Dobrý den,
podarilo se mi po 20letech rozkliknout blbost a uz to jede. dekuji za vas cas pri venovani se reseni moji blbosti.
FRSTlog:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-02-2016
Ran by masekv (administrator) on EPRW7HFN012 (26-02-2016 20:34:52)
Running from C:\Users\masekv\Desktop
Loaded Profiles: masekv (Available Profiles: masekv & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apache Software Foundation) C:\Program Files (x86)\EasyPHP-12.1\apache\bin\apache.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(truconneXion, a. s.) C:\AuditPro\SCAN.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(McAfee, Inc.) C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe
(Apache Software Foundation) C:\Program Files (x86)\EasyPHP-12.1\apache\bin\apache.exe
(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IFXSPMGT.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IFXTCS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe
() C:\Program Files (x86)\EasyPHP-12.1\mysql\bin\mysqld.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\Teamviewer\Version5\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(ArcSoft, Inc.) C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Windows\SoftwareProtection\systemvital.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\McTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\PSDrt.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
() C:\Program Files (x86)\SearchesToYesbnd\bugreport.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSDKHelperx64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(TODO: <公司名>) C:\Program Files (x86)\winsafe\winsafe.exe
(TODO: <公司名>) C:\Program Files (x86)\winsafe\winsafe.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(TODO: <公司名>) C:\Program Files (x86)\winsafe\winsafe.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.,LTD.) C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe
(Apple Inc.) C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe
(iQIYI.COM) C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(forum.viry.cz) C:\Users\masekv\Desktop\FRSTLauncher.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\McScript_InUse.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2919992 2011-01-27] (Hewlett-Packard Company)
HKLM\...\Run: [MfeEpePcMonitor] => C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe [200704 2011-02-09] ()
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [McAfee Host Intrusion Prevention Tray] => C:\Program Files\McAfee\Host Intrusion Prevention\FireTray.exe [255640 2010-12-20] (McAfee, Inc.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2013-06-08] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3011824 2013-06-15] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-23] (Apple Inc.)
HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [514544 2011-01-12] ()
HKLM-x32\...\Run: [File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-03] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] => c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [HPConnectionManager] => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-04-05] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [HPQuickWebProxy] => c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [76344 2011-02-11] (Hewlett-Packard Company)
HKLM-x32\...\Run: [IFXSPMGT] => c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe [1125728 2011-01-20] (Infineon Technologies AG)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-05-06] (PDF Complete Inc)
HKLM-x32\...\Run: [HPUsageTrackingLEDM] => C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)
HKLM-x32\...\Run: [ShStatEXE] => C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE [244080 2015-08-20] (McAfee, Inc.)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [312376 2011-03-21] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)
HKLM-x32\...\Run: [McAfeeUpdaterUI] => C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe [337776 2015-02-10] (McAfee, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [apphide] => C:\Program Files (x86)\qq\qq.exe
HKLM-x32\...\Run: [pcmgr] => C:\Program Files (x86)\qq\Uninst.exe
HKLM-x32\...\Run: [gmsd_re_021010249] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [594992 2016-01-29] (Oracle Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [] => [X]
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [system34] => C:\windows\SoftwareProtection\systemvital.exe [624608 2013-01-23] ()
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673696 2013-08-01] (Disc Soft Ltd)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-07-13] (TomTom)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [60688 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [103696 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [349968 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [apphide] => C:\Program Files (x86)\qq\qq.exe
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [winsafe] => C:\Program Files (x86)\winsafe\winsafe.exe [3302912 2016-02-24] (TODO: <公司名>)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [GoogleChromeAutoLaunch_59BF6F103A2FCAA536327B8975A2CE95] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [746648 2016-02-18] (Google Inc.)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [HCDNClient] => C:\Program Files (x86)\IQIYI Video\LStyle\QyKernel.exe [577128 2015-11-23] (iQIYI.COM)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\MountPoints2: {947e3d3a-2488-11e3-8e07-402cf417409c} - G:\SETUP.EXE
Lsa: [Notification Packages] EpePcNp64 DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2011-08-12]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\爱奇艺PPS影音.lnk [2016-02-26]
ShortcutTarget: 爱奇艺PPS影音.lnk -> C:\Program Files (x86)\IQIYI Video\LStyle\QyClient.exe (爱奇艺)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{03D1F58F-0CAC-4459-A02C-27C2654B0582}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{1A6A6104-BFC2-454C-9D89-1433B252FA81}: [DhcpNameServer] 213.46.172.37 213.46.172.36
Tcpip\..\Interfaces\{A966572D-083C-42F4-86D7-3EFCDA8BE685}: [DhcpNameServer] 10.212.1.16 10.212.1.3
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.bing.com?pc=CMNTDF
SearchScopes: HKLM -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKLM -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKU\S-1-5-21-1801674531-606747145-2147026105-5754 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL =
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20150922213547.dll [2015-09-22] (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll [2011-02-07] (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-02-26] (Oracle Corporation)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20150922213553.dll [2015-09-22] (McAfee, Inc.)
BHO-x32: No Name -> {83B80A9C-D91A-4F22-8DCF-EA7204039F79} -> No File
BHO-x32: Pomocná služba pro přihlášení k účtu Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-26] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: °®ĆćŇŐÖúĘÖ -> {FB4F6285-4C32-49F2-950F-A5998F9CEC6C} -> C:\Program Files (x86)\IQIYI Video\LStyle\Accelerator\IEHelper.dll [2015-11-17] (爱奇艺)
FireFox:
========
FF ProfilePath: C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1
FF NewTab: hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... ode=ffseng
FF DefaultSearchEngine: yessearches
FF DefaultSearchEngine.US: data:text/plain,browser.search.defaultenginename.US=yessearches
FF SelectedSearchEngine: yessearches
FF Homepage: hxxps://www.google.cz
FF Keyword.URL: hxxp://www.yessearches.com/chrome.php?uid=6871 ... toolbar&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_20_0_0_306.dll [2016-02-10] ()
FF Plugin: @iqiyi.com/npclient -> C:\Program Files (x86)\IQIYI Video\LStyle\npclient.dll [2015-11-17] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-10] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @iqiyi.com/npclient -> C:\Program Files (x86)\IQIYI Video\LStyle\npclient.dll [2015-11-17] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-02-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-02-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin -> C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll [2012-10-13] ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1801674531-606747145-2147026105-5754: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\masekv\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-08-18] (Unity Technologies ApS)
FF user.js: detected! => C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\091i76kz.default\user.js [2016-02-26]
FF user.js: detected! => C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\user.js [2016-02-26]
FF SearchPlugin: C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\searchplugins\DD1B66D4.xml [2016-02-25]
FF Extension: Firebug - C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\091i76kz.default\Extensions\firebug@software.joehewitt.com.xpi [2016-02-08]
FF Extension: GsearchFinder - C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi [2016-02-02]
FF Extension: Firebug - C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\firebug@software.joehewitt.com.xpi [2016-02-08]
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2011-08-12] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: McAfee ScriptScan for Firefox - C:\Program Files (x86)\Common Files\McAfee\SystemCore [2015-09-23] [not signed]
Chrome:
=======
CHR Profile: C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-26]
CHR Extension: (Disk Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-26]
CHR Extension: (YouTube) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-26]
CHR Extension: (Vyhledávání Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-26]
CHR Extension: (Lumin - Best Document Viewer) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbkidnlfklnjanneifjjojofckpcogcl [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dblpoacaeekoaelbbahfdgjfohpapkgh [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhipmoghimfdldnocmopeoanjmoolofl [2016-02-26]
CHR Extension: (Leafly) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpmboknidiiemiokdpihmmfokoljfamo [2016-02-26]
CHR Extension: (Gmail Offline) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-02-26]
CHR Extension: (Král Crash) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\gnhnlfnigjjkiphcnbnpedcpfoggjhba [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\haebnnbpedcbhciplfhjjkbafijpncjl [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcpejamelebpigblebnbabhndaaffjok [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljgpiikiibdligadiaifmdemkbkahfnf [2016-02-26]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-02-26]
CHR Extension: (\) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\picpigdgdkaekefkpcaenndmjhibibnk [2016-02-26]
CHR Extension: (Gmail) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-26]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apache2.2; C:\Program Files (x86)\EasyPHP-12.1\apache\bin\apache.exe [20992 2012-04-21] (Apache Software Foundation) [File not signed]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)
R2 AuditPro Scan; C:\AuditPro\Scan.exe [2623808 2015-03-03] (truconneXion, a. s.)
