Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

zpomalený reklamník

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
pampalini
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 20 pro 2014 13:12

zpomalený reklamník

#1 Příspěvek od pampalini »

Počítač je zpomalený, reklamy jsou na něm častěji, než co jiného.
Nejde ani pořádně psát, protože stránka je aktivní jen chvíli.
Zkusil jsem Adv cleaner, ale neobjevil se log...

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:23-11-2015
Ran by Pavel_2 (ATTENTION: The user is not administrator) on PAJA-NOTEBOOK (24-11-2015 19:02:17)
Running from C:\Users\Pavel_2\Desktop
Loaded Profiles: Pavel_2 (Available Profiles: Pavel & Pavel_2)
Platform: Windows 8.1 Pro (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe
Failed to access process -> csrss.exe
Failed to access process -> wininit.exe
Failed to access process -> csrss.exe
Failed to access process -> winlogon.exe
Failed to access process -> services.exe
Failed to access process -> lsass.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> dwm.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> nvxdsync.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> spoolsv.exe
Failed to access process -> svchost.exe
Failed to access process -> BtwRSupportService.exe
Failed to access process -> HPSIsvc.exe
Failed to access process -> dasHost.exe
Failed to access process -> ss_conn_service.exe
Failed to access process -> svchost.exe
Failed to access process -> MsMpEng.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> WUDFHost.exe
Failed to access process -> svchost.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> dllhost.exe
Failed to access process -> GoogleCrashHandler.exe
Failed to access process -> SearchIndexer.exe
Failed to access process -> GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
() C:\Users\Pavel_2\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
() C:\Users\Pavel_2\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
Failed to access process -> hpqWmiEx.exe
Failed to access process -> Com4QLBEx.exe
Failed to access process -> wmpnetwk.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
Failed to access process -> SearchProtocolHost.exe
Failed to access process -> SearchFilterHost.exe
Failed to access process -> taskhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2009-11-11] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [MSStp] => C:\WINDOWS\SysWOW64\msstp.vbe [1419 2014-01-19] ()
HKLM-x32\...\Run: [mncodjddfSrv] => C:\WINDOWS\inf\mncodjddf.vbe
HKLM-x32\...\Run: [seznam-listicka-distribuce] => C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3928238382-3514605491-939278140-1006\...\Run: [cz.seznam.software.szndesktop] => C:\Users\Pavel_2\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [103080 2015-05-26] ()
HKU\S-1-5-21-3928238382-3514605491-939278140-1006\...\Run: [cz.seznam.software.autoupdate] => C:\Users\Pavel_2\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{533F6746-0775-4100-809F-0CC6925536B4}: [DhcpNameServer] 10.0.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-3928238382-3514605491-939278140-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.seznam.cz/?clid=16194
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {134B72B4-9BD1-4A80-859E-678EAD28CA83} URL = hxxp://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {355D73DC-24FE-4763-B2F1-B5DB39071D61} URL = hxxp://search.seznam.cz/?q={searchTerms}&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {3F261BC4-AD78-4652-9829-4111AEC11702} URL = hxxp://www.novinky.cz/hledej?w={searchTerms}&s ... arch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {5E9575EF-8B34-4210-A4CE-2AA8A8BF265D} URL = hxxp://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {AB20AECB-D755-4B16-9962-99540C424BD5} URL = hxxp://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {D83DA68D-7C6C-4FE2-BC72-20A2F3AECBD5} URL = hxxp://www.zbozi.cz/?q={searchTerms}&r=campmoz ... arch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {DB9D1847-0313-4988-8697-FECC80F76DAF} URL = hxxp://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {DC1F6C67-C5AE-4B55-AFC7-925C98950564} URL = hxxp://www.mapy.cz/?query={searchTerms}&source ... arch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {FBAAAA14-65F4-45FF-95B3-A97454AC5385} URL = hxxp://www.firmy.cz/?q={searchTerms}&sourceid= ... arch_16194
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-24] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-11-24] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxps://mysearch.avg. ... 2014-08-29 23:19:35&v=18.1.9.786&pid=safeguard&sg=&sap=hp","hxxps://mysearch.avg.com?cid={FA9B6D71-1B83-4C34-9EBD-F3F836407FFB}&mid=27a21569937047d29dc121f6d1356f3d-fb42c40a7109f9855d5fc82c0156150b9cbc0550&lang=cs&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-08-29 23:19:35&v=18.1.9.799&pid=safeguard&sg=&sap=hp","hxxp://www.mystartsearch.com/?type=hp&ts=14346 ... oogle.com/"
CHR Profile: C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-24]
CHR Extension: (Dokumenty Google) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-24]
CHR Extension: (Disk Google) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-24]
CHR Extension: (YouTube) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-24]
CHR Extension: (Vyhledávání Google) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-24]
CHR Extension: (Screen capture) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\egggddlphjgblkkokllcobdpjhnaphgn [2015-11-24]
CHR Extension: (Tabulky Google) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-24]
CHR Extension: (Authy Chrome Extension) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhgenkpocbhhddlgkjnfghpjanffonno [2015-11-24]
CHR Extension: (Dokumenty Google offline) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-24]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-24]
CHR Extension: (Gmail) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-24]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
R2 lmhosts; C:\Windows\system32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 lmhosts; C:\WINDOWS\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 NlaSvc; C:\WINDOWS\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 nsi; C:\WINDOWS\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-07-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2015-02-17] (DT Soft Ltd)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-09-26] (Marvell Semiconductor, Inc.)
R3 smserial; C:\Windows\system32\DRIVERS\SmSerl64.sys [1227776 2013-06-18] (Motorola Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [71680 2014-04-30] (Microsoft Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [35856 2014-07-16] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [257880 2014-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-07-16] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-24 19:02 - 2015-11-24 19:03 - 00014037 _____ C:\Users\Pavel_2\Desktop\FRST.txt
2015-11-24 19:00 - 2015-11-24 19:02 - 00000000 ____D C:\FRST
2015-11-24 18:56 - 2015-11-24 18:56 - 02348544 _____ (Farbar) C:\Users\Pavel_2\Desktop\FRST64.exe
2015-11-24 18:49 - 2015-11-24 18:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\LocalLow\EmieUserList
2015-11-24 18:36 - 2015-11-24 18:40 - 00000000 ____D C:\AdwCleaner
2015-11-24 18:11 - 2015-11-24 18:11 - 00002281 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-11-24 18:11 - 2015-11-24 18:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-11-24 18:09 - 2015-11-24 18:47 - 00000974 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-24 18:09 - 2015-11-24 18:14 - 00000978 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-24 17:46 - 2015-11-24 17:46 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\GHISLER
2015-11-24 17:41 - 2015-11-24 17:45 - 00000000 ____D C:\Tatinkovo
2015-11-24 17:33 - 2015-11-24 17:33 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\GHISLER
2015-11-24 17:32 - 2015-11-24 17:33 - 00000000 ____D C:\totalcmd
2015-11-24 17:32 - 2015-11-24 17:32 - 00000646 _____ C:\Users\Public\Desktop\Total Commander.lnk
2015-11-24 17:32 - 2015-11-24 17:32 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\GHISLER
2015-11-24 17:32 - 2015-11-24 17:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Total Commander
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\UC.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\RAR.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\PKZIP.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\PKUNZIP.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\NOCLOSE.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\LHA.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\ARJ.PIF
2015-11-24 16:54 - 2015-11-24 16:54 - 00000928 _____ C:\Users\Pavel_2\Documents\47 Philips 6008 – zástupce.lnk
2015-11-24 16:49 - 2015-11-24 16:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\Local\EmieUserList
2015-11-24 16:49 - 2015-11-24 16:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\Local\EmieSiteList
2015-11-24 16:48 - 2015-11-24 18:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\LocalLow\EmieSiteList
2015-11-24 16:48 - 2015-11-24 18:47 - 00000000 ___RD C:\Users\Pavel_2\OneDrive
2015-11-24 16:47 - 2015-11-24 18:49 - 00015536 _____ C:\Users\Pavel_2\rgmnr
2015-11-24 16:46 - 2015-11-24 18:52 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\Seznam.cz
2015-11-24 16:46 - 2015-11-24 16:46 - 00000000 _____ C:\Users\Pavel_2\AppData\Local\QSwitch.txt
2015-11-24 16:46 - 2015-11-24 16:46 - 00000000 _____ C:\Users\Pavel_2\AppData\Local\DSwitch.txt
2015-11-24 16:46 - 2015-11-24 16:46 - 00000000 _____ C:\Users\Pavel_2\AppData\Local\AtStart.txt
2015-11-24 16:45 - 2015-11-24 16:47 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\Packages
2015-11-24 16:45 - 2015-11-24 16:45 - 00001428 _____ C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-11-24 16:45 - 2015-11-24 16:45 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\DAEMON Tools Pro
2015-11-24 16:45 - 2015-11-24 16:45 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\Adobe
2015-11-24 16:45 - 2015-11-24 16:45 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\VirtualStore
2015-11-24 16:45 - 2015-11-24 16:45 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\Google
2015-11-24 16:44 - 2015-11-24 16:48 - 00000000 ____D C:\Users\Pavel_2
2015-11-24 16:44 - 2015-11-24 16:44 - 00000020 ___SH C:\Users\Pavel_2\ntuser.ini
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Šablony
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Soubory cookie
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Poslední
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Okolní tiskárny
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Okolní síť
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Nabídka Start
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Dokumenty
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Documents\Obrázky
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Documents\Hudba
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Documents\Filmy
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Data aplikací
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\AppData\Local\Data aplikací
2015-11-24 16:44 - 2014-07-16 14:54 - 00000000 ___RD C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-11-24 16:44 - 2014-07-16 14:52 - 00000000 ___RD C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-11-24 16:44 - 2014-07-16 14:36 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\hpqLog
2015-11-24 16:44 - 2014-03-18 16:42 - 00000369 _____ C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-11-24 16:44 - 2014-03-18 16:42 - 00000369 _____ C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-11-24 16:44 - 2013-08-22 16:36 - 00000000 ___RD C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-11-24 16:44 - 2013-08-22 16:36 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-11-16 18:12 - 2015-11-16 18:12 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2015-11-16 17:35 - 2015-11-16 17:35 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2015-11-16 17:33 - 2015-11-16 17:35 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Samsung
2015-11-16 17:33 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\WINDOWS\SysWOW64\secman.dll
2015-11-16 16:34 - 2015-11-16 17:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-11-16 16:28 - 2015-11-16 17:33 - 00000000 ____D C:\Program Files (x86)\Samsung
2015-11-16 16:23 - 2015-11-16 16:23 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00770912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Msfdbqp.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Synchronization2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00397152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Msfdbse.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00253280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MetaStore2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00230240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Msfdb.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00189792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SimpleProviders2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00171360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FileSyncProvider2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00156512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FeedSync2.dll
2015-11-16 15:42 - 2015-11-16 15:43 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\mgyun
2015-11-16 15:37 - 2015-11-16 15:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-11-16 15:05 - 2015-11-16 15:05 - 00000000 ____D C:\Users\Pavel\.android
2015-11-16 15:04 - 2015-11-24 18:16 - 00000000 ____D C:\Program Files (x86)\Kingo ROOT
2015-11-16 14:11 - 2015-11-16 14:12 - 00000000 ____D C:\Program Files (x86)\ca373d01-2b6e-4153-b669-af6ed8d41ee2
2015-11-16 14:10 - 2015-11-24 16:10 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-11-16 14:09 - 2015-11-16 14:09 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Seznam.cz
2015-11-16 14:09 - 2015-11-16 14:09 - 00000000 ____D C:\Program Files (x86)\Seznam.cz
2015-11-16 14:08 - 2015-11-16 14:08 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Opera Software
2015-11-16 14:07 - 2015-11-24 16:10 - 00001069 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-11-16 14:06 - 2015-11-24 16:10 - 00000000 ____D C:\Program Files (x86)\Opera

