Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Jak zjistit v PC keylogger?

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
Lorgan
Návštěvník
Návštěvník
Příspěvky: 51
Registrován: 19 lis 2013 12:24
Bydliště: Přístup k údajům o bydlení vyžaduje bezpečnostní prověrku pátého stupně :P

Jak zjistit v PC keylogger?

#1 Příspěvek od Lorgan »

Dobrý den,

mám důvod si myslet, že mi byl na NTB nainstalován keylogger. Exituje nějaký program, kterým by se přítomnost keyloggeru dala zjistit?
Předem děkuji za odpověď :).
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119677
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Jak zjistit v PC keylogger?

#2 Příspěvek od Rudy »

Zdravím!
Měl by být vidět ve správci úloh, musíte ale vědět, jak se proces jmenuje. Dejte log FRST: http://forum.viry.cz/viewtopic.php?f=13&t=133100 .
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Lorgan
Návštěvník
Návštěvník
Příspěvky: 51
Registrován: 19 lis 2013 12:24
Bydliště: Přístup k údajům o bydlení vyžaduje bezpečnostní prověrku pátého stupně :P

Re: Jak zjistit v PC keylogger?

#3 Příspěvek od Lorgan »

Zdravím,

bohužel se mi nepodařilo stáhnout FRST launcher, i když jsem měl vypnutou všechnu ochranu, kterou jsem měl. Pořád rto píše: Blocked: may contain a virus or spyware. Omlouvám se, že s tím obtěžuji, ale nenapadá mne řešení...
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119677
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Jak zjistit v PC keylogger?

#4 Příspěvek od Rudy »

Tak zkuste RSIT: http://forum.viry.cz/viewtopic.php?f=13&t=130786 .
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Lorgan
Návštěvník
Návštěvník
Příspěvky: 51
Registrován: 19 lis 2013 12:24
Bydliště: Přístup k údajům o bydlení vyžaduje bezpečnostní prověrku pátého stupně :P

Re: Jak zjistit v PC keylogger?

#5 Příspěvek od Lorgan »

Děkuji, RSIT se stáhnul naprosto v pořádku.

Logfile of random's system information tool 1.10 (written by random/random)
Run by ThinkPad at 2015-03-13 22:17:12
Microsoft Windows 8.1 Pro
System drive C: has 39 GB (18%) free of 220 GB
Total RAM: 7603 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:17:14, on 13. 3. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17416)
Boot mode: Normal

Running processes:
C:\Users\ThinkPad\AppData\Local\Common\csag.exe
C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
C:\WINDOWS\SysWOW64\WScript.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Lenovo Fingerprint Reader\x86\IEWebSiteLogon.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
C:\Program Files (x86)\Terraria\Terraria.exe
C:\Program Files\trend micro\ThinkPad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.reerd.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: TrueSuite Browser Helper Object - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files\Lenovo Fingerprint Reader\x86\IEBHO.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll
O2 - BHO: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Razer Synapse] "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
O4 - HKLM\..\Run: [mslralSrv] "C:\WINDOWS\system32\mslral.vbe" msbvbb msqeelq
O4 - HKLM\..\Run: [MSStp] C:\WINDOWS\inf\msstp.vbe
O4 - HKLM\..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [AppEx Accelerator UI] C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe -h
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\PROGRAM FILES\CCLEANER\CCLEANER64.EXE" /MONITOR
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [cscommon] C:\Users\ThinkPad\AppData\Local\Common\csag.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_16_0_0_305_Plugin.exe -update plugin
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\WINDOWS\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Service Host (Avira.OE.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
O23 - Service: @oem18.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service (BcmBtRSupport) - Unknown owner - C:\WINDOWS\system32\BtwRSupportService.exe (file missing)
O23 - Service: Conexant Audio Message Service (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: EasyAntiCheat - EasyAntiCheat Ltd - C:\WINDOWS\system32\EasyAntiCheat.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: TrueSuiteService (FPLService) - AuthenTec, Inc - C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @oem9.inf,%ibm.svcDesc0%;Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe (file missing)
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Razer Game Scanner (Razer Game Scanner Service) - Unknown owner - C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Spyware Terminator 2012 Realtime Shield Service (ST2012_Svc) - Crawler.com - C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: TrueAPI Service component (TrueService) - AuthenTec, Inc. - C:\Program Files\Common Files\AuthenTec\TrueService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9731 bytes

======Listing Processes======





wininit.exe

C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
"C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe"
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\atiesrxx.exe
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-cbf094f2-8943-4519-a3fd-531e21e04cac -SystemEventPortName:HostProcess-c5eaf500-8d43-462c-9034-ad8ca878250a -IoCancelEventPortName:HostProcess-b4df4cd6-1deb-499a-85b6-f002a06110f8 -NonStateChangingEventPortName:HostProcess-5fee4a2b-4319-4286-b6fb-f8d89463a3e3 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:38270b49-2946-45e4-a642-612999eb325d -DeviceGroupId:
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k WbioSvcGroup
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe" /service
"C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe" /service
C:\Windows\system32\CxAudMsg64.exe
dashost.exe {57cd825a-1cb6-436c-adc027489125fd9b}
"C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe"
"C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe"
"C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe"
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\unsecapp.exe -Embedding
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe"
"C:\Program Files\Common Files\AuthenTec\TrueService.exe"
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_00001f78

C:\WINDOWS\System32\WinLogon.exe -SpecialSession
-hiberboot
atieclxx
taskhostex.exe
C:\Program Files\LENOVO\HOTKEY\tpnumlkd.exe
C:\PROGRA~1\Lenovo\HOTKEY\MKRMSG.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.MediaKey
C:\PROGRA~1\Lenovo\HOTKEY\TPOSD.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
"\Program Files\Synaptics\SynTP\SynTPEnh.exe"
C:\WINDOWS\Explorer.EXE
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
/ChildServer
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
"C:\Program Files\Lenovo\HOTKEY\extapsup.exe"
"C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe"
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe"
"C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe" -h
"C:\Users\ThinkPad\AppData\Local\Common\csag.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
"C:\WINDOWS\System32\WScript.exe" "C:\Windows\System32\mslral.vbe" msbvbb msqeelq
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding
AdblockPlusEngine.exe cs-CZ
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3596 CREDAT:78849 /prefetch:2
"C:\Program Files\Lenovo Fingerprint Reader\x86\IEWebSiteLogon.exe"
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3596 CREDAT:333058 /prefetch:2
"C:\Program Files\Lenovo Fingerprint Reader\TouchControl.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"

C:\WINDOWS\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe" /showMiniGui
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=7660.1a780040.1169079537 "C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" E7CF176E110C211B 7660 "\\.\pipe\gecko-crash-server-pipe.7660" plugin
"C:\WINDOWS\SYSTEM32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe" --proxy-stub-channel=Flash11044.69EA0BB8.16137 --host-broker-channel=Flash11044.69EA0BB8.13710 --host-pid=11044 --host-npapi-version=28 --plugin-path="C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32_16_0_0_305.dll"
"C:\WINDOWS\SYSTEM32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe" --channel=11704.0100F90C.735602048 --proxy-stub-channel=Flash11044.69EA0BB8.16137 --plugin-path="C:\WINDOWS\SYSTEM32\Macromed\Flash\NPSWF32_16_0_0_305.dll" --host-npapi-version=28 --type=renderer
"C:\Program Files (x86)\Terraria\Terraria.exe"
"C:\WINDOWS\system32\SnippingTool.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\WINDOWS\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\ThinkPad\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\WINDOWS\tasks\Synaptics TouchPad Enhancements.job - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\ThinkPad\AppData\Roaming\Mozilla\Firefox\Profiles\q1zt48l3.default

prefs.js - "browser.startup.homepage" - "https://www.google.cz/?gws_rd=ssl"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 16.0.0.305 Plugin
"Path"=C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@authentec.com/ffwloplugin]
"Description"=
"Path"=C:\Program Files\Lenovo Fingerprint Reader\npffwloplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.31.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.31.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 16.0.0.305 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll


C:\Users\ThinkPad\AppData\Roaming\Mozilla\Firefox\Profiles\q1zt48l3.default\extensions\
abs@avira.com