R2 Bonjour Service; C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe [414824 2015-11-20] (Apple Inc.)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [481104 2011-02-12] (DigitalPersona, Inc.)
R2 enterceptAgent; C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe [640312 2010-12-20] (McAfee, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [464480 2011-02-03] (Hewlett-Packard Company)
S2 ggbugreport; C:\Program Files (x86)\SearchesToYesbnd\bugreport.exe [1588408 2016-02-05] ()
R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [File not signed]
R3 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2011-01-12] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [133688 2011-01-28] (Hewlett-Packard Company)
R2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [320000 2011-02-07] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [293944 2011-03-21] (Hewlett-Packard Company)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IFXSpMgtSrv; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe [1125728 2011-01-20] (Infineon Technologies AG)
R2 IFXTCS; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxtcs.exe [980320 2011-01-20] (Infineon Technologies AG)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
R2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1318912 2011-02-09] () [File not signed]
R2 McAfeeFramework; C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [129904 2015-02-10] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [262544 2015-09-22] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe [208936 2015-08-20] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [203104 2010-11-23] (McAfee, Inc.)
R2 mfevtp; C:\windows\system32\mfevtps.exe [254792 2015-09-22] (McAfee, Inc.)
R2 MSSQL$PHARMSYS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MySQL; C:\Program Files (x86)\EasyPHP-12.1\mysql\bin\mysqld.exe [8186368 2012-07-20] () [File not signed]
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-05-06] (PDF Complete Inc)
R2 PersonalSecureDriveService; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe [203104 2011-01-20] (Infineon Technologies AG)
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2013-01-23] ()
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [336824 2010-11-30] (arvato digital services llc)
R2 QiyiService; C:\Program Files (x86)\IQIYI Video\LStyle\QiyiService.exe [458856 2015-11-17] (BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.,LTD.)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [323072 2013-06-08] (IDT, Inc.) [File not signed]
R2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Winsere; C:\Program Files (x86)\Winsere\Winsere\Winsere.exe [302776 2016-02-03] ()
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)
S3 Axtmvflt; C:\Windows\System32\DRIVERS\Axtmvflt.sys [6144 2007-03-26] (Axesstel)
S3 Axtmvmdm; C:\Windows\System32\DRIVERS\Axtmvmdm.sys [54272 2007-03-26] (Axesstel)
S3 Axtmvprt; C:\Windows\System32\Drivers\Axtmvprt.sys [52224 2007-03-26] (Axesstel)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [63336 2011-02-07] (Hewlett-Packard Company)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-09-26] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 FireNfcp; C:\Windows\System32\drivers\FireNfcp.sys [48840 2011-10-06] (McAfee, Inc.)
R3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [195280 2010-12-20] (McAfee, Inc.)
R3 johci; C:\Windows\System32\DRIVERS\johci.sys [26208 2013-06-08] (JMicron Technology Corp.)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [412440 2015-09-22] (McAfee, Inc.)
R3 mfeaacsk; C:\Windows\System32\drivers\mfeaacsk.sys [64416 2015-09-22] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [192512 2015-08-26] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [347800 2015-09-22] (McAfee, Inc.)
U3 mfeavfk01; no ImagePath
R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [168008 2011-02-09] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [496888 2015-09-22] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [875928 2015-09-22] (McAfee, Inc.)
R1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [74904 2010-11-28] (McAfee, Inc.)
R3 mfeplk; C:\Windows\System32\drivers\mfeplk.sys [66080 2015-09-22] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [114880 2015-09-22] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [344704 2015-09-22] (McAfee, Inc.)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2011-04-27] (Marvell Semiconductor, Inc.)
R1 PersonalSecureDrive; C:\Windows\System32\drivers\psd.sys [44576 2010-01-26] (Infineon Technologies AG)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1826048 2010-12-21] ()
S3 NPF; system32\drivers\NPF.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-02-26 20:34 - 2016-02-26 20:36 - 00036854 _____ C:\Users\masekv\Desktop\FRST.txt
2016-02-26 20:34 - 2016-02-26 20:34 - 00000000 ____D C:\FRST
2016-02-26 20:32 - 2016-02-26 20:32 - 00112640 _____ (forum.viry.cz) C:\Users\masekv\Desktop\FRSTLauncher.exe
2016-02-26 20:30 - 2016-02-26 20:30 - 02371072 _____ (Farbar) C:\Users\masekv\Desktop\FRST64.exe
2016-02-26 20:14 - 2016-02-26 20:29 - 00000000 ____D C:\qycache
2016-02-26 20:14 - 2016-02-26 20:14 - 00002169 _____ C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\爱奇艺PPS影音.lnk
2016-02-26 20:14 - 2016-02-26 20:14 - 00000000 ____D C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\爱奇艺
2016-02-26 20:13 - 2016-02-26 20:13 - 00002135 _____ C:\Users\masekv\Desktop\爱奇艺PPS 影音.lnk
2016-02-26 20:12 - 2016-02-26 20:12 - 00001927 _____ C:\Users\Public\Desktop\9377»ĘÍĽ.lnk
2016-02-26 20:12 - 2016-02-26 20:12 - 00000975 _____ C:\Users\masekv\Desktop\´«ĆćʢĘŔ.lnk
2016-02-26 20:12 - 2016-02-26 20:12 - 00000046 _____ C:\Users\masekv\FunShion.ini
2016-02-26 20:12 - 2016-02-26 20:12 - 00000000 ____D C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\cqss
2016-02-26 20:12 - 2016-02-26 20:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\»ĘÍĽ
2016-02-26 20:12 - 2016-02-26 20:12 - 00000000 ____D C:\Program Files (x86)\htby
2016-02-26 20:12 - 2016-02-26 20:12 - 00000000 ____D C:\Program Files (x86)\cqss
2016-02-26 19:50 - 2016-02-26 20:12 - 00000917 _____ C:\Users\masekv\Desktop\´«ÆæÊ¢ÊÀ.lnk
2016-02-26 19:39 - 2016-02-26 19:39 - 00002284 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-02-26 19:39 - 2016-02-26 19:39 - 00002255 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-02-26 19:36 - 2016-02-26 19:37 - 00987728 _____ (Google Inc.) C:\Users\masekv\Downloads\ChromeSetup.exe
2016-02-26 14:51 - 2016-02-26 20:12 - 00000000 ____D C:\Program Files (x86)\IQIYI Video
2016-02-26 14:50 - 2016-02-26 19:50 - 01396216 _____ (苏州聚和网络科技有限公司) C:\windows\SysWOW64\xy.exe
2016-02-26 14:50 - 2016-02-26 19:50 - 01067320 _____ (9377, Inc.) C:\windows\SysWOW64\ht.exe
2016-02-26 08:46 - 2016-02-26 08:46 - 00000000 ____D C:\Users\masekv\AppData\LocalLow\VirtualStore
2016-02-26 08:46 - 2016-02-26 08:46 - 00000000 ____D C:\Users\masekv\.android
2016-02-26 08:43 - 2016-02-26 20:04 - 00000000 ____D C:\ProgramData\IQIYI Video
2016-02-26 07:22 - 2016-02-26 19:53 - 00000000 ____D C:\Users\masekv\AppData\Local\SysassistByHotWheel
2016-02-26 07:21 - 2016-02-26 20:15 - 00000000 ____D C:\Users\masekv\AppData\Roaming\IQIYI Video
2016-02-26 07:21 - 2016-02-26 07:21 - 00000000 ____D C:\Users\Public\QiYi
2016-02-26 07:21 - 2016-02-26 07:21 - 00000000 ____D C:\Users\masekv\AppData\LocalLow\Unity
2016-02-26 07:21 - 2016-02-26 07:21 - 00000000 ____D C:\Users\masekv\AppData\Local\Unity
2016-02-26 07:21 - 2016-02-26 07:21 - 00000000 ____D C:\ppsfile
2016-02-25 22:40 - 2016-02-26 19:51 - 40657864 _____ (爱奇艺) C:\windows\SysWOW64\pps.exe
2016-02-25 22:20 - 2016-02-26 19:30 - 00000000 _____ C:\windows\SysWOW64\lock.dat
2016-02-25 22:20 - 2016-02-25 22:20 - 00000000 ____D C:\Users\masekv\AppData\Roaming\Tencent
2016-02-25 22:20 - 2016-02-25 22:20 - 00000000 ____D C:\ProgramData\Tencent
2016-02-25 22:20 - 2016-02-25 22:20 - 00000000 _____ C:\windows\SysWOW64\in.dat
2016-02-25 22:19 - 2016-02-25 22:19 - 00001423 _____ C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-02-25 21:55 - 2016-02-25 22:12 - 00000000 ____D C:\Users\masekv\AppData\Local\3810282D-6C19-47B0-8283-5C6C29A7E108