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-11-24 19:02 - 2014-07-16 14:17 - 01561427 _____ C:\WINDOWS\WindowsUpdate.log
2015-11-24 19:00 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-11-24 18:51 - 2014-03-18 16:33 - 01745984 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-11-24 18:51 - 2014-03-18 15:54 - 00739924 _____ C:\WINDOWS\system32\perfh005.dat
2015-11-24 18:51 - 2014-03-18 15:54 - 00151610 _____ C:\WINDOWS\system32\perfc005.dat
2015-11-24 18:46 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-11-24 18:45 - 2014-03-18 08:20 - 00023810 _____ C:\WINDOWS\PFRO.log
2015-11-24 18:45 - 2013-08-22 15:44 - 00486552 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-11-24 18:10 - 2014-07-15 13:38 - 00000000 ____D C:\Program Files (x86)\Google
2015-11-24 17:37 - 2013-08-22 15:46 - 00337890 _____ C:\WINDOWS\setupact.log
2015-11-24 16:53 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-11-24 16:33 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2015-11-16 17:33 - 2014-07-16 14:18 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-11-16 16:35 - 2015-03-02 15:05 - 00000000 ____D C:\ProgramData\Samsung
2015-11-16 15:37 - 2015-10-15 14:33 - 00000000 ____D C:\Program Files\WinRAR
2015-11-16 15:05 - 2014-07-16 14:32 - 00000000 ____D C:\Users\Pavel
2015-11-16 14:27 - 2015-02-20 19:49 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Skype
2015-11-16 14:12 - 2015-02-17 14:05 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Pro
2015-11-16 13:46 - 2014-07-16 15:33 - 00000000 ___DO C:\Users\Pavel\OneDrive
2015-11-16 13:44 - 2015-03-05 14:35 - 00015491 _____ C:\Users\Pavel\rgmnr
2015-11-15 19:08 - 2014-07-25 09:10 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\uTorrent
2015-11-15 18:55 - 2014-07-15 15:39 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\vlc
2015-11-03 22:07 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\FxsTmp
2015-11-03 21:28 - 2014-07-15 15:35 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\FileZilla

==================== Files in the root of some directories =======

2015-11-24 16:46 - 2015-11-24 16:46 - 0000000 _____ () C:\Users\Pavel_2\AppData\Local\AtStart.txt
2015-11-24 16:46 - 2015-11-24 16:46 - 0000000 _____ () C:\Users\Pavel_2\AppData\Local\DSwitch.txt
2015-11-24 16:46 - 2015-11-24 16:46 - 0000000 _____ () C:\Users\Pavel_2\AppData\Local\QSwitch.txt

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


ATTENTION: ==> Could not access BCD. The user is not administrator

==================== End of FRST.txt ============================
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: zpomalený reklamník

#2 Příspěvek od Rudy »

Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
pampalini
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 20 pro 2014 13:12

Re: zpomalený reklamník

#3 Příspěvek od pampalini »

provedl jsem, ale log se neukázal...
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: zpomalený reklamník

#4 Příspěvek od Rudy »

OK. Někde určitě bude. Dejte nový log FRST.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
pampalini
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 20 pro 2014 13:12

Re: zpomalený reklamník

#5 Příspěvek od pampalini »

