- C:\Windows\system32\generaltel.dll
2015-02-11 18:07:19 ----A---- C:\Windows\system32\devinv.dll
2015-02-11 18:07:19 ----A---- C:\Windows\system32\appraiser.dll
2015-02-11 18:07:19 ----A---- C:\Windows\system32\aitstatic.exe
2015-02-11 18:07:19 ----A---- C:\Windows\system32\aeinv.dll
2015-02-11 18:07:18 ----A---- C:\Windows\system32\aepdu.dll
2015-02-11 18:07:17 ----A---- C:\Windows\system32\aepic.dll
2015-02-11 18:07:08 ----A---- C:\Windows\system32\schannel.dll
2015-02-11 18:07:07 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-02-11 18:07:06 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-02-11 18:07:05 ----A---- C:\Windows\system32\kerberos.dll
2015-02-11 18:07:03 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-02-11 18:07:02 ----A---- C:\Windows\system32\msv1_0.dll
2015-02-11 18:07:01 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-02-11 18:07:01 ----A---- C:\Windows\system32\wdigest.dll
2015-02-11 18:07:01 ----A---- C:\Windows\system32\ncrypt.dll
2015-02-11 18:06:59 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-02-11 18:06:59 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-02-11 18:06:59 ----A---- C:\Windows\system32\TSpkg.dll
2015-02-11 18:06:58 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-02-11 18:06:58 ----A---- C:\Windows\system32\credssp.dll
2015-02-11 18:06:38 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-02-11 18:06:38 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-02-11 18:06:37 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-02-11 18:06:37 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-02-11 18:06:37 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-02-11 18:06:36 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-02-11 18:06:35 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-02-11 18:06:35 ----A---- C:\Windows\system32\iernonce.dll
2015-02-11 18:06:35 ----A---- C:\Windows\system32\ie4uinit.exe
2015-02-11 18:06:34 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-02-11 18:06:34 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-02-11 18:06:33 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 18:06:32 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-02-11 18:06:31 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-02-11 18:06:31 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-02-11 18:06:29 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-02-11 18:06:29 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-02-11 18:06:28 ----A---- C:\Windows\system32\urlmon.dll
2015-02-11 18:06:28 ----A---- C:\Windows\system32\iedkcs32.dll
2015-02-11 18:06:27 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-02-11 18:06:27 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 18:06:26 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-02-11 18:06:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-02-11 18:06:25 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 18:06:24 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-02-11 18:06:23 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-02-11 18:06:23 ----A---- C:\Windows\system32\msfeeds.dll
2015-02-11 18:06:23 ----A---- C:\Windows\system32\dxtrans.dll
2015-02-11 18:06:22 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-02-11 18:06:22 ----A---- C:\Windows\system32\iesetup.dll
2015-02-11 18:06:21 ----A---- C:\Windows\system32\ieapfltr.dll
2015-02-11 18:06:20 ----A---- C:\Windows\system32\iertutil.dll