2016-02-25 21:53 - 2016-02-26 06:58 - 00000000 ____D C:\Program Files (x86)\SearchesToYesbnd
2016-02-25 21:53 - 2016-02-25 21:53 - 00015206 _____ C:\windows\System32\Tasks\WinTaske
2016-02-25 21:53 - 2016-02-25 21:53 - 00000000 ____D C:\Program Files (x86)\WinTaske
2016-02-25 21:53 - 2016-02-25 21:53 - 00000000 ____D C:\Program Files (x86)\Winsere
2016-02-25 21:51 - 2016-02-25 21:53 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-02-25 21:50 - 2016-02-26 20:12 - 00000000 ____D C:\Program Files (x86)\winsafe
2016-02-25 21:46 - 2016-02-26 06:56 - 00000000 ____D C:\Users\masekv\AppData\Roaming\Seznam.cz
2016-02-25 21:33 - 2016-02-25 21:33 - 00000000 ____D C:\Users\masekv\Documents\Aquafadas
2016-02-25 21:09 - 2016-02-25 21:09 - 00000000 ____D C:\ProgramData\IsolatedStorage
2016-02-25 20:54 - 2016-02-25 20:54 - 17334952 _____ C:\Users\masekv\Downloads\BannerZest_Setup.exe
2016-02-25 20:45 - 2016-02-25 20:45 - 16399568 _____ (Devsoft, Inc ) C:\Users\masekv\Downloads\BannerEffectTrial.exe
2016-02-23 18:41 - 2016-02-23 18:42 - 00001209 _____ C:\Users\masekv\Downloads\Seznam_zasilek_detaily.csv
2016-02-19 00:08 - 2016-02-21 22:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-02-18 19:00 - 2016-02-18 19:00 - 00000864 _____ C:\Users\masekv\AppData\Local\recently-used.xbel
2016-02-14 10:25 - 2016-02-14 10:25 - 00186048 _____ C:\Users\masekv\Desktop\Husa 86x140.pdf
2016-02-11 19:28 - 2016-02-11 19:28 - 00000000 ____D C:\Users\masekv\AppData\LocalLow\Temp
2016-02-05 07:27 - 2016-01-16 20:06 - 00025024 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2016-02-05 07:27 - 2016-01-16 19:54 - 01162240 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2016-02-05 07:27 - 2016-01-11 20:05 - 03169792 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2016-02-05 07:27 - 2016-01-11 20:05 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2016-02-05 07:27 - 2016-01-11 20:05 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2016-02-05 07:27 - 2016-01-11 19:52 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2016-02-05 07:27 - 2016-01-11 19:47 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2016-02-05 07:27 - 2016-01-11 19:26 - 02610176 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2016-02-05 07:27 - 2016-01-11 19:24 - 00709120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2016-02-05 07:27 - 2016-01-11 19:23 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2016-02-05 07:27 - 2016-01-11 19:23 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2016-02-05 07:27 - 2016-01-11 19:23 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2016-02-05 07:27 - 2016-01-11 19:23 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2016-02-05 07:27 - 2016-01-11 19:23 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2016-02-05 07:27 - 2016-01-11 19:14 - 00573440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2016-02-05 07:27 - 2016-01-11 19:14 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2016-02-05 07:27 - 2016-01-11 19:14 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2016-02-05 07:27 - 2016-01-11 19:14 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 01362944 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00677376 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00499200 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2016-02-05 07:26 - 2016-01-22 07:19 - 14179840 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2016-02-05 07:26 - 2016-01-22 07:15 - 01866752 _____ (Microsoft Corporation) C:\windows\system32\ExplorerFrame.dll
2016-02-05 07:26 - 2016-01-22 07:12 - 01940992 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2016-02-05 07:26 - 2016-01-22 07:05 - 12877824 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2016-02-05 07:26 - 2016-01-22 07:00 - 01498624 _____ (Microsoft Corporation) C:\windows\SysWOW64\ExplorerFrame.dll
2016-02-05 07:26 - 2016-01-22 06:59 - 01805824 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2016-02-05 07:26 - 2016-01-22 06:19 - 03231232 _____ (Microsoft Corporation) C:\windows\explorer.exe
2016-02-05 07:26 - 2016-01-22 06:12 - 02973184 _____ (Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
2016-01-27 16:39 - 2015-11-16 21:17 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2016-01-27 16:39 - 2015-11-14 00:09 - 00091648 _____ (Microsoft Corporation) C:\windows\system32\mapistub.dll
2016-01-27 16:39 - 2015-11-14 00:09 - 00091648 _____ (Microsoft Corporation) C:\windows\system32\mapi32.dll
2016-01-27 16:39 - 2015-11-14 00:08 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\fixmapi.exe
2016-01-27 16:39 - 2015-11-13 23:50 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mapistub.dll
2016-01-27 16:39 - 2015-11-13 23:50 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mapi32.dll
2016-01-27 16:39 - 2015-11-13 23:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\fixmapi.exe
2016-01-27 16:38 - 2015-12-15 23:25 - 02350080 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2016-01-27 16:38 - 2015-12-15 22:44 - 00424960 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2016-01-27 16:37 - 2015-12-15 23:28 - 17892352 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2016-01-27 16:37 - 2015-12-15 23:21 - 10938368 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2016-01-27 16:37 - 2015-12-15 23:20 - 01388032 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2016-01-27 16:37 - 2015-12-15 23:20 - 00448512 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2016-01-27 16:37 - 2015-12-15 23:19 - 02158080 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2016-01-27 16:37 - 2015-12-15 23:19 - 01392128 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 02382848 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2016-01-27 16:37 - 2015-12-15 23:18 - 01494016 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2016-01-27 16:37 - 2015-12-15 23:18 - 00816128 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 00729088 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 00579584 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 00282112 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 00248320 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 00237056 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 00173568 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2016-01-27 16:37 - 2015-12-15 23:18 - 00096768 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 00055296 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2016-01-27 16:37 - 2015-12-15 23:18 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2016-01-27 16:37 - 2015-12-15 23:18 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2016-01-27 16:37 - 2015-12-15 22:50 - 01814528 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2016-01-27 16:37 - 2015-12-15 22:49 - 12388864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2016-01-27 16:37 - 2015-12-15 22:47 - 00367616 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2016-01-27 16:37 - 2015-12-15 22:46 - 09753088 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2016-01-27 16:37 - 2015-12-15 22:45 - 01140224 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2016-01-27 16:37 - 2015-12-15 22:45 - 01129472 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2016-01-27 16:37 - 2015-12-15 22:44 - 01804800 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2016-01-27 16:37 - 2015-12-15 22:44 - 01427968 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2016-01-27 16:37 - 2015-12-15 22:44 - 00718848 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2016-01-27 16:37 - 2015-12-15 22:44 - 00231936 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2016-01-27 16:37 - 2015-12-15 22:44 - 00142848 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2016-01-27 16:37 - 2015-12-15 22:44 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2016-01-27 16:37 - 2015-12-15 22:43 - 02382848 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2016-01-27 16:37 - 2015-12-15 22:43 - 00607744 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2016-01-27 16:37 - 2015-12-15 22:43 - 00353792 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2016-01-27 16:37 - 2015-12-15 22:43 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2016-01-27 16:37 - 2015-12-15 22:43 - 00176640 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2016-01-27 16:37 - 2015-12-15 22:43 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2016-01-27 16:37 - 2015-12-15 22:43 - 00041472 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2016-01-27 16:37 - 2015-12-15 22:43 - 00011776 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2016-01-27 16:37 - 2015-12-15 22:43 - 00010752 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2016-01-27 16:36 - 2015-12-16 19:55 - 00069120 _____ (Microsoft Corporation) C:\windows\system32\nlsbres.dll
