Dobrý den, prosím Vás o preventivku
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:19-11-2015
Ran by hynek (administrator) on ESPRIMO (20-11-2015 13:33:24)
Running from C:\Users\hynek.HBWARE\Desktop
Loaded Profiles: hynek (Available Profiles: hynek & hynek)
Platform: Microsoft® Windows Vista™ Business (X86) Language: Čeština (Česká republika)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(brother Industries Ltd) C:\Windows\System32\brsvc01a.exe
(brother Industries Ltd) C:\Windows\System32\brss01a.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Oki Data Corporation) C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(TOSHIBA CORPORATION) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
() C:\Program Files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe
() C:\Program Files\FSC\WebCam HotKey Utility\Webcam_HotKey.exe
(FinePrint Software, LLC) C:\Windows\System32\spool\drivers\w32x86\3\fppdis2a.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(RealNetworks, Inc.) C:\Program Files\Real\realplayer\Update\realsched.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(ITE Tech Inc.) C:\Program Files\FSC\Wireless Utility\WirelessSelector.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corp.) C:\Windows\System32\Defrag.exe
(Microsoft Corp.) C:\Windows\System32\DfrgNtfs.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
(Microsoft Corporation) C:\Windows\System32\wercon.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
(forum.viry.cz) C:\Users\hynek.HBWARE\Desktop\FRSTLauncher.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-09-12] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4489216 2007-06-13] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-05-28] (Realtek Semiconductor Corp.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [174616 2007-07-24] (Intel Corporation)
HKLM\...\Run: [TouchPadHotKey] => C:\Program Files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe [360448 2007-06-26] ()
HKLM\...\Run: [WebCamHotKey] => C:\Program Files\FSC\WebCam HotKey Utility\WebCam_HotKey.exe [376832 2007-06-26] ()
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [76304 2008-02-29] (Logitech, Inc.)
HKLM\...\Run: [pdfFactory Pro Dispatcher v2] => C:\Windows\system32\spool\DRIVERS\W32X86\3\fppdis2a.exe [479232 2005-03-03] (FinePrint Software, LLC)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [38840 2011-01-30] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [640440 2010-09-22] (Adobe Systems Inc.)
HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [981688 2015-04-29] (Microsoft Corporation)
HKLM\...\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [296056 2012-06-25] (RealNetworks, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [WinSent Messenger] => "C:\Program Files\WinSent Messenger\winsent.exe"
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [PID] => C:\Users\HYNEK~1.HBW\AppData\Local\Temp\Invoice_08.22.2011_Stor?cod.exe <===== ATTENTION
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [Google Update] => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-11-18] (Google Inc.)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [22568216 2015-10-12] (Google)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [GoogleChromeAutoLaunch_5E835259BEFB7618610CEBCBC68C4630] => C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe [811848 2015-11-07] (Google Inc.)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: E - E:\ActivateWarranty.exe
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {780c03e0-067e-11e4-af2d-806e6f6e6963} - E:\ActivateWarranty.exe
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {b95ff222-f8b7-11de-b9c9-001a6b28d8b7} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...0c966feabec1\InprocServer32: [Default-shell32] ATTENTION! ====> ZeroAccess?
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...409d6c4515e9\InprocServer32: [Default-shell32] <==== ATTENTION
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...A8F59079A8D5}\localserver32: <==== ATTENTION
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: [S-1-5-21-1715567821-507921405-1957994488-1150] => hbwares:8080
AutoConfigURL: [S-1-5-21-1715567821-507921405-1957994488-1150] => hbwares:8080
Winsock: Catalog5 04 C:\Windows\system32\napinsp.dll [50176 2006-11-02] (Společnost Microsoft)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [152864 2010-10-07] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.10.1
Tcpip\..\Interfaces\{74A54890-99E2-4483-86D6-4E456C1A0C9F}: [DhcpNameServer] 192.168.88.1
Tcpip\..\Interfaces\{CACC0914-1A62-420D-ABD5-5C3C9CADBDD7}: [DhcpNameServer] 192.168.10.1
Tcpip\..\Interfaces\{DF5D0A04-4B97-410D-8879-9041BD60F144}: [DhcpNameServer] 93.153.117.1 93.153.117.33
Internet Explorer:
==================
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.fujitsu-siemens.com/index2
SearchScopes: HKU\S-1-5-21-1715567821-507921405-1957994488-1150 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22] (Adobe Systems Incorporated)
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2012-06-25] (RealPlayer)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-05-07] (Oracle Corporation)
BHO: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-05-07] (Oracle Corporation)
BHO: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1715567821-507921405-1957994488-1150 -> Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} hxxps://www.mojedatovaschranka.cz/static/pages/ ... ?3,16,13,0
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FireFox:
========
FF ProfilePath: C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default
FF Homepage: hxxp://seznam.cz/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-18] ()
FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-05-07] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-05-07] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.4.53 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.4.53 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=15.0.4.53 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll [2012-06-25] (RealPlayer)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1715567821-507921405-1957994488-1150: @tools.google.com/Google Update;version=3 -> C:\Users\hynek.HBWARE\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1715567821-507921405-1957994488-1150: @tools.google.com/Google Update;version=9 -> C:\Users\hynek.HBWARE\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-27] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2011-03-12] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprjplug.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2012-06-25] (RealPlayer)
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\extensions\2020Player_IKEA@2020Technologies.com [2012-04-02] [not signed]
FF Extension: Garmin Communicator - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-07-19] [not signed]
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-06-25] [not signed]
FF Extension: Dman Data Editor - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\Extensions\npdmaned@onyxsoftware.cz [2011-02-18] [not signed]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-27] [not signed]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2012-10-23] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-02] [not signed]
FF HKLM\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
Chrome:
=======
CHR Plugin: (Native Client) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\46.0.2490.86\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\46.0.2490.86\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\46.0.2490.86\gcswf32.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll => No File
CHR Plugin: (Skype Click to Call) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.0.0.10297_0\npSkypeChromePlugin.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll => No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll (RealPlayer)
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll (RealNetworks, Inc.)
CHR Plugin: (Garmin Communicator Plug-In) - C:\Program Files\Garmin GPS Plugin\npGarmin.dll => No File
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll => No File
CHR Plugin: (Software602 Form Filler) - C:\Program Files\Software602\602XML\Filler\npfiller.dll => No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll => No File
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (Google Update) - C:\Users\hynek.HBWARE\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll => No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Profile: C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Disk Google) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-19]
CHR Extension: (YouTube) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-19]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-11-19]
CHR Extension: (Vyhledávání Google) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-19]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-19]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2012-07-09]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2014-11-09]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-04]
CHR Extension: (Gmail) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-08]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-06-25]
CHR HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\HYNEK~1.HBW\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-06-19]
CHR HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2002-04-11] (brother Industries Ltd) [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2009-08-18] (Macrovision Europe Ltd.) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2015-04-30] (Microsoft Corporation)
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]
R2 OpLclSrv; C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe [147456 2014-11-20] (Oki Data Corporation) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [265912 2007-09-12] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 acpi_contactor; C:\Windows\System32\DRIVERS\acpi_contactor_vista.sys [7680 2007-04-13] (INVENTEC Corporation)
R2 Ethpdrv; C:\Windows\System32\DRIVERS\ethpdrv.sys [16376 2007-08-01] (Gemfor s.r.o.)
R3 FIXUSTOR; C:\Windows\System32\DRIVERS\fixustor.sys [15360 2009-04-23] (Genesys Logic)
R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [183912 2006-11-02] (Společnost Microsoft)
S3 GT72NDISIPXP; C:\Windows\System32\DRIVERS\Gt51Ip.sys [106624 2008-02-18] (Option N.V.)
S3 GT72UBUS; C:\Windows\System32\DRIVERS\gt72ubus.sys [59648 2008-02-08] (Option N.V.)
S3 GTPTSER; C:\Windows\System32\DRIVERS\gtptser.sys [8064 2007-03-30] (Option N.V.)
S3 GTwinUSB; C:\Windows\System32\Drivers\GTwinUSB.sys [71424 2005-04-15] (Gemplus)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2010-02-22] (MBB Incorporated) [File not signed]
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [245096 2015-03-04] (Microsoft Corporation)
R3 Ntfs; C:\Windows\system32\Drivers\Ntfs.sys [1060920 2008-05-27] (Společnost Microsoft)
S3 s125bus; C:\Windows\System32\DRIVERS\s125bus.sys [83336 2007-04-24] (MCCI Corporation)
S3 s125mdfl; C:\Windows\System32\DRIVERS\s125mdfl.sys [15112 2007-04-24] (MCCI Corporation)
S3 s125mdm; C:\Windows\System32\DRIVERS\s125mdm.sys [108680 2007-04-24] (MCCI Corporation)
S3 s125mgmt; C:\Windows\System32\DRIVERS\s125mgmt.sys [100488 2007-04-24] (MCCI Corporation)
S3 s125obex; C:\Windows\System32\DRIVERS\s125obex.sys [98696 2007-04-24] (MCCI Corporation)
S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [83880 2007-12-10] (MCCI Corporation)
S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [15016 2007-12-10] (MCCI Corporation)
S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [110632 2007-12-10] (MCCI Corporation)
S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [104616 2007-12-10] (MCCI Corporation)
S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [25512 2007-12-10] (MCCI Corporation)
S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [100648 2007-12-10] (MCCI Corporation)
S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [110120 2007-12-10] (MCCI Corporation)
S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [9604096 2007-05-24] () [File not signed]
R1 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 Netaapl; system32\DRIVERS\netaapl.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-11-20 13:33 - 2015-11-20 13:34 - 00029057 _____ C:\Users\hynek.HBWARE\Desktop\FRST.txt
2015-11-20 10:52 - 2015-11-20 13:33 - 00000000 ____D C:\FRST
2015-11-20 10:52 - 2015-11-20 10:52 - 00112640 _____ (forum.viry.cz) C:\Users\hynek.HBWARE\Desktop\FRSTLauncher.exe
2015-11-20 10:48 - 2015-11-20 10:47 - 01391104 _____ (Farbar) C:\Users\hynek.HBWARE\Desktop\FRST.exe
2015-11-20 10:47 - 2015-11-20 10:47 - 01391104 _____ (Farbar) C:\Users\hynek.HBWARE\Downloads\FRST.exe
2015-11-20 10:39 - 2015-11-20 10:39 - 00112640 _____ (forum.viry.cz) C:\Users\hynek.HBWARE\Downloads\Nepotvrzeno 928929.crdownload
2015-11-19 15:13 - 2015-11-19 15:13 - 00000000 ___HD C:\OneDriveTemp
2015-11-19 14:52 - 2015-11-19 14:53 - 02449376 _____ (Megaify Software ) C:\Users\hynek.HBWARE\Downloads\DriverToolkitInstaller.exe
2015-11-19 13:00 - 2015-11-19 13:20 - 00000000 ____D C:\Windows\system32\MRT
2015-11-19 12:12 - 2015-11-19 15:13 - 00000000 ___RD C:\Users\hynek.HBWARE\OneDrive
2015-11-19 12:12 - 2015-11-19 12:12 - 00002000 _____ C:\Users\hynek.HBWARE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-11-19 12:12 - 2015-11-19 12:12 - 00001927 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-11-19 12:12 - 2015-11-19 12:12 - 00000000 ____D C:\Program Files\Microsoft OneDrive
2015-11-19 12:12 - 2015-11-19 12:09 - 07904968 _____ (Microsoft Corporation) C:\Users\hynek.HBWARE\Downloads\OneDriveSetup.exe
2015-11-19 12:04 - 2013-02-05 08:58 - 00000104 _____ C:\Windows\system32\opnetext.ver
2015-11-19 12:04 - 2013-01-29 18:58 - 00094208 ____N (Oki Data Corporation) C:\Windows\system32\opnetext.dll
2015-11-19 12:04 - 2013-01-29 10:03 - 00010104 ____N C:\Windows\system32\OPNETEXT.HLP
2015-11-19 12:04 - 2013-01-29 10:03 - 00005832 ____N C:\Windows\system32\license.txt
2015-11-19 12:04 - 2013-01-29 10:03 - 00003844 ____N C:\Windows\system32\opnedef.str
2015-11-19 12:04 - 2013-01-29 10:03 - 00000144 ____N C:\Windows\system32\opnetext.cnt
2015-11-19 12:04 - 2013-01-29 10:03 - 00000000 ____N C:\Windows\system32\OPNETEXT.GID
2015-11-19 11:58 - 2014-04-04 14:58 - 00000000 ____D C:\Users\hynek.HBWARE\Downloads\OKW3C04O107
2015-11-19 11:58 - 2009-06-25 18:00 - 00040960 _____ (Oki Data Corporation) C:\Windows\system32\OKLMON32.DLL
2015-11-19 11:53 - 2015-11-19 11:57 - 13647416 _____ C:\Users\hynek.HBWARE\Downloads\OKW3C04O107_tcm3-138073.exe
2015-11-19 11:49 - 2015-11-19 11:49 - 00000000 ____D C:\Program Files\Okidata
2015-11-19 11:49 - 2015-11-19 11:48 - 00052141 _____ C:\Windows\system32\OKDRTPRN.chm
2015-11-19 11:49 - 2015-11-19 11:48 - 00040960 _____ C:\Windows\system32\OkDPnRes.dll
2015-11-19 11:49 - 2015-03-09 12:41 - 00469272 _____ (Oki Data Corporation) C:\Windows\system32\OkDrtPrn.exe
2015-11-19 11:49 - 2014-10-13 18:01 - 00196608 _____ (Oki Data Corporation) C:\Windows\system32\OkDrtPrn.dll
2015-11-19 11:49 - 2014-07-11 15:25 - 00005120 _____ (Oki Data Corporation) C:\Windows\system32\okComDLL.dll
2015-11-19 11:49 - 2012-05-28 16:54 - 00004096 _____ (Oki Data Corporation) C:\Windows\system32\fxComDLL.dll
2015-11-19 11:49 - 2012-05-28 16:54 - 00004096 _____ (Oki Data Corporation) C:\Windows\system32\efComDLL.dll
2015-11-19 11:44 - 2015-11-19 11:45 - 06816512 _____ (Acresso Software Inc. ) C:\Users\hynek.HBWARE\Downloads\PDFP_ALL_040200_1_tcm3-53582.exe
2015-11-19 11:08 - 2015-06-19 15:51 - 00000000 ____D C:\Users\hynek.HBWARE\Downloads\CT_010618_2-3-ALWEB163022
2015-11-19 11:03 - 2015-11-19 11:06 - 28365648 _____ C:\Users\hynek.HBWARE\Downloads\CT_010618_2-3-ALWEB163022_tcm3-124644.exe
2015-11-19 10:18 - 2015-11-19 10:18 - 00001972 _____ C:\Users\Public\Desktop\NAS Starter Utility.lnk
2015-11-19 10:18 - 2015-11-19 10:18 - 00000000 ____D C:\Program Files\ZyXEL
2015-11-19 10:04 - 2015-11-19 10:04 - 00000292 _____ C:\Windows\SynInst.log
2015-11-19 09:49 - 2015-11-19 09:49 - 00000036 _____ C:\Windows\wininit.ini
2015-11-19 09:49 - 2007-05-22 10:02 - 00282624 _____ (Monet+, a.s.) C:\Windows\tmpun.tmp
2015-11-19 07:01 - 2015-11-19 07:01 - 00087608 _____ C:\Users\hynek.HBWARE\AppData\Roaming\inst.exe
2015-11-18 17:57 - 2015-11-18 17:57 - 00000924 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job
2015-11-18 17:01 - 2015-11-18 17:01 - 00000000 ____D C:\Program Files\Common Files\Logitech
2015-11-18 17:00 - 2015-11-18 17:00 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\LocalLow\Oracle
2015-11-18 17:00 - 2015-11-18 17:00 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Local\Downloaded Installations
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-11-20 13:34 - 2012-04-13 16:08 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-20 13:31 - 2012-11-29 08:05 - 00000940 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-20 13:30 - 2009-10-15 14:27 - 00000000 ____D C:\Users\hynek.HBWARE\Documents\Bluetooth