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:14-12-2015
Ran by Pavel_2 (ATTENTION: The user is not administrator) on PAJA-NOTEBOOK (15-12-2015 20:33:51)
Running from C:\Users\Pavel_2\Desktop
Loaded Profiles: Pavel & Pavel_2 (Available Profiles: Pavel & Pavel_2)
Platform: Windows 8.1 Pro (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe
Failed to access process -> csrss.exe
Failed to access process -> wininit.exe
Failed to access process -> csrss.exe
Failed to access process -> winlogon.exe
Failed to access process -> services.exe
Failed to access process -> lsass.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> dwm.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> nvxdsync.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> svchost.exe
Failed to access process -> spoolsv.exe
Failed to access process -> svchost.exe
Failed to access process -> BtwRSupportService.exe
Failed to access process -> HPSIsvc.exe
Failed to access process -> dasHost.exe
Failed to access process -> ss_conn_service.exe
Failed to access process -> svchost.exe
Failed to access process -> MsMpEng.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> dllhost.exe
Failed to access process -> GoogleCrashHandler.exe
Failed to access process -> GoogleCrashHandler64.exe
Failed to access process -> SearchIndexer.exe
Failed to access process -> wmpnetwk.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ZONER software) C:\Program Files\Photo Studio 16\Program32\ZPSTray.exe
() C:\Users\Pavel_2\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
() C:\Users\Pavel_2\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Failed to access process -> hpqWmiEx.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Failed to access process -> Com4QLBEx.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Failed to access process -> SearchProtocolHost.exe
Failed to access process -> SearchFilterHost.exe
(forum.viry.cz) C:\Users\Pavel_2\Desktop\FRSTLauncher.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2009-11-11] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [MSStp] => C:\WINDOWS\SysWOW64\msstp.vbe [1419 2014-01-19] ()
HKLM-x32\...\Run: [mncodjddfSrv] => C:\WINDOWS\inf\mncodjddf.vbe
HKLM-x32\...\Run: [seznam-listicka-distribuce] => C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3928238382-3514605491-939278140-1006\...\Run: [cz.seznam.software.szndesktop] => C:\Users\Pavel_2\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [103080 2015-05-26] ()
HKU\S-1-5-21-3928238382-3514605491-939278140-1006\...\Run: [cz.seznam.software.autoupdate] => C:\Users\Pavel_2\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3928238382-3514605491-939278140-1006\...\Run: [Zoner Photo Studio Autoupdate] => C:\PROGRAM FILES\PHOTO STUDIO 16\Program32\ZPSTRAY.EXE [801816 2013-09-27] (ZONER software)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{533F6746-0775-4100-809F-0CC6925536B4}: [DhcpNameServer] 10.0.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-3928238382-3514605491-939278140-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.seznam.cz/?clid=16194
URLSearchHook: [S-1-5-21-3928238382-3514605491-939278140-1001] ATTENTION => Default URLSearchHook is missing
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {134B72B4-9BD1-4A80-859E-678EAD28CA83} URL = hxxp://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {355D73DC-24FE-4763-B2F1-B5DB39071D61} URL = hxxp://search.seznam.cz/?q={searchTerms}&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {3F261BC4-AD78-4652-9829-4111AEC11702} URL = hxxp://www.novinky.cz/hledej?w={searchTerms}&s ... arch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {5E9575EF-8B34-4210-A4CE-2AA8A8BF265D} URL = hxxp://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {AB20AECB-D755-4B16-9962-99540C424BD5} URL = hxxp://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {D83DA68D-7C6C-4FE2-BC72-20A2F3AECBD5} URL = hxxp://www.zbozi.cz/?q={searchTerms}&r=campmoz ... arch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {DB9D1847-0313-4988-8697-FECC80F76DAF} URL = hxxp://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {DC1F6C67-C5AE-4B55-AFC7-925C98950564} URL = hxxp://www.mapy.cz/?query={searchTerms}&source ... arch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1006 -> {FBAAAA14-65F4-45FF-95B3-A97454AC5385} URL = hxxp://www.firmy.cz/?q={searchTerms}&sourceid= ... arch_16194
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxps://mysearch.avg. ... 2014-08-29 23:19:35&v=18.1.9.786&pid=safeguard&sg=&sap=hp","hxxps://mysearch.avg.com?cid={FA9B6D71-1B83-4C34-9EBD-F3F836407FFB}&mid=27a21569937047d29dc121f6d1356f3d-fb42c40a7109f9855d5fc82c0156150b9cbc0550&lang=cs&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-08-29 23:19:35&v=18.1.9.799&pid=safeguard&sg=&sap=hp","hxxp://www.mystartsearch.com/?type=hp&ts=14346 ... oogle.com/"
CHR Profile: C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-24]
CHR Extension: (Dokumenty Google) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-24]
CHR Extension: (Disk Google) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-24]
CHR Extension: (YouTube) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-24]
CHR Extension: (Vyhledávání Google) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-24]
CHR Extension: (Screen capture) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\egggddlphjgblkkokllcobdpjhnaphgn [2015-11-24]
CHR Extension: (Tabulky Google) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-24]
CHR Extension: (Authy Chrome Extension) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhgenkpocbhhddlgkjnfghpjanffonno [2015-11-24]
CHR Extension: (Dokumenty Google offline) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-24]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-24]
CHR Extension: (Gmail) - C:\Users\Pavel_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-24]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
R2 lmhosts; C:\Windows\system32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 lmhosts; C:\WINDOWS\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 NlaSvc; C:\WINDOWS\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [37768 2013-08-22] (Microsoft Corporation)
R2 nsi; C:\WINDOWS\SysWOW64\svchost.exe [31552 2013-08-22] (Microsoft Corporation)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-07-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2015-02-17] (DT Soft Ltd)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-09-26] (Marvell Semiconductor, Inc.)
R3 smserial; C:\Windows\system32\DRIVERS\SmSerl64.sys [1227776 2013-06-18] (Motorola Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [71680 2014-04-30] (Microsoft Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [35856 2014-07-16] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [257880 2014-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-07-16] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-15 20:32 - 2015-12-15 20:33 - 00000000 ____D C:\Users\Pavel_2\Desktop\FRST-OlderVersion
2015-12-08 11:36 - 2015-12-08 11:36 - 00000000 ____D C:\Users\Pavel_2\Documents\Vlastní šablony Office
2015-12-02 10:01 - 2015-12-02 10:01 - 00000000 _____ C:\Users\Pavel_2\Desktop\Nový textový dokument (2).txt
2015-12-02 09:37 - 2015-12-02 09:37 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\Zoner
2015-12-02 09:36 - 2015-12-02 09:37 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\Zoner
2015-12-02 09:36 - 2015-12-02 09:36 - 00001794 _____ C:\Users\Public\Desktop\Zoner Photo Studio 16.lnk
2015-12-02 09:36 - 2015-12-02 09:36 - 00001794 _____ C:\Users\Public\Desktop\Zoner Photo Studio 16 x64.lnk
2015-12-02 09:35 - 2015-12-02 09:36 - 00000000 ____D C:\Program Files\Photo Studio 16
2015-11-26 09:57 - 2015-12-14 20:25 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\CrashDumps
2015-11-24 19:56 - 2015-11-24 19:56 - 01733632 _____ C:\Users\Pavel_2\Downloads\adwcleaner_5.022.exe
2015-11-24 19:56 - 2015-11-24 19:56 - 01733632 _____ C:\Users\Pavel_2\Desktop\adwcleaner_5.022.exe
2015-11-24 19:39 - 2015-11-28 11:33 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\vlc
2015-11-24 19:18 - 2015-11-24 19:18 - 00112640 _____ (forum.viry.cz) C:\Users\Pavel_2\Desktop\FRSTLauncher.exe
2015-11-24 19:10 - 2015-11-24 19:10 - 00000000 _____ C:\Users\Pavel_2\Desktop\Nový textový dokument.txt
2015-11-24 19:02 - 2015-12-15 20:34 - 00015057 _____ C:\Users\Pavel_2\Desktop\FRST.txt
2015-11-24 19:00 - 2015-12-15 20:33 - 00000000 ____D C:\FRST
2015-11-24 18:56 - 2015-12-15 20:32 - 02369536 _____ (Farbar) C:\Users\Pavel_2\Desktop\FRST64.exe
2015-11-24 18:49 - 2015-11-24 18:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\LocalLow\EmieUserList
2015-11-24 18:36 - 2015-11-24 20:01 - 00000000 ____D C:\AdwCleaner
2015-11-24 18:11 - 2015-12-10 09:24 - 00002209 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-11-24 18:11 - 2015-11-24 18:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-11-24 18:09 - 2015-12-15 20:21 - 00000984 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-24 18:09 - 2015-12-15 20:20 - 00000988 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-24 17:46 - 2015-11-24 17:46 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\GHISLER
2015-11-24 17:41 - 2015-12-15 20:24 - 00000000 ____D C:\Tatinkovo
2015-11-24 17:33 - 2015-11-24 17:33 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\GHISLER
2015-11-24 17:32 - 2015-11-24 17:33 - 00000000 ____D C:\totalcmd
2015-11-24 17:32 - 2015-11-24 17:32 - 00000646 _____ C:\Users\Public\Desktop\Total Commander.lnk
2015-11-24 17:32 - 2015-11-24 17:32 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\GHISLER
2015-11-24 17:32 - 2015-11-24 17:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Total Commander
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\UC.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\RAR.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\PKZIP.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\PKUNZIP.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\NOCLOSE.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\LHA.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\ARJ.PIF
2015-11-24 16:54 - 2015-11-24 16:54 - 00000928 _____ C:\Users\Pavel_2\Documents\47 Philips 6008 – zástupce.lnk
2015-11-24 16:49 - 2015-11-24 16:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\Local\EmieUserList
2015-11-24 16:49 - 2015-11-24 16:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\Local\EmieSiteList
2015-11-24 16:48 - 2015-12-15 20:21 - 00000000 ___RD C:\Users\Pavel_2\OneDrive
2015-11-24 16:48 - 2015-11-24 18:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\LocalLow\EmieSiteList
2015-11-24 16:47 - 2015-12-15 20:22 - 00015536 _____ C:\Users\Pavel_2\rgmnr
2015-11-24 16:46 - 2015-12-15 20:26 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\Seznam.cz
2015-11-24 16:46 - 2015-11-24 16:46 - 00000000 _____ C:\Users\Pavel_2\AppData\Local\QSwitch.txt
2015-11-24 16:46 - 2015-11-24 16:46 - 00000000 _____ C:\Users\Pavel_2\AppData\Local\DSwitch.txt
2015-11-24 16:46 - 2015-11-24 16:46 - 00000000 _____ C:\Users\Pavel_2\AppData\Local\AtStart.txt
2015-11-24 16:45 - 2015-12-10 09:29 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\Google
2015-11-24 16:45 - 2015-11-24 16:47 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\Packages
2015-11-24 16:45 - 2015-11-24 16:45 - 00001428 _____ C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-11-24 16:45 - 2015-11-24 16:45 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\DAEMON Tools Pro
2015-11-24 16:45 - 2015-11-24 16:45 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\Adobe
2015-11-24 16:45 - 2015-11-24 16:45 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\VirtualStore
2015-11-24 16:44 - 2015-11-24 16:48 - 00000000 ____D C:\Users\Pavel_2
2015-11-24 16:44 - 2015-11-24 16:44 - 00000020 ___SH C:\Users\Pavel_2\ntuser.ini
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Šablony
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Soubory cookie
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Poslední
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Okolní tiskárny
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Okolní síť
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Nabídka Start
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Dokumenty
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Documents\Obrázky
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Documents\Hudba
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Documents\Filmy
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Data aplikací
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\AppData\Local\Data aplikací
2015-11-24 16:44 - 2014-07-16 14:36 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\hpqLog
2015-11-24 16:44 - 2014-03-18 16:42 - 00000369 _____ C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-11-24 16:44 - 2014-03-18 16:42 - 00000369 _____ C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-11-16 18:12 - 2015-11-16 18:12 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2015-11-16 17:35 - 2015-11-16 17:35 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2015-11-16 17:33 - 2015-11-16 17:35 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Samsung
2015-11-16 17:33 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\WINDOWS\SysWOW64\secman.dll
2015-11-16 16:34 - 2015-11-16 17:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-11-16 16:28 - 2015-11-16 17:33 - 00000000 ____D C:\Program Files (x86)\Samsung
2015-11-16 16:23 - 2015-11-16 16:23 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00770912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Msfdbqp.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Synchronization2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00397152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Msfdbse.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00253280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MetaStore2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00230240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Msfdb.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00189792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SimpleProviders2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00171360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FileSyncProvider2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00156512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FeedSync2.dll
2015-11-16 15:42 - 2015-11-16 15:43 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\mgyun
2015-11-16 15:38 - 2015-11-16 15:38 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\ADBDriverInstaller
2015-11-16 15:37 - 2015-11-16 15:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-11-16 15:05 - 2015-11-16 15:05 - 00000000 ____D C:\Users\Pavel\.android
2015-11-16 15:04 - 2015-11-24 18:16 - 00000000 ____D C:\Program Files (x86)\Kingo ROOT
2015-11-16 14:11 - 2015-11-16 14:12 - 00000000 ____D C:\Program Files (x86)\ca373d01-2b6e-4153-b669-af6ed8d41ee2
2015-11-16 14:10 - 2015-11-24 16:10 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-11-16 14:09 - 2015-11-16 14:09 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Seznam.cz
2015-11-16 14:09 - 2015-11-16 14:09 - 00000000 ____D C:\Program Files (x86)\Seznam.cz
2015-11-16 14:08 - 2015-11-16 14:08 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Opera Software
2015-11-16 14:07 - 2015-12-13 21:16 - 00001069 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-11-16 14:06 - 2015-12-13 21:16 - 00000000 ____D C:\Program Files (x86)\Opera