2016-01-27 16:36 - 2015-12-16 19:53 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\kbdgeoqw.dll
2016-01-27 16:36 - 2015-12-16 19:53 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDAZEL.DLL
2016-01-27 16:36 - 2015-12-16 19:53 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDAZE.DLL
2016-01-27 16:36 - 2015-12-16 19:48 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDAZE.DLL
2016-01-27 16:36 - 2015-12-16 19:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\kbdgeoqw.dll
2016-01-27 16:36 - 2015-12-16 19:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDAZEL.DLL
2016-01-27 16:36 - 2015-12-16 19:47 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlsbres.dll
2016-01-27 16:36 - 2015-12-08 22:54 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2016-01-27 16:36 - 2015-12-08 22:54 - 01568768 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVENCOD.DLL
2016-01-27 16:36 - 2015-12-08 22:54 - 01325056 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMSPDMOE.DLL
2016-01-27 16:36 - 2015-12-08 22:54 - 00902144 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMADMOD.DLL
2016-01-27 16:36 - 2015-12-08 22:54 - 00815616 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMADMOE.DLL
2016-01-27 16:36 - 2015-12-08 22:54 - 00740352 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmpmde.dll
2016-01-27 16:36 - 2015-12-08 22:54 - 00739328 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMSPDMOD.DLL
2016-01-27 16:36 - 2015-12-08 22:54 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVXENCD.DLL
2016-01-27 16:36 - 2015-12-08 22:54 - 00541184 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVSDECD.DLL
2016-01-27 16:36 - 2015-12-08 22:54 - 00358400 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVSENCD.DLL
2016-01-27 16:36 - 2015-12-08 22:54 - 00154112 _____ (Microsoft Corporation) C:\windows\SysWOW64\VIDRESZR.DLL
2016-01-27 16:36 - 2015-12-08 22:53 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 01329664 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00970240 _____ (Microsoft Corporation) C:\windows\SysWOW64\msmpeg2adec.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00829952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MSMPEG2ENC.DLL
2016-01-27 16:36 - 2015-12-08 22:53 - 00641536 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00609280 _____ (Microsoft Corporation) C:\windows\SysWOW64\MFWMAAEC.DLL
2016-01-27 16:36 - 2015-12-08 22:53 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00509952 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00489984 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00415744 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP4SDECD.DLL
2016-01-27 16:36 - 2015-12-08 22:53 - 00354816 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00241152 _____ (Microsoft Corporation) C:\windows\SysWOW64\MPG4DECD.DLL
2016-01-27 16:36 - 2015-12-08 22:53 - 00241152 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP43DECD.DLL
2016-01-27 16:36 - 2015-12-08 22:53 - 00206848 _____ (Microsoft Corporation) C:\windows\SysWOW64\RESAMPLEDMO.DLL
2016-01-27 16:36 - 2015-12-08 22:53 - 00206848 _____ (Microsoft Corporation) C:\windows\SysWOW64\qasf.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00193536 _____ (Microsoft Corporation) C:\windows\SysWOW64\ksproxy.ax
2016-01-27 16:36 - 2015-12-08 22:53 - 00153600 _____ (Microsoft Corporation) C:\windows\SysWOW64\COLORCNV.DLL
2016-01-27 16:36 - 2015-12-08 22:53 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00079872 _____ (Microsoft Corporation) C:\windows\SysWOW64\MP3DMOD.DLL
2016-01-27 16:36 - 2015-12-08 22:53 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\devenum.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00053248 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfvdsp.dll
2016-01-27 16:36 - 2015-12-08 22:53 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2016-01-27 16:36 - 2015-12-08 22:53 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2016-01-27 16:36 - 2015-12-08 22:53 - 00004608 _____ (Microsoft Corporation) C:\windows\SysWOW64\ksuser.dll
2016-01-27 16:36 - 2015-12-08 22:50 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 01955328 _____ (Microsoft Corporation) C:\windows\system32\WMVENCOD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 01575424 _____ (Microsoft Corporation) C:\windows\system32\WMSPDMOE.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 01573888 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 01393152 _____ (Microsoft Corporation) C:\windows\system32\WMALFXGFXDSP.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 01307136 _____ (Microsoft Corporation) C:\windows\system32\msmpeg2adec.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 01232896 _____ (Microsoft Corporation) C:\windows\system32\WMADMOD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 01160192 _____ (Microsoft Corporation) C:\windows\system32\MSMPEG2ENC.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 01153024 _____ (Microsoft Corporation) C:\windows\system32\WMADMOE.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 01026048 _____ (Microsoft Corporation) C:\windows\system32\wmpmde.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 01010688 _____ (Microsoft Corporation) C:\windows\system32\mcmde.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00978944 _____ (Microsoft Corporation) C:\windows\system32\WMSPDMOD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00879104 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00666112 _____ (Microsoft Corporation) C:\windows\system32\WMVSDECD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00653824 _____ (Microsoft Corporation) C:\windows\system32\MP4SDECD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00642048 _____ (Microsoft Corporation) C:\windows\system32\WMVXENCD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00632320 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00624640 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00484864 _____ (Microsoft Corporation) C:\windows\system32\MFWMAAEC.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00447488 _____ (Microsoft Corporation) C:\windows\system32\WMVSENCD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00378880 _____ (Microsoft Corporation) C:\windows\system32\SysFxUI.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00292352 _____ (Microsoft Corporation) C:\windows\system32\VIDRESZR.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00254464 _____ (Microsoft Corporation) C:\windows\system32\qasf.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00225792 _____ (Microsoft Corporation) C:\windows\system32\RESAMPLEDMO.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00224768 _____ (Microsoft Corporation) C:\windows\system32\MPG4DECD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00223744 _____ (Microsoft Corporation) C:\windows\system32\MP43DECD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00189952 _____ (Microsoft Corporation) C:\windows\system32\COLORCNV.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\MP3DMOD.DLL
2016-01-27 16:36 - 2015-12-08 20:07 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\devenum.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00070144 _____ (Microsoft Corporation) C:\windows\system32\mfvdsp.dll