2015-11-20 13:30 - 2008-09-17 18:00 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\Skype
2015-11-20 13:30 - 2008-05-27 19:43 - 01848211 _____ C:\Windows\WindowsUpdate.log
2015-11-20 13:30 - 2006-11-02 13:47 - 00003584 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-20 13:30 - 2006-11-02 13:47 - 00003584 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-20 11:53 - 2008-05-27 21:30 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{A734A4B6-56BF-4618-BD52-3C746DF2B429}.job
2015-11-20 10:40 - 2009-08-31 12:50 - 00000422 ____H C:\Windows\Tasks\User_Feed_Synchronization-{F49D08F9-F437-4469-8920-5D8403C0ED0D}.job
2015-11-20 10:36 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tracing
2015-11-19 15:15 - 2012-11-29 08:11 - 00000000 ___RD C:\Users\hynek.HBWARE\Disk Google
2015-11-19 15:11 - 2012-11-29 08:05 - 00000936 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-19 15:08 - 2008-05-28 20:23 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2015-11-19 15:08 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-19 15:06 - 2008-05-27 20:04 - 00000012 _____ C:\Windows\bthservsdp.dat
2015-11-19 15:06 - 2006-11-02 14:01 - 00032618 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-11-19 14:35 - 2010-02-28 19:27 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-11-19 14:35 - 2006-11-02 14:00 - 00064516 _____ C:\Windows\PFRO.log
2015-11-19 12:12 - 2008-05-28 09:25 - 00000000 ____D C:\Users\hynek.HBWARE
2015-11-19 12:04 - 2008-05-27 19:45 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2015-11-19 12:03 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Web
2015-11-19 11:34 - 2008-07-26 09:38 - 00189440 _____ C:\Users\hynek.HBWARE\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-11-19 11:11 - 2014-07-04 07:13 - 00000000 ____D C:\Users\hynek.HBWARE\Ubiquiti UniFi
2015-11-19 10:51 - 2009-02-02 11:48 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\dvdcss
2015-11-19 10:26 - 2012-04-10 13:22 - 00000000 ____D C:\Users\hynek.HBWARE\NSU
2015-11-19 10:17 - 2008-05-27 19:45 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2015-11-19 10:16 - 2008-09-15 08:15 - 00674370 _____ C:\Windows\DPINST.LOG
2015-11-19 10:12 - 2006-11-02 13:42 - 00000000 ____D C:\Windows\WindowsMobile
2015-11-19 10:10 - 2008-11-23 20:26 - 00000000 ____D C:\Program Files\Common Files\soft602
2015-11-19 10:09 - 2006-11-02 12:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-11-19 10:03 - 2011-04-28 09:26 - 00000000 ____D C:\WinSetupFromUSB
2015-11-19 09:56 - 2009-11-10 13:15 - 00000000 ____D C:\Program Files\remoteAP
2015-11-19 09:54 - 2011-04-29 08:00 - 00000000 ____D C:\Program Files\nLite
2015-11-19 09:43 - 2008-06-01 18:53 - 00000000 ____D C:\Windows\Downloaded Installations
2015-11-19 09:43 - 2008-05-28 09:27 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\Teleca
2015-11-19 09:42 - 2008-05-27 21:02 - 00000000 ____D C:\Program Files\Common Files\Teleca Shared
2015-11-19 09:35 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\twain_32
2015-11-19 08:11 - 2014-07-19 08:25 - 01292172 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-19 07:29 - 2009-05-29 19:39 - 00000000 ____D C:\Program Files\Google
2015-11-19 07:28 - 2009-05-29 19:40 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Local\Google
2015-11-19 07:06 - 2008-06-01 17:39 - 00000000 ____D C:\WIN_SYS61
2015-11-19 07:04 - 2012-05-17 12:31 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-11-19 07:04 - 2011-02-25 16:39 - 00000000 ____D C:\Program Files\QuickTime
2015-11-19 07:04 - 2009-08-21 08:36 - 00000000 ____D C:\Program Files\Ahead
2015-11-19 07:04 - 2009-01-19 15:11 - 00000000 ____D C:\Fujitsu Siemens Computers
2015-11-19 07:04 - 2007-02-19 13:32 - 00000000 ____D C:\Windows\Panther
2015-11-19 07:04 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\DigitalLocker
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Default
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Registration
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\PLA
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\MSAgent
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\IME
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Help
2015-11-19 07:01 - 2009-01-16 15:25 - 00000033 _____ C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.log
2015-11-19 07:01 - 2009-01-16 15:24 - 00047360 _____ (VSO Software) C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.sys
2015-11-19 07:01 - 2009-01-16 15:24 - 00007887 _____ C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.cat
2015-11-19 07:01 - 2009-01-16 15:24 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\Vso
2015-11-18 20:59 - 2013-03-21 10:09 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Local\Garmin
2015-11-18 20:59 - 2010-01-05 20:54 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\GARMIN
2015-11-18 20:37 - 2009-04-20 14:49 - 00000009 _____ C:\Windows\Brfaxrx.ini
2015-11-18 20:37 - 2009-04-20 14:47 - 00000000 ____D C:\Program Files\Brother
2015-11-18 18:34 - 2012-04-13 16:07 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-11-18 18:34 - 2011-05-24 07:52 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-11-18 17:57 - 2015-08-03 15:47 - 00000924 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job
2015-10-27 18:44 - 2006-11-02 11:24 - 143250520 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
==================== Files in the root of some directories =======
2009-01-16 15:24 - 2009-01-16 15:24 - 0087608 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\ezpinst.exe
2012-08-17 07:49 - 2012-08-17 07:49 - 0038492 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\Hodnoty oddělené čárkami (DOS).ADR
2012-08-17 08:06 - 2012-08-17 08:06 - 0038491 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\Hodnoty oddělené čárkami (Windows).ADR
2015-11-19 07:01 - 2015-11-19 07:01 - 0087608 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\inst.exe
2009-01-16 15:24 - 2015-11-19 07:01 - 0007887 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.cat
2009-01-16 15:24 - 2015-11-19 07:01 - 0001144 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.inf
2009-01-16 15:25 - 2015-11-19 07:01 - 0000033 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.log
2009-01-16 15:24 - 2015-11-19 07:01 - 0047360 _____ (VSO Software) C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.sys
2010-07-01 15:20 - 2010-07-01 15:21 - 0000180 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\setup.log
2010-07-01 15:20 - 2010-07-01 15:20 - 0000760 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\setup_ldm.iss
2009-12-13 18:23 - 2010-12-25 09:35 - 0000668 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\vso_ts_preview.xml
2010-12-03 18:34 - 2013-11-21 12:11 - 0000680 _____ () C:\Users\hynek.HBWARE\AppData\Local\d3d9caps.dat
2008-07-26 09:38 - 2015-11-19 11:34 - 0189440 _____ () C:\Users\hynek.HBWARE\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-07-19 07:20 - 2011-08-09 06:22 - 0000147 _____ () C:\Users\hynek.HBWARE\AppData\Local\RAExpertHistory.xml
2009-08-21 08:47 - 2009-10-21 15:15 - 0000147 _____ () C:\Users\hynek.HBWARE\AppData\Local\rahistory.xml
2008-09-17 18:06 - 2008-09-17 18:06 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2008-06-01 18:03 - 2009-02-07 10:02 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt
Some files in TEMP:
====================
C:\Users\hynek.HBWARE\AppData\Local\Temp\Bootstrapper.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperARA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperARU.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperCHS.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperCHT.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperCSY.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperDAN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperDEU.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperELL.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperENU.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperESN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperESP.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperFIN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperFRA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperHEB.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperHRV.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperHUN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperITA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperJPN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperKOR.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperLOC.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperNLD.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperNOR.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperPLK.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperPTB.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperPTG.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperRUS.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperSKY.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperSLV.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperSVE.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperTHA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperTRK.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperUKR.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\dotNetFx40_Client_setup.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\firefoxjre_exe-1.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\Garmin.Cartography.DeviceInteraction.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\GarminMapUpdater.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\GpsImgWrapper.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\ICReinstall_JavaSetup.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\Interop.IWshRuntimeLibrary.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u13-windows-i586-p-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u17-windows-i586-iftw-rv.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u40-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\lowproc.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\mfc100.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\msvcp100.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\msvcr100.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\MyDownloader.Core.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\setpointenu.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\SkypeSetup.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\sp_setpoint.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\stubhelper.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\SystemParametersInfo.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\tmpB65C.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\tmpBFCE.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\Uninst.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\UninstallRC-8876480.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\usb_lib.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\_is481A.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_is4C0.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_is59A0.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isA6A4.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isD68B.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isDBDF.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isE0C2.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isF21F.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
==================== MBR and Partition Table ==================
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cf96d28e1ce51e.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cff022afa1884c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d006fdd9c5323a.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0469cac5defc4.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d073b6646e6a44.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{A734A4B6-56BF-4618-BD52-3C746DF2B429}.job => C:\Windows\system32\msfeedssync.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{F49D08F9-F437-4469-8920-5D8403C0ED0D}.job => C:\Windows\system32\msfeedssync.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\hynek.HBWARE\Desktop" je 16 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000
==================== End Of Log ==============================
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
preventivka
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Re: preventivka
Krasny den Vam preju 
V ramci cisteni Vam budou vyprazdneny docasne adresare (vcetne Kose).
Ulozte na plochu MBAR - http://www.bleepingcomputer.com/downloa ... i-rootkit/
V ramci cisteni Vam budou vyprazdneny docasne adresare (vcetne Kose). Ulozte na plochu MBAR - http://www.bleepingcomputer.com/downloa ... i-rootkit/
- Spuste dvojklikem a extrahujte na plochu
- kliknete na Next
- Aktualizujte virovou databazi klikem na Update a pokracujte na Next
- Vsechny 3 moznosti nechte zaskrtnute a zvolte Scan (potrva cca 15 minut)
- zatrhnete vsechny nalezy a take zkontrolujte zatrzitko u Create Restore Point
- kliknete na Cleanup a souhlaste s restartem - Yes
- obsah logu ulozene na plose v mbar\mbar-log-2015-mm-dd (hh-mm-ss).txt vlozte do pristi odpovedi
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Re: preventivka
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2015.11.22.02
rootkit: v2015.11.14.01
Windows Vista x86 NTFS
Internet Explorer 8.0.6001.18904
hynek :: ESPRIMO [administrator]
22.11.2015 13:07:38
mbar-log-2015-11-22 (13-07-38).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 329284
Time elapsed: 55 minute(s), 42 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 2
HKU\S-1-5-21-1715567821-507921405-1957994488-1150_Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} (Trojan.Poweliks.B) -> Delete on reboot. [aa60b5cc93f82511a5f918eabe42669a]
HKU\S-1-5-21-1715567821-507921405-1957994488-1150_Classes\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9} (Hijack.Trojan.Siredef.C) -> Delete on reboot. [dd2d61204348d75f56f412ef47b9d12f]
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
www.malwarebytes.org
Database version:
main: v2015.11.22.02
rootkit: v2015.11.14.01
Windows Vista x86 NTFS
Internet Explorer 8.0.6001.18904
hynek :: ESPRIMO [administrator]
22.11.2015 13:07:38
mbar-log-2015-11-22 (13-07-38).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 329284
Time elapsed: 55 minute(s), 42 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 2
HKU\S-1-5-21-1715567821-507921405-1957994488-1150_Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} (Trojan.Poweliks.B) -> Delete on reboot. [aa60b5cc93f82511a5f918eabe42669a]
HKU\S-1-5-21-1715567821-507921405-1957994488-1150_Classes\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9} (Hijack.Trojan.Siredef.C) -> Delete on reboot. [dd2d61204348d75f56f412ef47b9d12f]
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Re: preventivka
Ulozte na plochu MBRScan - http://eric71.geekstogo.com/tools/MbrScan.exe
- Spustte jej, vpravo nahore kliknete na Options a vsechno dooznacte
- kliknete na Report
- obsah prave otevreneho textaku mi vlozte do pristi odpovedi
Ulozte na plochu aswMBR - http://files.avast.com/files/rootkit-scanner/aswmbr.exe
- spustte jako spravce (v pripade XP obycejne dvojklikem)
- souhlaste s aktualizaci virove databaze Yes - bude se stahovat cca 205 MB a nasledne se chvili bude instalovat
- vse ponechte, jak je a kliknete na Scan - vezme cca 10 min
- kliknete na Save log a ulozte vysledek skenu - obsah tohoto logu vlozte do sve pristi odpovedi
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Re: preventivka
Kód: Vybrat vše
MBRScan v1.1.1
OS : Windows Vista (32 bit)
PROCESSOR : x86 Family 6 Model 15 Stepping 13, GenuineIntel
BOOT : Normal Boot
DATE : 2015/11/22 (ISO 8601) at 15:23:31
________________________________________________________________________________
DISK : Device\Harddisk0\DR0 __ST916082 1AS (3.AL)
BUS_TYPE : (0x03) P-ATA
USE_PIO : YES
MAX_TRANSFER : 128 Kb
ALIGNMENT_MASK : word aligned
________________________________________________________________________________
Device\Harddisk0\DR0 149.1 Go [Fixed] ==> Vista MBR Code
MBR_MD5 : D041B637DB0414D372D950E2DF5FAF4B
MBR_SHA1 : A9F47B8FC0474935AD3268F706420FDC3CCC4BA5
Device\Harddisk0\Partition1 2.00 Go 0x27 RE Hidden partition
Device\Harddisk0\Partition2 108.1 Go 0x07 NTFS / HPFS __ BOOTABLE __
Device\Harddisk0\Partition3 38.91 Go 0x07 NTFS / HPFS
________________________________________________________________________________
############################### Additional scan ################################
SystemStartOptions : /NOEXECUTE=OPTIN
________________________________________________________________________________
_______MBR \Device\Harddisk0\DR0
0x00000000 33 C0 8E D0 BC 00 7C 8E C0 8E D8 BE 00 7C BF 00 3À.м.|.À.ؾ.|¿.