2015-02-11 18:06:18 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-02-11 18:06:17 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-02-11 18:06:17 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-02-11 18:06:17 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-02-11 18:06:17 ----A---- C:\Windows\system32\jsproxy.dll
2015-02-11 18:06:17 ----A---- C:\Windows\system32\ieUnatt.exe
2015-02-11 18:06:16 ----A---- C:\Windows\system32\dxtmsft.dll
2015-02-11 18:06:15 ----A---- C:\Windows\system32\ieui.dll
2015-02-11 18:06:15 ----A---- C:\Windows\system32\ieframe.dll
2015-02-11 18:06:14 ----A---- C:\Windows\system32\mshtmled.dll
2015-02-11 18:06:12 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-02-11 18:06:11 ----A---- C:\Windows\system32\vbscript.dll
2015-02-11 18:06:10 ----A---- C:\Windows\system32\wininet.dll
2015-02-11 18:06:09 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-02-11 18:06:08 ----A---- C:\Windows\system32\msrating.dll
2015-02-11 18:06:07 ----A---- C:\Windows\system32\mshtml.dll
2015-02-11 18:04:58 ----A---- C:\Windows\system32\WindowsCodecs.dll
2015-02-11 18:04:56 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2015-02-11 17:52:37 ----A---- C:\Windows\system32\lsasrv.dll
2015-02-11 17:52:37 ----A---- C:\Windows\system32\drivers\cng.sys
2015-02-11 17:52:36 ----A---- C:\Windows\system32\adtschema.dll
2015-02-11 17:52:35 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-02-11 17:52:35 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-02-11 17:52:35 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-02-11 17:52:34 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-02-11 17:52:34 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-02-11 17:52:34 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-02-11 17:52:34 ----A---- C:\Windows\system32\sspisrv.dll
2015-02-11 17:52:34 ----A---- C:\Windows\system32\sspicli.dll
2015-02-11 17:52:34 ----A---- C:\Windows\system32\secur32.dll
2015-02-11 17:52:34 ----A---- C:\Windows\system32\lsass.exe
2015-02-11 17:52:34 ----A---- C:\Windows\system32\auditpol.exe
2015-02-11 17:52:32 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-02-11 17:52:31 ----A---- C:\Windows\system32\msobjs.dll
2015-02-11 17:52:29 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-02-11 17:52:29 ----A---- C:\Windows\system32\msaudite.dll
2015-02-11 17:51:34 ----A---- C:\Windows\system32\crypt32.dll
2015-02-11 17:51:32 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2015-02-11 17:50:21 ----A---- C:\Windows\system32\oleaut32.dll
2015-02-11 17:50:20 ----A---- C:\Windows\SYSWOW64\oleaut32.dll
2015-02-11 17:49:07 ----A---- C:\Windows\system32\scesrv.dll
2015-02-11 17:49:06 ----A---- C:\Windows\SYSWOW64\scesrv.dll
2015-02-11 17:45:22 ----A---- C:\Windows\system32\ntoskrnl.exe
2015-02-11 17:45:17 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2015-02-11 17:45:16 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2015-02-11 17:45:10 ----A---- C:\Windows\system32\srcore.dll
2015-02-11 17:45:10 ----A---- C:\Windows\system32\rstrui.exe
2015-02-11 17:45:08 ----A---- C:\Windows\SYSWOW64\srclient.dll
2015-02-11 17:45:08 ----A---- C:\Windows\system32\srclient.dll
2015-02-11 17:37:54 ----D---- C:\Program Files\CCleaner
2015-02-11 17:34:55 ----A---- C:\Windows\system32\win32k.sys
2015-02-08 16:26:55 ----A---- C:\Windows\system32\javaws.exe
2015-02-08 16:26:33 ----A---- C:\Windows\system32\WindowsAccessBridge-64.dll
2015-02-08 16:26:33 ----A---- C:\Windows\system32\javaw.exe
2015-02-08 16:26:33 ----A---- C:\Windows\system32\java.exe
2015-02-08 16:26:11 ----D---- C:\Program Files\Java
2015-02-07 08:21:29 ----D---- C:\Program Files (x86)\pazera-software