2016-01-27 16:36 - 2015-12-08 20:07 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2016-01-27 16:36 - 2015-12-08 20:07 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\ksuser.dll
2016-01-27 16:36 - 2015-12-08 20:06 - 00250880 _____ (Microsoft Corporation) C:\windows\system32\ksproxy.ax
2016-01-27 16:36 - 2015-12-08 20:06 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2016-01-27 16:36 - 2015-12-08 20:04 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2016-01-27 16:36 - 2015-12-08 19:54 - 00116736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\drmk.sys
2016-01-27 16:36 - 2015-12-08 19:12 - 00230400 _____ (Microsoft Corporation) C:\windows\system32\Drivers\portcls.sys
2016-01-27 16:36 - 2015-12-08 19:11 - 00005632 _____ (Microsoft Corporation) C:\windows\system32\Drivers\drmkaud.sys
2016-01-27 16:36 - 2015-12-08 18:58 - 03211264 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2016-01-27 16:35 - 2015-12-30 20:08 - 05572544 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2016-01-27 16:35 - 2015-12-30 20:08 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2016-01-27 16:35 - 2015-12-30 20:08 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2016-01-27 16:35 - 2015-12-30 20:05 - 01730496 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2016-01-27 16:35 - 2015-12-30 20:02 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2016-01-27 16:35 - 2015-12-30 20:02 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2016-01-27 16:35 - 2015-12-30 20:02 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2016-01-27 16:35 - 2015-12-30 20:02 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2016-01-27 16:35 - 2015-12-30 20:02 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2016-01-27 16:35 - 2015-12-30 20:02 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2016-01-27 16:35 - 2015-12-30 20:01 - 01214464 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2016-01-27 16:35 - 2015-12-30 20:01 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2016-01-27 16:35 - 2015-12-30 20:01 - 00344064 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2016-01-27 16:35 - 2015-12-30 20:01 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2016-01-27 16:35 - 2015-12-30 20:01 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2016-01-27 16:35 - 2015-12-30 20:01 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2016-01-27 16:35 - 2015-12-30 20:01 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2016-01-27 16:35 - 2015-12-30 20:00 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2016-01-27 16:35 - 2015-12-30 19:59 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2016-01-27 16:35 - 2015-12-30 19:59 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2016-01-27 16:35 - 2015-12-30 19:59 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2016-01-27 16:35 - 2015-12-30 19:58 - 01461248 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2016-01-27 16:35 - 2015-12-30 19:58 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2016-01-27 16:35 - 2015-12-30 19:57 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2016-01-27 16:35 - 2015-12-30 19:57 - 00729600 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2016-01-27 16:35 - 2015-12-30 19:57 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2016-01-27 16:35 - 2015-12-30 19:55 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2016-01-27 16:35 - 2015-12-30 19:55 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2016-01-27 16:35 - 2015-12-30 19:55 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:54 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:47 - 03993536 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2016-01-27 16:35 - 2015-12-30 19:47 - 03938240 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2016-01-27 16:35 - 2015-12-30 19:44 - 01311768 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2016-01-27 16:35 - 2015-12-30 19:41 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2016-01-27 16:35 - 2015-12-30 19:41 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2016-01-27 16:35 - 2015-12-30 19:41 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2016-01-27 16:35 - 2015-12-30 19:41 - 00171520 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2016-01-27 16:35 - 2015-12-30 19:41 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2016-01-27 16:35 - 2015-12-30 19:41 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2016-01-27 16:35 - 2015-12-30 19:41 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2016-01-27 16:35 - 2015-12-30 19:41 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2016-01-27 16:35 - 2015-12-30 19:40 - 00251392 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2016-01-27 16:35 - 2015-12-30 19:40 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2016-01-27 16:35 - 2015-12-30 19:39 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2016-01-27 16:35 - 2015-12-30 19:39 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2016-01-27 16:35 - 2015-12-30 19:39 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2016-01-27 16:35 - 2015-12-30 19:39 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2016-01-27 16:35 - 2015-12-30 19:38 - 00552960 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2016-01-27 16:35 - 2015-12-30 19:38 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 19:37 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 18:57 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2016-01-27 16:35 - 2015-12-30 18:50 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2016-01-27 16:35 - 2015-12-30 18:49 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2016-01-27 16:35 - 2015-12-30 18:44 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2016-01-27 16:35 - 2015-12-30 18:43 - 00159232 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2016-01-27 16:35 - 2015-12-30 18:42 - 00290816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2016-01-27 16:35 - 2015-12-30 18:42 - 00129024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2016-01-27 16:35 - 2015-12-30 18:41 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2016-01-27 16:35 - 2015-12-30 18:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2016-01-27 16:35 - 2015-12-30 18:32 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2016-01-27 16:35 - 2015-12-30 18:32 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2016-01-27 16:35 - 2015-12-30 18:32 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2016-01-27 16:35 - 2015-12-30 18:32 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2016-01-27 16:35 - 2015-12-30 18:30 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
2016-01-27 16:35 - 2015-12-30 18:30 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 18:30 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 18:30 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-01-27 16:35 - 2015-12-30 18:30 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-01-27 16:35 - 2015-12-08 22:52 - 00312320 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2016-01-27 16:35 - 2015-12-08 20:07 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2016-01-27 07:21 - 2016-01-27 07:21 - 00400571 _____ C:\Users\masekv\Documents\tritace-combi-10-mg-10-mg-pil.pdf
2016-01-27 07:20 - 2016-01-27 07:20 - 00603990 _____ C:\Users\masekv\Documents\tritace-combi-10-mg-10-mg-spc.pdf
2016-01-27 00:09 - 2016-01-27 00:11 - 07117923 _____ C:\Users\masekv\Desktop\Noclaud leden2016.pptx
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-02-26 20:29 - 2012-07-14 21:28 - 00000952 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-02-26 20:28 - 2014-11-25 16:58 - 00000000 ____D C:\Users\masekv\Documents\Soukromy
2016-02-26 20:27 - 2012-06-25 09:11 - 00127376 _____ C:\Users\masekv\AppData\Local\GDIPFONTCACHEV1.DAT
2016-02-26 20:27 - 2012-05-24 09:23 - 00000914 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2016-02-26 20:12 - 2012-06-25 09:10 - 00000000 ____D C:\Users\masekv
2016-02-26 19:52 - 2015-04-02 21:40 - 00000000 ____D C:\Program Files (x86)\Safari
2016-02-26 19:39 - 2012-06-27 08:24 - 00000000 ____D C:\Users\masekv\AppData\Local\Google
2016-02-26 19:38 - 2011-12-27 18:57 - 00000000 ____D C:\Program Files (x86)\Google