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-15 20:23 - 2014-03-18 16:33 - 01745984 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-15 20:23 - 2014-03-18 15:54 - 00739924 _____ C:\WINDOWS\system32\perfh005.dat
2015-12-15 20:23 - 2014-03-18 15:54 - 00151610 _____ C:\WINDOWS\system32\perfc005.dat
2015-12-15 20:23 - 2013-08-22 14:36 - 00000000 ____D C:\WINDOWS\Inf
2015-12-15 20:17 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-12-10 08:50 - 2012-07-26 08:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-12-09 14:09 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-12-09 04:39 - 2014-07-16 10:19 - 00301728 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-12-02 09:36 - 2014-07-23 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zoner Photo Studio 16
2015-11-26 13:14 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-11-24 18:45 - 2013-08-22 15:44 - 00486552 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-11-24 18:10 - 2014-07-15 13:38 - 00000000 ____D C:\Program Files (x86)\Google
2015-11-24 17:32 - 2013-08-22 14:36 - 00000000 ____D C:\Windows
2015-11-24 16:33 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2015-11-16 17:33 - 2014-07-16 14:18 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-11-16 16:35 - 2015-03-02 15:05 - 00000000 ____D C:\ProgramData\Samsung
2015-11-16 15:37 - 2015-10-15 14:33 - 00000000 ____D C:\Program Files\WinRAR
2015-11-16 15:05 - 2014-07-16 14:32 - 00000000 ____D C:\Users\Pavel
2015-11-16 14:27 - 2015-02-20 19:49 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Skype
2015-11-16 14:12 - 2015-02-17 14:05 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Pro
2015-11-16 13:46 - 2014-07-16 15:33 - 00000000 ___DO C:\Users\Pavel\OneDrive
2015-11-16 13:44 - 2015-03-05 14:35 - 00015491 _____ C:\Users\Pavel\rgmnr
2015-11-15 19:08 - 2014-07-25 09:10 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\uTorrent
2015-11-15 18:55 - 2014-07-15 15:39 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\vlc