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8590886E-EC8C-43C1-A32C-E4C2B0B6395B}]
TrueSuite Browser Helper Object - C:\Program Files\Lenovo Fingerprint Reader\IEBHO.DLL [2013-08-07 2518312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14 2117216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFCB3198-32F3-4E8B-9539-4324694ED664}]
Adblock Plus for IE Browser Helper Object - C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2015-02-25 728840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-24 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8590886E-EC8C-43C1-A32C-E4C2B0B6395B}]
TrueSuite Browser Helper Object - C:\Program Files\Lenovo Fingerprint Reader\x86\IEBHO.dll [2013-08-07 2353448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14 1709152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-24 172968]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFCB3198-32F3-4E8B-9539-4324694ED664}]
Adblock Plus for IE Browser Helper Object - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-02-25 617736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"LenovoOptMouseUpdate"=C:\Program Files\Lenovo\HOTKEY\extapsup.exe [2013-06-20 255480]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SACpl.exe [2012-06-13 1647616]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [2012-06-14 887968]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-04-24 2963184]
"SpywareTerminatorShield"=C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2012-09-07 2777296]
"SpywareTerminatorUpdater"=C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [2014-11-04 3681656]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AppEx Accelerator UI"=C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [2012-05-22 1000288]
"CCleaner Monitoring"=C:\PROGRAM FILES\CCLEANER\CCLEANER64.EXE [2014-11-21 7063832]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]
"cscommon"=C:\Users\ThinkPad\AppData\Local\Common\csag.exe [2015-03-02 1342464]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"=C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_16_0_0_305_Plugin.exe [2015-02-06 960688]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [2014-07-04 766688]
""= []
"Razer Synapse"=C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [2014-11-03 585536]
"mslralSrv"=C:\WINDOWS\system32\mslral.vbe msbvbb msqeelq []
"MSStp"=C:\WINDOWS\inf\msstp.vbe [2014-03-05 1584]
"Avira Systray"=C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [2015-01-19 126712]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2015-03-12 703280]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-03-13 22:14:36 ----D---- C:\Program Files\trend micro
2015-03-13 22:14:35 ----D---- C:\rsit
2015-03-11 21:19:30 ----D---- C:\Users\ThinkPad\AppData\Roaming\OpenOffice
2015-03-11 21:17:11 ----D---- C:\Program Files (x86)\OpenOffice 4
2015-03-11 14:54:36 ----D---- C:\Program Files (x86)\Bf2SP64 2.32
2015-03-11 13:29:54 ----D---- C:\Skladiště her bez ladu a skladu
2015-03-11 13:19:35 ----A---- C:\WINDOWS\SYSWOW64\SHCore.dll
2015-03-11 13:19:35 ----A---- C:\WINDOWS\system32\SHCore.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\lpk.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\fontsub.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\dciman32.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\atmlib.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\atmfd.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\lpk.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\fontsub.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\dciman32.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\atmlib.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\atmfd.dll
2015-03-11 13:19:21 ----A---- C:\WINDOWS\SYSWOW64\photowiz.dll
2015-03-11 13:19:21 ----A---- C:\WINDOWS\system32\photowiz.dll
2015-03-11 13:19:03 ----A---- C:\WINDOWS\system32\win32spl.dll
2015-03-11 13:19:03 ----A---- C:\WINDOWS\system32\pmcsnap.dll
2015-03-11 13:19:03 ----A---- C:\WINDOWS\system32\localspl.dll
2015-03-11 13:19:00 ----A---- C:\WINDOWS\system32\puiobj.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\puiobj.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\puiapi.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\prnntfy.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\DafPrintProvider.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\compstui.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\puiapi.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\prnntfy.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\ppcsnap.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\DafPrintProvider.dll
2015-03-11 13:18:58 ----A---- C:\WINDOWS\SYSWOW64\printui.exe
2015-03-11 13:18:58 ----A---- C:\WINDOWS\SYSWOW64\findnetprinters.dll
2015-03-11 13:18:58 ----A---- C:\WINDOWS\system32\printui.exe
2015-03-11 13:18:58 ----A---- C:\WINDOWS\system32\findnetprinters.dll
2015-03-11 13:18:58 ----A---- C:\WINDOWS\system32\compstui.dll
2015-03-11 13:18:56 ----A---- C:\WINDOWS\system32\win32k.sys
2015-03-11 13:18:55 ----A---- C:\WINDOWS\system32\schannel.dll
2015-03-11 13:18:54 ----A---- C:\WINDOWS\SYSWOW64\schannel.dll
2015-03-11 13:18:53 ----A---- C:\WINDOWS\SYSWOW64\StorageContextHandler.dll
2015-03-11 13:18:53 ----A---- C:\WINDOWS\system32\StorageContextHandler.dll
2015-03-11 13:18:51 ----A---- C:\WINDOWS\SYSWOW64\msftedit.dll
2015-03-11 13:18:51 ----A---- C:\WINDOWS\system32\msftedit.dll
2015-03-11 13:18:49 ----A---- C:\WINDOWS\SYSWOW64\authui.dll
2015-03-11 13:18:49 ----A---- C:\WINDOWS\system32\authui.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\SYSWOW64\WSShared.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\system32\WSShared.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-03-11 13:18:44 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-11 13:18:44 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.dll
2015-03-11 13:18:44 ----A---- C:\WINDOWS\system32\WSReset.exe
2015-03-11 13:18:44 ----A---- C:\WINDOWS\system32\WSCollect.exe
2015-03-11 13:18:19 ----A---- C:\WINDOWS\SYSWOW64\calc.exe
2015-03-11 13:18:19 ----A---- C:\WINDOWS\system32\calc.exe
2015-03-11 13:18:17 ----A---- C:\WINDOWS\SYSWOW64\dwmcore.dll
2015-03-11 13:18:17 ----A---- C:\WINDOWS\system32\dwmcore.dll
2015-03-11 13:18:11 ----A---- C:\WINDOWS\system32\drivers\WdFilter.sys
2015-03-11 13:18:10 ----A---- C:\WINDOWS\system32\drivers\WdNisDrv.sys
2015-03-11 13:18:10 ----A---- C:\WINDOWS\system32\drivers\WdBoot.sys
2015-03-11 13:18:07 ----A---- C:\WINDOWS\SYSWOW64\winshfhc.dll
2015-03-11 13:18:07 ----A---- C:\WINDOWS\system32\winshfhc.dll
2015-03-11 13:17:29 ----A---- C:\WINDOWS\system32\drivers\ndis.sys
2015-03-11 13:17:26 ----A---- C:\WINDOWS\system32\atlthunk.dll
2015-03-11 13:17:25 ----A---- C:\WINDOWS\SYSWOW64\D3DCompiler_47.dll
2015-03-11 13:17:25 ----A---- C:\WINDOWS\SYSWOW64\atlthunk.dll
2015-03-11 13:17:25 ----A---- C:\WINDOWS\system32\D3DCompiler_47.dll
2015-03-11 13:17:24 ----A---- C:\WINDOWS\SYSWOW64\mfc42u.dll
2015-03-11 13:17:24 ----A---- C:\WINDOWS\system32\mfc42u.dll
2015-03-11 13:17:23 ----A---- C:\WINDOWS\SYSWOW64\mfc42.dll
2015-03-11 13:17:23 ----A---- C:\WINDOWS\system32\mfc42.dll
2015-03-11 13:17:20 ----AC---- C:\WINDOWS\system32\drivers\bthport.sys
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\fsquirt.exe
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\rfcomm.sys
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\hidbth.sys
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\BTHUSB.SYS
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\bthenum.sys
2015-03-11 13:17:10 ----A---- C:\WINDOWS\system32\mshtml.dll
2015-03-11 13:17:07 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2015-03-11 13:17:05 ----A---- C:\WINDOWS\system32\jscript9.dll
2015-03-11 13:17:03 ----A---- C:\WINDOWS\system32\ieframe.dll
2015-03-11 13:17:01 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2015-03-11 13:16:57 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2015-03-11 13:16:57 ----A---- C:\WINDOWS\system32\wininet.dll
2015-03-11 13:16:56 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2015-03-11 13:16:56 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2015-03-11 13:16:56 ----A---- C:\WINDOWS\system32\iertutil.dll
2015-03-11 13:16:55 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2015-03-11 13:16:55 ----A---- C:\WINDOWS\system32\urlmon.dll
2015-03-11 13:16:55 ----A---- C:\WINDOWS\system32\inetcomm.dll
2015-03-11 13:16:54 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2015-03-11 13:16:54 ----A---- C:\WINDOWS\SYSWOW64\msfeeds.dll
2015-03-11 13:16:54 ----A---- C:\WINDOWS\SYSWOW64\inetcomm.dll
2015-03-11 13:16:51 ----A---- C:\WINDOWS\system32\vbscript.dll
2015-03-11 13:16:50 ----A---- C:\WINDOWS\system32\msfeeds.dll
2015-03-11 13:16:50 ----A---- C:\WINDOWS\system32\iepeers.dll
2015-03-11 13:16:50 ----A---- C:\WINDOWS\system32\dxtrans.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\webcheck.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\mshtmled.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\MshtmlDac.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\dxtrans.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\webcheck.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\MshtmlDac.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\jscript9diag.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\actxprxy.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\SYSWOW64\iepeers.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\SYSWOW64\ieapfltr.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\mshtmled.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\jscript.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2015-03-11 13:16:15 ----A---- C:\WINDOWS\SYSWOW64\WMPhoto.dll
2015-03-11 13:16:15 ----A---- C:\WINDOWS\system32\WMPhoto.dll
2015-03-11 13:16:15 ----A---- C:\WINDOWS\system32\msctf.dll
2015-03-11 13:16:14 ----A---- C:\WINDOWS\SYSWOW64\msctf.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\rfxvmt.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\rdpudd.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\rdpcorets.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\drivers\rdpvideominiport.sys
2015-03-11 13:16:12 ----A---- C:\WINDOWS\system32\ubpm.dll
2015-03-11 13:16:10 ----A---- C:\WINDOWS\SYSWOW64\WindowsCodecs.dll
2015-03-11 13:16:10 ----A---- C:\WINDOWS\system32\WindowsCodecs.dll
2015-03-11 13:16:08 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2015-03-11 13:16:08 ----A---- C:\WINDOWS\system32\shell32.dll
2015-03-11 13:15:58 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2015-03-11 13:15:57 ----A---- C:\WINDOWS\SYSWOW64\ntdll.dll
2015-03-11 13:15:57 ----A---- C:\WINDOWS\system32\ntdll.dll
2015-03-11 13:15:56 ----A---- C:\WINDOWS\explorer.exe
2015-03-11 13:15:55 ----A---- C:\WINDOWS\SYSWOW64\explorer.exe
2015-03-11 13:15:54 ----A---- C:\WINDOWS\SYSWOW64\MrmCoreR.dll
2015-03-11 13:15:54 ----A---- C:\WINDOWS\system32\MrmCoreR.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eappprxy.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eapphost.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eappgnui.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eappcfg.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eapp3hst.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eappprxy.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eapphost.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eappgnui.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eappcfg.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eapp3hst.dll
2015-03-11 13:15:52 ----A---- C:\WINDOWS\system32\LockScreenContentServer.exe
2015-03-07 13:53:51 ----D---- C:\Users\ThinkPad\AppData\Roaming\PSpad
2015-03-07 13:53:39 ----D---- C:\Program Files (x86)\PSPad editor
2015-03-06 15:14:15 ----D---- C:\Program Files (x86)\Mozilla Firefox
2015-03-05 14:02:10 ----D---- C:\Users\ThinkPad\AppData\Roaming\TeamViewer
2015-03-03 13:51:14 ----AD---- C:\ProgramData\TEMP
2015-03-03 13:51:03 ----D---- C:\Program Files (x86)\CamSpace
2015-03-02 16:57:59 ----D---- C:\Program Files (x86)\X Plugin Manager
2015-03-02 16:45:19 ----D---- C:\Program Files (x86)\X3 ModManager
2015-03-02 14:14:11 ----D---- C:\Program Files (x86)\X3CZ
2015-02-28 19:20:03 ----D---- C:\Program Files (x86)\Star Wars Jedi Knight - Jedi Academy
2015-02-28 18:32:11 ----A---- C:\TDSSKiller.3.0.0.44_28.02.2015_18.32.11_log.txt
2015-02-27 23:51:35 ----A---- C:\Program Files (x86)\Readme.txt
2015-02-27 23:51:35 ----A---- C:\Program Files (x86)\EULA.txt
2015-02-27 23:48:49 ----A---- C:\WINDOWS\unvise32.exe
2015-02-27 23:48:39 ----D---- C:\Program Files (x86)\DivX
2015-02-27 23:46:41 ----D---- C:\Program Files (x86)\Sierra
2015-02-27 12:44:18 ----D---- C:\Program Files (x86)\Mozilla Firefox.bak
2015-02-26 09:51:46 ----A---- C:\WINDOWS\system32\drivers\avnetflt.sys
2015-02-26 09:47:50 ----D---- C:\Users\ThinkPad\AppData\Roaming\Avira
2015-02-26 09:44:57 ----A---- C:\WINDOWS\system32\drivers\avkmgr.sys
2015-02-26 09:44:56 ----A---- C:\WINDOWS\system32\drivers\avipbb.sys
2015-02-26 09:44:56 ----A---- C:\WINDOWS\system32\drivers\avgntflt.sys
2015-02-26 09:41:48 ----D---- C:\ProgramData\Avira
2015-02-25 14:52:08 ----A---- C:\WINDOWS\SYSWOW64\Windows.Globalization.dll
2015-02-25 14:52:08 ----A---- C:\WINDOWS\SYSWOW64\GlobCollationHost.dll
2015-02-25 14:52:08 ----A---- C:\WINDOWS\system32\Windows.Globalization.dll
2015-02-25 14:52:08 ----A---- C:\WINDOWS\system32\GlobCollationHost.dll
2015-02-25 13:02:18 ----D---- C:\Users\ThinkPad\AppData\Roaming\wld
2015-02-22 11:09:05 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2015-02-21 23:17:21 ----D---- C:\Program Files (x86)\SpeedFan
2015-02-16 09:51:47 ----D---- C:\Program Files (x86)\DOSBox-0.74
2015-02-15 20:25:31 ----D---- C:\Program Files (x86)\Avira
2015-02-15 20:23:55 ----D---- C:\OETemp