2016-02-26 17:39 - 2011-08-12 04:37 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-02-26 14:57 - 2009-07-14 05:45 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-02-26 14:57 - 2009-07-14 05:45 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-02-26 09:08 - 2014-12-26 13:03 - 00000000 ___RD C:\Users\masekv\iCloudDrive
2016-02-26 09:07 - 2012-07-14 21:28 - 00000948 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-02-26 09:06 - 2011-08-12 04:48 - 00000000 ____D C:\ProgramData\PDFC
2016-02-26 09:06 - 2011-08-12 04:44 - 00000000 ____D C:\ProgramData\HPQLOG
2016-02-26 09:04 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-02-26 08:55 - 2009-07-14 05:45 - 00484720 _____ C:\windows\system32\FNTCACHE.DAT
2016-02-26 07:12 - 2013-12-07 13:51 - 00000000 ____D C:\ProgramData\Oracle
2016-02-26 07:09 - 2014-10-29 21:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-02-26 07:09 - 2013-12-07 13:50 - 00000000 ____D C:\Program Files (x86)\Java
2016-02-26 07:07 - 2015-08-28 08:21 - 00000000 ____D C:\Users\masekv\.oracle_jre_usage
2016-02-26 07:07 - 2014-10-29 21:23 - 00097888 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2016-02-26 06:54 - 2014-11-10 23:40 - 00001873 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-02-26 06:52 - 2011-08-12 04:58 - 00000000 ____D C:\Program Files (x86)\Bing Bar Installer
2016-02-26 06:50 - 2012-06-27 08:23 - 00000000 ____D C:\Users\masekv\AppData\Local\Deployment
2016-02-26 02:00 - 2012-06-26 10:18 - 00000000 ____D C:\Users\masekv\AppData\Local\Adobe
2016-02-26 01:30 - 2012-07-02 22:26 - 00000000 ____D C:\Users\masekv\AppData\Local\ElevatedDiagnostics
2016-02-25 22:38 - 2012-09-08 18:58 - 00000000 ____D C:\Quarantine
2016-02-25 22:20 - 2009-07-14 06:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
2016-02-25 22:19 - 2012-06-25 09:11 - 00001389 _____ C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-02-25 22:18 - 2012-06-25 09:11 - 00000000 ___RD C:\Users\masekv\Virtual Machines
2016-02-25 22:18 - 2009-07-14 05:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-02-25 22:11 - 2015-11-23 07:49 - 00007607 _____ C:\Users\masekv\AppData\Local\Resmon.ResmonCfg
2016-02-25 21:05 - 2011-11-10 12:23 - 00000224 _____ C:\windows\system32\config\netlogon.ftl
2016-02-25 17:21 - 2014-11-10 23:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-02-24 19:06 - 2013-01-22 20:39 - 00000000 ____D C:\Users\masekv\AppData\Roaming\dvdcss
2016-02-24 18:27 - 2011-08-12 05:00 - 00718866 _____ C:\windows\system32\perfh005.dat
2016-02-24 18:27 - 2011-08-12 05:00 - 00160232 _____ C:\windows\system32\perfc005.dat
2016-02-24 18:27 - 2009-07-14 06:13 - 01718940 _____ C:\windows\system32\PerfStringBackup.INI
2016-02-24 18:27 - 2009-07-14 04:20 - 00000000 ____D C:\windows\inf
2016-02-19 00:50 - 2015-11-17 20:21 - 00000000 ____D C:\Users\masekv\Desktop\konferencewww
2016-02-18 19:33 - 2014-09-16 14:19 - 00000000 ____D C:\Users\masekv\.gimp-2.8
2016-02-18 19:00 - 2014-09-16 14:21 - 00000000 ____D C:\Users\masekv\AppData\Local\gtk-2.0
2016-02-18 18:52 - 2015-12-14 22:06 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-02-10 20:27 - 2012-05-24 09:23 - 00796864 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2016-02-10 20:27 - 2012-05-24 09:23 - 00003852 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2016-02-10 20:27 - 2011-12-27 18:57 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-02-09 16:43 - 2015-10-07 16:32 - 00000000 ____D C:\Users\masekv\Downloads\bo videa
2016-02-06 21:46 - 2015-01-26 17:04 - 00000000 ____D C:\windows\system32\appraiser
2016-02-06 21:46 - 2014-04-26 15:01 - 00000000 ___SD C:\windows\system32\CompatTel
2016-02-05 21:28 - 2012-07-14 19:46 - 00000000 ____D C:\Users\masekv\AppData\Roaming\vlc
2016-02-03 19:53 - 2013-01-27 19:29 - 00000000 ____D C:\Users\masekv\Downloads\boruvka pisnicky
2016-02-02 19:24 - 2012-07-08 20:51 - 00000000 ____D C:\Users\masekv\Documents\Moje dokumenty
2016-02-01 21:24 - 2012-07-14 21:28 - 00003948 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-02-01 21:24 - 2012-07-14 21:28 - 00003696 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-01-29 22:21 - 2014-02-02 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-01-29 22:20 - 2014-02-02 16:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-01-29 22:20 - 2014-02-02 16:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-01-29 22:13 - 2009-07-14 03:34 - 00000530 _____ C:\windows\win.ini
2016-01-29 22:01 - 2014-01-05 18:06 - 00003192 _____ C:\windows\System32\Tasks\HPCeeScheduleFormasekv
2016-01-29 22:01 - 2014-01-05 18:06 - 00000336 _____ C:\windows\Tasks\HPCeeScheduleFormasekv.job
2016-01-27 00:06 - 2015-03-12 22:00 - 00849049 _____ C:\Users\masekv\Desktop\Noclaud regiomeeting březen15.pptx
==================== Files in the root of some directories =======
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Quartz Composer
2015-01-17 20:11 - 2015-01-17 20:11 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Radio Sounds
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Receipts
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Sampler Instruments
2016-02-18 19:00 - 2016-02-18 19:00 - 0000864 _____ () C:\Users\masekv\AppData\Local\recently-used.xbel
2015-11-23 07:49 - 2016-02-25 22:11 - 0007607 _____ () C:\Users\masekv\AppData\Local\Resmon.ResmonCfg
2011-11-04 16:39 - 2011-11-04 16:39 - 0000120 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2015-01-17 20:10 - 2015-01-17 20:10 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2015-01-17 20:11 - 2015-01-17 20:11 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2015-01-17 20:10 - 2016-01-01 17:55 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2015-01-17 20:10 - 2016-01-01 17:56 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\ProgramData\Resources
2015-01-17 20:11 - 2015-01-17 20:11 - 0000268 ___RH () C:\ProgramData\Reverb
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\ProgramData\Robot
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\ProgramData\Scripts Menu
Some files in TEMP:
====================
C:\Users\egis\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\egis\AppData\Local\Temp\Resource.exe
C:\Users\egis\AppData\Local\Temp\sp54373.exe
C:\Users\egis\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\egis\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\masekv\AppData\Local\Temp\Browser_V5.5.10106.5_f_4674_(Build1601261105).exe
C:\Users\masekv\AppData\Local\Temp\gb2.exe
C:\Users\masekv\AppData\Local\Temp\gma.dll
C:\Users\masekv\AppData\Local\Temp\jre-8u73-windows-au.exe
C:\Users\masekv\AppData\Local\Temp\MSN96E4.exe
C:\Users\masekv\AppData\Local\Temp\ose00000.exe
C:\Users\masekv\AppData\Local\Temp\set.exe
C:\Users\masekv\AppData\Local\Temp\setup.exe
C:\Users\masekv\AppData\Local\Temp\{E638ABC1-0067-474b-A379-87CFE81E7848}.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\SysWOW64\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
==================== MBR and Partition Table ==================
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleFormasekv.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
AV: McAfee VirusScan Enterprise (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee VirusScan Enterprise Antispyware Module (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Host Intrusion Prevention Firewall (Disabled) {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\masekv\Desktop" je 253 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000001
==================== End Of Log ==============================
Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
čínsky virus
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
čínsky virus
- Přílohy
-
- Addition.rar
- (8.64 KiB) Staženo 92 x
-
Rudy
- Site Admin
- Příspěvky: 119673
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: čínsky virus
Zdravím!
Spusťte tuto utilitu:
Spusťte tuto utilitu:
Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: čínsky virus
Je to log, ktery se ukazal po restartu PC. Píšou nakonci "cleared, removed" 
prosím at mám vyhráno 
Vážím si vašeho času s takovými "odborníky" jako jsem já.
Vl.