==================== Files in the root of some directories =======

2015-11-24 16:46 - 2015-11-24 16:46 - 0000000 _____ () C:\Users\Pavel_2\AppData\Local\AtStart.txt
2015-11-24 16:46 - 2015-11-24 16:46 - 0000000 _____ () C:\Users\Pavel_2\AppData\Local\DSwitch.txt
2015-11-24 16:46 - 2015-11-24 16:46 - 0000000 _____ () C:\Users\Pavel_2\AppData\Local\QSwitch.txt

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


ATTENTION: ==> Could not access BCD. The user is not administrator



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job =>
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job =>

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Pavel_2\Desktop" je 6 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000000
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: zpomalený reklamník

#6 Příspěvek od Rudy »

Program nemaže, nejste přihlášen jako admin (s plnými právy). Bez toho PC nelze vyčistit.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
pampalini
Návštěvník
Návštěvník
Příspěvky: 28
Registrován: 20 pro 2014 13:12

Re: zpomalený reklamník

#7 Příspěvek od pampalini »

Přihlásil jsem se jako správce a udělal log.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:14-12-2015
Ran by Pavel (administrator) on PAJA-NOTEBOOK (15-12-2015 20:57:49)
Running from C:\Users\Pavel\Desktop
Loaded Profiles: Pavel (Available Profiles: Pavel & Pavel_2)
Platform: Windows 8.1 Pro (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD.EXE
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Users\Pavel\AppData\Roaming\Seznam.cz\szninstall.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies3\FirmwareUpdate\Kies3PDLR.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
() C:\Users\Pavel\AppData\Roaming\Seznam.cz\bin\szndesktop.exe
() C:\Users\Pavel\AppData\Roaming\Seznam.cz\bin\listicka-x64.exe
(Ghisler Software GmbH) C:\totalcmd\TCMADMIN.EXE
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(forum.viry.cz) C:\Users\Pavel\Desktop\FRSTLauncher.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)
HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [287800 2009-11-11] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [MSStp] => C:\WINDOWS\SysWOW64\msstp.vbe [1419 2014-01-19] ()
HKLM-x32\...\Run: [mncodjddfSrv] => C:\WINDOWS\inf\mncodjddf.vbe
HKLM-x32\...\Run: [seznam-listicka-distribuce] => C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\...\Run: [Zoner Photo Studio Service 16] => C:\Program Files\Photo Studio 16\Program32\ZPSService.exe [27672 2013-09-27] ()
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [3108480 2012-10-23] (DT Soft Ltd)
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-29] (Skype Technologies S.A.)
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\...\Run: [cz.seznam.software.autoupdate] => C:\Users\Pavel\AppData\Roaming\Seznam.cz\szninstall.exe [1062472 2013-05-16] ()
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\...\Run: [cz.seznam.software.szndesktop] => C:\Users\Pavel\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe [103080 2015-05-26] ()
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\...\Run: [Kies3PDLR.exe] => C:\Program Files (x86)\Samsung\Kies3\FirmwareUpdate\Kies3PDLR.exe [1015104 2015-07-03] (Samsung)
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\...\Run: [Zoner Photo Studio Autoupdate] => C:\Program Files\Photo Studio 16\Program32\ZPSTRAY.EXE [801816 2013-09-27] (ZONER software)
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\...\MountPoints2: {a9ecd64d-b6a0-11e4-be77-001a6bb0c6fd} - "G:\MafiaLauncher.EXE"
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\...\MountPoints2: {e58e92c8-c0d4-11e4-be80-001a6bb0c6fd} - "F:\SISetup.exe"
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\PhotoScreensaver.scr [571392 2013-08-22] (Microsoft Corporation)
Startup: C:\Users\Pavel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Galaxy_Note2_Toolkit_v2.0.0.lnk [2015-03-02]
ShortcutTarget: Galaxy_Note2_Toolkit_v2.0.0.lnk -> C:\ProgramData\{b8820082-ab00-f5b2-b882-20082ab0020a}\Galaxy_Note2_Toolkit_v2.0.0.exe (No File)
Startup: C:\Users\Pavel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Odin_Techbeasts_3.09 (1).rar.lnk [2015-03-02]
ShortcutTarget: Odin_Techbeasts_3.09 (1).rar.lnk -> C:\ProgramData\{e8a4ce62-3240-d4ec-e8a4-4ce623243988}\Odin_Techbeasts_3.09 (1).rar.exe (No File)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{533F6746-0775-4100-809F-0CC6925536B4}: [DhcpNameServer] 10.0.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-3928238382-3514605491-939278140-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.seznam.cz/?clid=16194
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1001 -> {04996D9E-EB5D-4D4D-A310-91B59FD77D26} URL = hxxp://search.seznam.cz/?q={searchTerms}&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1001 -> {04E8AF7A-B63C-4017-A9A5-FC4DB3061182} URL = hxxp://www.firmy.cz/?q={searchTerms}&sourceid= ... arch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1001 -> {0F89CD01-2C1D-4E83-8845-06598034C128} URL = hxxp://slovnik.seznam.cz/?q={searchTerms}&lang=en_cz&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1001 -> {4E1DFE0D-B84E-46F1-8E43-E790D4522837} URL = hxxp://www.mapy.cz/?query={searchTerms}&source ... arch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1001 -> {A323A88A-2033-4C3B-A54F-9E02640ED544} URL = hxxp://encyklopedie.seznam.cz/search?q={searchTerms}&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1001 -> {AC63439A-AF17-44FF-912F-587923BDBEC6} URL = hxxp://www.zbozi.cz/?q={searchTerms}&r=campmoz ... arch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1001 -> {EDB0DB59-2A79-4924-99E6-E4D7C5A66F1F} URL = hxxp://slovnik.seznam.cz/?q={searchTerms}&lang=cz_en&sourceid=QuickSearch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1001 -> {EEC950E0-EF0B-448B-90E3-63110147D8D6} URL = hxxp://www.novinky.cz/hledej?w={searchTerms}&s ... arch_16194
SearchScopes: HKU\S-1-5-21-3928238382-3514605491-939278140-1001 -> {F25C06EA-DC95-437C-9C45-7B97B0782C41} URL = hxxp://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_16194
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)

Chrome:
=======
CHR Profile: C:\Users\Pavel\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Pavel\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-24]