======List of files/folders modified in the last 1 month======

2015-03-13 22:17:12 ----D---- C:\WINDOWS\Temp
2015-03-13 22:14:44 ----D---- C:\WINDOWS\Prefetch
2015-03-13 22:14:36 ----RD---- C:\Program Files
2015-03-13 22:00:00 ----D---- C:\WINDOWS\system32\sru
2015-03-13 20:21:44 ----D---- C:\WINDOWS\system32\config
2015-03-13 20:03:05 ----SHD---- C:\System Volume Information
2015-03-13 18:34:06 ----D---- C:\WINDOWS\rescache
2015-03-13 16:25:30 ----D---- C:\WINDOWS\system32\DriverStore
2015-03-13 16:24:41 ----D---- C:\WINDOWS\WinSxS
2015-03-13 16:21:37 ----D---- C:\WINDOWS\Microsoft.NET
2015-03-13 15:47:27 ----D---- C:\WINDOWS\AppReadiness
2015-03-13 13:13:43 ----D---- C:\ProgramData\Spyware Terminator
2015-03-12 21:26:07 ----D---- C:\WINDOWS\system32\drivers
2015-03-12 13:05:06 ----RD---- C:\WINDOWS\System32
2015-03-12 13:05:06 ----D---- C:\WINDOWS\Inf
2015-03-12 13:05:06 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2015-03-12 13:01:03 ----D---- C:\WINDOWS\SysWOW64
2015-03-12 12:57:13 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-11 22:42:59 ----D---- C:\WINDOWS\system32\catroot
2015-03-11 22:41:19 ----D---- C:\Windows
2015-03-11 22:41:17 ----D---- C:\Program Files\Windows Defender
2015-03-11 22:41:16 ----D---- C:\Program Files (x86)\Windows Defender
2015-03-11 22:41:15 ----D---- C:\WINDOWS\PolicyDefinitions
2015-03-11 22:41:14 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2015-03-11 22:41:14 ----D---- C:\WINDOWS\system32\cs-CZ
2015-03-11 22:41:13 ----RD---- C:\WINDOWS\ToastData
2015-03-11 22:41:11 ----D---- C:\WINDOWS\WinStore
2015-03-11 22:41:09 ----D---- C:\Program Files\Internet Explorer
2015-03-11 22:41:09 ----D---- C:\Program Files (x86)\Internet Explorer
2015-03-11 21:18:46 ----SHD---- C:\WINDOWS\Installer
2015-03-11 21:18:45 ----RSD---- C:\WINDOWS\assembly
2015-03-11 21:17:41 ----RSD---- C:\WINDOWS\Fonts
2015-03-11 21:17:11 ----RD---- C:\Program Files (x86)
2015-03-11 20:00:49 ----D---- C:\WINDOWS\CbsTemp
2015-03-11 19:51:51 ----D---- C:\WINDOWS\system32\MRT
2015-03-11 19:48:27 ----A---- C:\WINDOWS\system32\MRT.exe
2015-03-11 14:58:53 ----HD---- C:\Program Files\WindowsApps
2015-03-11 13:34:45 ----D---- C:\Program Files (x86)\Electronic Arts
2015-03-11 13:34:36 ----D---- C:\Program Files (x86)\EA Sports
2015-03-11 13:33:04 ----D---- C:\Martin
2015-03-11 13:11:50 ----D---- C:\WINDOWS\system32\catroot2
2015-03-09 15:27:42 ----D---- C:\Users\ThinkPad\AppData\Roaming\Skype
2015-03-07 00:12:03 ----D---- C:\Program Files\Steam
2015-03-05 20:38:00 ----D---- C:\Program Files (x86)\R.G. Mechanics
2015-03-05 16:14:16 ----D---- C:\WINDOWS\system32\Tasks
2015-03-04 22:24:42 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2015-03-03 13:51:14 ----HD---- C:\ProgramData
2015-03-01 09:57:36 ----D---- C:\Users\ThinkPad\AppData\Roaming\vlc
2015-02-27 23:44:43 ----D---- C:\Users\ThinkPad\AppData\Roaming\DAEMON Tools Lite
2015-02-26 09:50:11 ----D---- C:\Program Files\Adblock Plus for IE
2015-02-26 09:36:54 ----D---- C:\ProgramData\Package Cache
2015-02-25 18:10:32 ----D---- C:\WINDOWS\debug
2015-02-24 18:05:39 ----D---- C:\ProgramData\Oracle
2015-02-24 18:05:27 ----D---- C:\Program Files (x86)\Java
2015-02-24 18:05:01 ----D---- C:\Program Files (x86)\Common Files
2015-02-24 18:04:31 ----A---- C:\WINDOWS\SYSWOW64\WindowsAccessBridge-32.dll
2015-02-24 16:34:02 ----RD---- C:\Program Files (x86)\Skype
2015-02-24 16:33:38 ----D---- C:\ProgramData\Skype
2015-02-23 17:09:27 ----D---- C:\Users\ThinkPad\AppData\Roaming\My Battle for Middle-earth(tm) II Files
2015-02-19 17:43:32 ----D---- C:\WINDOWS\SoftwareDistribution
2015-02-16 21:42:17 ----D---- C:\WINDOWS\system32\NDF
2015-02-15 20:08:48 ----D---- C:\WINDOWS\Logs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 speedfan;speedfan; C:\WINDOWS\SysWOW64\speedfan.sys [2012-12-29 28664]
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2015-03-12 132120]
R1 avkmgr;avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [2014-11-24 28600]
R1 dtsoftbus01;@oem8.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\System32\drivers\dtsoftbus01.sys [2014-12-24 283064]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\WINDOWS\system32\DRIVERS\vwififlt.sys [2014-04-30 71680]
R2 AODDriver4.2.0;AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2013-09-20 59648]
R2 APXACC;@oem5.inf,%APPEX_ACC_SERVICE_NAME%;AppEx Networks Accelerator LWF; C:\WINDOWS\system32\DRIVERS\appexDrv.sys [2012-06-23 199008]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2015-03-12 128536]
R2 rzpmgrk;rzpmgrk; \??\C:\WINDOWS\system32\drivers\rzpmgrk.sys [2014-12-09 37184]
R2 rzpnk;rzpnk; \??\C:\WINDOWS\system32\drivers\rzpnk.sys [2014-12-10 129600]
R2 sp_rsdrv2;Spyware Terminator Driver Filter; C:\WINDOWS\system32\DRIVERS\stflt.sys [2015-01-27 51496]
R3 amdkmdag;amdkmdag; C:\WINDOWS\system32\DRIVERS\atikmdag.sys [2014-07-21 13209088]
R3 amdkmdap;amdkmdap; C:\WINDOWS\system32\DRIVERS\atikmpag.sys [2014-07-21 626688]
R3 AtiHDAudioService;@oem4.inf,%ATIHdAudioDriver.SvcDesc%;AMD Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdW86.sys [2012-08-21 91648]
R3 bcbtums;@oem18.inf,%BCBTUMS.SvcDesc%;Bluetooth RAM Firmware Download USB Filter; C:\WINDOWS\system32\drivers\bcbtums.sys [2013-09-04 170712]
R3 BCM43XX;@netbc64.inf,%BCM43XX_Service_DispName%;Broadcom 802.11 – ovladač síťového adaptéru; C:\WINDOWS\system32\DRIVERS\bcmwl63a.sys [2013-07-01 8536752]
R3 BthEnum;@bth.inf,%BthEnum.SVCDESC%;Služba Bluetooth Enumerator; C:\WINDOWS\System32\drivers\BthEnum.sys [2014-10-29 53248]
R3 BthLEEnum;@bthleenum.inf,%BthLEEnum.SVCDESC%;Ovladač úspory energie technologie Bluetooth; C:\WINDOWS\system32\DRIVERS\BthLEEnum.sys [2014-09-24 226304]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Zařízení Bluetooth (síť PAN); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2014-09-24 118272]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2014-10-29 81920]
R3 CnxtHdAudService;@oem11.inf,%UAAFunctionDriverForHdAudio.SvcDesc%;Conexant UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDRT64.sys [2012-09-20 1609376]
R3 IBMPMDRV;IBMPMDRV; C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys [2014-11-14 60112]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\System32\drivers\rfcomm.sys [2015-01-30 167424]
R3 RSP2STOR;@oem16.inf,%Rts5229%;Realtek PCIE CardReader Driver - P2; C:\WINDOWS\system32\DRIVERS\RtsP2Stor.sys [2012-12-13 288480]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\WINDOWS\system32\DRIVERS\Rt630x64.sys [2013-06-18 591360]
R3 rzdaendpt;@oem20.inf,%rzdaendpt.SvcDesc%;Razer DeathAdder end point; C:\WINDOWS\System32\drivers\rzdaendpt.sys [2014-09-05 33448]
R3 rzudd;@oem37.inf,%Razer.SvcDesc%;Razer Mouse Driver; C:\WINDOWS\System32\drivers\rzudd.sys [2014-09-05 160424]
R3 rzvkeyboard;@oem29.inf,%rzvkeyboard%;Razer Virtual Keyboard Driver; C:\WINDOWS\System32\drivers\rzvkeyboard.sys [2014-09-05 31912]
R3 SmbDrv;SmbDrv; C:\WINDOWS\system32\DRIVERS\Smb_driver_AMDASF.sys [2013-04-26 29424]
R3 SynTP;@oem10.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2013-04-24 460528]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2013-08-22 212224]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\WINDOWS\system32\DRIVERS\vwifimp.sys [2014-04-30 38912]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Ovladač portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2014-10-29 1198080]
S3 btwampfl;@oem18.inf,%btwampfl.ServiceName%;btwampfl; C:\WINDOWS\system32\DRIVERS\btwampfl.sys [2013-09-04 166104]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\WINDOWS\system32\atiesrxx.exe [2014-07-21 239616]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2014-07-04 344064]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2015-03-12 432888]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2015-03-12 432888]
R2 c2cautoupdatesvc;Skype Click to Call Updater; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
R2 c2cpnrsvc;Skype Click to Call PNR Service; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
R2 CxAudMsg;Conexant Audio Message Service; C:\Windows\system32\CxAudMsg64.exe [2012-06-08 201376]
R2 FPLService;TrueSuiteService; C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe [2013-08-07 2139944]
R2 IBMPMSVC;@oem9.inf,%ibm.svcDesc0%;Lenovo PM Service; C:\WINDOWS\system32\ibmpmsvc.exe [2014-11-14 84208]
R2 IconMan_R;IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-11-15 2468496]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-04-07 110128]
R2 Razer Game Scanner Service;Razer Game Scanner; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [2014-12-09 186048]
R2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [2012-09-07 1148664]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 124400]
R3 TrueService;TrueAPI Service component; C:\Program Files\Common Files\AuthenTec\TrueService.exe [2013-07-22 401704]
S2 Avira.OE.ServiceHost;Avira Service Host; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [2015-01-19 182520]
S2 BcmBtRSupport;@oem18.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service; C:\WINDOWS\system32\BtwRSupportService.exe [2013-09-04 2252504]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-01 107912]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-01-02 315488]
S3 EasyAntiCheat;EasyAntiCheat; C:\WINDOWS\syswow64\EasyAntiCheat.exe [2014-12-25 175136]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2013-08-03 43696]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-01 107912]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2015-03-06 148080]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2015-02-19 835776]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119677
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Jak zjistit v PC keylogger?

#6 Příspěvek od Rudy »

Spusťte teď tuto utilitu:
Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Lorgan
Návštěvník
Návštěvník
Příspěvky: 51
Registrován: 19 lis 2013 12:24
Bydliště: Přístup k údajům o bydlení vyžaduje bezpečnostní prověrku pátého stupně :P

Re: Jak zjistit v PC keylogger?

#7 Příspěvek od Lorgan »

# AdwCleaner v4.112 - Logfile created 14/03/2015 at 10:13:59
# Updated 09/03/2015 by Xplode
# Database : 2015-03-05.1 [Server]
# Operating system : Windows 8.1 Pro (x64)
# Username : ThinkPad - LENOVO
# Running from : C:\Users\ThinkPad\Downloads\adwcleaner_4.112(1).exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\ThinkPad\AppData\Roaming\OpenCandy

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416


-\\ Mozilla Firefox v36.0.1 (x86 en-US)


-\\ Google Chrome v41.0.2272.89


*************************

AdwCleaner[R0].txt - [839 bytes] - [13/03/2015 23:02:56]
AdwCleaner[R1].txt - [900 bytes] - [14/03/2015 09:50:30]
AdwCleaner[S0].txt - [830 bytes] - [14/03/2015 10:13:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [888 bytes] ##########
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119677
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Jak zjistit v PC keylogger?

#8 Příspěvek od Rudy »

Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Lorgan
Návštěvník
Návštěvník
Příspěvky: 51
Registrován: 19 lis 2013 12:24
Bydliště: Přístup k údajům o bydlení vyžaduje bezpečnostní prověrku pátého stupně :P

Re: Jak zjistit v PC keylogger?

#9 Příspěvek od Lorgan »

Logfile of random's system information tool 1.10 (written by random/random)
Run by ThinkPad at 2015-03-15 11:02:04
Microsoft Windows 8.1 Pro
System drive C: has 42 GB (19%) free of 220 GB
Total RAM: 7603 MB (75% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:02:09, on 15. 3. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17416)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
C:\Users\ThinkPad\AppData\Local\Common\csag.exe
C:\WINDOWS\SysWOW64\WScript.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Lenovo Fingerprint Reader\x86\IEWebSiteLogon.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\trend micro\ThinkPad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.reerd.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: TrueSuite Browser Helper Object - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files\Lenovo Fingerprint Reader\x86\IEBHO.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll
O2 - BHO: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Razer Synapse] "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
O4 - HKLM\..\Run: [mslralSrv] "C:\WINDOWS\system32\mslral.vbe" msbvbb msqeelq
O4 - HKLM\..\Run: [MSStp] C:\WINDOWS\inf\msstp.vbe
O4 - HKLM\..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [AppEx Accelerator UI] C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe -h
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\PROGRAM FILES\CCLEANER\CCLEANER64.EXE" /MONITOR
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [cscommon] C:\Users\ThinkPad\AppData\Local\Common\csag.exe
O4 - HKCU\..\Run: [GSplay.exe] C:\Users\ThinkPad\Desktop\GSplay.exe
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\WINDOWS\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Service Host (Avira.OE.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
O23 - Service: @oem18.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service (BcmBtRSupport) - Unknown owner - C:\WINDOWS\system32\BtwRSupportService.exe (file missing)
O23 - Service: Conexant Audio Message Service (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: EasyAntiCheat - EasyAntiCheat Ltd - C:\WINDOWS\system32\EasyAntiCheat.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: TrueSuiteService (FPLService) - AuthenTec, Inc - C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @oem9.inf,%ibm.svcDesc0%;Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe (file missing)
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Razer Game Scanner (Razer Game Scanner Service) - Unknown owner - C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Spyware Terminator 2012 Realtime Shield Service (ST2012_Svc) - Crawler.com - C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: TrueAPI Service component (TrueService) - AuthenTec, Inc. - C:\Program Files\Common Files\AuthenTec\TrueService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9403 bytes