0x00000010 06 B9 00 02 FC F3 A4 50 68 1C 06 CB FB B9 04 00 .¹..üó¤Ph..Ëû¹..
0x00000020 BD BE 07 80 7E 00 00 7C 0B 0F 85 10 01 83 C5 10 ½¾..~..|......Å.
0x00000030 E2 F1 CD 18 88 56 00 55 C6 46 11 05 C6 46 10 00 âñÍ..V.UÆF..ÆF..
0x00000040 B4 41 BB AA 55 CD 13 5D 72 0F 81 FB 55 AA 75 09 ´A»ªUÍ.]r..ûUªu.
0x00000050 F7 C1 01 00 74 03 FE 46 10 66 60 80 7E 10 00 74 ÷Á..t.þF.f`.~..t
0x00000060 26 66 68 00 00 00 00 66 FF 76 08 68 00 00 68 00 &fh....f.v.h..h.
0x00000070 7C 68 01 00 68 10 00 B4 42 8A 56 00 8B F4 CD 13 |h..h..´B.V..ôÍ.
0x00000080 9F 83 C4 10 9E EB 14 B8 01 02 BB 00 7C 8A 56 00 ..Ä..ë.¸..».|.V.
0x00000090 8A 76 01 8A 4E 02 8A 6E 03 CD 13 66 61 73 1E FE .v..N..n.Í.fas.þ
0x000000A0 4E 11 0F 85 0C 00 80 7E 00 80 0F 84 8A 00 B2 80 N......~......².
0x000000B0 EB 82 55 32 E4 8A 56 00 CD 13 5D EB 9C 81 3E FE ë.U2ä.V.Í.]ë..>þ
0x000000C0 7D 55 AA 75 6E FF 76 00 E8 8A 00 0F 85 15 00 B0 }Uªun.v.è......°
0x000000D0 D1 E6 64 E8 7F 00 B0 DF E6 60 E8 78 00 B0 FF E6 Ñædè..°ßæ`èx.°.æ
0x000000E0 64 E8 71 00 B8 00 BB CD 1A 66 23 C0 75 3B 66 81 dèq.¸.»Í.f#Àu;f.
0x000000F0 FB 54 43 50 41 75 32 81 F9 02 01 72 2C 66 68 07 ûTCPAu2.ù..r,fh.
0x00000100 BB 00 00 66 68 00 02 00 00 66 68 08 00 00 00 66 »..fh....fh....f
0x00000110 53 66 53 66 55 66 68 00 00 00 00 66 68 00 7C 00 SfSfUfh....fh.|.
0x00000120 00 66 61 68 00 00 07 CD 1A 5A 32 F6 EA 00 7C 00 .fah...Í.Z2öê.|.
0x00000130 00 CD 18 A0 B7 07 EB 08 A0 B6 07 EB 03 A0 B5 07 .Í..·.ë..¶.ë..µ.
0x00000140 32 E4 05 00 07 8B F0 AC 3C 00 74 FC BB 07 00 B4 2ä....ð¬<.tü»..´
0x00000150 0E CD 10 EB F2 2B C9 E4 64 EB 00 24 02 E0 F8 24 .Í.ëò+Éädë.$.àø$
0x00000160 02 C3 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 .ÃInvalid partit
0x00000170 69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20 ion table.Error
0x00000180 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E loading operatin
0x00000190 67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 g system.Missing
0x000001A0 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65 operating syste
0x000001B0 6D 00 00 00 00 62 7A 99 82 49 79 F0 00 00 00 C9 m....bz..Iyð...É
0x000001C0 10 00 27 FE 7F 05 86 31 00 00 00 08 40 00 80 9E ..'þ...1....@...
0x000001D0 6C 06 07 FE FF FF 93 60 40 00 00 08 84 0D 00 FE l..þ...`@......þ
0x000001E0 FF FF 07 FE FF FF 00 70 C4 0D 00 20 DD 04 00 00 ...þ...pÄ.. Ý...
0x000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............Uª
__________________________16_BIT_ASM_CODE
0x0000 33c0 XOR AX, AX
0x0002 8ed0 MOV SS, AX
0x0004 bc 007c MOV SP, 0x7c00
0x0007 8ec0 MOV ES, AX
0x0009 8ed8 MOV DS, AX
0x000B be 007c MOV SI, 0x7c00
0x000E bf 0006 MOV DI, 0x600
0x0011 b9 0002 MOV CX, 0x200
0x0014 fc CLD
0x0015 f3 a4 REP MOVSB
0x0017 50 PUSH AX
0x0018 68 1c06 PUSH 0x61c
0x001B cb RETF
0x001C fb STI
0x001D b9 0400 MOV CX, 0x4
0x0020 bd be07 MOV BP, 0x7be
0x0023 807e 00 00 CMP BYTE [BP+0x0], 0x0
0x0027 7c 0b JL 0x34
0x0029 0f85 1001 JNZ 0x13d
0x002D 83c5 10 ADD BP, 0x10
0x0030 e2 f1 LOOP 0x23
0x0032 cd 18 INT 0x18
0x0034 8856 00 MOV [BP+0x0], DL
0x0037 55 PUSH BP
0x0038 c646 11 05 MOV BYTE [BP+0x11], 0x5
0x003C c646 10 00 MOV BYTE [BP+0x10], 0x0
0x0040 b4 41 MOV AH, 0x41
0x0042 bb aa55 MOV BX, 0x55aa
0x0045 cd 13 INT 0x13
0x0047 5d POP BP
0x0048 72 0f JB 0x59
0x004A 81fb 55aa CMP BX, 0xaa55
0x004E 75 09 JNZ 0x59
0x0050 f7c1 0100 TEST CX, 0x1
0x0054 74 03 JZ 0x59
0x0056 fe46 10 INC BYTE [BP+0x10]
0x0059 66 60 PUSHAD
0x005B 807e 10 00 CMP BYTE [BP+0x10], 0x0
0x005F 74 26 JZ 0x87
0x0061 66 68 00000000 PUSH 0x0
0x0067 66 ff76 08 PUSH DWORD [BP+0x8]
0x006B 68 0000 PUSH 0x0
0x006E 68 007c PUSH 0x7c00
0x0071 68 0100 PUSH 0x1
0x0074 68 1000 PUSH 0x10
0x0077 b4 42 MOV AH, 0x42
0x0079 8a56 00 MOV DL, [BP+0x0]
0x007C 8bf4 MOV SI, SP
0x007E cd 13 INT 0x13
0x0080 9f LAHF
0x0081 83c4 10 ADD SP, 0x10
0x0084 9e SAHF
0x0085 eb 14 JMP 0x9b
0x0087 b8 0102 MOV AX, 0x201
0x008A bb 007c MOV BX, 0x7c00
0x008D 8a56 00 MOV DL, [BP+0x0]
0x0090 8a76 01 MOV DH, [BP+0x1]
0x0093 8a4e 02 MOV CL, [BP+0x2]
0x0096 8a6e 03 MOV CH, [BP+0x3]
0x0099 cd 13 INT 0x13
0x009B 66 61 POPAD
0x009D 73 1e JAE 0xbd
0x009F fe4e 11 DEC BYTE [BP+0x11]
0x00A2 0f85 0c00 JNZ 0xb2
0x00A6 807e 00 80 CMP BYTE [BP+0x0], 0x80
0x00AA 0f84 8a00 JZ 0x138
0x00AE b2 80 MOV DL, 0x80
0x00B0 eb 82 JMP 0x34
0x00B2 55 PUSH BP
0x00B3 32e4 XOR AH, AH
0x00B5 8a56 00 MOV DL, [BP+0x0]
0x00B8 cd 13 INT 0x13
0x00BA 5d POP BP
0x00BB eb 9c JMP 0x59
0x00BD 813e fe7d 55aa CMP WORD [0x7dfe], 0xaa55
0x00C3 75 6e JNZ 0x133
0x00C5 ff76 00 PUSH WORD [BP+0x0]
0x00C8 e8 8a00 CALL 0x155
0x00CB 0f85 1500 JNZ 0xe4
0x00CF b0 d1 MOV AL, 0xd1
0x00D1 e6 64 OUT 0x64, AL
0x00D3 e8 7f00 CALL 0x155
0x00D6 b0 df MOV AL, 0xdf
0x00D8 e6 60 OUT 0x60, AL
0x00DA e8 7800 CALL 0x155
0x00DD b0 ff MOV AL, 0xff
0x00DF e6 64 OUT 0x64, AL
0x00E1 e8 7100 CALL 0x155
0x00E4 b8 00bb MOV AX, 0xbb00
0x00E7 cd 1a INT 0x1a
0x00E9 66 23c0 AND EAX, EAX
0x00EC 75 3b JNZ 0x129
0x00EE 66 81fb 54435041CMP EBX, 0x41504354
0x00F5 75 32 JNZ 0x129
0x00F7 81f9 0201 CMP CX, 0x102
0x00FB 72 2c JB 0x129
0x00FD 66 68 07bb0000 PUSH 0xbb07
0x0103 66 68 00020000 PUSH 0x200
0x0109 66 68 08000000 PUSH 0x8
0x010F 66 53 PUSH EBX
0x0111 66 53 PUSH EBX
0x0113 66 55 PUSH EBP
0x0115 66 68 00000000 PUSH 0x0
0x011B 66 68 007c0000 PUSH 0x7c00
0x0121 66 61 POPAD
0x0123 68 0000 PUSH 0x0
0x0126 07 POP ES
0x0127 cd 1a INT 0x1a
0x0129 5a POP DX
0x012A 32f6 XOR DH, DH
0x012C ea 007c 0000 JMP FAR 0x0:0x7c00
0x0131 cd 18 INT 0x18
0x0133 a0 b707 MOV AL, [0x7b7]
0x0136 eb 08 JMP 0x140
0x0138 a0 b607 MOV AL, [0x7b6]
0x013B eb 03 JMP 0x140
0x013D a0 b507 MOV AL, [0x7b5]
0x0140 32e4 XOR AH, AH
0x0142 05 0007 ADD AX, 0x700
0x0145 8bf0 MOV SI, AX
0x0147 ac LODSB
0x0148 3c 00 CMP AL, 0x0
0x014A 74 fc JZ 0x148
0x014C bb 0700 MOV BX, 0x7
0x014F b4 0e MOV AH, 0xe
0x0151 cd 10 INT 0x10
0x0153 eb f2 JMP 0x147
0x0155 2bc9 SUB CX, CX
0x0157 e4 64 IN AL, 0x64
0x0159 eb 00 JMP 0x15b
0x015B 24 02 AND AL, 0x2
0x015D e0 f8 LOOPNZ 0x157
0x015F 24 02 AND AL, 0x2
0x0161 c3 RET
0x0162 49 DEC CX
0x0163 6e OUTSB
0x0164 76 61 JBE 0x1c7
0x0166 6c INSB
0x0167 6964 20 7061 IMUL SP, [SI+0x20], 0x6170
0x016C 72 74 JB 0x1e2
0x016E 6974 69 6f6e IMUL SI, [SI+0x69], 0x6e6f
0x0173 2074 61 AND [SI+0x61], DH
0x0176 626c 65 BOUND BP, [SI+0x65]
0x0179 0045 72 ADD [DI+0x72], AL
0x017C 72 6f JB 0x1ed
0x017E 72 20 JB 0x1a0
0x0180 6c INSB
0x0181 6f OUTSW
0x0182 61 POPA
0x0183 64 696e 67 206f IMUL BP, FS:[BP+0x67], 0x6f20
0x0189 70 65 JO 0x1f0
0x018B 72 61 JB 0x1ee
0x018D 74 69 JZ 0x1f8
0x018F 6e OUTSB
0x0190 67 2073 79 AND [EBX+0x79], DH
0x0194 73 74 JAE 0x20a
0x0196 65 6d INS WORD GS:[DI], DX
0x0198 004d 69 ADD [DI+0x69], CL
0x019B 73 73 JAE 0x210
0x019D 696e 67 206f IMUL BP, [BP+0x67], 0x6f20
0x01A2 70 65 JO 0x209
0x01A4 72 61 JB 0x207
0x01A6 74 69 JZ 0x211
0x01A8 6e OUTSB
0x01A9 67 2073 79 AND [EBX+0x79], DH
0x01AD 73 74 JAE 0x223
0x01AF 65 6d INS WORD GS:[DI], DX
0x01B1 0000 ADD [BX+SI], AL
0x01B3 0000 ADD [BX+SI], AL
0x01B5 627a 99 BOUND DI, [BP+SI-0x67]
0x01B8 8249 79 f0 OR BYTE [BX+DI+0x79], -0x10
0x01BC 0000 ADD [BX+SI], AL
0x01BE 00c9 ADD CL, CL
0x01C0 1000 ADC [BX+SI], AL
0x01C2 27 DAA
0x01C3 fe DB 0xfe
0x01C4 7f 05 JG 0x1cb
0x01C6 8631 XCHG [BX+DI], DH
0x01C8 0000 ADD [BX+SI], AL
0x01CA 0008 ADD [BX+SI], CL
0x01CC 40 INC AX
0x01CD 0080 9e6c ADD [BX+SI+0x6c9e], AL
0x01D1 06 PUSH ES
0x01D2 07 POP ES
0x01D3 fe DB 0xfe
0x01D4 ff DB 0xff
0x01D5 ff93 6040 CALL [BP+DI+0x4060]
0x01D9 0000 ADD [BX+SI], AL
0x01DB 0884 0d00 OR [SI+0xd], AL
0x01DF fe DB 0xfe
0x01E0 ff DB 0xff
0x01E1 ff07 INC WORD [BX]
0x01E3 fe DB 0xfe
0x01E4 ff DB 0xff
0x01E5 ff00 INC WORD [BX+SI]
0x01E7 70 c4 JO 0x1ad
0x01E9 0d 0020 OR AX, 0x2000
0x01EC dd04 FLD QWORD [SI]
0x01EE 0000 ADD [BX+SI], AL
0x01F0 0000 ADD [BX+SI], AL
0x01F2 0000 ADD [BX+SI], AL
0x01F4 0000 ADD [BX+SI], AL
0x01F6 0000 ADD [BX+SI], AL
0x01F8 0000 ADD [BX+SI], AL
0x01FA 0000 ADD [BX+SI], AL
0x01FC 0000 ADD [BX+SI], AL
0x01FE 55 PUSH BP
0x01FF aa STOSB
Re: preventivka
aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2015-11-22 15:24:57
-----------------------------
15:24:57.506 OS Version: Windows 6.0.6000
15:24:57.506 Number of processors: 2 586 0xF0D
15:24:57.507 ComputerName: ESPRIMO UserName: hynek
15:24:58.329 Initialize success
15:24:58.350 VM: initialized successfully
15:24:58.354 VM: Intel CPU virtualization not supported
15:30:47.427 AVAST engine defs: 15112200
15:31:57.228 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
15:31:57.231 Disk 0 Vendor: ST916082 3.AL Size: 152627MB BusType: 3
15:31:57.912 Disk 0 MBR read successfully
15:31:57.915 Disk 0 MBR scan
15:31:57.995 Disk 0 Windows VISTA default MBR code
15:31:58.008 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 2049 MB offset 12678
15:31:58.035 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 110721 MB offset 4219027
15:31:58.071 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 39844 MB offset 230977536
15:31:58.177 Disk 0 scanning sectors +312578048
15:31:59.554 Disk 0 scanning C:\Windows\system32\drivers
15:33:04.648 Service scanning
15:33:35.889 Service MpKsl3de36f3f c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{76EF9060-483A-4CE0-9FF6-8CD69827952D}\MpKsl3de36f3f.sys **LOCKED** 32
15:34:14.517 Modules scanning
15:34:14.526 Disk 0 trace - called modules:
15:34:14.557 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
15:34:14.565 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85e8c790]
15:34:14.577 3 ntkrnlpa.exe[828b07e2] -> nt!IofCallDriver -> [0x85062f18]
15:34:14.604 5 acpi.sys[8042532a] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x85570030]
15:34:17.058 AVAST engine scan C:\Windows
15:34:25.143 AVAST engine scan C:\Windows\system32
15:41:21.819 AVAST engine scan C:\Windows\system32\drivers
15:42:05.781 AVAST engine scan C:\Users\hynek.HBWARE
15:42:29.517 Disk 0 MBR has been saved successfully to "C:\Users\hynek.HBWARE\Desktop\MBR.dat"
15:42:29.709 The log file has been saved successfully to "C:\Users\hynek.HBWARE\Desktop\aswMBR.txt"
Run date: 2015-11-22 15:24:57
-----------------------------
15:24:57.506 OS Version: Windows 6.0.6000
15:24:57.506 Number of processors: 2 586 0xF0D
15:24:57.507 ComputerName: ESPRIMO UserName: hynek
15:24:58.329 Initialize success
15:24:58.350 VM: initialized successfully
15:24:58.354 VM: Intel CPU virtualization not supported
15:30:47.427 AVAST engine defs: 15112200
15:31:57.228 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
15:31:57.231 Disk 0 Vendor: ST916082 3.AL Size: 152627MB BusType: 3
15:31:57.912 Disk 0 MBR read successfully
15:31:57.915 Disk 0 MBR scan
15:31:57.995 Disk 0 Windows VISTA default MBR code
15:31:58.008 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 2049 MB offset 12678
15:31:58.035 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 110721 MB offset 4219027
15:31:58.071 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 39844 MB offset 230977536
15:31:58.177 Disk 0 scanning sectors +312578048
15:31:59.554 Disk 0 scanning C:\Windows\system32\drivers
15:33:04.648 Service scanning
15:33:35.889 Service MpKsl3de36f3f c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{76EF9060-483A-4CE0-9FF6-8CD69827952D}\MpKsl3de36f3f.sys **LOCKED** 32
15:34:14.517 Modules scanning
15:34:14.526 Disk 0 trace - called modules:
15:34:14.557 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
15:34:14.565 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85e8c790]
15:34:14.577 3 ntkrnlpa.exe[828b07e2] -> nt!IofCallDriver -> [0x85062f18]
15:34:14.604 5 acpi.sys[8042532a] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x85570030]
15:34:17.058 AVAST engine scan C:\Windows
15:34:25.143 AVAST engine scan C:\Windows\system32
15:41:21.819 AVAST engine scan C:\Windows\system32\drivers
15:42:05.781 AVAST engine scan C:\Users\hynek.HBWARE
15:42:29.517 Disk 0 MBR has been saved successfully to "C:\Users\hynek.HBWARE\Desktop\MBR.dat"
15:42:29.709 The log file has been saved successfully to "C:\Users\hynek.HBWARE\Desktop\aswMBR.txt"
Re: preventivka
Otestujte na virustotal.com C:\Users\hynek.HBWARE\Desktop\MBR.dat - pokud uz byl soubor otestovany, zvolte Reanalyse. Do pristiho prispevku dejte link (odkaz) s vysledky analyzy. Ulozte na plochu AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/ (nebo http://www.bleepingcomputer.com/download/adwcleaner/ )
- ukoncete vsechny programy
- kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
- kliknete na Scan, pote na Cleaning
- po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\AdwCleaner[Cx].txt), jehoz obsah mi zkopirujte do pristi odpovedi
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Re: preventivka
s původním odesláním aswMBR jsem se unáhlil, stále probíhá scan..