Opera:
=======
OPR Extension: (Opera Bookmarks Share Portal) - C:\Users\Pavel\AppData\Roaming\Opera Software\Opera Stable\Extensions\lkadffjmnaiokkdncgdlecdegajoiemi [2015-11-16]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2255064 2013-10-28] (Broadcom Corporation.)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-07-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-10-28] (Broadcom Corporation.)
R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2015-02-17] (DT Soft Ltd)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-09-26] (Marvell Semiconductor, Inc.)
R3 smserial; C:\Windows\system32\DRIVERS\SmSerl64.sys [1227776 2013-06-18] (Motorola Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [71680 2014-04-30] (Microsoft Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [35856 2014-07-16] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [257880 2014-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-07-16] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-15 20:57 - 2015-12-15 20:59 - 00012997 _____ C:\Users\Pavel\Desktop\FRST.txt
2015-12-15 20:56 - 2015-12-15 20:56 - 00000000 ____D C:\Users\Pavel\AppData\Local\GHISLER
2015-12-15 20:56 - 2015-12-15 20:32 - 02369536 _____ (Farbar) C:\Users\Pavel\Desktop\FRST64.exe
2015-12-15 20:56 - 2015-11-24 19:18 - 00112640 _____ (forum.viry.cz) C:\Users\Pavel\Desktop\FRSTLauncher.exe
2015-12-15 20:35 - 2015-12-15 20:36 - 00022549 _____ C:\Users\Pavel_2\Desktop\Addition.txt
2015-12-15 20:32 - 2015-12-15 20:33 - 00000000 ____D C:\Users\Pavel_2\Desktop\FRST-OlderVersion
2015-12-08 11:36 - 2015-12-08 11:36 - 00000000 ____D C:\Users\Pavel_2\Documents\Vlastní šablony Office
2015-12-02 10:01 - 2015-12-02 10:01 - 00000000 _____ C:\Users\Pavel_2\Desktop\Nový textový dokument (2).txt
2015-12-02 09:37 - 2015-12-02 09:37 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\Zoner
2015-12-02 09:36 - 2015-12-02 09:37 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\Zoner
2015-12-02 09:36 - 2015-12-02 09:36 - 00001794 _____ C:\Users\Public\Desktop\Zoner Photo Studio 16.lnk
2015-12-02 09:36 - 2015-12-02 09:36 - 00001794 _____ C:\Users\Public\Desktop\Zoner Photo Studio 16 x64.lnk
2015-12-02 09:35 - 2015-12-02 09:36 - 00000000 ____D C:\Program Files\Photo Studio 16
2015-11-29 10:43 - 2015-12-15 20:30 - 00005000 _____ C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for PAJA-NOTEBOOK-Pavel_2 PAJA-Notebook
2015-11-26 09:57 - 2015-12-14 20:25 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\CrashDumps
2015-11-24 19:56 - 2015-11-24 19:56 - 01733632 _____ C:\Users\Pavel_2\Downloads\adwcleaner_5.022.exe
2015-11-24 19:56 - 2015-11-24 19:56 - 01733632 _____ C:\Users\Pavel_2\Desktop\adwcleaner_5.022.exe
2015-11-24 19:39 - 2015-11-28 11:33 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\vlc
2015-11-24 19:18 - 2015-11-24 19:18 - 00112640 _____ (forum.viry.cz) C:\Users\Pavel_2\Desktop\FRSTLauncher.exe
2015-11-24 19:10 - 2015-11-24 19:10 - 00000000 _____ C:\Users\Pavel_2\Desktop\Nový textový dokument.txt
2015-11-24 19:02 - 2015-12-15 20:36 - 00030798 _____ C:\Users\Pavel_2\Desktop\FRST.txt
2015-11-24 19:00 - 2015-12-15 20:57 - 00000000 ____D C:\FRST
2015-11-24 18:56 - 2015-12-15 20:32 - 02369536 _____ (Farbar) C:\Users\Pavel_2\Desktop\FRST64.exe
2015-11-24 18:49 - 2015-11-24 18:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\LocalLow\EmieUserList
2015-11-24 18:36 - 2015-11-24 20:01 - 00000000 ____D C:\AdwCleaner
2015-11-24 18:35 - 2015-11-24 18:36 - 01733632 _____ C:\Users\Pavel\Downloads\adwcleaner_5.022.exe
2015-11-24 18:11 - 2015-12-10 09:24 - 00002209 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-11-24 18:11 - 2015-11-24 18:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-11-24 18:09 - 2015-12-15 20:54 - 00000984 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-24 18:09 - 2015-12-15 20:20 - 00000988 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-24 18:09 - 2015-12-04 21:15 - 00003960 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-11-24 18:09 - 2015-12-04 21:15 - 00003724 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-11-24 17:46 - 2015-11-24 17:46 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\GHISLER
2015-11-24 17:41 - 2015-12-15 20:24 - 00000000 ____D C:\Tatinkovo
2015-11-24 17:33 - 2015-11-24 17:33 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\GHISLER
2015-11-24 17:32 - 2015-11-24 17:33 - 00000000 ____D C:\totalcmd
2015-11-24 17:32 - 2015-11-24 17:32 - 00000646 _____ C:\Users\Public\Desktop\Total Commander.lnk
2015-11-24 17:32 - 2015-11-24 17:32 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\GHISLER
2015-11-24 17:32 - 2015-11-24 17:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Total Commander
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\UC.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\RAR.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\PKZIP.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\PKUNZIP.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\NOCLOSE.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\LHA.PIF
2015-11-24 17:32 - 2010-07-07 07:55 - 00000545 _____ C:\WINDOWS\ARJ.PIF
2015-11-24 16:54 - 2015-11-24 16:54 - 00000928 _____ C:\Users\Pavel_2\Documents\47 Philips 6008 – zástupce.lnk
2015-11-24 16:51 - 2015-12-13 22:02 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3928238382-3514605491-939278140-1006
2015-11-24 16:49 - 2015-11-24 16:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\Local\EmieUserList
2015-11-24 16:49 - 2015-11-24 16:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\Local\EmieSiteList
2015-11-24 16:48 - 2015-12-15 20:24 - 00003998 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{40B6C421-ED72-4EC8-8AAE-0E95FEAA54CF}
2015-11-24 16:48 - 2015-12-15 20:21 - 00000000 ___RD C:\Users\Pavel_2\OneDrive
2015-11-24 16:48 - 2015-11-24 18:49 - 00000000 __SHD C:\Users\Pavel_2\AppData\LocalLow\EmieSiteList
2015-11-24 16:47 - 2015-12-15 20:22 - 00015536 _____ C:\Users\Pavel_2\rgmnr
2015-11-24 16:46 - 2015-12-15 20:26 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\Seznam.cz
2015-11-24 16:46 - 2015-11-24 16:46 - 00000000 _____ C:\Users\Pavel_2\AppData\Local\QSwitch.txt
2015-11-24 16:46 - 2015-11-24 16:46 - 00000000 _____ C:\Users\Pavel_2\AppData\Local\DSwitch.txt
2015-11-24 16:46 - 2015-11-24 16:46 - 00000000 _____ C:\Users\Pavel_2\AppData\Local\AtStart.txt
2015-11-24 16:45 - 2015-12-10 09:29 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\Google
2015-11-24 16:45 - 2015-11-24 16:47 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\Packages
2015-11-24 16:45 - 2015-11-24 16:45 - 00001428 _____ C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-11-24 16:45 - 2015-11-24 16:45 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\DAEMON Tools Pro
2015-11-24 16:45 - 2015-11-24 16:45 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\Adobe
2015-11-24 16:45 - 2015-11-24 16:45 - 00000000 ____D C:\Users\Pavel_2\AppData\Local\VirtualStore
2015-11-24 16:44 - 2015-11-24 16:48 - 00000000 ____D C:\Users\Pavel_2
2015-11-24 16:44 - 2015-11-24 16:44 - 00000020 ___SH C:\Users\Pavel_2\ntuser.ini
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Šablony
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Soubory cookie
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Poslední
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Okolní tiskárny
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Okolní síť
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Nabídka Start
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Dokumenty
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Documents\Obrázky
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Documents\Hudba
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Documents\Filmy
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\Data aplikací
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2015-11-24 16:44 - 2015-11-24 16:44 - 00000000 _SHDL C:\Users\Pavel_2\AppData\Local\Data aplikací
2015-11-24 16:44 - 2014-07-16 14:36 - 00000000 ____D C:\Users\Pavel_2\AppData\Roaming\hpqLog
2015-11-24 16:44 - 2014-03-18 16:42 - 00000369 _____ C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-11-24 16:44 - 2014-03-18 16:42 - 00000369 _____ C:\Users\Pavel_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-11-16 18:12 - 2015-11-16 18:12 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2015-11-16 17:35 - 2015-11-16 17:35 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2015-11-16 17:35 - 2015-11-16 17:35 - 00000000 ____D C:\Users\Pavel\Documents\SelfMV
2015-11-16 17:34 - 2015-11-16 17:34 - 00000000 ____D C:\Users\Pavel\Documents\samsung
2015-11-16 17:33 - 2015-11-16 17:35 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Samsung
2015-11-16 17:33 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\WINDOWS\SysWOW64\secman.dll
2015-11-16 17:27 - 2015-11-16 17:28 - 43832704 _____ (Samsung Electronics Co., Ltd.) C:\Users\Pavel\Downloads\Kies3Setup.exe
2015-11-16 16:45 - 2015-11-16 16:46 - 1183751351 _____ C:\Users\Pavel\Downloads\N9005XXUGBNL8 5.0.7z
2015-11-16 16:34 - 2015-11-16 17:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2015-11-16 16:28 - 2015-11-16 17:33 - 00000000 ____D C:\Program Files (x86)\Samsung
2015-11-16 16:23 - 2015-11-16 16:23 - 09989712 _____ (MEGA Limited) C:\Users\Pavel\Downloads\MEGAsyncSetup.exe
2015-11-16 16:23 - 2015-11-16 16:23 - 04659712 _____ (Dmitry Streblechenko) C:\WINDOWS\SysWOW64\Redemption.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00770912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Msfdbqp.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Synchronization2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00397152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Msfdbse.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00253280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MetaStore2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00230240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Msfdb.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00189792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SimpleProviders2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00171360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FileSyncProvider2.dll
2015-11-16 16:23 - 2015-11-16 16:23 - 00156512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FeedSync2.dll
2015-11-16 16:21 - 2015-11-16 16:22 - 00000000 ____D C:\Users\Pavel\Desktop\kgh
2015-11-16 16:20 - 2015-11-16 16:21 - 42987144 _____ (Samsung Electronics Co., Ltd. ) C:\Users\Pavel\Downloads\Kies_Mini_For_Captivate_11011_4.exe
2015-11-16 16:18 - 2015-11-16 16:18 - 00995769 _____ C:\Users\Pavel\Desktop\Odin3_v3.09.zip
2015-11-16 16:17 - 2015-11-16 16:18 - 15364480 _____ (SAMSUNG Electronics Co., Ltd.) C:\Users\Pavel\Downloads\SAMSUNG_USB_Driver_for_Mobile_Phones_v1.5.25.0-retail.exe
2015-11-16 16:05 - 2015-11-16 16:05 - 10132676 _____ C:\Users\Pavel\Downloads\CHANGE MY SOFTWARE ALL EDİTİONS !!!.rar
2015-11-16 15:42 - 2015-11-16 15:43 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\mgyun
2015-11-16 15:41 - 2015-11-16 15:42 - 18479120 _____ ( ) C:\Users\Pavel\Downloads\iRoot_1.8.6.19461_cid1005_7337ba1e.exe
2015-11-16 15:38 - 2015-11-16 15:38 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\ADBDriverInstaller
2015-11-16 15:38 - 2015-10-21 11:27 - 00000085 _____ C:\Users\Pavel\Downloads\manual.txt
2015-11-16 15:37 - 2015-11-16 15:37 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-11-16 15:37 - 2015-11-16 15:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-11-16 15:37 - 2015-10-21 11:20 - 11715584 _____ (ADBDriver.com) C:\Users\Pavel\Downloads\ADBDriverInstaller.exe
2015-11-16 15:36 - 2015-11-16 15:36 - 09667561 _____ C:\Users\Pavel\Desktop\adbdriver.zip
2015-11-16 15:05 - 2015-11-16 15:05 - 00000000 ____D C:\Users\Pavel\AppData\Local\Kingosoft
2015-11-16 15:05 - 2015-11-16 15:05 - 00000000 ____D C:\Users\Pavel\.android
2015-11-16 15:04 - 2015-11-24 18:16 - 00000000 ____D C:\Program Files (x86)\Kingo ROOT
2015-11-16 15:03 - 2015-11-16 15:04 - 19523944 _____ (Kingosoft Technology Ltd. ) C:\Users\Pavel\Downloads\android_root.exe
2015-11-16 14:33 - 2015-11-16 14:33 - 00000000 ____D C:\Users\Pavel\AppData\Local\ElevatedDiagnostics
2015-11-16 14:11 - 2015-11-16 14:12 - 00000000 ____D C:\Program Files (x86)\ca373d01-2b6e-4153-b669-af6ed8d41ee2
2015-11-16 14:10 - 2015-11-24 16:10 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-11-16 14:09 - 2015-12-15 21:00 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Seznam.cz
2015-11-16 14:09 - 2015-11-16 14:09 - 00000000 ____D C:\Program Files (x86)\Seznam.cz
2015-11-16 14:08 - 2015-11-16 14:08 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Opera Software
2015-11-16 14:08 - 2015-11-16 14:08 - 00000000 ____D C:\Users\Pavel\AppData\Local\Opera Software
2015-11-16 14:07 - 2015-12-13 21:16 - 00003856 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1447679252
2015-11-16 14:07 - 2015-12-13 21:16 - 00001069 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-11-16 14:07 - 2015-11-16 14:07 - 02405219 _____ C:\Users\Pavel\Downloads\Change My Software 8 Edition.rar
2015-11-16 14:06 - 2015-12-13 21:16 - 00000000 ____D C:\Program Files (x86)\Opera
2015-11-16 14:03 - 2015-11-16 14:03 - 03607810 _____ C:\Users\Pavel\Downloads\Change+My+Software+8+Edit.ace
2015-11-16 13:59 - 2015-11-16 14:13 - 00000000 ____D C:\Users\Pavel\Desktop\ldkj
2015-11-16 13:58 - 2015-11-16 13:59 - 07779866 _____ C:\Users\Pavel\Downloads\Change My Software 8 Edition (www.changemysoftware.org) (1).rar
2015-11-16 13:58 - 2015-11-16 13:58 - 07779866 _____ C:\Users\Pavel\Downloads\Change My Software 8 Edition (www.changemysoftware.org).rar
2015-11-15 18:54 - 2015-11-15 19:36 - 1054867456 _____ C:\Users\Pavel\Downloads\ubuntu-14.04.3-desktop-amd64 (1).iso
2015-11-15 18:53 - 2015-11-15 19:36 - 1054867456 _____ C:\Users\Pavel\Downloads\ubuntu-14.04.3-desktop-amd64.iso
2015-11-15 16:25 - 2015-11-15 16:53 - 00000000 ____D C:\Users\Pavel\Downloads\Inside.Out.2015.720p.BluRay.DTS.x264-HiDt.CZ-FTU
2015-11-15 16:23 - 2015-11-15 16:23 - 00031624 _____ C:\Users\Pavel\Downloads\[CzT]V_hlave_Inside_Out_2015_CZ_EN_720pHD_.torrent
2015-11-15 08:19 - 2015-11-15 15:12 - 1277014016 ____R C:\Users\Pavel\Downloads\The.Walking.Dead.S06E05.720p.AC3.EN.HDTV.xvid.CZ.tit.avi
2015-11-15 08:18 - 2015-11-15 08:18 - 04831744 _____ (Geza Kovacs) C:\Users\Pavel\Downloads\unetbootin-windows-613.exe
2015-11-15 08:01 - 2015-11-15 08:02 - 00012760 _____ C:\Users\Pavel\Downloads\[CzT]Zivi_mrtvi_The_Walking_Dead_S06E05_Now_TvRip_720p_.torrent