======Listing Processes======





wininit.exe

C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
"C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe"
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\atiesrxx.exe
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-bbdd565f-eaa8-45d2-ac97-29135d0ebdea -SystemEventPortName:HostProcess-2b509423-0049-4a54-9a03-6c8fdaabb123 -IoCancelEventPortName:HostProcess-703f5e36-1ca7-43ac-b38b-fcccfc536f98 -NonStateChangingEventPortName:HostProcess-4580b16a-895e-48e7-a394-ef274b306607 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:43e21a47-b3e3-4f73-843b-d1d007c12a3a -DeviceGroupId:
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k WbioSvcGroup
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
"C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe" /service
"C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe" /service
C:\Windows\system32\CxAudMsg64.exe
dashost.exe {b4fd5104-bfa7-45dd-a1a84b3cfdb288f0}
"C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe"
"C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe"
"C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
"C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe"
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_00000670
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe"
"C:\Program Files\Common Files\AuthenTec\TrueService.exe"
C:\WINDOWS\system32\SearchIndexer.exe /Embedding

C:\WINDOWS\System32\WinLogon.exe -SpecialSession
-hiberboot
atieclxx
C:\Program Files\LENOVO\HOTKEY\tpnumlkd.exe
"\Program Files\Synaptics\SynTP\SynTPEnh.exe"
C:\PROGRA~1\Lenovo\HOTKEY\MKRMSG.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.MediaKey
C:\PROGRA~1\Lenovo\HOTKEY\TPOSD.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
"C:\Program Files\Lenovo Fingerprint Reader\TouchControl.exe"
taskhostex.exe
C:\WINDOWS\Explorer.EXE
/ChildServer
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files\Lenovo\HOTKEY\extapsup.exe"
"C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe"
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe"
"C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe"
"C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe" -h
"C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" /ELEVATED
"C:\Users\ThinkPad\AppData\Local\Common\csag.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\WINDOWS\System32\WScript.exe" "C:\Windows\System32\mslral.vbe" msbvbb msqeelq
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding
AdblockPlusEngine.exe cs-CZ
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3272 CREDAT:78849 /prefetch:2
"C:\Program Files\CCleaner\CCleaner.exe" /uac
"C:\PROGRAM FILES\CCLEANER\CCLEANER64.EXE" /monitor
"C:\Program Files\Lenovo Fingerprint Reader\x86\IEWebSiteLogon.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"

"C:\Users\ThinkPad\Downloads\RSITx64.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\WINDOWS\tasks\Synaptics TouchPad Enhancements.job - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\ThinkPad\AppData\Roaming\Mozilla\Firefox\Profiles\q1zt48l3.default

prefs.js - "browser.startup.homepage" - "https://www.google.cz/?gws_rd=ssl"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 17.0.0.134 Plugin
"Path"=C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@authentec.com/ffwloplugin]
"Description"=
"Path"=C:\Program Files\Lenovo Fingerprint Reader\npffwloplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.31.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.31.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 17.0.0.134 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll


C:\Users\ThinkPad\AppData\Roaming\Mozilla\Firefox\Profiles\q1zt48l3.default\extensions\
abs@avira.com

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8590886E-EC8C-43C1-A32C-E4C2B0B6395B}]
TrueSuite Browser Helper Object - C:\Program Files\Lenovo Fingerprint Reader\IEBHO.DLL [2013-08-07 2518312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14 2117216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFCB3198-32F3-4E8B-9539-4324694ED664}]
Adblock Plus for IE Browser Helper Object - C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2015-02-25 728840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-24 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8590886E-EC8C-43C1-A32C-E4C2B0B6395B}]
TrueSuite Browser Helper Object - C:\Program Files\Lenovo Fingerprint Reader\x86\IEBHO.dll [2013-08-07 2353448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14 1709152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-24 172968]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFCB3198-32F3-4E8B-9539-4324694ED664}]
Adblock Plus for IE Browser Helper Object - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-02-25 617736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"LenovoOptMouseUpdate"=C:\Program Files\Lenovo\HOTKEY\extapsup.exe [2013-06-20 255480]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SACpl.exe [2012-06-13 1647616]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [2012-06-14 887968]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-04-24 2963184]
"SpywareTerminatorShield"=C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2012-09-07 2777296]
"SpywareTerminatorUpdater"=C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [2014-11-04 3681656]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AppEx Accelerator UI"=C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [2012-05-22 1000288]
"CCleaner Monitoring"=C:\PROGRAM FILES\CCLEANER\CCLEANER64.EXE [2014-11-21 7063832]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]
"cscommon"=C:\Users\ThinkPad\AppData\Local\Common\csag.exe [2015-03-02 1342464]
"GSplay.exe"=C:\Users\ThinkPad\Desktop\GSplay.exe [2014-03-12 4772747]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [2014-07-04 766688]
""= []
"Razer Synapse"=C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [2014-11-03 585536]
"mslralSrv"=C:\WINDOWS\system32\mslral.vbe msbvbb msqeelq []
"MSStp"=C:\WINDOWS\inf\msstp.vbe [2014-03-05 1584]
"Avira Systray"=C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [2015-01-19 126712]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2015-03-12 703280]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-03-14 22:44:09 ----D---- C:\ProgramData\LogMeIn
2015-03-14 09:47:34 ----D---- C:\ProgramData\McAfee
2015-03-13 23:02:53 ----D---- C:\AdwCleaner
2015-03-13 22:23:50 ----D---- C:\Program Files (x86)\FTL
2015-03-13 22:14:36 ----D---- C:\Program Files\trend micro
2015-03-13 22:14:35 ----D---- C:\rsit
2015-03-11 21:19:30 ----D---- C:\Users\ThinkPad\AppData\Roaming\OpenOffice
2015-03-11 21:17:11 ----D---- C:\Program Files (x86)\OpenOffice 4
2015-03-11 14:54:36 ----D---- C:\Program Files (x86)\Bf2SP64 2.32
2015-03-11 13:29:54 ----D---- C:\Skladiště her bez ladu a skladu
2015-03-11 13:19:35 ----A---- C:\WINDOWS\SYSWOW64\SHCore.dll
2015-03-11 13:19:35 ----A---- C:\WINDOWS\system32\SHCore.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\lpk.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\fontsub.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\dciman32.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\atmlib.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\atmfd.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\lpk.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\fontsub.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\dciman32.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\atmlib.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\atmfd.dll
2015-03-11 13:19:21 ----A---- C:\WINDOWS\SYSWOW64\photowiz.dll
2015-03-11 13:19:21 ----A---- C:\WINDOWS\system32\photowiz.dll
2015-03-11 13:19:03 ----A---- C:\WINDOWS\system32\win32spl.dll
2015-03-11 13:19:03 ----A---- C:\WINDOWS\system32\pmcsnap.dll
2015-03-11 13:19:03 ----A---- C:\WINDOWS\system32\localspl.dll
2015-03-11 13:19:00 ----A---- C:\WINDOWS\system32\puiobj.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\puiobj.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\puiapi.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\prnntfy.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\DafPrintProvider.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\compstui.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\puiapi.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\prnntfy.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\ppcsnap.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\DafPrintProvider.dll
2015-03-11 13:18:58 ----A---- C:\WINDOWS\SYSWOW64\printui.exe
2015-03-11 13:18:58 ----A---- C:\WINDOWS\SYSWOW64\findnetprinters.dll
2015-03-11 13:18:58 ----A---- C:\WINDOWS\system32\printui.exe
2015-03-11 13:18:58 ----A---- C:\WINDOWS\system32\findnetprinters.dll
2015-03-11 13:18:58 ----A---- C:\WINDOWS\system32\compstui.dll
2015-03-11 13:18:56 ----A---- C:\WINDOWS\system32\win32k.sys
2015-03-11 13:18:55 ----A---- C:\WINDOWS\system32\schannel.dll
2015-03-11 13:18:54 ----A---- C:\WINDOWS\SYSWOW64\schannel.dll
2015-03-11 13:18:53 ----A---- C:\WINDOWS\SYSWOW64\StorageContextHandler.dll
2015-03-11 13:18:53 ----A---- C:\WINDOWS\system32\StorageContextHandler.dll
2015-03-11 13:18:51 ----A---- C:\WINDOWS\SYSWOW64\msftedit.dll
2015-03-11 13:18:51 ----A---- C:\WINDOWS\system32\msftedit.dll
2015-03-11 13:18:49 ----A---- C:\WINDOWS\SYSWOW64\authui.dll
2015-03-11 13:18:49 ----A---- C:\WINDOWS\system32\authui.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\SYSWOW64\WSShared.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\system32\WSShared.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-03-11 13:18:44 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-11 13:18:44 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.dll
2015-03-11 13:18:44 ----A---- C:\WINDOWS\system32\WSReset.exe
2015-03-11 13:18:44 ----A---- C:\WINDOWS\system32\WSCollect.exe
2015-03-11 13:18:19 ----A---- C:\WINDOWS\SYSWOW64\calc.exe
2015-03-11 13:18:19 ----A---- C:\WINDOWS\system32\calc.exe
2015-03-11 13:18:17 ----A---- C:\WINDOWS\SYSWOW64\dwmcore.dll
2015-03-11 13:18:17 ----A---- C:\WINDOWS\system32\dwmcore.dll
2015-03-11 13:18:11 ----A---- C:\WINDOWS\system32\drivers\WdFilter.sys
2015-03-11 13:18:10 ----A---- C:\WINDOWS\system32\drivers\WdNisDrv.sys
2015-03-11 13:18:10 ----A---- C:\WINDOWS\system32\drivers\WdBoot.sys
2015-03-11 13:18:07 ----A---- C:\WINDOWS\SYSWOW64\winshfhc.dll
2015-03-11 13:18:07 ----A---- C:\WINDOWS\system32\winshfhc.dll
2015-03-11 13:17:29 ----A---- C:\WINDOWS\system32\drivers\ndis.sys
2015-03-11 13:17:26 ----A---- C:\WINDOWS\system32\atlthunk.dll
2015-03-11 13:17:25 ----A---- C:\WINDOWS\SYSWOW64\D3DCompiler_47.dll
2015-03-11 13:17:25 ----A---- C:\WINDOWS\SYSWOW64\atlthunk.dll
2015-03-11 13:17:25 ----A---- C:\WINDOWS\system32\D3DCompiler_47.dll
2015-03-11 13:17:24 ----A---- C:\WINDOWS\SYSWOW64\mfc42u.dll
2015-03-11 13:17:24 ----A---- C:\WINDOWS\system32\mfc42u.dll
2015-03-11 13:17:23 ----A---- C:\WINDOWS\SYSWOW64\mfc42.dll
2015-03-11 13:17:23 ----A---- C:\WINDOWS\system32\mfc42.dll
2015-03-11 13:17:20 ----AC---- C:\WINDOWS\system32\drivers\bthport.sys
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\fsquirt.exe
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\rfcomm.sys
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\hidbth.sys
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\BTHUSB.SYS
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\bthenum.sys
2015-03-11 13:17:10 ----A---- C:\WINDOWS\system32\mshtml.dll
2015-03-11 13:17:07 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2015-03-11 13:17:05 ----A---- C:\WINDOWS\system32\jscript9.dll
2015-03-11 13:17:03 ----A---- C:\WINDOWS\system32\ieframe.dll
2015-03-11 13:17:01 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2015-03-11 13:16:57 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2015-03-11 13:16:57 ----A---- C:\WINDOWS\system32\wininet.dll
2015-03-11 13:16:56 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2015-03-11 13:16:56 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2015-03-11 13:16:56 ----A---- C:\WINDOWS\system32\iertutil.dll
2015-03-11 13:16:55 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2015-03-11 13:16:55 ----A---- C:\WINDOWS\system32\urlmon.dll
2015-03-11 13:16:55 ----A---- C:\WINDOWS\system32\inetcomm.dll
2015-03-11 13:16:54 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2015-03-11 13:16:54 ----A---- C:\WINDOWS\SYSWOW64\msfeeds.dll
2015-03-11 13:16:54 ----A---- C:\WINDOWS\SYSWOW64\inetcomm.dll
2015-03-11 13:16:51 ----A---- C:\WINDOWS\system32\vbscript.dll
2015-03-11 13:16:50 ----A---- C:\WINDOWS\system32\msfeeds.dll
2015-03-11 13:16:50 ----A---- C:\WINDOWS\system32\iepeers.dll
2015-03-11 13:16:50 ----A---- C:\WINDOWS\system32\dxtrans.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\webcheck.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\mshtmled.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\MshtmlDac.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\dxtrans.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\webcheck.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\MshtmlDac.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\jscript9diag.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\actxprxy.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\SYSWOW64\iepeers.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\SYSWOW64\ieapfltr.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\mshtmled.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\jscript.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2015-03-11 13:16:15 ----A---- C:\WINDOWS\SYSWOW64\WMPhoto.dll
2015-03-11 13:16:15 ----A---- C:\WINDOWS\system32\WMPhoto.dll
2015-03-11 13:16:15 ----A---- C:\WINDOWS\system32\msctf.dll
2015-03-11 13:16:14 ----A---- C:\WINDOWS\SYSWOW64\msctf.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\rfxvmt.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\rdpudd.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\rdpcorets.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\drivers\rdpvideominiport.sys
2015-03-11 13:16:12 ----A---- C:\WINDOWS\system32\ubpm.dll
2015-03-11 13:16:10 ----A---- C:\WINDOWS\SYSWOW64\WindowsCodecs.dll
2015-03-11 13:16:10 ----A---- C:\WINDOWS\system32\WindowsCodecs.dll
2015-03-11 13:16:08 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2015-03-11 13:16:08 ----A---- C:\WINDOWS\system32\shell32.dll
2015-03-11 13:15:58 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2015-03-11 13:15:57 ----A---- C:\WINDOWS\SYSWOW64\ntdll.dll
2015-03-11 13:15:57 ----A---- C:\WINDOWS\system32\ntdll.dll
2015-03-11 13:15:56 ----A---- C:\WINDOWS\explorer.exe
2015-03-11 13:15:55 ----A---- C:\WINDOWS\SYSWOW64\explorer.exe
2015-03-11 13:15:54 ----A---- C:\WINDOWS\SYSWOW64\MrmCoreR.dll
2015-03-11 13:15:54 ----A---- C:\WINDOWS\system32\MrmCoreR.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eappprxy.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eapphost.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eappgnui.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eappcfg.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eapp3hst.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eappprxy.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eapphost.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eappgnui.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eappcfg.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eapp3hst.dll
2015-03-11 13:15:52 ----A---- C:\WINDOWS\system32\LockScreenContentServer.exe
2015-03-07 13:53:51 ----D---- C:\Users\ThinkPad\AppData\Roaming\PSpad
2015-03-07 13:53:39 ----D---- C:\Program Files (x86)\PSPad editor
2015-03-06 15:14:15 ----D---- C:\Program Files (x86)\Mozilla Firefox
2015-03-05 14:02:10 ----D---- C:\Users\ThinkPad\AppData\Roaming\TeamViewer
2015-03-03 13:51:14 ----AD---- C:\ProgramData\TEMP
2015-03-03 13:51:03 ----D---- C:\Program Files (x86)\CamSpace
2015-03-02 16:57:59 ----D---- C:\Program Files (x86)\X Plugin Manager
2015-03-02 16:45:19 ----D---- C:\Program Files (x86)\X3 ModManager
2015-03-02 14:14:11 ----D---- C:\Program Files (x86)\X3CZ
2015-02-28 19:20:03 ----D---- C:\Program Files (x86)\Star Wars Jedi Knight - Jedi Academy
2015-02-28 18:32:11 ----A---- C:\TDSSKiller.3.0.0.44_28.02.2015_18.32.11_log.txt
2015-02-27 23:51:35 ----A---- C:\Program Files (x86)\Readme.txt
2015-02-27 23:51:35 ----A---- C:\Program Files (x86)\EULA.txt
2015-02-27 23:48:49 ----A---- C:\WINDOWS\unvise32.exe
2015-02-27 23:48:39 ----D---- C:\Program Files (x86)\DivX
2015-02-27 23:46:41 ----D---- C:\Program Files (x86)\Sierra
2015-02-27 12:44:18 ----D---- C:\Program Files (x86)\Mozilla Firefox.bak
2015-02-26 09:51:46 ----A---- C:\WINDOWS\system32\drivers\avnetflt.sys
2015-02-26 09:47:50 ----D---- C:\Users\ThinkPad\AppData\Roaming\Avira
2015-02-26 09:44:57 ----A---- C:\WINDOWS\system32\drivers\avkmgr.sys
2015-02-26 09:44:56 ----A---- C:\WINDOWS\system32\drivers\avipbb.sys
2015-02-26 09:44:56 ----A---- C:\WINDOWS\system32\drivers\avgntflt.sys
2015-02-26 09:41:48 ----D---- C:\ProgramData\Avira
2015-02-25 14:52:08 ----A---- C:\WINDOWS\SYSWOW64\Windows.Globalization.dll
2015-02-25 14:52:08 ----A---- C:\WINDOWS\SYSWOW64\GlobCollationHost.dll
2015-02-25 14:52:08 ----A---- C:\WINDOWS\system32\Windows.Globalization.dll
2015-02-25 14:52:08 ----A---- C:\WINDOWS\system32\GlobCollationHost.dll
2015-02-25 13:02:18 ----D---- C:\Users\ThinkPad\AppData\Roaming\wld
2015-02-22 11:09:05 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2015-02-21 23:17:21 ----D---- C:\Program Files (x86)\SpeedFan
2015-02-17 18:21:50 ----AH---- C:\WINDOWS\system32\drivers\Hamdrv.sys
2015-02-16 09:51:47 ----D---- C:\Program Files (x86)\DOSBox-0.74