Re: preventivka
Ukoncete jej - to dulezite (MBR a scan driveru) jsme zkontrolovali.
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Re: preventivka
# AdwCleaner v5.021 - Logfile created 22/11/2015 at 16:21:57
# Updated 14/11/2015 by Xplode
# Database : 2015-11-19.4 [Server]
# Operating system : Windows Vista (TM) Business (x86)
# Username : hynek - ESPRIMO
# Running from : C:\Users\hynek.HBWARE\Desktop\adwcleaner_5.021.exe
# Option : Cleaning
# Support : http://toolslib.net/forum
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder Deleted : C:\Program Files\FlvPlayer
[-] Folder Deleted : C:\Users\hynek.HBWARE\AppData\Roaming\download Manager
***** [ Files ] *****
[-] File Deleted : C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_wlogin.icq.com_0.localstorage
[-] File Deleted : C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_wlogin.icq.com_0.localstorage-journal
***** [ DLLs ] *****
***** [ Shortcuts ] *****
***** [ Scheduled tasks ] *****
***** [ Registry ] *****
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
[-] Key Deleted : HKCU\Software\YahooPartnerToolbar
[-] Key Deleted : HKLM\SOFTWARE\FlvPlayer
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FlvPlayer
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00B2-0405-0000-0000000FF1CE}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A2D81E70-2A98-4A08-A628-94388B063C5E}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FlvPlayer
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{90120000-00B2-0405-0000-0000000FF1CE}
[!] Key Not Deleted : HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\YahooPartnerToolbar
[!] Key Not Deleted : HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
[!] Key Not Deleted : HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FlvPlayer
[!] Key Not Deleted : HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{90120000-00B2-0405-0000-0000000FF1CE}
***** [ Web browsers ] *****
*************************
:: "Tracing" keys removed
:: Winsock settings cleared
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2577 bytes] ##########
# Updated 14/11/2015 by Xplode
# Database : 2015-11-19.4 [Server]
# Operating system : Windows Vista (TM) Business (x86)
# Username : hynek - ESPRIMO
# Running from : C:\Users\hynek.HBWARE\Desktop\adwcleaner_5.021.exe
# Option : Cleaning
# Support : http://toolslib.net/forum
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder Deleted : C:\Program Files\FlvPlayer
[-] Folder Deleted : C:\Users\hynek.HBWARE\AppData\Roaming\download Manager
***** [ Files ] *****
[-] File Deleted : C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_wlogin.icq.com_0.localstorage
[-] File Deleted : C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_wlogin.icq.com_0.localstorage-journal
***** [ DLLs ] *****
***** [ Shortcuts ] *****
***** [ Scheduled tasks ] *****
***** [ Registry ] *****
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
[-] Key Deleted : HKCU\Software\YahooPartnerToolbar
[-] Key Deleted : HKLM\SOFTWARE\FlvPlayer
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FlvPlayer
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00B2-0405-0000-0000000FF1CE}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A2D81E70-2A98-4A08-A628-94388B063C5E}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FlvPlayer
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{90120000-00B2-0405-0000-0000000FF1CE}
[!] Key Not Deleted : HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\YahooPartnerToolbar
[!] Key Not Deleted : HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
[!] Key Not Deleted : HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\FlvPlayer
[!] Key Not Deleted : HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{90120000-00B2-0405-0000-0000000FF1CE}
***** [ Web browsers ] *****
*************************
:: "Tracing" keys removed
:: Winsock settings cleared
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2577 bytes] ##########
Re: preventivka
Dejte logy FRST.txt a Addition.txt - http://forum.viry.cz/viewtopic.php?f=30&t=133101Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Re: preventivka
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:20-11-2015
Ran by hynek (administrator) on ESPRIMO (22-11-2015 17:11:21)
Running from C:\Users\hynek.HBWARE\Desktop
Loaded Profiles: hynek (Available Profiles: hynek & hynek)
Platform: Microsoft® Windows Vista™ Business (X86) Language: Čeština (Česká republika)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(brother Industries Ltd) C:\Windows\System32\brsvc01a.exe
(brother Industries Ltd) C:\Windows\System32\brss01a.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Oki Data Corporation) C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(TOSHIBA CORPORATION) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
() C:\Program Files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe
() C:\Program Files\FSC\WebCam HotKey Utility\Webcam_HotKey.exe
(FinePrint Software, LLC) C:\Windows\System32\spool\drivers\w32x86\3\fppdis2a.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(RealNetworks, Inc.) C:\Program Files\Real\realplayer\Update\realsched.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(ITE Tech Inc.) C:\Program Files\FSC\Wireless Utility\WirelessSelector.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(forum.viry.cz) C:\Users\hynek.HBWARE\Desktop\FRSTLauncher.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-09-12] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4489216 2007-06-13] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-05-28] (Realtek Semiconductor Corp.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [174616 2007-07-24] (Intel Corporation)
HKLM\...\Run: [TouchPadHotKey] => C:\Program Files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe [360448 2007-06-26] ()
HKLM\...\Run: [WebCamHotKey] => C:\Program Files\FSC\WebCam HotKey Utility\WebCam_HotKey.exe [376832 2007-06-26] ()
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [76304 2008-02-29] (Logitech, Inc.)
HKLM\...\Run: [pdfFactory Pro Dispatcher v2] => C:\Windows\system32\spool\DRIVERS\W32X86\3\fppdis2a.exe [479232 2005-03-03] (FinePrint Software, LLC)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [38840 2011-01-30] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [640440 2010-09-22] (Adobe Systems Inc.)
HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [981688 2015-04-29] (Microsoft Corporation)
HKLM\...\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [296056 2012-06-25] (RealNetworks, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [WinSent Messenger] => "C:\Program Files\WinSent Messenger\winsent.exe"
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [PID] => C:\Users\HYNEK~1.HBW\AppData\Local\Temp\Invoice_08.22.2011_Stor?cod.exe <===== ATTENTION
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [Google Update] => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-11-18] (Google Inc.)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [22568216 2015-10-12] (Google)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [GoogleChromeAutoLaunch_5E835259BEFB7618610CEBCBC68C4630] => C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe [811848 2015-11-07] (Google Inc.)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: E - E:\ActivateWarranty.exe
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {780c03e0-067e-11e4-af2d-806e6f6e6963} - E:\ActivateWarranty.exe
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {b95ff222-f8b7-11de-b9c9-001a6b28d8b7} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...0c966feabec1\InprocServer32: [Default-shell32] ATTENTION! ====> ZeroAccess?
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: [S-1-5-21-1715567821-507921405-1957994488-1150] => hbwares:8080
AutoConfigURL: [S-1-5-21-1715567821-507921405-1957994488-1150] => hbwares:8080
Winsock: Catalog5 04 C:\Windows\system32\napinsp.dll [50176 2006-11-02] (Společnost Microsoft)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [152864 2010-10-07] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.10.1
Tcpip\..\Interfaces\{74A54890-99E2-4483-86D6-4E456C1A0C9F}: [DhcpNameServer] 192.168.88.1
Tcpip\..\Interfaces\{CACC0914-1A62-420D-ABD5-5C3C9CADBDD7}: [DhcpNameServer] 192.168.10.1
Tcpip\..\Interfaces\{DF5D0A04-4B97-410D-8879-9041BD60F144}: [DhcpNameServer] 93.153.117.1 93.153.117.33
Internet Explorer:
==================
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.fujitsu-siemens.com/index2
SearchScopes: HKU\S-1-5-21-1715567821-507921405-1957994488-1150 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22] (Adobe Systems Incorporated)
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2012-06-25] (RealPlayer)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-05-07] (Oracle Corporation)
BHO: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-05-07] (Oracle Corporation)
BHO: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1715567821-507921405-1957994488-1150 -> Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} hxxps://www.mojedatovaschranka.cz/static/pages/ ... ?3,16,13,0
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FireFox:
========
FF ProfilePath: C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default
FF Homepage: hxxp://seznam.cz/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-18] ()
FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-05-07] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-05-07] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.4.53 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.4.53 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=15.0.4.53 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll [2012-06-25] (RealPlayer)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1715567821-507921405-1957994488-1150: @tools.google.com/Google Update;version=3 -> C:\Users\hynek.HBWARE\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1715567821-507921405-1957994488-1150: @tools.google.com/Google Update;version=9 -> C:\Users\hynek.HBWARE\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-27] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2011-03-12] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprjplug.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2012-06-25] (RealPlayer)
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\extensions\2020Player_IKEA@2020Technologies.com [2012-04-02] [not signed]
FF Extension: Garmin Communicator - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-07-19] [not signed]
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-06-25] [not signed]
FF Extension: Dman Data Editor - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\Extensions\npdmaned@onyxsoftware.cz [2011-02-18] [not signed]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-27] [not signed]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2012-10-23] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-02] [not signed]
FF HKLM\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
Chrome:
=======
CHR Plugin: (Native Client) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\46.0.2490.86\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\46.0.2490.86\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\46.0.2490.86\gcswf32.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll => No File
CHR Plugin: (Skype Click to Call) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.0.0.10297_0\npSkypeChromePlugin.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll => No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll (RealPlayer)
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll (RealNetworks, Inc.)
CHR Plugin: (Garmin Communicator Plug-In) - C:\Program Files\Garmin GPS Plugin\npGarmin.dll => No File
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll => No File
CHR Plugin: (Software602 Form Filler) - C:\Program Files\Software602\602XML\Filler\npfiller.dll => No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll => No File
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (Google Update) - C:\Users\hynek.HBWARE\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll => No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Profile: C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Disk Google) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-19]
CHR Extension: (YouTube) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-19]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-11-19]
CHR Extension: (Vyhledávání Google) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-19]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-19]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2012-07-09]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2014-11-09]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-04]
CHR Extension: (Gmail) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-08]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-06-25]
CHR HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\HYNEK~1.HBW\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-06-19]
CHR HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2002-04-11] (brother Industries Ltd) [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2009-08-18] (Macrovision Europe Ltd.) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2015-04-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]
R2 OpLclSrv; C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe [147456 2014-11-20] (Oki Data Corporation) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [265912 2007-09-12] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 acpi_contactor; C:\Windows\System32\DRIVERS\acpi_contactor_vista.sys [7680 2007-04-13] (INVENTEC Corporation)
R2 Ethpdrv; C:\Windows\System32\DRIVERS\ethpdrv.sys [16376 2007-08-01] (Gemfor s.r.o.)
R3 FIXUSTOR; C:\Windows\System32\DRIVERS\fixustor.sys [15360 2009-04-23] (Genesys Logic)
R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [183912 2006-11-02] (Společnost Microsoft)
S3 GT72NDISIPXP; C:\Windows\System32\DRIVERS\Gt51Ip.sys [106624 2008-02-18] (Option N.V.)
S3 GT72UBUS; C:\Windows\System32\DRIVERS\gt72ubus.sys [59648 2008-02-08] (Option N.V.)