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-15 20:57 - 2015-02-20 19:49 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\Skype
2015-12-15 20:57 - 2013-08-22 14:36 - 00000000 ____D C:\Windows
2015-12-15 20:56 - 2015-03-05 14:35 - 00015536 _____ C:\Users\Pavel\rgmnr
2015-12-15 20:55 - 2014-07-16 15:33 - 00000000 ___DO C:\Users\Pavel\OneDrive
2015-12-15 20:23 - 2014-03-18 16:33 - 01745984 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-15 20:23 - 2014-03-18 15:54 - 00739924 _____ C:\WINDOWS\system32\perfh005.dat
2015-12-15 20:23 - 2014-03-18 15:54 - 00151610 _____ C:\WINDOWS\system32\perfc005.dat
2015-12-15 20:23 - 2013-08-22 14:36 - 00000000 ____D C:\WINDOWS\Inf
2015-12-15 20:17 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-12-11 07:26 - 2013-08-22 14:25 - 01048576 ___SH C:\WINDOWS\system32\config\BBI
2015-12-10 08:50 - 2012-07-26 08:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-12-09 14:09 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-12-09 04:39 - 2014-07-16 10:19 - 00301728 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-12-02 09:36 - 2014-07-23 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zoner Photo Studio 16
2015-11-26 13:14 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-11-24 18:45 - 2013-08-22 15:44 - 00486552 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-11-24 18:10 - 2014-07-15 13:38 - 00000000 ____D C:\Program Files (x86)\Google
2015-11-24 18:09 - 2015-02-18 12:22 - 00000000 ____D C:\Users\Pavel\AppData\Local\Deployment
2015-11-24 16:46 - 2014-07-15 13:26 - 00000000 ____D C:\WINDOWS\System32\Tasks\WPD
2015-11-24 16:33 - 2015-10-03 14:02 - 00011264 ___SH C:\Users\Pavel\Downloads\Thumbs.db
2015-11-24 16:33 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2015-11-24 16:30 - 2015-03-05 14:35 - 00003990 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{260B4945-FC32-43AC-9DDA-33BD37B9B3F1}
2015-11-24 16:24 - 2014-07-15 13:32 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3928238382-3514605491-939278140-1001
2015-11-24 16:16 - 2014-07-23 11:52 - 00000000 ____D C:\Users\Pavel\Desktop\Programy
2015-11-16 17:33 - 2014-07-16 14:18 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-11-16 16:35 - 2015-03-02 15:05 - 00000000 ____D C:\ProgramData\Samsung
2015-11-16 15:37 - 2015-10-15 14:33 - 00000000 ____D C:\Program Files\WinRAR
2015-11-16 15:05 - 2014-07-16 14:32 - 00000000 ____D C:\Users\Pavel
2015-11-16 14:33 - 2014-07-25 08:38 - 00000000 ____D C:\Users\Pavel\AppData\Local\CrashDumps
2015-11-16 14:12 - 2015-02-17 14:05 - 00000000 ____D C:\Program Files (x86)\DAEMON Tools Pro
2015-11-15 19:08 - 2014-07-25 09:10 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\uTorrent
2015-11-15 18:55 - 2014-07-15 15:39 - 00000000 ____D C:\Users\Pavel\AppData\Roaming\vlc