======List of files/folders modified in the last 1 month======

2015-02-15 09:22:45 ----D---- C:\Windows\Prefetch
2015-02-15 09:12:24 ----D---- C:\ProgramData\NVIDIA
2015-02-14 22:13:49 ----D---- C:\Windows\system32\config
2015-02-14 20:52:34 ----D---- C:\Windows\system32\drivers
2015-02-14 20:46:03 ----D---- C:\Windows
2015-02-14 20:46:03 ----A---- C:\Windows\system.ini
2015-02-14 20:45:56 ----D---- C:\Windows\system32\drivers\etc
2015-02-14 20:34:08 ----D---- C:\Windows\SYSWOW64\drivers
2015-02-14 20:34:08 ----D---- C:\Windows\SysWOW64
2015-02-14 20:34:08 ----D---- C:\Windows\AppPatch
2015-02-14 20:34:07 ----D---- C:\Program Files (x86)\Common Files
2015-02-14 20:22:01 ----SHD---- C:\System Volume Information
2015-02-14 16:59:19 ----D---- C:\Windows\System32
2015-02-14 16:59:19 ----D---- C:\Windows\inf
2015-02-14 16:59:19 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-02-14 11:41:00 ----D---- C:\Windows\system32\wdi
2015-02-14 08:11:22 ----RD---- C:\Program Files (x86)
2015-02-14 08:11:13 ----D---- C:\ProgramData
2015-02-13 17:51:58 ----D---- C:\Windows\system32\catroot2
2015-02-13 12:28:33 ----D---- C:\Windows\rescache
2015-02-13 12:07:31 ----D---- C:\Windows\Microsoft.NET
2015-02-12 22:36:47 ----D---- C:\Windows\winsxs
2015-02-12 22:36:41 ----D---- C:\Windows\SYSWOW64\cs-CZ
2015-02-12 22:36:41 ----D---- C:\Windows\system32\cs-CZ
2015-02-12 22:34:43 ----D---- C:\Windows\debug
2015-02-12 00:02:54 ----D---- C:\Windows\SYSWOW64\wbem
2015-02-12 00:02:54 ----D---- C:\Windows\SYSWOW64\en-US
2015-02-12 00:02:54 ----D---- C:\Windows\system32\en-US
2015-02-12 00:02:53 ----D---- C:\Windows\system32\wbem
2015-02-12 00:02:53 ----D---- C:\Windows\system32\drivers\en-US
2015-02-12 00:02:52 ----D---- C:\Windows\tracing
2015-02-12 00:02:52 ----D---- C:\Windows\system32\DriverStore
2015-02-12 00:01:14 ----SHD---- C:\Windows\Installer
2015-02-11 23:57:03 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2015-02-11 23:35:15 ----SD---- C:\Windows\system32\CompatTel
2015-02-11 23:35:14 ----D---- C:\Windows\system32\appraiser
2015-02-11 23:35:12 ----D---- C:\Program Files\Internet Explorer
2015-02-11 23:35:07 ----D---- C:\Program Files (x86)\Internet Explorer
2015-02-11 23:35:03 ----D---- C:\Windows\PolicyDefinitions
2015-02-11 23:31:13 ----D---- C:\Windows\system32\MRT
2015-02-11 23:25:35 ----A---- C:\Windows\system32\MRT.exe
2015-02-11 22:06:13 ----RD---- C:\Program Files (x86)\Skype
2015-02-11 22:06:13 ----D---- C:\Windows\Tasks
2015-02-11 19:24:32 ----D---- C:\Windows\system32\Tasks
2015-02-11 19:02:06 ----D---- C:\Program Files
2015-02-11 17:52:17 ----D---- C:\Users\Petr\AppData\Roaming\Skype
2015-02-11 17:52:17 ----D---- C:\Users\Petr\AppData\Roaming\PhotoScape
2015-02-11 17:52:17 ----D---- C:\Users\Petr\AppData\Roaming\inkscape
2015-02-11 17:52:17 ----D---- C:\Users\Petr\AppData\Roaming\DAEMON Tools Lite
2015-02-11 17:52:17 ----D---- C:\ProgramData\BlueStacksSetup
2015-02-11 17:52:17 ----D---- C:\Program Files (x86)\Steam
2015-02-11 17:52:17 ----D---- C:\Program Files (x86)\PDFCreator
2015-02-11 17:51:39 ----D---- C:\Windows\Panther
2015-02-11 17:51:33 ----D---- C:\Windows\Logs
2015-02-11 17:44:59 ----D---- C:\Program Files (x86)\Opera
2015-02-11 17:19:29 ----A---- C:\Windows\win.ini
2015-02-08 18:24:40 ----RD---- C:\Users
2015-02-08 16:10:36 ----D---- C:\Temp
2015-02-06 17:39:34 ----RSD---- C:\Windows\Fonts
2015-02-05 19:46:41 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2015-02-02 19:50:29 ----D---- C:\ProgramData\HILTI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-11-23 65776]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-11-23 267632]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-10-29 834544]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2014-11-23 93568]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2014-11-23 1050432]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2014-11-23 436624]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2014-11-23 29208]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2014-11-23 83280]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2014-11-23 116728]
R2 BstHdDrv;BlueStacks Hypervisor; \??\C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [2014-08-13 122072]
R3 AVerAF35;AVerMedia A835 USB DVB-T; C:\Windows\System32\Drivers\AVerAF35.sys [2010-03-16 677632]
R3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K; C:\Windows\system32\DRIVERS\e1k62x64.sys [2010-04-05 301232]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-09-07 2484072]