S3 GTPTSER; C:\Windows\System32\DRIVERS\gtptser.sys [8064 2007-03-30] (Option N.V.)
S3 GTwinUSB; C:\Windows\System32\Drivers\GTwinUSB.sys [71424 2005-04-15] (Gemplus)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2010-02-22] (MBB Incorporated) [File not signed]
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [245096 2015-03-04] (Microsoft Corporation)
R1 MpKsl3de36f3f; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{76EF9060-483A-4CE0-9FF6-8CD69827952D}\MpKsl3de36f3f.sys [39168 2015-11-22] (Microsoft Corporation)
R1 MpKsl7d2cbc68; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{76EF9060-483A-4CE0-9FF6-8CD69827952D}\MpKsl7d2cbc68.sys [39168 2015-11-22] (Microsoft Corporation)
R3 Ntfs; C:\Windows\system32\Drivers\Ntfs.sys [1060920 2008-05-27] (Společnost Microsoft)
S3 s125bus; C:\Windows\System32\DRIVERS\s125bus.sys [83336 2007-04-24] (MCCI Corporation)
S3 s125mdfl; C:\Windows\System32\DRIVERS\s125mdfl.sys [15112 2007-04-24] (MCCI Corporation)
S3 s125mdm; C:\Windows\System32\DRIVERS\s125mdm.sys [108680 2007-04-24] (MCCI Corporation)
S3 s125mgmt; C:\Windows\System32\DRIVERS\s125mgmt.sys [100488 2007-04-24] (MCCI Corporation)
S3 s125obex; C:\Windows\System32\DRIVERS\s125obex.sys [98696 2007-04-24] (MCCI Corporation)
S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [83880 2007-12-10] (MCCI Corporation)
S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [15016 2007-12-10] (MCCI Corporation)
S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [110632 2007-12-10] (MCCI Corporation)
S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [104616 2007-12-10] (MCCI Corporation)
S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [25512 2007-12-10] (MCCI Corporation)
S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [100648 2007-12-10] (MCCI Corporation)
S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [110120 2007-12-10] (MCCI Corporation)
S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [9604096 2007-05-24] () [File not signed]
R1 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 Netaapl; system32\DRIVERS\netaapl.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-11-22 17:11 - 2015-11-22 17:11 - 00028988 _____ C:\Users\hynek.HBWARE\Desktop\FRST.txt
2015-11-22 17:09 - 2015-11-22 17:09 - 00112640 _____ (forum.viry.cz) C:\Users\hynek.HBWARE\Desktop\FRSTLauncher.exe
2015-11-22 17:05 - 2015-11-22 17:05 - 00000000 ____D C:\Users\hynek.HBWARE\Desktop\FRST-OlderVersion
2015-11-22 16:10 - 2015-11-22 16:25 - 00000000 ____D C:\AdwCleaner
2015-11-22 16:02 - 2015-11-22 16:03 - 01732096 _____ C:\Users\hynek.HBWARE\Desktop\adwcleaner_5.021.exe
2015-11-22 15:42 - 2015-11-22 15:42 - 00002219 _____ C:\Users\hynek.HBWARE\Desktop\aswMBR.txt
2015-11-22 15:42 - 2015-11-22 15:42 - 00000512 _____ C:\Users\hynek.HBWARE\Desktop\MBR.dat
2015-11-22 15:23 - 2015-11-22 15:23 - 00025396 _____ C:\Users\hynek.HBWARE\Desktop\MbrScan.log
2015-11-22 15:23 - 2015-11-22 15:23 - 00000512 _____ C:\Users\hynek.HBWARE\Desktop\Dump_Hdd0_DR0.mbr
2015-11-22 15:21 - 2015-11-22 15:22 - 05200384 _____ (AVAST Software) C:\Users\hynek.HBWARE\Desktop\aswmbr.exe
2015-11-22 15:21 - 2015-11-22 15:21 - 00147456 _____ (Eric_71) C:\Users\hynek.HBWARE\Desktop\MbrScan.exe
2015-11-22 13:04 - 2015-11-22 13:07 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-11-22 13:02 - 2015-11-22 14:03 - 00000000 ____D C:\Users\hynek.HBWARE\Desktop\mbar
2015-11-22 12:58 - 2015-11-22 12:59 - 16563352 _____ (Malwarebytes Corp.) C:\Users\hynek.HBWARE\Desktop\mbar-1.09.3.1001.exe
2015-11-22 12:05 - 2015-11-22 12:06 - 00001986 _____ C:\Users\hynek.HBWARE\Downloads\hynekbrydl@gmail.com-20151122-120557.csv
2015-11-20 10:52 - 2015-11-22 17:11 - 00000000 ____D C:\FRST
2015-11-20 10:47 - 2015-11-22 17:07 - 01716736 _____ (Farbar) C:\Users\hynek.HBWARE\Desktop\FRST.exe
2015-11-20 10:39 - 2015-11-20 10:39 - 00112640 _____ (forum.viry.cz) C:\Users\hynek.HBWARE\Downloads\Nepotvrzeno 928929.crdownload
2015-11-19 15:13 - 2015-11-19 15:13 - 00000000 ___HD C:\OneDriveTemp
2015-11-19 14:52 - 2015-11-19 14:53 - 02449376 _____ (Megaify Software ) C:\Users\hynek.HBWARE\Downloads\DriverToolkitInstaller.exe
2015-11-19 13:00 - 2015-11-19 13:20 - 00000000 ____D C:\Windows\system32\MRT
2015-11-19 12:12 - 2015-11-22 16:40 - 00000000 ___RD C:\Users\hynek.HBWARE\OneDrive
2015-11-19 12:12 - 2015-11-19 12:12 - 00002000 _____ C:\Users\hynek.HBWARE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-11-19 12:12 - 2015-11-19 12:12 - 00001927 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-11-19 12:12 - 2015-11-19 12:12 - 00000000 ____D C:\Program Files\Microsoft OneDrive
2015-11-19 12:12 - 2015-11-19 12:09 - 07904968 _____ (Microsoft Corporation) C:\Users\hynek.HBWARE\Downloads\OneDriveSetup.exe
2015-11-19 12:04 - 2013-02-05 08:58 - 00000104 _____ C:\Windows\system32\opnetext.ver
2015-11-19 12:04 - 2013-01-29 18:58 - 00094208 ____N (Oki Data Corporation) C:\Windows\system32\opnetext.dll
2015-11-19 12:04 - 2013-01-29 10:03 - 00010104 ____N C:\Windows\system32\OPNETEXT.HLP
2015-11-19 12:04 - 2013-01-29 10:03 - 00005832 ____N C:\Windows\system32\license.txt
2015-11-19 12:04 - 2013-01-29 10:03 - 00003844 ____N C:\Windows\system32\opnedef.str
2015-11-19 12:04 - 2013-01-29 10:03 - 00000144 ____N C:\Windows\system32\opnetext.cnt
2015-11-19 12:04 - 2013-01-29 10:03 - 00000000 ____N C:\Windows\system32\OPNETEXT.GID
2015-11-19 11:58 - 2014-04-04 14:58 - 00000000 ____D C:\Users\hynek.HBWARE\Downloads\OKW3C04O107
2015-11-19 11:58 - 2009-06-25 18:00 - 00040960 _____ (Oki Data Corporation) C:\Windows\system32\OKLMON32.DLL
2015-11-19 11:53 - 2015-11-19 11:57 - 13647416 _____ C:\Users\hynek.HBWARE\Downloads\OKW3C04O107_tcm3-138073.exe
2015-11-19 11:49 - 2015-11-19 11:49 - 00000000 ____D C:\Program Files\Okidata
2015-11-19 11:49 - 2015-11-19 11:48 - 00052141 _____ C:\Windows\system32\OKDRTPRN.chm
2015-11-19 11:49 - 2015-11-19 11:48 - 00040960 _____ C:\Windows\system32\OkDPnRes.dll
2015-11-19 11:49 - 2015-03-09 12:41 - 00469272 _____ (Oki Data Corporation) C:\Windows\system32\OkDrtPrn.exe
2015-11-19 11:49 - 2014-10-13 18:01 - 00196608 _____ (Oki Data Corporation) C:\Windows\system32\OkDrtPrn.dll
2015-11-19 11:49 - 2014-07-11 15:25 - 00005120 _____ (Oki Data Corporation) C:\Windows\system32\okComDLL.dll
2015-11-19 11:49 - 2012-05-28 16:54 - 00004096 _____ (Oki Data Corporation) C:\Windows\system32\fxComDLL.dll
2015-11-19 11:49 - 2012-05-28 16:54 - 00004096 _____ (Oki Data Corporation) C:\Windows\system32\efComDLL.dll
2015-11-19 11:44 - 2015-11-19 11:45 - 06816512 _____ (Acresso Software Inc. ) C:\Users\hynek.HBWARE\Downloads\PDFP_ALL_040200_1_tcm3-53582.exe
2015-11-19 11:08 - 2015-06-19 15:51 - 00000000 ____D C:\Users\hynek.HBWARE\Downloads\CT_010618_2-3-ALWEB163022
2015-11-19 11:03 - 2015-11-19 11:06 - 28365648 _____ C:\Users\hynek.HBWARE\Downloads\CT_010618_2-3-ALWEB163022_tcm3-124644.exe
2015-11-19 10:18 - 2015-11-19 10:18 - 00001972 _____ C:\Users\Public\Desktop\NAS Starter Utility.lnk
2015-11-19 10:18 - 2015-11-19 10:18 - 00000000 ____D C:\Program Files\ZyXEL
2015-11-19 10:04 - 2015-11-19 10:04 - 00000292 _____ C:\Windows\SynInst.log
2015-11-19 09:49 - 2015-11-19 09:49 - 00000036 _____ C:\Windows\wininit.ini
2015-11-19 09:49 - 2007-05-22 10:02 - 00282624 _____ (Monet+, a.s.) C:\Windows\tmpun.tmp
2015-11-19 07:01 - 2015-11-19 07:01 - 00087608 _____ C:\Users\hynek.HBWARE\AppData\Roaming\inst.exe
2015-11-18 17:57 - 2015-11-18 17:57 - 00000924 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job
2015-11-18 17:01 - 2015-11-18 17:01 - 00000000 ____D C:\Program Files\Common Files\Logitech
2015-11-18 17:00 - 2015-11-18 17:00 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\LocalLow\Oracle
2015-11-18 17:00 - 2015-11-18 17:00 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Local\Downloaded Installations
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-11-22 17:10 - 2008-05-27 21:30 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{A734A4B6-56BF-4618-BD52-3C746DF2B429}.job
2015-11-22 17:07 - 2009-08-31 12:50 - 00000422 ____H C:\Windows\Tasks\User_Feed_Synchronization-{F49D08F9-F437-4469-8920-5D8403C0ED0D}.job
2015-11-22 17:04 - 2012-11-29 08:05 - 00000940 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-22 16:45 - 2008-05-27 19:43 - 01926326 _____ C:\Windows\WindowsUpdate.log
2015-11-22 16:40 - 2009-10-15 14:27 - 00000000 ____D C:\Users\hynek.HBWARE\Documents\Bluetooth
2015-11-22 16:35 - 2012-04-13 16:08 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-22 16:33 - 2012-11-29 08:05 - 00000936 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-22 16:31 - 2008-05-28 20:23 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2015-11-22 16:31 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-22 16:31 - 2006-11-02 14:00 - 00064872 _____ C:\Windows\PFRO.log
2015-11-22 16:31 - 2006-11-02 13:47 - 00003584 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-22 16:31 - 2006-11-02 13:47 - 00003584 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-22 16:30 - 2008-05-27 20:04 - 00000012 _____ C:\Windows\bthservsdp.dat
2015-11-22 16:30 - 2006-11-02 14:01 - 00032618 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-11-22 14:13 - 2012-11-29 08:11 - 00000000 ___RD C:\Users\hynek.HBWARE\Disk Google
2015-11-22 14:08 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tracing
2015-11-22 12:28 - 2008-09-17 18:00 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\Skype
2015-11-19 14:35 - 2010-02-28 19:27 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-11-19 12:12 - 2008-05-28 09:25 - 00000000 ____D C:\Users\hynek.HBWARE
2015-11-19 12:04 - 2008-05-27 19:45 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2015-11-19 12:03 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Web
2015-11-19 11:34 - 2008-07-26 09:38 - 00189440 _____ C:\Users\hynek.HBWARE\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-11-19 11:11 - 2014-07-04 07:13 - 00000000 ____D C:\Users\hynek.HBWARE\Ubiquiti UniFi
2015-11-19 10:51 - 2009-02-02 11:48 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\dvdcss
2015-11-19 10:26 - 2012-04-10 13:22 - 00000000 ____D C:\Users\hynek.HBWARE\NSU
2015-11-19 10:17 - 2008-05-27 19:45 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2015-11-19 10:16 - 2008-09-15 08:15 - 00674370 _____ C:\Windows\DPINST.LOG
2015-11-19 10:12 - 2006-11-02 13:42 - 00000000 ____D C:\Windows\WindowsMobile
2015-11-19 10:10 - 2008-11-23 20:26 - 00000000 ____D C:\Program Files\Common Files\soft602
2015-11-19 10:09 - 2006-11-02 12:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-11-19 10:03 - 2011-04-28 09:26 - 00000000 ____D C:\WinSetupFromUSB
2015-11-19 09:56 - 2009-11-10 13:15 - 00000000 ____D C:\Program Files\remoteAP
2015-11-19 09:54 - 2011-04-29 08:00 - 00000000 ____D C:\Program Files\nLite
2015-11-19 09:43 - 2008-06-01 18:53 - 00000000 ____D C:\Windows\Downloaded Installations
2015-11-19 09:43 - 2008-05-28 09:27 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\Teleca
2015-11-19 09:42 - 2008-05-27 21:02 - 00000000 ____D C:\Program Files\Common Files\Teleca Shared
2015-11-19 09:35 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\twain_32
2015-11-19 08:11 - 2014-07-19 08:25 - 01292172 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-19 07:29 - 2009-05-29 19:39 - 00000000 ____D C:\Program Files\Google
2015-11-19 07:28 - 2009-05-29 19:40 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Local\Google
2015-11-19 07:06 - 2008-06-01 17:39 - 00000000 ____D C:\WIN_SYS61
2015-11-19 07:04 - 2012-05-17 12:31 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-11-19 07:04 - 2011-02-25 16:39 - 00000000 ____D C:\Program Files\QuickTime
2015-11-19 07:04 - 2009-08-21 08:36 - 00000000 ____D C:\Program Files\Ahead
2015-11-19 07:04 - 2009-01-19 15:11 - 00000000 ____D C:\Fujitsu Siemens Computers
2015-11-19 07:04 - 2007-02-19 13:32 - 00000000 ____D C:\Windows\Panther
2015-11-19 07:04 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\DigitalLocker
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Default
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Registration
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\PLA
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\MSAgent
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\IME
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Help
2015-11-19 07:01 - 2009-01-16 15:25 - 00000033 _____ C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.log
2015-11-19 07:01 - 2009-01-16 15:24 - 00047360 _____ (VSO Software) C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.sys
2015-11-19 07:01 - 2009-01-16 15:24 - 00007887 _____ C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.cat
2015-11-19 07:01 - 2009-01-16 15:24 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\Vso
2015-11-18 20:59 - 2013-03-21 10:09 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Local\Garmin
2015-11-18 20:59 - 2010-01-05 20:54 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\GARMIN
2015-11-18 20:37 - 2009-04-20 14:49 - 00000009 _____ C:\Windows\Brfaxrx.ini
2015-11-18 20:37 - 2009-04-20 14:47 - 00000000 ____D C:\Program Files\Brother
2015-11-18 18:34 - 2012-04-13 16:07 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-11-18 18:34 - 2011-05-24 07:52 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-11-18 17:57 - 2015-08-03 15:47 - 00000924 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job
2015-10-27 18:44 - 2006-11-02 11:24 - 143250520 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
==================== Files in the root of some directories =======
2009-01-16 15:24 - 2009-01-16 15:24 - 0087608 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\ezpinst.exe
2012-08-17 07:49 - 2012-08-17 07:49 - 0038492 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\Hodnoty oddělené čárkami (DOS).ADR
2012-08-17 08:06 - 2012-08-17 08:06 - 0038491 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\Hodnoty oddělené čárkami (Windows).ADR
2015-11-19 07:01 - 2015-11-19 07:01 - 0087608 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\inst.exe
2009-01-16 15:24 - 2015-11-19 07:01 - 0007887 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.cat
2009-01-16 15:24 - 2015-11-19 07:01 - 0001144 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.inf
2009-01-16 15:25 - 2015-11-19 07:01 - 0000033 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.log
2009-01-16 15:24 - 2015-11-19 07:01 - 0047360 _____ (VSO Software) C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.sys
2010-07-01 15:20 - 2010-07-01 15:21 - 0000180 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\setup.log
2010-07-01 15:20 - 2010-07-01 15:20 - 0000760 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\setup_ldm.iss
2009-12-13 18:23 - 2010-12-25 09:35 - 0000668 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\vso_ts_preview.xml
2010-12-03 18:34 - 2013-11-21 12:11 - 0000680 _____ () C:\Users\hynek.HBWARE\AppData\Local\d3d9caps.dat
2008-07-26 09:38 - 2015-11-19 11:34 - 0189440 _____ () C:\Users\hynek.HBWARE\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-07-19 07:20 - 2011-08-09 06:22 - 0000147 _____ () C:\Users\hynek.HBWARE\AppData\Local\RAExpertHistory.xml
2009-08-21 08:47 - 2009-10-21 15:15 - 0000147 _____ () C:\Users\hynek.HBWARE\AppData\Local\rahistory.xml
2008-09-17 18:06 - 2008-09-17 18:06 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2008-06-01 18:03 - 2009-02-07 10:02 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt
Some files in TEMP:
====================