# AdwCleaner v5.037 - Logfile created 29/02/2016 at 07:52:41
# Updated 28/02/2016 by Xplode
# Database : 2016-02-28.2 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : masekv - EPRW7HFN012
# Running from : C:\Users\masekv\Desktop\adwcleaner_5.037.exe
# Option : Clean
# Support : http://toolslib.net/forum
***** [ Services ] *****
[-] Service Deleted : ggbugreport
[-] Service Deleted : QiyiService
[-] Service Deleted : Winsere
***** [ Folders ] *****
[-] Folder Deleted : C:\ppsfile
[-] Folder Deleted : C:\qycache
[-] Folder Deleted : C:\Program Files (x86)\IQIYI Video
[-] Folder Deleted : C:\Program Files (x86)\SearchesToYesbnd
[-] Folder Deleted : C:\Program Files (x86)\Winsere
[-] Folder Deleted : C:\Program Files (x86)\WinTaske
[-] Folder Deleted : C:\ProgramData\apn
[-] Folder Deleted : C:\ProgramData\IQIYI Video
[-] Folder Deleted : C:\ProgramData\tencent
[-] Folder Deleted : C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[-] Folder Deleted : C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
[-] Folder Deleted : C:\Users\masekv\AppData\Local\SysassistByHotWheel
[-] Folder Deleted : C:\Users\masekv\AppData\Roaming\IQIYI Video
[-] Folder Deleted : C:\Users\masekv\AppData\Roaming\tencent
[-] Folder Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\爱奇艺
[-] Folder Deleted : C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\YourGSearchFinder_br
[-] Folder Deleted : C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
[#] Folder Deleted : C:\windows\SysNative\Tasks\WinTaske
***** [ Files ] *****
[-] File Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\爱奇艺PPS影音.LNK
[-] File Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\爱奇艺PPS影音.LNK
[-] File Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\爱奇艺PPS影音.LNK
[-] File Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\爱奇艺PPS影音.LNK
[-] File Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\爱奇艺PPS影音.LNK
[-] File Deleted : C:\Users\masekv\Desktop\爱奇艺PPS 影音.lnk
***** [ DLLs ] *****
***** [ Shortcuts ] *****
***** [ Scheduled tasks ] *****
[-] Task Deleted : WinTaske
***** [ Registry ] *****
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION [QyBrowser.exe]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION [QyClient.exe]
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PPStream.exe
[-] Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@iqiyi.com/npclient
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D879A501-50A7-BEFC-A4C5-32DC6E0CB208}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4DFC-959F-233651CC4D7F}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKCU\Software\BI
[-] Key Deleted : HKCU\Software\DAILYPCCLEAN
[-] Key Deleted : HKCU\Software\Microsoft\Tinstalls
[-] Key Deleted : HKCU\Software\PPStream
[-] Key Deleted : HKCU\Software\QiYi
[-] Key Deleted : HKCU\Software\QyGameClient
[-] Key Deleted : HKCU\Software\TutoTag
[-] Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
[-] Key Deleted : HKCU\Software\AppDataLow\Software\QiYi
[-] Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
[-] Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
[-] Key Deleted : HKLM\SOFTWARE\QiYi
[-] Key Deleted : HKLM\SOFTWARE\yessearchesSoftware
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PPStream
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{A3161860-EF84-43FC-810B-7C5AE6C4488D}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{61835AF8-ABE6-4F06-835C-8E27A96A4D6D}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{00B5D8A6-B6A4-4464-9F36-597A2DDD9685}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{004760CD-9EBB-4227-9892-662D7A0ABD47}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{0A8D3466-0CB0-4E37-840F-86417B053887}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{2307ECA8-F510-4E40-BD3F-3A4BAF076DF9}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{E005FFC3-382D-4775-B6C9-91565E89F5C8}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{F878D7F6-4C4D-4B45-BF75-18652CD1AF2F}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{F49D5C02-A922-47EA-8E6B-E590E223A4F7}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{E853BDC2-754F-49C2-894D-DE6DAB187D92}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{EAA79020-B5B3-46C1-A381-79A56B71A4DD}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{31CEB47D-4196-4550-B95E-2812B84A4A02}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{CCCD4337-A62E-466F-8EF2-0AA7B395B493}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{BB6C6014-80C5-44B7-9BFF-CAC06E2A7AD8}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{FA398831-16E5-46B3-B05B-09BB5F783A76}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{65FAF317-0554-4746-98D3-1E9AB9F553BB}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{554CE626-4BCB-4B15-B0BB-B56CC9FBE36E}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{D03FAE3A-7665-4C06-BFFD-A448BFCFDAB4}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{ADC21D68-220D-437A-9D0C-3C8E83D60527}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{4838D4A0-095B-42B3-8524-88FC236408A6}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{C311BC6C-F9E3-4038-984F-3FCB536D8C10}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{CD2D0057-4CB4-4B28-A809-A93D5A704A38}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{FD5C2095-4E14-4C1E-B10C-F3B82CE5524F}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{C0B5576C-C427-4564-94F4-62F9D1DF6465}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{2FE6E19D-9DE2-4C15-9929-4A730CA3CFD0}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{CD3608DD-0336-4356-A9DF-B28AFF1E24F1}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{ED66DF33-00D2-4990-ACE8-01F058DE11B0}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{8D2873B0-0F18-4D74-A311-2CF60962E63A}]
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
[-] Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [apphide]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [apphide]
[-] Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [HCDNClient]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [pcmgr]
***** [ Web browsers ] *****
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.newtab.url", "hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... ode=ffseng");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename", "yessearches");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename.US", "data:text/plain,browser.search.defaultenginename.US=yessearches");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.hp", "hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... =ffsengext");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.sp", "hxxp://www.yessearches.com/chrome.php?mode=ffs ... v=20160202");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.url", "hxxp://www.yessearches.com/chrome.php?mode=ffs ... v=20160202");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "yessearches");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.BUTTON_STRUCTURE", "[{\"b\":224520315,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224520316,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.browser.version.last", "43.0");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.firstKnownVersion", "7.38.8.45986");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.homepage", "/index.jhtml?n=782a1056");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.hp.enabled", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.hp.guardType", "HPR");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.initialized", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.installation.installDate", "2016022614");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.installation.success", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lastActivePing", "1456494783202");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lastKnownVersion", "7.38.8.45986");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lssState", "{\"previousLocales\":[\"cs\",\"en-US\",\"en\"],\"supportedLocales\":[\"de\",\"es\",\"pt\",\"ja\",\"en\"],\"defaultLocale\":\"en\",\"supp[...]
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.defaultSearch", false);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.homePageEnabled", false);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.keywordEnabled", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.tabEnabled", false);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.language", "en");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.type", "Toolbar");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.successUrl", "hxxp://www.yessearches.com/chrome.php?uid=6871 ... ttoolbar&q[...]
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.toolbarCollapsed", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.uninstallTasks", "{\"prefBranchesToDelete\":[\"extensions.toolbar.mindspark._brMembers_.\"],\"filesToDelete\":[\"C:\\\\Users\\\\masekv\\\\AppData\\\[...]
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "yourGSearchfinder@GSearch.com");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "yourGSearchfinder@GSearch.com");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("keyword.URL", "hxxp://www.yessearches.com/chrome.php?uid=6871 ... toolbar&q=");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.newtab.url", "hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... ode=ffseng");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename", "yessearches");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.hp", "hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... =ffsengext");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.sp", "hxxp://www.yessearches.com/chrome.php?mode=ffs ... v=20160202");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.url", "hxxp://www.yessearches.com/chrome.php?mode=ffs ... v=20160202");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "yessearches");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.startup.homepage", "hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... ode=ffseng");
[-] [C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : bannerzest-pro.en.softonic.com
*************************
:: "Tracing" keys removed
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C1].txt - [21427 bytes] - [29/02/2016 07:52:41]
C:\AdwCleaner\AdwCleaner[S1].txt - [20604 bytes] - [29/02/2016 07:48:30]
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [21575 bytes] ##########
prosím at mám vyhráno Vážím si vašeho času s takovými "odborníky" jako jsem já.
Vl.