R3 LVUSBS64;Logitech USB Monitor Filter; C:\Windows\system32\DRIVERS\LVUSBS64.sys [2008-07-26 50072]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 12288]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 EfiInvoker;Efi Invoker Service; \??\C:\Windows\SysWOW64\Drivers\invoker64.sys [2008-08-11 14104]
S3 FlexBios;FlexBIOS Service; \??\C:\Windows\SysWOW64\Drivers\FlexBios.sys [2008-08-11 13592]
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
S3 lvpepf64;Volume Adapter; C:\Windows\system32\DRIVERS\lv302a64.sys [2008-07-26 15768]
S3 LVRS64;Logitech RightSound Filter Driver; C:\Windows\system32\DRIVERS\lvrs64.sys [2008-07-26 790424]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2007-09-17 29184]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 PID_PEPI;Logitech QuickCam IM(PID_PEPI); C:\Windows\system32\DRIVERS\LV302V64.SYS [2008-07-26 2624408]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 SMARTMouseFilterx64;HID-compliant mouse; C:\Windows\system32\DRIVERS\SMARTMouseFilterx64.sys [2011-07-13 13168]
S3 SMARTVHidMiniVistaAmd64;SMART HID Device; C:\Windows\system32\DRIVERS\SMARTVHidMiniVistaAmd64.sys [2011-07-13 16368]
S3 SMARTVTabletPCx64;SMART Virtual TabletPC; C:\Windows\system32\DRIVERS\SMARTVTabletPCx64.sys [2011-07-13 24944]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\Windows\system32\DRIVERS\ss_bbus.sys [2010-04-27 127488]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\Windows\system32\DRIVERS\ss_bmdfl.sys [2010-04-27 18944]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\Windows\system32\DRIVERS\ss_bmdm.sys [2010-04-27 161280]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 TFsExDisk;TFsExDisk; \??\C:\Windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;YunOS USB Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]
S4 VBoxAswDrv;VBoxAsw Support Driver; \??\C:\Program Files\Alwil Software\Avast5\ng\vbox\VBoxAswDrv.sys [2014-11-23 271752]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-19 81088]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2014-11-23 50344]
R2 AVerRemote;AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [2010-04-28 348160]
R2 AVerScheduleService;AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [2011-04-01 403456]
R2 BstHdAndroidSvc;BlueStacks Android Service; C:\Program Files (x86)\BlueStacks\HD-Service.exe [2014-08-13 409304]
R2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [2014-08-13 384728]
R2 BstHdUpdaterSvc;BlueStacks Updater Service; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [2014-08-13 777944]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 Hilti PROFIS AutoUpdate Service;Hilti PROFIS AutoUpdate Service; C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe [2014-09-01 213504]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [2010-08-16 73728]
R2 MDM;Machine Debug Manager; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service; C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [2009-05-14 4901888]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-07-14 383008]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [2006-12-19 81920]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-09-01 235624]
R2 TeamViewer9;TeamViewer 9; C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [2014-02-05 4915040]
R3 AvastVBoxSvc;AvastVBox COM Service; C:\Program Files\Alwil Software\Avast5\ng\vbox\AvastVBoxSVC.exe [2014-11-23 4012248]
R3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [2008-01-22 275752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18 107912]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2014-12-11 315496]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05 267440]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe [2010-11-03 85096]
S3 DialComService;DIAL Communication Service; C:\Program Files (x86)\DIAL GmbH\DIAL Communication Framework\DialComService.exe [2011-02-13 1623552]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18 107912]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-01-12 114688]
S3 NBService;NBService; C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe [2008-04-08 800040]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2015-01-23 834752]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-10-07 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]