C:\Users\hynek.HBWARE\AppData\Local\Temp\Bootstrapper.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperARA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperARU.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperCHS.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperCHT.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperCSY.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperDAN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperDEU.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperELL.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperENU.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperESN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperESP.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperFIN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperFRA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperHEB.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperHRV.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperHUN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperITA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperJPN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperKOR.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperLOC.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperNLD.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperNOR.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperPLK.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperPTB.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperPTG.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperRUS.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperSKY.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperSLV.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperSVE.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperTHA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperTRK.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperUKR.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\dotNetFx40_Client_setup.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\firefoxjre_exe-1.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\Garmin.Cartography.DeviceInteraction.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\GarminMapUpdater.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\GpsImgWrapper.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\ICReinstall_JavaSetup.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\Interop.IWshRuntimeLibrary.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u13-windows-i586-p-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u17-windows-i586-iftw-rv.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u40-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\lowproc.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\mfc100.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\msvcp100.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\msvcr100.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\MyDownloader.Core.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\setpointenu.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\SkypeSetup.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\sp_setpoint.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\sqlite3.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\stubhelper.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\SystemParametersInfo.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\tmpB65C.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\tmpBFCE.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\Uninst.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\UninstallRC-8876480.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\usb_lib.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\_is481A.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_is4C0.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_is59A0.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isA6A4.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isD68B.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isDBDF.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isE0C2.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isF21F.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
==================== MBR and Partition Table ==================
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cf96d28e1ce51e.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cff022afa1884c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d006fdd9c5323a.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0469cac5defc4.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d073b6646e6a44.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{A734A4B6-56BF-4618-BD52-3C746DF2B429}.job => C:\Windows\system32\msfeedssync.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{F49D08F9-F437-4469-8920-5D8403C0ED0D}.job => C:\Windows\system32\msfeedssync.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\hynek.HBWARE\Desktop" je 69 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000
==================== End Of Log ==============================
Ran by hynek (administrator) on ESPRIMO (22-11-2015 17:11:21)
Running from C:\Users\hynek.HBWARE\Desktop
Loaded Profiles: hynek (Available Profiles: hynek & hynek)
Platform: Microsoft® Windows Vista™ Business (X86) Language: Čeština (Česká republika)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(brother Industries Ltd) C:\Windows\System32\brsvc01a.exe
(brother Industries Ltd) C:\Windows\System32\brss01a.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Oki Data Corporation) C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(TOSHIBA CORPORATION) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
() C:\Program Files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe
() C:\Program Files\FSC\WebCam HotKey Utility\Webcam_HotKey.exe
(FinePrint Software, LLC) C:\Windows\System32\spool\drivers\w32x86\3\fppdis2a.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(RealNetworks, Inc.) C:\Program Files\Real\realplayer\Update\realsched.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
(ITE Tech Inc.) C:\Program Files\FSC\Wireless Utility\WirelessSelector.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
(TOSHIBA CORPORATION.) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Google Inc.) C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(forum.viry.cz) C:\Users\hynek.HBWARE\Desktop\FRSTLauncher.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1006264 2007-09-12] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4489216 2007-06-13] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-05-28] (Realtek Semiconductor Corp.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [174616 2007-07-24] (Intel Corporation)
HKLM\...\Run: [TouchPadHotKey] => C:\Program Files\FSC\TouchPad HotKey Utility\TouchPad_HotKey.exe [360448 2007-06-26] ()
HKLM\...\Run: [WebCamHotKey] => C:\Program Files\FSC\WebCam HotKey Utility\WebCam_HotKey.exe [376832 2007-06-26] ()
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [76304 2008-02-29] (Logitech, Inc.)
HKLM\...\Run: [pdfFactory Pro Dispatcher v2] => C:\Windows\system32\spool\DRIVERS\W32X86\3\fppdis2a.exe [479232 2005-03-03] (FinePrint Software, LLC)
HKLM\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [38840 2011-01-30] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [640440 2010-09-22] (Adobe Systems Inc.)
HKLM\...\Run: [NeroFilterCheck] => C:\Windows\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [981688 2015-04-29] (Microsoft Corporation)
HKLM\...\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [296056 2012-06-25] (RealNetworks, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [WinSent Messenger] => "C:\Program Files\WinSent Messenger\winsent.exe"
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [PID] => C:\Users\HYNEK~1.HBW\AppData\Local\Temp\Invoice_08.22.2011_Stor?cod.exe <===== ATTENTION
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [Google Update] => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-11-18] (Google Inc.)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [22568216 2015-10-12] (Google)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [GoogleChromeAutoLaunch_5E835259BEFB7618610CEBCBC68C4630] => C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe [811848 2015-11-07] (Google Inc.)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: E - E:\ActivateWarranty.exe
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {780c03e0-067e-11e4-af2d-806e6f6e6963} - E:\ActivateWarranty.exe
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {b95ff222-f8b7-11de-b9c9-001a6b28d8b7} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...0c966feabec1\InprocServer32: [Default-shell32] ATTENTION! ====> ZeroAccess?
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll [2015-10-12] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: [S-1-5-21-1715567821-507921405-1957994488-1150] => hbwares:8080
AutoConfigURL: [S-1-5-21-1715567821-507921405-1957994488-1150] => hbwares:8080
Winsock: Catalog5 04 C:\Windows\system32\napinsp.dll [50176 2006-11-02] (Společnost Microsoft)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [152864 2010-10-07] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.10.1
Tcpip\..\Interfaces\{74A54890-99E2-4483-86D6-4E456C1A0C9F}: [DhcpNameServer] 192.168.88.1
Tcpip\..\Interfaces\{CACC0914-1A62-420D-ABD5-5C3C9CADBDD7}: [DhcpNameServer] 192.168.10.1
Tcpip\..\Interfaces\{DF5D0A04-4B97-410D-8879-9041BD60F144}: [DhcpNameServer] 93.153.117.1 93.153.117.33
Internet Explorer:
==================
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.fujitsu-siemens.com/index2
SearchScopes: HKU\S-1-5-21-1715567821-507921405-1957994488-1150 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22] (Adobe Systems Incorporated)
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2012-06-25] (RealPlayer)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-05-07] (Oracle Corporation)
BHO: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-05-07] (Oracle Corporation)
BHO: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1715567821-507921405-1957994488-1150 -> Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2010-09-22] (Adobe Systems Incorporated)
DPF: {672EE252-D813-4F5E-81BB-5DD163DD4FA5} hxxps://www.mojedatovaschranka.cz/static/pages/ ... ?3,16,13,0
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FireFox:
========
FF ProfilePath: C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default
FF Homepage: hxxp://seznam.cz/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-18] ()
FF Plugin: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-05-07] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-05-07] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.4.53 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.4.53 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=15.0.4.53 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll [2012-06-25] (RealPlayer)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1715567821-507921405-1957994488-1150: @tools.google.com/Google Update;version=3 -> C:\Users\hynek.HBWARE\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin HKU\S-1-5-21-1715567821-507921405-1957994488-1150: @tools.google.com/Google Update;version=9 -> C:\Users\hynek.HBWARE\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-18] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-27] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2011-03-12] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2011-02-25] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprjplug.dll [2012-06-25] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2012-06-25] (RealPlayer)
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\extensions\2020Player_IKEA@2020Technologies.com [2012-04-02] [not signed]
FF Extension: Garmin Communicator - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-07-19] [not signed]
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-06-25] [not signed]
FF Extension: Dman Data Editor - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\Extensions\npdmaned@onyxsoftware.cz [2011-02-18] [not signed]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\hynek.HBWARE\AppData\Roaming\Mozilla\Firefox\Profiles\a262ui4k.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-27] [not signed]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2012-10-23] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-02] [not signed]
FF HKLM\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
Chrome:
=======
CHR Plugin: (Native Client) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\46.0.2490.86\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\46.0.2490.86\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\46.0.2490.86\gcswf32.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll => No File
CHR Plugin: (Skype Click to Call) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.0.0.10297_0\npSkypeChromePlugin.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll => No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll (RealPlayer)
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll (RealNetworks, Inc.)
CHR Plugin: (Garmin Communicator Plug-In) - C:\Program Files\Garmin GPS Plugin\npGarmin.dll => No File
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll => No File
CHR Plugin: (Software602 Form Filler) - C:\Program Files\Software602\602XML\Filler\npfiller.dll => No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll => No File
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (Google Update) - C:\Users\hynek.HBWARE\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll => No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Profile: C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Disk Google) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-19]
CHR Extension: (YouTube) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-19]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-11-19]
CHR Extension: (Vyhledávání Google) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-19]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-19]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2012-07-09]
CHR Extension: (Store) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2014-11-09]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-04]
CHR Extension: (Gmail) - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-08]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-06-25]
CHR HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\HYNEK~1.HBW\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-06-19]
CHR HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome - C:\Users\hynek.HBWARE\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2002-04-11] (brother Industries Ltd) [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2009-08-18] (Macrovision Europe Ltd.) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2015-04-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2008-02-28] (Hewlett-Packard) [File not signed]
R2 OpLclSrv; C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe [147456 2014-11-20] (Oki Data Corporation) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2008-02-28] (Hewlett-Packard) [File not signed]
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [265912 2007-09-12] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 acpi_contactor; C:\Windows\System32\DRIVERS\acpi_contactor_vista.sys [7680 2007-04-13] (INVENTEC Corporation)
R2 Ethpdrv; C:\Windows\System32\DRIVERS\ethpdrv.sys [16376 2007-08-01] (Gemfor s.r.o.)
R3 FIXUSTOR; C:\Windows\System32\DRIVERS\fixustor.sys [15360 2009-04-23] (Genesys Logic)
R0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [183912 2006-11-02] (Společnost Microsoft)
S3 GT72NDISIPXP; C:\Windows\System32\DRIVERS\Gt51Ip.sys [106624 2008-02-18] (Option N.V.)
S3 GT72UBUS; C:\Windows\System32\DRIVERS\gt72ubus.sys [59648 2008-02-08] (Option N.V.)
S3 GTPTSER; C:\Windows\System32\DRIVERS\gtptser.sys [8064 2007-03-30] (Option N.V.)