======List of files/folders modified in the last 1 month======

2015-03-15 11:02:09 ----D---- C:\WINDOWS\Temp
2015-03-15 11:00:00 ----D---- C:\WINDOWS\system32\sru
2015-03-15 10:52:47 ----D---- C:\WINDOWS\Prefetch
2015-03-15 10:52:32 ----SHD---- C:\WINDOWS\Installer
2015-03-15 10:52:31 ----RD---- C:\Program Files (x86)
2015-03-15 08:18:23 ----D---- C:\Users\ThinkPad\AppData\Roaming\Skype
2015-03-15 00:35:36 ----D---- C:\WINDOWS\Microsoft.NET
2015-03-15 00:28:02 ----RD---- C:\WINDOWS\System32
2015-03-15 00:28:02 ----D---- C:\WINDOWS\Inf
2015-03-15 00:28:02 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2015-03-14 22:57:35 ----D---- C:\Program Files\Steam
2015-03-14 22:44:09 ----HD---- C:\ProgramData
2015-03-14 22:38:00 ----D---- C:\WINDOWS\system32\drivers
2015-03-14 18:44:23 ----SHD---- C:\System Volume Information
2015-03-14 12:42:27 ----D---- C:\Program Files (x86)\Battle.net
2015-03-14 12:21:12 ----D---- C:\WINDOWS\system32\config
2015-03-14 12:16:41 ----D---- C:\WINDOWS\debug
2015-03-14 11:17:02 ----D---- C:\WINDOWS\SoftwareDistribution
2015-03-14 11:17:02 ----D---- C:\Windows
2015-03-14 11:14:55 ----D---- C:\ProgramData\Conexant
2015-03-14 11:12:16 ----D---- C:\Users\ThinkPad\AppData\Roaming\DAEMON Tools Lite
2015-03-14 11:10:02 ----RD---- C:\Program Files (x86)\Skype
2015-03-14 11:09:52 ----D---- C:\ProgramData\Skype
2015-03-14 10:27:54 ----D---- C:\WINDOWS\AppReadiness
2015-03-14 10:27:53 ----HD---- C:\Program Files\WindowsApps
2015-03-13 22:14:36 ----RD---- C:\Program Files
2015-03-13 18:34:06 ----D---- C:\WINDOWS\rescache
2015-03-13 16:25:30 ----D---- C:\WINDOWS\system32\DriverStore
2015-03-13 16:24:41 ----D---- C:\WINDOWS\WinSxS
2015-03-13 13:13:43 ----D---- C:\ProgramData\Spyware Terminator
2015-03-12 13:01:03 ----D---- C:\WINDOWS\SysWOW64
2015-03-12 12:57:13 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-11 22:42:59 ----D---- C:\WINDOWS\system32\catroot
2015-03-11 22:41:17 ----D---- C:\Program Files\Windows Defender
2015-03-11 22:41:16 ----D---- C:\Program Files (x86)\Windows Defender
2015-03-11 22:41:15 ----D---- C:\WINDOWS\PolicyDefinitions
2015-03-11 22:41:14 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2015-03-11 22:41:14 ----D---- C:\WINDOWS\system32\cs-CZ
2015-03-11 22:41:13 ----RD---- C:\WINDOWS\ToastData
2015-03-11 22:41:11 ----D---- C:\WINDOWS\WinStore
2015-03-11 22:41:09 ----D---- C:\Program Files\Internet Explorer
2015-03-11 22:41:09 ----D---- C:\Program Files (x86)\Internet Explorer
2015-03-11 21:18:45 ----RSD---- C:\WINDOWS\assembly
2015-03-11 21:17:41 ----RSD---- C:\WINDOWS\Fonts
2015-03-11 20:00:49 ----D---- C:\WINDOWS\CbsTemp
2015-03-11 19:51:51 ----D---- C:\WINDOWS\system32\MRT
2015-03-11 19:48:27 ----A---- C:\WINDOWS\system32\MRT.exe
2015-03-11 13:34:45 ----D---- C:\Program Files (x86)\Electronic Arts
2015-03-11 13:34:36 ----D---- C:\Program Files (x86)\EA Sports
2015-03-11 13:33:04 ----D---- C:\Martin
2015-03-11 13:11:50 ----D---- C:\WINDOWS\system32\catroot2
2015-03-05 20:38:00 ----D---- C:\Program Files (x86)\R.G. Mechanics
2015-03-05 16:14:16 ----D---- C:\WINDOWS\system32\Tasks
2015-03-04 22:24:42 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2015-03-01 09:57:36 ----D---- C:\Users\ThinkPad\AppData\Roaming\vlc
2015-02-26 09:50:11 ----D---- C:\Program Files\Adblock Plus for IE
2015-02-26 09:44:46 ----D---- C:\Program Files (x86)\Avira
2015-02-26 09:41:23 ----D---- C:\OETemp
2015-02-26 09:36:54 ----D---- C:\ProgramData\Package Cache
2015-02-24 18:05:39 ----D---- C:\ProgramData\Oracle
2015-02-24 18:05:27 ----D---- C:\Program Files (x86)\Java
2015-02-24 18:05:01 ----D---- C:\Program Files (x86)\Common Files
2015-02-24 18:04:31 ----A---- C:\WINDOWS\SYSWOW64\WindowsAccessBridge-32.dll
2015-02-23 17:09:27 ----D---- C:\Users\ThinkPad\AppData\Roaming\My Battle for Middle-earth(tm) II Files
2015-02-16 21:42:17 ----D---- C:\WINDOWS\system32\NDF