-----------------EOF-----------------

[cernohous13]

Stáhni OTM z jednoho odkazu a rozbal nejlépe na plochu.
http://oldtimer.geekstogo.com/OTM.exe
http://www.itxassociates.com/OT-Tools/OTM.exe

Spusť program „OTM.exe“ (pro Vistu a Win7 – pravým a „Run As Administrator“).
Do okna pod žlutou čáru vlož celý text zeleným písmem ze „Scriptu“

Klikni na červené „MoveIt!“

Při nabídce restartu „YES“
a log potom najdeš v C:\_OTM\MovedFiles\ - dej mi ho sem na kontrolu

Script OTM

Kód: Vybrat vše

:Commands
[resethosts]
[emptytemp]
[emptyflash]
[emptyjava]
[clearallrestorepoints]

:Files
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp /s

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-
"CCleaner Monitoring"=-
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SSBkgdUpdate"=-
"PROFIS AutoUpdate"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]

:Services
NMIndexingService
gupdate
gupdatem
NBService

[Petrdoktor]

OTM zahlasil nějakou chybu a pak to se restartovalo, posílám výpis...

Files moved on Reboot...
C:\Users\Petr\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Petr\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
C:\Users\Petra\AppData\Local\Temp\Skype\DbTemp\temp-lwbIJZblP0QNtYx1S0nWuuuE moved successfully.
C:\Users\Petra\AppData\Local\Temp\Skype\DbTemp\temp-tbVQoxnE6EWCuRiZ6Oamx4o8 moved successfully.
C:\Users\Petra\AppData\Local\Temp\AdskCleanup.0001.dir.0000\~de86ff.tmp moved successfully.
C:\Users\Petra\AppData\Local\Temp\AdskCleanup.0001.dir.0000\~df394b.tmp moved successfully.
C:\Users\Petra\AppData\Local\Temp\AdskCleanup.0001.dir.0000\~efe2.tmp moved successfully.
C:\Users\Petra\AppData\Local\Temp\AdskCleanup.0001 moved successfully.
C:\Users\Petra\AppData\Local\Temp\AHI4EA5.tmp moved successfully.
C:\Users\Petra\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Petra\AppData\Local\Temp\REDO.ac$ moved successfully.
C:\Users\Petra\AppData\Local\Temp\UNDO.ac$ moved successfully.
C:\Users\Petra\AppData\Local\Temp\ws_Crypto_20150215_0.log moved successfully.
C:\Users\Petra\AppData\Local\Temp\ws_NET_20150215_0.log moved successfully.
File move failed. C:\Users\Petra\AppData\Local\Temp\~DF08871DB64EA71408.TMP scheduled to be moved on reboot.
C:\Users\Petra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS0000.tmp moved successfully.
C:\Users\Petra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSXYO2FF\AdLoader[1].htm moved successfully.
C:\Users\Petra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSXYO2FF\chatadwidget[1].htm moved successfully.
C:\Users\Petra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSXYO2FF\home[1].htm moved successfully.
C:\Users\Petra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q30I8QBE\co[1].js moved successfully.
C:\Users\Petra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q30I8QBE\rexdot[3].js moved successfully.
C:\Users\Petra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DAEW4OYU\DU1Ia251o0y[1].htm moved successfully.

Registry entries deleted on Reboot...