S3 GTwinUSB; C:\Windows\System32\Drivers\GTwinUSB.sys [71424 2005-04-15] (Gemplus)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2010-02-22] (MBB Incorporated) [File not signed]
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [245096 2015-03-04] (Microsoft Corporation)
R1 MpKsl3de36f3f; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{76EF9060-483A-4CE0-9FF6-8CD69827952D}\MpKsl3de36f3f.sys [39168 2015-11-22] (Microsoft Corporation)
R1 MpKsl7d2cbc68; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{76EF9060-483A-4CE0-9FF6-8CD69827952D}\MpKsl7d2cbc68.sys [39168 2015-11-22] (Microsoft Corporation)
R3 Ntfs; C:\Windows\system32\Drivers\Ntfs.sys [1060920 2008-05-27] (Společnost Microsoft)
S3 s125bus; C:\Windows\System32\DRIVERS\s125bus.sys [83336 2007-04-24] (MCCI Corporation)
S3 s125mdfl; C:\Windows\System32\DRIVERS\s125mdfl.sys [15112 2007-04-24] (MCCI Corporation)
S3 s125mdm; C:\Windows\System32\DRIVERS\s125mdm.sys [108680 2007-04-24] (MCCI Corporation)
S3 s125mgmt; C:\Windows\System32\DRIVERS\s125mgmt.sys [100488 2007-04-24] (MCCI Corporation)
S3 s125obex; C:\Windows\System32\DRIVERS\s125obex.sys [98696 2007-04-24] (MCCI Corporation)
S3 s3017bus; C:\Windows\System32\DRIVERS\s3017bus.sys [83880 2007-12-10] (MCCI Corporation)
S3 s3017mdfl; C:\Windows\System32\DRIVERS\s3017mdfl.sys [15016 2007-12-10] (MCCI Corporation)
S3 s3017mdm; C:\Windows\System32\DRIVERS\s3017mdm.sys [110632 2007-12-10] (MCCI Corporation)
S3 s3017mgmt; C:\Windows\System32\DRIVERS\s3017mgmt.sys [104616 2007-12-10] (MCCI Corporation)
S3 s3017nd5; C:\Windows\System32\DRIVERS\s3017nd5.sys [25512 2007-12-10] (MCCI Corporation)
S3 s3017obex; C:\Windows\System32\DRIVERS\s3017obex.sys [100648 2007-12-10] (MCCI Corporation)
S3 s3017unic; C:\Windows\System32\DRIVERS\s3017unic.sys [110120 2007-12-10] (MCCI Corporation)
S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [9604096 2007-05-24] () [File not signed]
R1 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 Netaapl; system32\DRIVERS\netaapl.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-11-22 17:11 - 2015-11-22 17:11 - 00028988 _____ C:\Users\hynek.HBWARE\Desktop\FRST.txt
2015-11-22 17:09 - 2015-11-22 17:09 - 00112640 _____ (forum.viry.cz) C:\Users\hynek.HBWARE\Desktop\FRSTLauncher.exe
2015-11-22 17:05 - 2015-11-22 17:05 - 00000000 ____D C:\Users\hynek.HBWARE\Desktop\FRST-OlderVersion
2015-11-22 16:10 - 2015-11-22 16:25 - 00000000 ____D C:\AdwCleaner
2015-11-22 16:02 - 2015-11-22 16:03 - 01732096 _____ C:\Users\hynek.HBWARE\Desktop\adwcleaner_5.021.exe
2015-11-22 15:42 - 2015-11-22 15:42 - 00002219 _____ C:\Users\hynek.HBWARE\Desktop\aswMBR.txt
2015-11-22 15:42 - 2015-11-22 15:42 - 00000512 _____ C:\Users\hynek.HBWARE\Desktop\MBR.dat
2015-11-22 15:23 - 2015-11-22 15:23 - 00025396 _____ C:\Users\hynek.HBWARE\Desktop\MbrScan.log
2015-11-22 15:23 - 2015-11-22 15:23 - 00000512 _____ C:\Users\hynek.HBWARE\Desktop\Dump_Hdd0_DR0.mbr
2015-11-22 15:21 - 2015-11-22 15:22 - 05200384 _____ (AVAST Software) C:\Users\hynek.HBWARE\Desktop\aswmbr.exe
2015-11-22 15:21 - 2015-11-22 15:21 - 00147456 _____ (Eric_71) C:\Users\hynek.HBWARE\Desktop\MbrScan.exe
2015-11-22 13:04 - 2015-11-22 13:07 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-11-22 13:02 - 2015-11-22 14:03 - 00000000 ____D C:\Users\hynek.HBWARE\Desktop\mbar
2015-11-22 12:58 - 2015-11-22 12:59 - 16563352 _____ (Malwarebytes Corp.) C:\Users\hynek.HBWARE\Desktop\mbar-1.09.3.1001.exe
2015-11-22 12:05 - 2015-11-22 12:06 - 00001986 _____ C:\Users\hynek.HBWARE\Downloads\hynekbrydl@gmail.com-20151122-120557.csv
2015-11-20 10:52 - 2015-11-22 17:11 - 00000000 ____D C:\FRST
2015-11-20 10:47 - 2015-11-22 17:07 - 01716736 _____ (Farbar) C:\Users\hynek.HBWARE\Desktop\FRST.exe
2015-11-20 10:39 - 2015-11-20 10:39 - 00112640 _____ (forum.viry.cz) C:\Users\hynek.HBWARE\Downloads\Nepotvrzeno 928929.crdownload
2015-11-19 15:13 - 2015-11-19 15:13 - 00000000 ___HD C:\OneDriveTemp
2015-11-19 14:52 - 2015-11-19 14:53 - 02449376 _____ (Megaify Software ) C:\Users\hynek.HBWARE\Downloads\DriverToolkitInstaller.exe
2015-11-19 13:00 - 2015-11-19 13:20 - 00000000 ____D C:\Windows\system32\MRT
2015-11-19 12:12 - 2015-11-22 16:40 - 00000000 ___RD C:\Users\hynek.HBWARE\OneDrive
2015-11-19 12:12 - 2015-11-19 12:12 - 00002000 _____ C:\Users\hynek.HBWARE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-11-19 12:12 - 2015-11-19 12:12 - 00001927 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-11-19 12:12 - 2015-11-19 12:12 - 00000000 ____D C:\Program Files\Microsoft OneDrive
2015-11-19 12:12 - 2015-11-19 12:09 - 07904968 _____ (Microsoft Corporation) C:\Users\hynek.HBWARE\Downloads\OneDriveSetup.exe
2015-11-19 12:04 - 2013-02-05 08:58 - 00000104 _____ C:\Windows\system32\opnetext.ver
2015-11-19 12:04 - 2013-01-29 18:58 - 00094208 ____N (Oki Data Corporation) C:\Windows\system32\opnetext.dll
2015-11-19 12:04 - 2013-01-29 10:03 - 00010104 ____N C:\Windows\system32\OPNETEXT.HLP
2015-11-19 12:04 - 2013-01-29 10:03 - 00005832 ____N C:\Windows\system32\license.txt
2015-11-19 12:04 - 2013-01-29 10:03 - 00003844 ____N C:\Windows\system32\opnedef.str
2015-11-19 12:04 - 2013-01-29 10:03 - 00000144 ____N C:\Windows\system32\opnetext.cnt
2015-11-19 12:04 - 2013-01-29 10:03 - 00000000 ____N C:\Windows\system32\OPNETEXT.GID
2015-11-19 11:58 - 2014-04-04 14:58 - 00000000 ____D C:\Users\hynek.HBWARE\Downloads\OKW3C04O107
2015-11-19 11:58 - 2009-06-25 18:00 - 00040960 _____ (Oki Data Corporation) C:\Windows\system32\OKLMON32.DLL
2015-11-19 11:53 - 2015-11-19 11:57 - 13647416 _____ C:\Users\hynek.HBWARE\Downloads\OKW3C04O107_tcm3-138073.exe
2015-11-19 11:49 - 2015-11-19 11:49 - 00000000 ____D C:\Program Files\Okidata
2015-11-19 11:49 - 2015-11-19 11:48 - 00052141 _____ C:\Windows\system32\OKDRTPRN.chm
2015-11-19 11:49 - 2015-11-19 11:48 - 00040960 _____ C:\Windows\system32\OkDPnRes.dll
2015-11-19 11:49 - 2015-03-09 12:41 - 00469272 _____ (Oki Data Corporation) C:\Windows\system32\OkDrtPrn.exe
2015-11-19 11:49 - 2014-10-13 18:01 - 00196608 _____ (Oki Data Corporation) C:\Windows\system32\OkDrtPrn.dll
2015-11-19 11:49 - 2014-07-11 15:25 - 00005120 _____ (Oki Data Corporation) C:\Windows\system32\okComDLL.dll
2015-11-19 11:49 - 2012-05-28 16:54 - 00004096 _____ (Oki Data Corporation) C:\Windows\system32\fxComDLL.dll
2015-11-19 11:49 - 2012-05-28 16:54 - 00004096 _____ (Oki Data Corporation) C:\Windows\system32\efComDLL.dll
2015-11-19 11:44 - 2015-11-19 11:45 - 06816512 _____ (Acresso Software Inc. ) C:\Users\hynek.HBWARE\Downloads\PDFP_ALL_040200_1_tcm3-53582.exe
2015-11-19 11:08 - 2015-06-19 15:51 - 00000000 ____D C:\Users\hynek.HBWARE\Downloads\CT_010618_2-3-ALWEB163022
2015-11-19 11:03 - 2015-11-19 11:06 - 28365648 _____ C:\Users\hynek.HBWARE\Downloads\CT_010618_2-3-ALWEB163022_tcm3-124644.exe
2015-11-19 10:18 - 2015-11-19 10:18 - 00001972 _____ C:\Users\Public\Desktop\NAS Starter Utility.lnk
2015-11-19 10:18 - 2015-11-19 10:18 - 00000000 ____D C:\Program Files\ZyXEL
2015-11-19 10:04 - 2015-11-19 10:04 - 00000292 _____ C:\Windows\SynInst.log
2015-11-19 09:49 - 2015-11-19 09:49 - 00000036 _____ C:\Windows\wininit.ini
2015-11-19 09:49 - 2007-05-22 10:02 - 00282624 _____ (Monet+, a.s.) C:\Windows\tmpun.tmp
2015-11-19 07:01 - 2015-11-19 07:01 - 00087608 _____ C:\Users\hynek.HBWARE\AppData\Roaming\inst.exe
2015-11-18 17:57 - 2015-11-18 17:57 - 00000924 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job
2015-11-18 17:01 - 2015-11-18 17:01 - 00000000 ____D C:\Program Files\Common Files\Logitech
2015-11-18 17:00 - 2015-11-18 17:00 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\LocalLow\Oracle
2015-11-18 17:00 - 2015-11-18 17:00 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Local\Downloaded Installations
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-11-22 17:10 - 2008-05-27 21:30 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{A734A4B6-56BF-4618-BD52-3C746DF2B429}.job
2015-11-22 17:07 - 2009-08-31 12:50 - 00000422 ____H C:\Windows\Tasks\User_Feed_Synchronization-{F49D08F9-F437-4469-8920-5D8403C0ED0D}.job
2015-11-22 17:04 - 2012-11-29 08:05 - 00000940 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-22 16:45 - 2008-05-27 19:43 - 01926326 _____ C:\Windows\WindowsUpdate.log
2015-11-22 16:40 - 2009-10-15 14:27 - 00000000 ____D C:\Users\hynek.HBWARE\Documents\Bluetooth
2015-11-22 16:35 - 2012-04-13 16:08 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-11-22 16:33 - 2012-11-29 08:05 - 00000936 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-22 16:31 - 2008-05-28 20:23 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2015-11-22 16:31 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-11-22 16:31 - 2006-11-02 14:00 - 00064872 _____ C:\Windows\PFRO.log
2015-11-22 16:31 - 2006-11-02 13:47 - 00003584 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-11-22 16:31 - 2006-11-02 13:47 - 00003584 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-11-22 16:30 - 2008-05-27 20:04 - 00000012 _____ C:\Windows\bthservsdp.dat
2015-11-22 16:30 - 2006-11-02 14:01 - 00032618 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-11-22 14:13 - 2012-11-29 08:11 - 00000000 ___RD C:\Users\hynek.HBWARE\Disk Google
2015-11-22 14:08 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\tracing
2015-11-22 12:28 - 2008-09-17 18:00 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\Skype
2015-11-19 14:35 - 2010-02-28 19:27 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-11-19 12:12 - 2008-05-28 09:25 - 00000000 ____D C:\Users\hynek.HBWARE
2015-11-19 12:04 - 2008-05-27 19:45 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2015-11-19 12:03 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Web
2015-11-19 11:34 - 2008-07-26 09:38 - 00189440 _____ C:\Users\hynek.HBWARE\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-11-19 11:11 - 2014-07-04 07:13 - 00000000 ____D C:\Users\hynek.HBWARE\Ubiquiti UniFi
2015-11-19 10:51 - 2009-02-02 11:48 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\dvdcss
2015-11-19 10:26 - 2012-04-10 13:22 - 00000000 ____D C:\Users\hynek.HBWARE\NSU
2015-11-19 10:17 - 2008-05-27 19:45 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2015-11-19 10:16 - 2008-09-15 08:15 - 00674370 _____ C:\Windows\DPINST.LOG
2015-11-19 10:12 - 2006-11-02 13:42 - 00000000 ____D C:\Windows\WindowsMobile
2015-11-19 10:10 - 2008-11-23 20:26 - 00000000 ____D C:\Program Files\Common Files\soft602
2015-11-19 10:09 - 2006-11-02 12:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-11-19 10:03 - 2011-04-28 09:26 - 00000000 ____D C:\WinSetupFromUSB
2015-11-19 09:56 - 2009-11-10 13:15 - 00000000 ____D C:\Program Files\remoteAP
2015-11-19 09:54 - 2011-04-29 08:00 - 00000000 ____D C:\Program Files\nLite
2015-11-19 09:43 - 2008-06-01 18:53 - 00000000 ____D C:\Windows\Downloaded Installations
2015-11-19 09:43 - 2008-05-28 09:27 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\Teleca
2015-11-19 09:42 - 2008-05-27 21:02 - 00000000 ____D C:\Program Files\Common Files\Teleca Shared
2015-11-19 09:35 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\twain_32
2015-11-19 08:11 - 2014-07-19 08:25 - 01292172 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-19 07:29 - 2009-05-29 19:39 - 00000000 ____D C:\Program Files\Google
2015-11-19 07:28 - 2009-05-29 19:40 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Local\Google
2015-11-19 07:06 - 2008-06-01 17:39 - 00000000 ____D C:\WIN_SYS61
2015-11-19 07:04 - 2012-05-17 12:31 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-11-19 07:04 - 2011-02-25 16:39 - 00000000 ____D C:\Program Files\QuickTime
2015-11-19 07:04 - 2009-08-21 08:36 - 00000000 ____D C:\Program Files\Ahead
2015-11-19 07:04 - 2009-01-19 15:11 - 00000000 ____D C:\Fujitsu Siemens Computers
2015-11-19 07:04 - 2007-02-19 13:32 - 00000000 ____D C:\Windows\Panther
2015-11-19 07:04 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\DigitalLocker
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Default
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Registration
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\PLA
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\MSAgent
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\IME
2015-11-19 07:04 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Help
2015-11-19 07:01 - 2009-01-16 15:25 - 00000033 _____ C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.log
2015-11-19 07:01 - 2009-01-16 15:24 - 00047360 _____ (VSO Software) C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.sys
2015-11-19 07:01 - 2009-01-16 15:24 - 00007887 _____ C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.cat
2015-11-19 07:01 - 2009-01-16 15:24 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\Vso
2015-11-18 20:59 - 2013-03-21 10:09 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Local\Garmin
2015-11-18 20:59 - 2010-01-05 20:54 - 00000000 ____D C:\Users\hynek.HBWARE\AppData\Roaming\GARMIN
2015-11-18 20:37 - 2009-04-20 14:49 - 00000009 _____ C:\Windows\Brfaxrx.ini
2015-11-18 20:37 - 2009-04-20 14:47 - 00000000 ____D C:\Program Files\Brother
2015-11-18 18:34 - 2012-04-13 16:07 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-11-18 18:34 - 2011-05-24 07:52 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-11-18 17:57 - 2015-08-03 15:47 - 00000924 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job
2015-10-27 18:44 - 2006-11-02 11:24 - 143250520 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
==================== Files in the root of some directories =======
2009-01-16 15:24 - 2009-01-16 15:24 - 0087608 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\ezpinst.exe
2012-08-17 07:49 - 2012-08-17 07:49 - 0038492 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\Hodnoty oddělené čárkami (DOS).ADR
2012-08-17 08:06 - 2012-08-17 08:06 - 0038491 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\Hodnoty oddělené čárkami (Windows).ADR
2015-11-19 07:01 - 2015-11-19 07:01 - 0087608 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\inst.exe
2009-01-16 15:24 - 2015-11-19 07:01 - 0007887 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.cat
2009-01-16 15:24 - 2015-11-19 07:01 - 0001144 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.inf
2009-01-16 15:25 - 2015-11-19 07:01 - 0000033 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.log
2009-01-16 15:24 - 2015-11-19 07:01 - 0047360 _____ (VSO Software) C:\Users\hynek.HBWARE\AppData\Roaming\pcouffin.sys
2010-07-01 15:20 - 2010-07-01 15:21 - 0000180 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\setup.log
2010-07-01 15:20 - 2010-07-01 15:20 - 0000760 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\setup_ldm.iss
2009-12-13 18:23 - 2010-12-25 09:35 - 0000668 _____ () C:\Users\hynek.HBWARE\AppData\Roaming\vso_ts_preview.xml
2010-12-03 18:34 - 2013-11-21 12:11 - 0000680 _____ () C:\Users\hynek.HBWARE\AppData\Local\d3d9caps.dat
2008-07-26 09:38 - 2015-11-19 11:34 - 0189440 _____ () C:\Users\hynek.HBWARE\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-07-19 07:20 - 2011-08-09 06:22 - 0000147 _____ () C:\Users\hynek.HBWARE\AppData\Local\RAExpertHistory.xml
2009-08-21 08:47 - 2009-10-21 15:15 - 0000147 _____ () C:\Users\hynek.HBWARE\AppData\Local\rahistory.xml
2008-09-17 18:06 - 2008-09-17 18:06 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2008-06-01 18:03 - 2009-02-07 10:02 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt
Some files in TEMP:
====================