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 speedfan;speedfan; C:\WINDOWS\SysWOW64\speedfan.sys [2012-12-29 28664]
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2015-03-12 132120]
R1 avkmgr;avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [2014-11-24 28600]
R1 dtsoftbus01;@oem8.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\System32\drivers\dtsoftbus01.sys [2014-12-24 283064]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\WINDOWS\system32\DRIVERS\vwififlt.sys [2014-04-30 71680]
R2 AODDriver4.2.0;AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2013-09-20 59648]
R2 APXACC;@oem5.inf,%APPEX_ACC_SERVICE_NAME%;AppEx Networks Accelerator LWF; C:\WINDOWS\system32\DRIVERS\appexDrv.sys [2012-06-23 199008]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2015-03-12 128536]
R2 rzpmgrk;rzpmgrk; \??\C:\WINDOWS\system32\drivers\rzpmgrk.sys [2014-12-09 37184]
R2 rzpnk;rzpnk; \??\C:\WINDOWS\system32\drivers\rzpnk.sys [2014-12-10 129600]
R2 sp_rsdrv2;Spyware Terminator Driver Filter; C:\WINDOWS\system32\DRIVERS\stflt.sys [2015-01-27 51496]
R3 amdkmdag;amdkmdag; C:\WINDOWS\system32\DRIVERS\atikmdag.sys [2014-07-21 13209088]
R3 amdkmdap;amdkmdap; C:\WINDOWS\system32\DRIVERS\atikmpag.sys [2014-07-21 626688]
R3 AtiHDAudioService;@oem4.inf,%ATIHdAudioDriver.SvcDesc%;AMD Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdW86.sys [2012-08-21 91648]
R3 bcbtums;@oem18.inf,%BCBTUMS.SvcDesc%;Bluetooth RAM Firmware Download USB Filter; C:\WINDOWS\system32\drivers\bcbtums.sys [2013-09-04 170712]
R3 BCM43XX;@netbc64.inf,%BCM43XX_Service_DispName%;Broadcom 802.11 – ovladač síťového adaptéru; C:\WINDOWS\system32\DRIVERS\bcmwl63a.sys [2013-07-01 8536752]
R3 BthEnum;@bth.inf,%BthEnum.SVCDESC%;Služba Bluetooth Enumerator; C:\WINDOWS\System32\drivers\BthEnum.sys [2014-10-29 53248]
R3 BthLEEnum;@bthleenum.inf,%BthLEEnum.SVCDESC%;Ovladač úspory energie technologie Bluetooth; C:\WINDOWS\system32\DRIVERS\BthLEEnum.sys [2014-09-24 226304]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Zařízení Bluetooth (síť PAN); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2014-09-24 118272]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2014-10-29 81920]
R3 CnxtHdAudService;@oem11.inf,%UAAFunctionDriverForHdAudio.SvcDesc%;Conexant UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDRT64.sys [2012-09-20 1609376]
R3 IBMPMDRV;IBMPMDRV; C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys [2014-11-14 60112]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\System32\drivers\rfcomm.sys [2015-01-30 167424]
R3 RSP2STOR;@oem16.inf,%Rts5229%;Realtek PCIE CardReader Driver - P2; C:\WINDOWS\system32\DRIVERS\RtsP2Stor.sys [2012-12-13 288480]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\WINDOWS\system32\DRIVERS\Rt630x64.sys [2013-06-18 591360]
R3 rzdaendpt;@oem20.inf,%rzdaendpt.SvcDesc%;Razer DeathAdder end point; C:\WINDOWS\System32\drivers\rzdaendpt.sys [2014-09-05 33448]
R3 rzudd;@oem37.inf,%Razer.SvcDesc%;Razer Mouse Driver; C:\WINDOWS\System32\drivers\rzudd.sys [2014-09-05 160424]
R3 rzvkeyboard;@oem29.inf,%rzvkeyboard%;Razer Virtual Keyboard Driver; C:\WINDOWS\System32\drivers\rzvkeyboard.sys [2014-09-05 31912]
R3 SmbDrv;SmbDrv; C:\WINDOWS\system32\DRIVERS\Smb_driver_AMDASF.sys [2013-04-26 29424]
R3 SynTP;@oem10.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2013-04-24 460528]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2013-08-22 212224]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\WINDOWS\system32\DRIVERS\vwifimp.sys [2014-04-30 38912]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Ovladač portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2014-10-29 1198080]
S3 btwampfl;@oem18.inf,%btwampfl.ServiceName%;btwampfl; C:\WINDOWS\system32\DRIVERS\btwampfl.sys [2013-09-04 166104]
S3 Hamachi;LogMeIn Hamachi Virtual Miniport); C:\WINDOWS\system32\DRIVERS\Hamdrv.sys [2015-02-17 44296]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\WINDOWS\system32\atiesrxx.exe [2014-07-21 239616]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2014-07-04 344064]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2015-03-12 432888]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2015-03-12 432888]
R2 Avira.OE.ServiceHost;Avira Service Host; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [2015-01-19 182520]
R2 c2cautoupdatesvc;Skype Click to Call Updater; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
R2 c2cpnrsvc;Skype Click to Call PNR Service; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
R2 CxAudMsg;Conexant Audio Message Service; C:\Windows\system32\CxAudMsg64.exe [2012-06-08 201376]
R2 FPLService;TrueSuiteService; C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe [2013-08-07 2139944]
R2 IBMPMSVC;@oem9.inf,%ibm.svcDesc0%;Lenovo PM Service; C:\WINDOWS\system32\ibmpmsvc.exe [2014-11-14 84208]
R2 IconMan_R;IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-11-15 2468496]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-04-07 110128]
R2 Razer Game Scanner Service;Razer Game Scanner; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [2014-12-09 186048]
R2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [2012-09-07 1148664]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 124400]
R3 TrueService;TrueAPI Service component; C:\Program Files\Common Files\AuthenTec\TrueService.exe [2013-07-22 401704]
S2 BcmBtRSupport;@oem18.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service; C:\WINDOWS\system32\BtwRSupportService.exe [2013-09-04 2252504]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-01 107912]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-01-02 315488]
S3 EasyAntiCheat;EasyAntiCheat; C:\WINDOWS\syswow64\EasyAntiCheat.exe [2014-12-25 175136]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2013-08-03 43696]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-01 107912]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2015-03-06 148080]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2015-02-19 835776]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119677
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Jak zjistit v PC keylogger?

#10 Příspěvek od Rudy »

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\Program Files (x86)\Skype\Toolbars
C:\WINDOWS\inf\msstp.vbe
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\system32\mslral.vbe

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]/64
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]/64
"mslralSrv"=-
"MSStp"=-

:services
c2cautoupdatesvc
c2cpnrsvc

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Lorgan
Návštěvník
Návštěvník
Příspěvky: 51
Registrován: 19 lis 2013 12:24
Bydliště: Přístup k údajům o bydlení vyžaduje bezpečnostní prověrku pátého stupně :P

Re: Jak zjistit v PC keylogger?

#11 Příspěvek od Lorgan »

Níže vkládam log z RSIT, ale nejdříve mi prosím řekněte co byly tyto soubory, které OTM vymazal : C:\WINDOWS\inf\msstp.vbe
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\system32\mslral.vbe

Děkuji moc za odpověď. Teď už log z RSIT.


C:\Users\ThinkPad\AppData\Local\Common\csag.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\Lenovo Fingerprint Reader\x86\IEWebSiteLogon.exe
C:\Program Files\trend micro\ThinkPad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.reerd.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll
O2 - BHO: TrueSuite Browser Helper Object - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files\Lenovo Fingerprint Reader\x86\IEBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll
O2 - BHO: Adblock Plus for IE Browser Helper Object - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Razer Synapse] "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"
O4 - HKLM\..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [AppEx Accelerator UI] C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe -h
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\PROGRAM FILES\CCLEANER\CCLEANER64.EXE" /MONITOR
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [cscommon] C:\Users\ThinkPad\AppData\Local\Common\csag.exe
O4 - HKCU\..\Run: [GSplay.exe] C:\Users\ThinkPad\Desktop\GSplay.exe
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\WINDOWS\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira Service Host (Avira.OE.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
O23 - Service: @oem18.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service (BcmBtRSupport) - Unknown owner - C:\WINDOWS\system32\BtwRSupportService.exe (file missing)
O23 - Service: Conexant Audio Message Service (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: EasyAntiCheat - EasyAntiCheat Ltd - C:\WINDOWS\system32\EasyAntiCheat.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: TrueSuiteService (FPLService) - AuthenTec, Inc - C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @oem9.inf,%ibm.svcDesc0%;Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe (file missing)
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Razer Game Scanner (Razer Game Scanner Service) - Unknown owner - C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Spyware Terminator 2012 Realtime Shield Service (ST2012_Svc) - Crawler.com - C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: TrueAPI Service component (TrueService) - AuthenTec, Inc. - C:\Program Files\Common Files\AuthenTec\TrueService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9069 bytes

======Listing Processes======





wininit.exe

winlogon.exe

C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
"dwm.exe"
"C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe"
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\atiesrxx.exe
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
atieclxx
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-918aebe1-d1f4-43d2-bd0f-02346bd974cf -SystemEventPortName:HostProcess-424a9cc6-5c44-4bd3-bdc4-e0e95196961e -IoCancelEventPortName:HostProcess-70d571ba-d478-4d00-97c3-9c66f73a5ddd -NonStateChangingEventPortName:HostProcess-341d00da-ef8a-4353-b951-d9958d533df5 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:0b7c40be-b1f1-4dca-818e-0f2e6b05f941 -DeviceGroupId:
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k WbioSvcGroup
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
C:\Windows\system32\CxAudMsg64.exe
dashost.exe {5ee5d348-069c-4514-8caa3f7e3889b714}
"C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe"
"C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe"
"C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
"C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe"
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\unsecapp.exe -Embedding
taskeng.exe {FF755F2E-86BF-4554-8EE4-93097A1C5807}
taskhostex.exe
"\Program Files\Synaptics\SynTP\SynTPEnh.exe"
C:\WINDOWS\Explorer.EXE
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
C:\Program Files\LENOVO\HOTKEY\tpnumlkd.exe
C:\PROGRA~1\Lenovo\HOTKEY\MKRMSG.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.MediaKey
C:\PROGRA~1\Lenovo\HOTKEY\TPOSD.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
"C:\Program Files\Lenovo Fingerprint Reader\TouchControl.exe"
"C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_00000678
"C:\Program Files\Common Files\AuthenTec\TrueService.exe"
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
/ChildServer
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files\Lenovo\HOTKEY\extapsup.exe"
"C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe"
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe"
"C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe"
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
"C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe" -h
"C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" /ELEVATED
"C:\Users\ThinkPad\AppData\Local\Common\csag.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0

"C:\Program Files\Lenovo Fingerprint Reader\x86\IEWebSiteLogon.exe"
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 580 584 592 65536 588
"C:\Users\ThinkPad\Desktop\RSITx64.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\WINDOWS\tasks\Synaptics TouchPad Enhancements.job - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\ThinkPad\AppData\Roaming\Mozilla\Firefox\Profiles\q1zt48l3.default

prefs.js - "browser.startup.homepage" - "https://www.google.cz/?gws_rd=ssl"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 17.0.0.134 Plugin
"Path"=C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@authentec.com/ffwloplugin]
"Description"=
"Path"=C:\Program Files\Lenovo Fingerprint Reader\npffwloplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.31.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.31.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 17.0.0.134 Plugin
"Path"=C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll


C:\Users\ThinkPad\AppData\Roaming\Mozilla\Firefox\Profiles\q1zt48l3.default\extensions\
abs@avira.com