==================== Files in the root of some directories =======

2015-07-21 23:58 - 2015-10-13 17:56 - 0000020 _____ () C:\Users\Pavel\AppData\Roaming\appdataFr2.bin
2015-05-17 16:50 - 2015-07-20 23:23 - 0000024 _____ () C:\Users\Pavel\AppData\Roaming\appdataFr25.bin
2015-03-09 13:01 - 2015-03-26 19:31 - 0000020 _____ () C:\Users\Pavel\AppData\Roaming\appdataFr3.bin
2015-02-17 14:09 - 2002-08-29 18:33 - 0319488 ____R () C:\Users\Pavel\AppData\Roaming\MafiaSetup.exe
2014-07-15 15:19 - 2014-07-15 15:19 - 0000000 _____ () C:\Users\Pavel\AppData\Local\AtStart.txt
2014-07-15 15:19 - 2014-07-15 15:19 - 0000000 _____ () C:\Users\Pavel\AppData\Local\DSwitch.txt
2015-02-23 22:32 - 2015-02-23 22:32 - 0000000 _____ () C:\Users\Pavel\AppData\Local\FnF4.txt
2014-07-15 15:19 - 2014-07-15 15:19 - 0000000 _____ () C:\Users\Pavel\AppData\Local\QSwitch.txt
2014-07-23 11:57 - 2014-07-23 11:57 - 0007606 _____ () C:\Users\Pavel\AppData\Local\Resmon.ResmonCfg
2015-05-18 21:32 - 2015-05-18 21:32 - 0000000 _____ () C:\Users\Pavel\AppData\Local\Temp.dat
2015-07-19 23:51 - 2015-07-19 23:51 - 0000000 _____ () C:\Users\Pavel\AppData\Local\{491CF29C-357C-4C3F-9B43-8B62A69DAA8F}

Some files in TEMP:
====================
C:\Users\Pavel\AppData\Local\Temp\2B80.exe
C:\Users\Pavel\AppData\Local\Temp\8480.exe
C:\Users\Pavel\AppData\Local\Temp\BackupSetup.exe
C:\Users\Pavel\AppData\Local\Temp\Change+My+Software+8+Edit__10924_i1744771211_il148954.exe
C:\Users\Pavel\AppData\Local\Temp\Change+My+Software+8+Edit__10924_i1744775914_il148954.exe
C:\Users\Pavel\AppData\Local\Temp\E254.exe
C:\Users\Pavel\AppData\Local\Temp\EAD1D4D.exe
C:\Users\Pavel\AppData\Local\Temp\EAD2280.exe
C:\Users\Pavel\AppData\Local\Temp\EAD4EEB.exe
C:\Users\Pavel\AppData\Local\Temp\EADFBF0.exe
C:\Users\Pavel\AppData\Local\Temp\Opera_NI_stable.exe
C:\Users\Pavel\AppData\Local\Temp\setacl.exe
C:\Users\Pavel\AppData\Local\Temp\setup.exe
C:\Users\Pavel\AppData\Local\Temp\siinst.exe
C:\Users\Pavel\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Pavel\AppData\Local\Temp\sqlite3.dll
C:\Users\Pavel\AppData\Local\Temp\strings.dll
C:\Users\Pavel\AppData\Local\Temp\supoptsetup.exe
C:\Users\Pavel\AppData\Local\Temp\Uninstall.exe
C:\Users\Pavel\AppData\Local\Temp\UninstallEADM.dll
C:\Users\Pavel\AppData\Local\Temp\vcredist_x64.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Pavel\Desktop" je 1371 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000000
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: zpomalený reklamník

#8 Příspěvek od Rudy »

Jestli jste dělal ten sken MBAM také pod běžným uživatelským profilem, udělejte nový v tomto profilu.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“