C:\Users\hynek.HBWARE\AppData\Local\Temp\Bootstrapper.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperARA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperARU.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperCHS.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperCHT.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperCSY.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperDAN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperDEU.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperELL.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperENU.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperESN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperESP.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperFIN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperFRA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperHEB.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperHRV.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperHUN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperITA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperJPN.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperKOR.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperLOC.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperNLD.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperNOR.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperPLK.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperPTB.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperPTG.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperRUS.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperSKY.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperSLV.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperSVE.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperTHA.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperTRK.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\BootstrapperUKR.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\dotNetFx40_Client_setup.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\firefoxjre_exe-1.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\Garmin.Cartography.DeviceInteraction.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\GarminMapUpdater.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\GpsImgWrapper.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\ICReinstall_JavaSetup.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\Interop.IWshRuntimeLibrary.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u13-windows-i586-p-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u17-windows-i586-iftw-rv.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u40-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\lowproc.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\mfc100.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\msvcp100.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\msvcr100.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\MyDownloader.Core.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\setpointenu.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\SkypeSetup.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\sp_setpoint.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\sqlite3.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\stubhelper.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\SystemParametersInfo.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\tmpB65C.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\tmpBFCE.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\Uninst.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\UninstallRC-8876480.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\usb_lib.dll
C:\Users\hynek.HBWARE\AppData\Local\Temp\_is481A.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_is4C0.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_is59A0.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isA6A4.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isD68B.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isDBDF.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isE0C2.exe
C:\Users\hynek.HBWARE\AppData\Local\Temp\_isF21F.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
==================== MBR and Partition Table ==================
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cf96d28e1ce51e.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cff022afa1884c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d006fdd9c5323a.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0469cac5defc4.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d073b6646e6a44.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{A734A4B6-56BF-4618-BD52-3C746DF2B429}.job => C:\Windows\system32\msfeedssync.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{F49D08F9-F437-4469-8920-5D8403C0ED0D}.job => C:\Windows\system32\msfeedssync.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\hynek.HBWARE\Desktop" je 69 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000
==================== End Of Log ==============================
- Přílohy
-
- Addition.rar
- (11.19 KiB) Staženo 42 x
Re: preventivka
Odinstalujte starou a zranitelnou verzi javy. Pokud javu potrebujete, pak nainstalujte novou z java.com - pozor na adware pri jeji instalaci http://forum.viry.cz/viewtopic.php?p=1374438#p1374438 . Z hlediska bezpecnosti (exploity) je lepsi ji nemit. Aktualni je 8U66. Verze Javy, ktere v PC mate nainstalovane:- J2SE Runtime Environment 5.0 Update 4
- Java 7 Update 60
- Java(TM) 6 Update 37
- Do Poznamkoveho bloku (Start -> spustit -> notepad) zkopirujte obsah bileho pole
- ulozte na plochu jako fixlist (Typ souboru: Textovy dokument)
- znovu spustte FRST a kliknete na Fix
- po restartu bude na plose ulozen fixlog, jehoz obsah vlozte do pristi odpovedi
Kód: Vybrat vše
Start CreateRestorePoint: CloseProcesses: HKLM\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [38840 2011-01-30] (Adobe Systems Incorporated) HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [640440 2010-09-22] (Adobe Systems Inc.) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated) HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.) HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.) HKLM\...\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [296056 2012-06-25] (RealNetworks, Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation) HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [PID] => C:\Users\HYNEK~1.HBW\AppData\Local\Temp\Invoice_08.22.2011_Stor?cod.exe <===== ATTENTION HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: E - E:\ActivateWarranty.exe HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {780c03e0-067e-11e4-af2d-806e6f6e6963} - E:\ActivateWarranty.exe HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {b95ff222-f8b7-11de-b9c9-001a6b28d8b7} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...0c966feabec1\InprocServer32: [Default-shell32] ATTENTION! ====> ZeroAccess? SearchScopes: HKU\S-1-5-21-1715567821-507921405-1957994488-1150 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cf96d28e1ce51e.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cff022afa1884c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d006fdd9c5323a.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0469cac5defc4.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d073b6646e6a44.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe Task: {0661BB41-4CF2-400E-BE64-8DA2001CF1E3} - System32\Tasks\{9100CE9D-AEA1-4DA0-B3ED-6D525EF755D5} => pcalua.exe -a "C:\Users\hynek.HBWARE\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ML5AMZSK\IPCam%20S300R.part1[1].exe" -d C:\Users\hynek.HBWARE Task: {91529A8C-0F30-4E76-9438-79CC23D1B703} - System32\Tasks\{5DDAC7C1-FA09-430A-BB5A-A1134A59A55A} => pcalua.exe -a "C:\Users\hynek.HBWARE\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BP9XC487\CommunicatorPlugin_291[1].exe" -d C:\Users\hynek.HBWARE Hosts: C:\Users\hynek.HBWARE\AppData\Local\Temp End
Pokud je cokoliv nejasného, ihned se ptej.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
V případě spokojenosti prosím podpořte forum.
Pro dotazy, které se nehodí na forum, je možné využít altrokzavináčforum.viry.cz
Máš-li chuť pomáhat návštěvníkům tohoto fora, přihlas se do naší školičky.
Re: preventivka
Java odinstalovaná 
Fix result of Farbar Recovery Scan Tool (x86) Version:20-11-2015
Ran by hynek (2015-11-22 18:24:42) Run:1
Running from C:\Users\hynek.HBWARE\Desktop
Loaded Profiles: hynek (Available Profiles: hynek & hynek)
Boot Mode: Normal
==============================================
fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [38840 2011-01-30] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [640440 2010-09-22] (Adobe Systems Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM\...\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [296056 2012-06-25] (RealNetworks, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [PID] => C:\Users\HYNEK~1.HBW\AppData\Local\Temp\Invoice_08.22.2011_Stor?cod.exe <===== ATTENTION
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: E - E:\ActivateWarranty.exe
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {780c03e0-067e-11e4-af2d-806e6f6e6963} - E:\ActivateWarranty.exe
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {b95ff222-f8b7-11de-b9c9-001a6b28d8b7} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...0c966feabec1\InprocServer32: [Default-shell32] ATTENTION! ====> ZeroAccess?
SearchScopes: HKU\S-1-5-21-1715567821-507921405-1957994488-1150 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cf96d28e1ce51e.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cff022afa1884c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d006fdd9c5323a.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0469cac5defc4.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d073b6646e6a44.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {0661BB41-4CF2-400E-BE64-8DA2001CF1E3} - System32\Tasks\{9100CE9D-AEA1-4DA0-B3ED-6D525EF755D5} => pcalua.exe -a "C:\Users\hynek.HBWARE\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ML5AMZSK\IPCam%20S300R.part1[1].exe" -d C:\Users\hynek.HBWARE
Task: {91529A8C-0F30-4E76-9438-79CC23D1B703} - System32\Tasks\{5DDAC7C1-FA09-430A-BB5A-A1134A59A55A} => pcalua.exe -a "C:\Users\hynek.HBWARE\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BP9XC487\CommunicatorPlugin_291[1].exe" -d C:\Users\hynek.HBWARE
Hosts:
C:\Users\hynek.HBWARE\AppData\Local\Temp
End
*****************
Error: (0) Failed to create a restore point.
Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Acrobat Speed Launcher => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Acrobat Assistant 8.0 => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SSBkgdUpdate => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\TkBellExe => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value not found.
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Windows\CurrentVersion\Run\\PID => value removed successfully.
"HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E" => key removed successfully.
"HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{780c03e0-067e-11e4-af2d-806e6f6e6963}" => key removed successfully.
HKCR\CLSID\{780c03e0-067e-11e4-af2d-806e6f6e6963} => key not found.
"HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b95ff222-f8b7-11de-b9c9-001a6b28d8b7}" => key removed successfully.
HKCR\CLSID\{b95ff222-f8b7-11de-b9c9-001a6b28d8b7} => key not found.
"HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}" => key removed successfully.
"HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => key removed successfully.
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => key not found.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cf96d28e1ce51e.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cff022afa1884c.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d006fdd9c5323a.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0469cac5defc4.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d073b6646e6a44.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0661BB41-4CF2-400E-BE64-8DA2001CF1E3}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0661BB41-4CF2-400E-BE64-8DA2001CF1E3}" => key removed successfully.
C:\Windows\System32\Tasks\{9100CE9D-AEA1-4DA0-B3ED-6D525EF755D5} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9100CE9D-AEA1-4DA0-B3ED-6D525EF755D5}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{91529A8C-0F30-4E76-9438-79CC23D1B703}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{91529A8C-0F30-4E76-9438-79CC23D1B703}" => key removed successfully.
C:\Windows\System32\Tasks\{5DDAC7C1-FA09-430A-BB5A-A1134A59A55A} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5DDAC7C1-FA09-430A-BB5A-A1134A59A55A}" => key removed successfully.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
"C:\Users\hynek.HBWARE\AppData\Local\Temp" folder move:
Could not move "C:\Users\hynek.HBWARE\AppData\Local\Temp" => Scheduled to move on reboot.
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2015-11-22 18:38:30)
"C:\Users\hynek.HBWARE\AppData\Local\Temp" => Could not move
==== End of Fixlog 18:38:30 ====
Fix result of Farbar Recovery Scan Tool (x86) Version:20-11-2015
Ran by hynek (2015-11-22 18:24:42) Run:1
Running from C:\Users\hynek.HBWARE\Desktop
Loaded Profiles: hynek (Available Profiles: hynek & hynek)
Boot Mode: Normal
==============================================
fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [38840 2011-01-30] (Adobe Systems Incorporated)
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [640440 2010-09-22] (Adobe Systems Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM\...\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [296056 2012-06-25] (RealNetworks, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\Run: [PID] => C:\Users\HYNEK~1.HBW\AppData\Local\Temp\Invoice_08.22.2011_Stor?cod.exe <===== ATTENTION
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: E - E:\ActivateWarranty.exe
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {780c03e0-067e-11e4-af2d-806e6f6e6963} - E:\ActivateWarranty.exe
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...\MountPoints2: {b95ff222-f8b7-11de-b9c9-001a6b28d8b7} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL http://www.garmin.com/agent
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\...0c966feabec1\InprocServer32: [Default-shell32] ATTENTION! ====> ZeroAccess?
SearchScopes: HKU\S-1-5-21-1715567821-507921405-1957994488-1150 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cf96d28e1ce51e.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cff022afa1884c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d006fdd9c5323a.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0469cac5defc4.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d073b6646e6a44.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job => C:\Users\hynek.HBWARE\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {0661BB41-4CF2-400E-BE64-8DA2001CF1E3} - System32\Tasks\{9100CE9D-AEA1-4DA0-B3ED-6D525EF755D5} => pcalua.exe -a "C:\Users\hynek.HBWARE\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ML5AMZSK\IPCam%20S300R.part1[1].exe" -d C:\Users\hynek.HBWARE
Task: {91529A8C-0F30-4E76-9438-79CC23D1B703} - System32\Tasks\{5DDAC7C1-FA09-430A-BB5A-A1134A59A55A} => pcalua.exe -a "C:\Users\hynek.HBWARE\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BP9XC487\CommunicatorPlugin_291[1].exe" -d C:\Users\hynek.HBWARE
Hosts:
C:\Users\hynek.HBWARE\AppData\Local\Temp
End
*****************
Error: (0) Failed to create a restore point.
Processes closed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Acrobat Speed Launcher => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Acrobat Assistant 8.0 => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SSBkgdUpdate => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\TkBellExe => value removed successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value not found.
HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Microsoft\Windows\CurrentVersion\Run\\PID => value removed successfully.
"HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E" => key removed successfully.
"HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{780c03e0-067e-11e4-af2d-806e6f6e6963}" => key removed successfully.
HKCR\CLSID\{780c03e0-067e-11e4-af2d-806e6f6e6963} => key not found.
"HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b95ff222-f8b7-11de-b9c9-001a6b28d8b7}" => key removed successfully.
HKCR\CLSID\{b95ff222-f8b7-11de-b9c9-001a6b28d8b7} => key not found.
"HKU\S-1-5-21-1715567821-507921405-1957994488-1150\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}" => key removed successfully.
"HKU\S-1-5-21-1715567821-507921405-1957994488-1150\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" => key removed successfully.
HKCR\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} => key not found.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cf96d28e1ce51e.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1cff022afa1884c.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d006fdd9c5323a.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0469cac5defc4.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d073b6646e6a44.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d0cdfb4bbcad13.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-507921405-1957994488-1150Core1d122222a2e821c.job => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0661BB41-4CF2-400E-BE64-8DA2001CF1E3}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0661BB41-4CF2-400E-BE64-8DA2001CF1E3}" => key removed successfully.
C:\Windows\System32\Tasks\{9100CE9D-AEA1-4DA0-B3ED-6D525EF755D5} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{9100CE9D-AEA1-4DA0-B3ED-6D525EF755D5}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{91529A8C-0F30-4E76-9438-79CC23D1B703}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{91529A8C-0F30-4E76-9438-79CC23D1B703}" => key removed successfully.
C:\Windows\System32\Tasks\{5DDAC7C1-FA09-430A-BB5A-A1134A59A55A} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5DDAC7C1-FA09-430A-BB5A-A1134A59A55A}" => key removed successfully.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
"C:\Users\hynek.HBWARE\AppData\Local\Temp" folder move:
Could not move "C:\Users\hynek.HBWARE\AppData\Local\Temp" => Scheduled to move on reboot.
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2015-11-22 18:38:30)
"C:\Users\hynek.HBWARE\AppData\Local\Temp" => Could not move
==== End of Fixlog 18:38:30 ====
Přispějete na provoz fóra?