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8590886E-EC8C-43C1-A32C-E4C2B0B6395B}]
TrueSuite Browser Helper Object - C:\Program Files\Lenovo Fingerprint Reader\IEBHO.DLL [2013-08-07 2518312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFCB3198-32F3-4E8B-9539-4324694ED664}]
Adblock Plus for IE Browser Helper Object - C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2015-02-25 728840]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-24 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8590886E-EC8C-43C1-A32C-E4C2B0B6395B}]
TrueSuite Browser Helper Object - C:\Program Files\Lenovo Fingerprint Reader\x86\IEBHO.dll [2013-08-07 2353448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-24 172968]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FFCB3198-32F3-4E8B-9539-4324694ED664}]
Adblock Plus for IE Browser Helper Object - C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-02-25 617736]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"LenovoOptMouseUpdate"=C:\Program Files\Lenovo\HOTKEY\extapsup.exe [2013-06-20 255480]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SACpl.exe [2012-06-13 1647616]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [2012-06-14 887968]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-04-24 2963184]
"SpywareTerminatorShield"=C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2012-09-07 2777296]
"SpywareTerminatorUpdater"=C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [2014-11-04 3681656]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AppEx Accelerator UI"=C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [2012-05-22 1000288]
"CCleaner Monitoring"=C:\PROGRAM FILES\CCLEANER\CCLEANER64.EXE [2014-11-21 7063832]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]
"cscommon"=C:\Users\ThinkPad\AppData\Local\Common\csag.exe [2015-03-02 1342464]
"GSplay.exe"=C:\Users\ThinkPad\Desktop\GSplay.exe [2014-03-12 4772747]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [2014-07-04 766688]
""= []
"Razer Synapse"=C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [2014-11-03 585536]
"Avira Systray"=C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [2015-01-19 126712]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2015-03-12 703280]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-03-15 20:44:00 ----D---- C:\_OTM
2015-03-14 22:44:09 ----D---- C:\ProgramData\LogMeIn
2015-03-14 09:47:34 ----D---- C:\ProgramData\McAfee
2015-03-13 23:02:53 ----D---- C:\AdwCleaner
2015-03-13 22:23:50 ----D---- C:\Program Files (x86)\FTL
2015-03-13 22:14:36 ----D---- C:\Program Files\trend micro
2015-03-13 22:14:35 ----D---- C:\rsit
2015-03-11 21:19:30 ----D---- C:\Users\ThinkPad\AppData\Roaming\OpenOffice
2015-03-11 21:17:11 ----D---- C:\Program Files (x86)\OpenOffice 4
2015-03-11 14:54:36 ----D---- C:\Program Files (x86)\Bf2SP64 2.32
2015-03-11 13:29:54 ----D---- C:\Skladiště her bez ladu a skladu
2015-03-11 13:19:35 ----A---- C:\WINDOWS\SYSWOW64\SHCore.dll
2015-03-11 13:19:35 ----A---- C:\WINDOWS\system32\SHCore.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\lpk.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\fontsub.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\dciman32.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\atmlib.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\SYSWOW64\atmfd.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\lpk.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\fontsub.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\dciman32.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\atmlib.dll
2015-03-11 13:19:24 ----A---- C:\WINDOWS\system32\atmfd.dll
2015-03-11 13:19:21 ----A---- C:\WINDOWS\SYSWOW64\photowiz.dll
2015-03-11 13:19:21 ----A---- C:\WINDOWS\system32\photowiz.dll
2015-03-11 13:19:03 ----A---- C:\WINDOWS\system32\win32spl.dll
2015-03-11 13:19:03 ----A---- C:\WINDOWS\system32\pmcsnap.dll
2015-03-11 13:19:03 ----A---- C:\WINDOWS\system32\localspl.dll
2015-03-11 13:19:00 ----A---- C:\WINDOWS\system32\puiobj.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\puiobj.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\puiapi.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\prnntfy.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\DafPrintProvider.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\SYSWOW64\compstui.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\puiapi.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\prnntfy.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\ppcsnap.dll
2015-03-11 13:18:59 ----A---- C:\WINDOWS\system32\DafPrintProvider.dll
2015-03-11 13:18:58 ----A---- C:\WINDOWS\SYSWOW64\printui.exe
2015-03-11 13:18:58 ----A---- C:\WINDOWS\SYSWOW64\findnetprinters.dll
2015-03-11 13:18:58 ----A---- C:\WINDOWS\system32\printui.exe
2015-03-11 13:18:58 ----A---- C:\WINDOWS\system32\findnetprinters.dll
2015-03-11 13:18:58 ----A---- C:\WINDOWS\system32\compstui.dll
2015-03-11 13:18:56 ----A---- C:\WINDOWS\system32\win32k.sys
2015-03-11 13:18:55 ----A---- C:\WINDOWS\system32\schannel.dll
2015-03-11 13:18:54 ----A---- C:\WINDOWS\SYSWOW64\schannel.dll
2015-03-11 13:18:53 ----A---- C:\WINDOWS\SYSWOW64\StorageContextHandler.dll
2015-03-11 13:18:53 ----A---- C:\WINDOWS\system32\StorageContextHandler.dll
2015-03-11 13:18:51 ----A---- C:\WINDOWS\SYSWOW64\msftedit.dll
2015-03-11 13:18:51 ----A---- C:\WINDOWS\system32\msftedit.dll
2015-03-11 13:18:49 ----A---- C:\WINDOWS\SYSWOW64\authui.dll
2015-03-11 13:18:49 ----A---- C:\WINDOWS\system32\authui.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\SYSWOW64\WSShared.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\system32\WSShared.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-11 13:18:45 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-03-11 13:18:44 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-11 13:18:44 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.dll
2015-03-11 13:18:44 ----A---- C:\WINDOWS\system32\WSReset.exe
2015-03-11 13:18:44 ----A---- C:\WINDOWS\system32\WSCollect.exe
2015-03-11 13:18:19 ----A---- C:\WINDOWS\SYSWOW64\calc.exe
2015-03-11 13:18:19 ----A---- C:\WINDOWS\system32\calc.exe
2015-03-11 13:18:17 ----A---- C:\WINDOWS\SYSWOW64\dwmcore.dll
2015-03-11 13:18:17 ----A---- C:\WINDOWS\system32\dwmcore.dll
2015-03-11 13:18:11 ----A---- C:\WINDOWS\system32\drivers\WdFilter.sys
2015-03-11 13:18:10 ----A---- C:\WINDOWS\system32\drivers\WdNisDrv.sys
2015-03-11 13:18:10 ----A---- C:\WINDOWS\system32\drivers\WdBoot.sys
2015-03-11 13:18:07 ----A---- C:\WINDOWS\SYSWOW64\winshfhc.dll
2015-03-11 13:18:07 ----A---- C:\WINDOWS\system32\winshfhc.dll
2015-03-11 13:17:29 ----A---- C:\WINDOWS\system32\drivers\ndis.sys
2015-03-11 13:17:26 ----A---- C:\WINDOWS\system32\atlthunk.dll
2015-03-11 13:17:25 ----A---- C:\WINDOWS\SYSWOW64\D3DCompiler_47.dll
2015-03-11 13:17:25 ----A---- C:\WINDOWS\SYSWOW64\atlthunk.dll
2015-03-11 13:17:25 ----A---- C:\WINDOWS\system32\D3DCompiler_47.dll
2015-03-11 13:17:24 ----A---- C:\WINDOWS\SYSWOW64\mfc42u.dll
2015-03-11 13:17:24 ----A---- C:\WINDOWS\system32\mfc42u.dll
2015-03-11 13:17:23 ----A---- C:\WINDOWS\SYSWOW64\mfc42.dll
2015-03-11 13:17:23 ----A---- C:\WINDOWS\system32\mfc42.dll
2015-03-11 13:17:20 ----AC---- C:\WINDOWS\system32\drivers\bthport.sys
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\fsquirt.exe
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\rfcomm.sys
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\hidbth.sys
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\BTHUSB.SYS
2015-03-11 13:17:19 ----AC---- C:\WINDOWS\system32\drivers\bthenum.sys
2015-03-11 13:17:10 ----A---- C:\WINDOWS\system32\mshtml.dll
2015-03-11 13:17:07 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2015-03-11 13:17:05 ----A---- C:\WINDOWS\system32\jscript9.dll
2015-03-11 13:17:03 ----A---- C:\WINDOWS\system32\ieframe.dll
2015-03-11 13:17:01 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2015-03-11 13:16:57 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2015-03-11 13:16:57 ----A---- C:\WINDOWS\system32\wininet.dll
2015-03-11 13:16:56 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2015-03-11 13:16:56 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2015-03-11 13:16:56 ----A---- C:\WINDOWS\system32\iertutil.dll
2015-03-11 13:16:55 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2015-03-11 13:16:55 ----A---- C:\WINDOWS\system32\urlmon.dll
2015-03-11 13:16:55 ----A---- C:\WINDOWS\system32\inetcomm.dll
2015-03-11 13:16:54 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2015-03-11 13:16:54 ----A---- C:\WINDOWS\SYSWOW64\msfeeds.dll
2015-03-11 13:16:54 ----A---- C:\WINDOWS\SYSWOW64\inetcomm.dll
2015-03-11 13:16:51 ----A---- C:\WINDOWS\system32\vbscript.dll
2015-03-11 13:16:50 ----A---- C:\WINDOWS\system32\msfeeds.dll
2015-03-11 13:16:50 ----A---- C:\WINDOWS\system32\iepeers.dll
2015-03-11 13:16:50 ----A---- C:\WINDOWS\system32\dxtrans.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\webcheck.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\mshtmled.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\MshtmlDac.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\SYSWOW64\dxtrans.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\webcheck.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\MshtmlDac.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\jscript9diag.dll
2015-03-11 13:16:49 ----A---- C:\WINDOWS\system32\actxprxy.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\SYSWOW64\iepeers.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\SYSWOW64\ieapfltr.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\mshtmled.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\jscript.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2015-03-11 13:16:48 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2015-03-11 13:16:15 ----A---- C:\WINDOWS\SYSWOW64\WMPhoto.dll
2015-03-11 13:16:15 ----A---- C:\WINDOWS\system32\WMPhoto.dll
2015-03-11 13:16:15 ----A---- C:\WINDOWS\system32\msctf.dll
2015-03-11 13:16:14 ----A---- C:\WINDOWS\SYSWOW64\msctf.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\rfxvmt.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\rdpudd.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\rdpcorets.dll
2015-03-11 13:16:13 ----A---- C:\WINDOWS\system32\drivers\rdpvideominiport.sys
2015-03-11 13:16:12 ----A---- C:\WINDOWS\system32\ubpm.dll
2015-03-11 13:16:10 ----A---- C:\WINDOWS\SYSWOW64\WindowsCodecs.dll
2015-03-11 13:16:10 ----A---- C:\WINDOWS\system32\WindowsCodecs.dll
2015-03-11 13:16:08 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2015-03-11 13:16:08 ----A---- C:\WINDOWS\system32\shell32.dll
2015-03-11 13:15:58 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2015-03-11 13:15:57 ----A---- C:\WINDOWS\SYSWOW64\ntdll.dll
2015-03-11 13:15:57 ----A---- C:\WINDOWS\system32\ntdll.dll
2015-03-11 13:15:56 ----A---- C:\WINDOWS\explorer.exe
2015-03-11 13:15:55 ----A---- C:\WINDOWS\SYSWOW64\explorer.exe
2015-03-11 13:15:54 ----A---- C:\WINDOWS\SYSWOW64\MrmCoreR.dll
2015-03-11 13:15:54 ----A---- C:\WINDOWS\system32\MrmCoreR.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eappprxy.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eapphost.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eappgnui.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eappcfg.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\SYSWOW64\eapp3hst.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eappprxy.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eapphost.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eappgnui.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eappcfg.dll
2015-03-11 13:15:53 ----A---- C:\WINDOWS\system32\eapp3hst.dll
2015-03-11 13:15:52 ----A---- C:\WINDOWS\system32\LockScreenContentServer.exe
2015-03-07 13:53:51 ----D---- C:\Users\ThinkPad\AppData\Roaming\PSpad
2015-03-07 13:53:39 ----D---- C:\Program Files (x86)\PSPad editor
2015-03-06 15:14:15 ----D---- C:\Program Files (x86)\Mozilla Firefox
2015-03-05 14:02:10 ----D---- C:\Users\ThinkPad\AppData\Roaming\TeamViewer
2015-03-03 13:51:14 ----AD---- C:\ProgramData\TEMP
2015-03-03 13:51:03 ----D---- C:\Program Files (x86)\CamSpace
2015-03-02 16:57:59 ----D---- C:\Program Files (x86)\X Plugin Manager
2015-03-02 16:45:19 ----D---- C:\Program Files (x86)\X3 ModManager
2015-03-02 14:14:11 ----D---- C:\Program Files (x86)\X3CZ
2015-02-28 19:20:03 ----D---- C:\Program Files (x86)\Star Wars Jedi Knight - Jedi Academy
2015-02-28 18:32:11 ----A---- C:\TDSSKiller.3.0.0.44_28.02.2015_18.32.11_log.txt
2015-02-27 23:51:35 ----A---- C:\Program Files (x86)\Readme.txt
2015-02-27 23:51:35 ----A---- C:\Program Files (x86)\EULA.txt
2015-02-27 23:48:49 ----A---- C:\WINDOWS\unvise32.exe
2015-02-27 23:48:39 ----D---- C:\Program Files (x86)\DivX
2015-02-27 23:46:41 ----D---- C:\Program Files (x86)\Sierra
2015-02-27 12:44:18 ----D---- C:\Program Files (x86)\Mozilla Firefox.bak
2015-02-26 09:51:46 ----A---- C:\WINDOWS\system32\drivers\avnetflt.sys
2015-02-26 09:47:50 ----D---- C:\Users\ThinkPad\AppData\Roaming\Avira
2015-02-26 09:44:57 ----A---- C:\WINDOWS\system32\drivers\avkmgr.sys
2015-02-26 09:44:56 ----A---- C:\WINDOWS\system32\drivers\avipbb.sys
2015-02-26 09:44:56 ----A---- C:\WINDOWS\system32\drivers\avgntflt.sys
2015-02-26 09:41:48 ----D---- C:\ProgramData\Avira
2015-02-25 14:52:08 ----A---- C:\WINDOWS\SYSWOW64\Windows.Globalization.dll
2015-02-25 14:52:08 ----A---- C:\WINDOWS\SYSWOW64\GlobCollationHost.dll
2015-02-25 14:52:08 ----A---- C:\WINDOWS\system32\Windows.Globalization.dll
2015-02-25 14:52:08 ----A---- C:\WINDOWS\system32\GlobCollationHost.dll
2015-02-25 13:02:18 ----D---- C:\Users\ThinkPad\AppData\Roaming\wld
2015-02-22 11:09:05 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2015-02-21 23:17:21 ----D---- C:\Program Files (x86)\SpeedFan
2015-02-17 18:21:50 ----AH---- C:\WINDOWS\system32\drivers\Hamdrv.sys
2015-02-16 09:51:47 ----D---- C:\Program Files (x86)\DOSBox-0.74

======List of files/folders modified in the last 1 month======

2015-03-15 20:50:42 ----D---- C:\WINDOWS\Temp
2015-03-15 20:50:40 ----D---- C:\WINDOWS\Prefetch
2015-03-15 20:48:23 ----D---- C:\WINDOWS\system32\sru
2015-03-15 20:46:25 ----D---- C:\Windows
2015-03-15 20:44:01 ----RD---- C:\Program Files (x86)\Skype
2015-03-15 20:44:01 ----D---- C:\WINDOWS\Tasks
2015-03-15 20:44:01 ----D---- C:\WINDOWS\SysWOW64
2015-03-15 20:44:01 ----D---- C:\WINDOWS\Inf
2015-03-15 20:40:59 ----SHD---- C:\System Volume Information
2015-03-15 19:12:58 ----D---- C:\WINDOWS\Microsoft.NET
2015-03-15 16:29:09 ----D---- C:\Program Files\Steam
2015-03-15 10:52:32 ----SHD---- C:\WINDOWS\Installer
2015-03-15 10:52:31 ----RD---- C:\Program Files (x86)
2015-03-15 08:18:23 ----D---- C:\Users\ThinkPad\AppData\Roaming\Skype
2015-03-15 00:28:02 ----RD---- C:\WINDOWS\System32
2015-03-15 00:28:02 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2015-03-14 22:44:09 ----HD---- C:\ProgramData
2015-03-14 22:38:00 ----D---- C:\WINDOWS\system32\drivers
2015-03-14 12:42:27 ----D---- C:\Program Files (x86)\Battle.net
2015-03-14 12:21:12 ----D---- C:\WINDOWS\system32\config
2015-03-14 12:16:41 ----D---- C:\WINDOWS\debug
2015-03-14 11:17:02 ----D---- C:\WINDOWS\SoftwareDistribution
2015-03-14 11:14:55 ----D---- C:\ProgramData\Conexant
2015-03-14 11:12:16 ----D---- C:\Users\ThinkPad\AppData\Roaming\DAEMON Tools Lite
2015-03-14 11:09:52 ----D---- C:\ProgramData\Skype
2015-03-14 10:27:54 ----D---- C:\WINDOWS\AppReadiness
2015-03-14 10:27:53 ----HD---- C:\Program Files\WindowsApps
2015-03-13 22:14:36 ----RD---- C:\Program Files
2015-03-13 18:34:06 ----D---- C:\WINDOWS\rescache
2015-03-13 16:25:30 ----D---- C:\WINDOWS\system32\DriverStore
2015-03-13 16:24:41 ----D---- C:\WINDOWS\WinSxS
2015-03-13 13:13:43 ----D---- C:\ProgramData\Spyware Terminator
2015-03-12 12:57:13 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-11 22:42:59 ----D---- C:\WINDOWS\system32\catroot
2015-03-11 22:41:17 ----D---- C:\Program Files\Windows Defender
2015-03-11 22:41:16 ----D---- C:\Program Files (x86)\Windows Defender
2015-03-11 22:41:15 ----D---- C:\WINDOWS\PolicyDefinitions
2015-03-11 22:41:14 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2015-03-11 22:41:14 ----D---- C:\WINDOWS\system32\cs-CZ
2015-03-11 22:41:13 ----RD---- C:\WINDOWS\ToastData
2015-03-11 22:41:11 ----D---- C:\WINDOWS\WinStore
2015-03-11 22:41:09 ----D---- C:\Program Files\Internet Explorer
2015-03-11 22:41:09 ----D---- C:\Program Files (x86)\Internet Explorer
2015-03-11 21:18:45 ----RSD---- C:\WINDOWS\assembly
2015-03-11 21:17:41 ----RSD---- C:\WINDOWS\Fonts
2015-03-11 20:00:49 ----D---- C:\WINDOWS\CbsTemp
2015-03-11 19:51:51 ----D---- C:\WINDOWS\system32\MRT
2015-03-11 19:48:27 ----A---- C:\WINDOWS\system32\MRT.exe
2015-03-11 13:34:45 ----D---- C:\Program Files (x86)\Electronic Arts
2015-03-11 13:34:36 ----D---- C:\Program Files (x86)\EA Sports
2015-03-11 13:33:04 ----D---- C:\Martin
2015-03-11 13:11:50 ----D---- C:\WINDOWS\system32\catroot2
2015-03-05 20:38:00 ----D---- C:\Program Files (x86)\R.G. Mechanics
2015-03-05 16:14:16 ----D---- C:\WINDOWS\system32\Tasks
2015-03-04 22:24:42 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2015-03-01 09:57:36 ----D---- C:\Users\ThinkPad\AppData\Roaming\vlc
2015-02-26 09:50:11 ----D---- C:\Program Files\Adblock Plus for IE
2015-02-26 09:44:46 ----D---- C:\Program Files (x86)\Avira
2015-02-26 09:41:23 ----D---- C:\OETemp
2015-02-26 09:36:54 ----D---- C:\ProgramData\Package Cache
2015-02-24 18:05:39 ----D---- C:\ProgramData\Oracle
2015-02-24 18:05:27 ----D---- C:\Program Files (x86)\Java
2015-02-24 18:05:01 ----D---- C:\Program Files (x86)\Common Files
2015-02-24 18:04:31 ----A---- C:\WINDOWS\SYSWOW64\WindowsAccessBridge-32.dll
2015-02-23 17:09:27 ----D---- C:\Users\ThinkPad\AppData\Roaming\My Battle for Middle-earth(tm) II Files
2015-02-16 21:42:17 ----D---- C:\WINDOWS\system32\NDF

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 speedfan;speedfan; C:\WINDOWS\SysWOW64\speedfan.sys [2012-12-29 28664]
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2015-03-12 132120]
R1 avkmgr;avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [2014-11-24 28600]
R1 dtsoftbus01;@oem8.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\System32\drivers\dtsoftbus01.sys [2014-12-24 283064]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\WINDOWS\system32\DRIVERS\vwififlt.sys [2014-04-30 71680]
R2 AODDriver4.2.0;AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2013-09-20 59648]
R2 APXACC;@oem5.inf,%APPEX_ACC_SERVICE_NAME%;AppEx Networks Accelerator LWF; C:\WINDOWS\system32\DRIVERS\appexDrv.sys [2012-06-23 199008]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2015-03-12 128536]
R2 rzpmgrk;rzpmgrk; \??\C:\WINDOWS\system32\drivers\rzpmgrk.sys [2014-12-09 37184]
R2 rzpnk;rzpnk; \??\C:\WINDOWS\system32\drivers\rzpnk.sys [2014-12-10 129600]
R2 sp_rsdrv2;Spyware Terminator Driver Filter; C:\WINDOWS\system32\DRIVERS\stflt.sys [2015-01-27 51496]
R3 amdkmdag;amdkmdag; C:\WINDOWS\system32\DRIVERS\atikmdag.sys [2014-07-21 13209088]
R3 amdkmdap;amdkmdap; C:\WINDOWS\system32\DRIVERS\atikmpag.sys [2014-07-21 626688]
R3 AtiHDAudioService;@oem4.inf,%ATIHdAudioDriver.SvcDesc%;AMD Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdW86.sys [2012-08-21 91648]
R3 bcbtums;@oem18.inf,%BCBTUMS.SvcDesc%;Bluetooth RAM Firmware Download USB Filter; C:\WINDOWS\system32\drivers\bcbtums.sys [2013-09-04 170712]
R3 BCM43XX;@netbc64.inf,%BCM43XX_Service_DispName%;Broadcom 802.11 – ovladač síťového adaptéru; C:\WINDOWS\system32\DRIVERS\bcmwl63a.sys [2013-07-01 8536752]
R3 BthEnum;@bth.inf,%BthEnum.SVCDESC%;Služba Bluetooth Enumerator; C:\WINDOWS\System32\drivers\BthEnum.sys [2014-10-29 53248]
R3 BthLEEnum;@bthleenum.inf,%BthLEEnum.SVCDESC%;Ovladač úspory energie technologie Bluetooth; C:\WINDOWS\system32\DRIVERS\BthLEEnum.sys [2014-09-24 226304]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Zařízení Bluetooth (síť PAN); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2014-09-24 118272]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Ovladač rozhraní USB radiostanice Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2014-10-29 81920]
R3 CnxtHdAudService;@oem11.inf,%UAAFunctionDriverForHdAudio.SvcDesc%;Conexant UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\CHDRT64.sys [2012-09-20 1609376]
R3 IBMPMDRV;IBMPMDRV; C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys [2014-11-14 60112]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\System32\drivers\rfcomm.sys [2015-01-30 167424]
R3 RSP2STOR;@oem16.inf,%Rts5229%;Realtek PCIE CardReader Driver - P2; C:\WINDOWS\system32\DRIVERS\RtsP2Stor.sys [2012-12-13 288480]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\WINDOWS\system32\DRIVERS\Rt630x64.sys [2013-06-18 591360]
R3 rzdaendpt;@oem20.inf,%rzdaendpt.SvcDesc%;Razer DeathAdder end point; C:\WINDOWS\System32\drivers\rzdaendpt.sys [2014-09-05 33448]
R3 rzudd;@oem37.inf,%Razer.SvcDesc%;Razer Mouse Driver; C:\WINDOWS\System32\drivers\rzudd.sys [2014-09-05 160424]
R3 rzvkeyboard;@oem29.inf,%rzvkeyboard%;Razer Virtual Keyboard Driver; C:\WINDOWS\System32\drivers\rzvkeyboard.sys [2014-09-05 31912]
R3 SmbDrv;SmbDrv; C:\WINDOWS\system32\DRIVERS\Smb_driver_AMDASF.sys [2013-04-26 29424]
R3 SynTP;@oem10.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2013-04-24 460528]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;Zobrazovací zařízení USB (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2013-08-22 212224]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\WINDOWS\system32\DRIVERS\vwifimp.sys [2014-04-30 38912]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Ovladač portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2014-10-29 1198080]
S3 btwampfl;@oem18.inf,%btwampfl.ServiceName%;btwampfl; C:\WINDOWS\system32\DRIVERS\btwampfl.sys [2013-09-04 166104]
S3 Hamachi;LogMeIn Hamachi Virtual Miniport); C:\WINDOWS\system32\DRIVERS\Hamdrv.sys [2015-02-17 44296]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\WINDOWS\system32\atiesrxx.exe [2014-07-21 239616]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2014-07-04 344064]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2015-03-12 432888]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2015-03-12 432888]
R2 Avira.OE.ServiceHost;Avira Service Host; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [2015-01-19 182520]
R2 CxAudMsg;Conexant Audio Message Service; C:\Windows\system32\CxAudMsg64.exe [2012-06-08 201376]
R2 FPLService;TrueSuiteService; C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe [2013-08-07 2139944]
R2 IBMPMSVC;@oem9.inf,%ibm.svcDesc0%;Lenovo PM Service; C:\WINDOWS\system32\ibmpmsvc.exe [2014-11-14 84208]
R2 IconMan_R;IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-11-15 2468496]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-04-07 110128]
R2 Razer Game Scanner Service;Razer Game Scanner; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [2014-12-09 186048]
R2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [2012-09-07 1148664]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 124400]
R3 TrueService;TrueAPI Service component; C:\Program Files\Common Files\AuthenTec\TrueService.exe [2013-07-22 401704]
S2 BcmBtRSupport;@oem18.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service; C:\WINDOWS\system32\BtwRSupportService.exe [2013-09-04 2252504]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-01 107912]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-01-02 315488]
S3 EasyAntiCheat;EasyAntiCheat; C:\WINDOWS\syswow64\EasyAntiCheat.exe [2014-12-25 175136]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2013-08-03 43696]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-01 107912]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2015-03-06 148080]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2015-02-19 835776]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119677
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Jak zjistit v PC keylogger?

#12 Příspěvek od Rudy »

Dvouklikem na soubor C:\Program Files\trend micro\ThinkPad.exe spusťte HijackThis. Klikněte na "Do a system scan only" a v otevřeném okně vlevo ve čtverečcích zaškrtněte:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.reerd.com
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (file missing)
Klikněte na >FixChecked<. Pak znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC.

Dále bych doporučil otestovat online na www.virustotal.com tento soubor: C:\Users\ThinkPad\AppData\Local\Common\csag.exe . Výsledek oznamte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Lorgan
Návštěvník
Návštěvník
Příspěvky: 51
Registrován: 19 lis 2013 12:24
Bydliště: Přístup k údajům o bydlení vyžaduje bezpečnostní prověrku pátého stupně :P

Re: Jak zjistit v PC keylogger?

#13 Příspěvek od Lorgan »

Dobrý den,

Jeden z 57 antivirových programů, které soubor testovali nalezl virus Trojan-Downloader.win32.Small.gen.105. našel jej antivir Byte Hero. Prosím poradíte mi co s tím mám dělat?
Nahoru
Uživatelský avatar
cernohous13
VIP in memoriam
VIP in memoriam
Příspěvky: 8721
Registrován: 09 pro 2006 06:19
Bydliště: Jablonec nad Nisou
Kontaktovat uživatele:
Kontaktovat uživatele cernohous13

Re: Jak zjistit v PC keylogger?

#14 Příspěvek od cernohous13 »

Zdravím a kolega promine :oops:
Je to něco nového a další tvůrci AV programů postupně reagují
http://www.threatexpert.com/files/csag.exe.html

a neboj, Rudy už ho zneškodní :D
Doporučení:
V průběhu léčení prováděj nové instalace a odinstalace jen na můj pokyn.
Důkladně prostuduj a proveď celou operaci podle mé odpovědi.
V případě nejasností se zeptej - vysvětlím Obrázek

-------------------------------------------------------------------------------------------------
> Podpora fóra <
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119677
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: Jak zjistit v PC keylogger?

#15 Příspěvek od Rudy »

Tak to ani mazat nemusíte, pokud světové antiviry k němu mlčí. Klidně ho ale pro jistotu můžete smazat, chod systému by to ovlivnit nemělo. Určitě to ale není keylogger.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“