# AdwCleaner v5.037 - Logfile created 29/02/2016 at 07:52:41
# Updated 28/02/2016 by Xplode
# Database : 2016-02-28.2 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : masekv - EPRW7HFN012
# Running from : C:\Users\masekv\Desktop\adwcleaner_5.037.exe
# Option : Clean
# Support : http://toolslib.net/forum
***** [ Services ] *****
[-] Service Deleted : ggbugreport
[-] Service Deleted : QiyiService
[-] Service Deleted : Winsere
***** [ Folders ] *****
[-] Folder Deleted : C:\ppsfile
[-] Folder Deleted : C:\qycache
[-] Folder Deleted : C:\Program Files (x86)\IQIYI Video
[-] Folder Deleted : C:\Program Files (x86)\SearchesToYesbnd
[-] Folder Deleted : C:\Program Files (x86)\Winsere
[-] Folder Deleted : C:\Program Files (x86)\WinTaske
[-] Folder Deleted : C:\ProgramData\apn
[-] Folder Deleted : C:\ProgramData\IQIYI Video
[-] Folder Deleted : C:\ProgramData\tencent
[-] Folder Deleted : C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[-] Folder Deleted : C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
[-] Folder Deleted : C:\Users\masekv\AppData\Local\SysassistByHotWheel
[-] Folder Deleted : C:\Users\masekv\AppData\Roaming\IQIYI Video
[-] Folder Deleted : C:\Users\masekv\AppData\Roaming\tencent
[-] Folder Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\爱奇艺
[-] Folder Deleted : C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\YourGSearchFinder_br
[-] Folder Deleted : C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
[#] Folder Deleted : C:\windows\SysNative\Tasks\WinTaske
***** [ Files ] *****
[-] File Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\爱奇艺PPS影音.LNK
[-] File Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\爱奇艺PPS影音.LNK
[-] File Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\爱奇艺PPS影音.LNK
[-] File Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\爱奇艺PPS影音.LNK
[-] File Deleted : C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\爱奇艺PPS影音.LNK
[-] File Deleted : C:\Users\masekv\Desktop\爱奇艺PPS 影音.lnk
***** [ DLLs ] *****
***** [ Shortcuts ] *****
***** [ Scheduled tasks ] *****
[-] Task Deleted : WinTaske
***** [ Registry ] *****
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION [QyBrowser.exe]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION [QyClient.exe]
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\PPStream.exe
[-] Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@iqiyi.com/npclient
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{307B3CDB-9EE3-4137-9D18-F9AD6537ECEB}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CF3CDEFB-31BE-43AE-B064-B9C62C883259}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D879A501-50A7-BEFC-A4C5-32DC6E0CB208}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B6360BD3-5CD0-40D3-BD87-DAFF37889F50}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E1D75F62-CBBD-45C7-9D1D-6B5ECEC2E006}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FB4F6285-4C32-49F2-950F-A5998F9CEC6C}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6BE0FB-8B18-4DFC-959F-233651CC4D7F}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BAC94FEE-45B4-4FD4-9EEA-D8978EC96C6E}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{085CB97F-6D0B-487D-B94C-E11A736C38CE}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E6A8DA1-1731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2E6A8DA1-2731-465B-B036-B9E16EF26CAC}
[-] Key Deleted : HKCU\Software\BI
[-] Key Deleted : HKCU\Software\DAILYPCCLEAN
[-] Key Deleted : HKCU\Software\Microsoft\Tinstalls
[-] Key Deleted : HKCU\Software\PPStream
[-] Key Deleted : HKCU\Software\QiYi
[-] Key Deleted : HKCU\Software\QyGameClient
[-] Key Deleted : HKCU\Software\TutoTag
[-] Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
[-] Key Deleted : HKCU\Software\AppDataLow\Software\QiYi
[-] Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
[-] Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
[-] Key Deleted : HKLM\SOFTWARE\QiYi
[-] Key Deleted : HKLM\SOFTWARE\yessearchesSoftware
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bi_uninstaller
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IQIYI Video
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PPStream
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{A3161860-EF84-43FC-810B-7C5AE6C4488D}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{61835AF8-ABE6-4F06-835C-8E27A96A4D6D}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{00B5D8A6-B6A4-4464-9F36-597A2DDD9685}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{004760CD-9EBB-4227-9892-662D7A0ABD47}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{0A8D3466-0CB0-4E37-840F-86417B053887}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{2307ECA8-F510-4E40-BD3F-3A4BAF076DF9}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{E005FFC3-382D-4775-B6C9-91565E89F5C8}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{F878D7F6-4C4D-4B45-BF75-18652CD1AF2F}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{F49D5C02-A922-47EA-8E6B-E590E223A4F7}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{E853BDC2-754F-49C2-894D-DE6DAB187D92}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{EAA79020-B5B3-46C1-A381-79A56B71A4DD}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{31CEB47D-4196-4550-B95E-2812B84A4A02}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{CCCD4337-A62E-466F-8EF2-0AA7B395B493}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{BB6C6014-80C5-44B7-9BFF-CAC06E2A7AD8}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{FA398831-16E5-46B3-B05B-09BB5F783A76}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{65FAF317-0554-4746-98D3-1E9AB9F553BB}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{554CE626-4BCB-4B15-B0BB-B56CC9FBE36E}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{D03FAE3A-7665-4C06-BFFD-A448BFCFDAB4}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{ADC21D68-220D-437A-9D0C-3C8E83D60527}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{4838D4A0-095B-42B3-8524-88FC236408A6}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{C311BC6C-F9E3-4038-984F-3FCB536D8C10}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{CD2D0057-4CB4-4B28-A809-A93D5A704A38}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{FD5C2095-4E14-4C1E-B10C-F3B82CE5524F}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{C0B5576C-C427-4564-94F4-62F9D1DF6465}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{2FE6E19D-9DE2-4C15-9929-4A730CA3CFD0}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{CD3608DD-0336-4356-A9DF-B28AFF1E24F1}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{ED66DF33-00D2-4990-ACE8-01F058DE11B0}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{8D2873B0-0F18-4D74-A311-2CF60962E63A}]
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
[-] Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [apphide]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [apphide]
[-] Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [HCDNClient]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [pcmgr]
***** [ Web browsers ] *****
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.newtab.url", "hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... ode=ffseng");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename", "yessearches");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename.US", "data:text/plain,browser.search.defaultenginename.US=yessearches");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.hp", "hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... =ffsengext");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.sp", "hxxp://www.yessearches.com/chrome.php?mode=ffs ... v=20160202");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.url", "hxxp://www.yessearches.com/chrome.php?mode=ffs ... v=20160202");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "yessearches");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.BUTTON_STRUCTURE", "[{\"b\":224520315,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224520316,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.browser.version.last", "43.0");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.firstKnownVersion", "7.38.8.45986");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.homepage", "/index.jhtml?n=782a1056");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.hp.enabled", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.hp.guardType", "HPR");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.initialized", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.installation.installDate", "2016022614");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.installation.success", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lastActivePing", "1456494783202");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lastKnownVersion", "7.38.8.45986");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lssState", "{\"previousLocales\":[\"cs\",\"en-US\",\"en\"],\"supportedLocales\":[\"de\",\"es\",\"pt\",\"ja\",\"en\"],\"defaultLocale\":\"en\",\"supp[...]
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.defaultSearch", false);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.homePageEnabled", false);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.keywordEnabled", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.tabEnabled", false);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.language", "en");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.type", "Toolbar");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.successUrl", "hxxp://www.yessearches.com/chrome.php?uid=6871 ... ttoolbar&q[...]
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.toolbarCollapsed", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.uninstallTasks", "{\"prefBranchesToDelete\":[\"extensions.toolbar.mindspark._brMembers_.\"],\"filesToDelete\":[\"C:\\\\Users\\\\masekv\\\\AppData\\\[...]
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "yourGSearchfinder@GSearch.com");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("extensions.toolbar.mindspark.lastInstalled", "yourGSearchfinder@GSearch.com");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\prefs.js] [Preference] Deleted : user_pref("keyword.URL", "hxxp://www.yessearches.com/chrome.php?uid=6871 ... toolbar&q=");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.newtab.url", "hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... ode=ffseng");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.defaultenginename", "yessearches");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.hp", "hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... =ffsengext");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.sp", "hxxp://www.yessearches.com/chrome.php?mode=ffs ... v=20160202");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.searchengine.url", "hxxp://www.yessearches.com/chrome.php?mode=ffs ... v=20160202");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.search.selectedEngine", "yessearches");
[-] [C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\CCACCBF1-7AB4-4CF5-B32D-668C686A539F\prefs.js] [Preference] Deleted : user_pref("browser.startup.homepage", "hxxp://www.yessearches.com/?ts=AHEpBXEnAnMkCE. ... ode=ffseng");
[-] [C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : bannerzest-pro.en.softonic.com
*************************
:: "Tracing" keys removed
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C1].txt - [21427 bytes] - [29/02/2016 07:52:41]
C:\AdwCleaner\AdwCleaner[S1].txt - [20604 bytes] - [29/02/2016 07:48:30]
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [21575 bytes] ##########
Re: čínsky virus
tak ted se mi nastartovala zas reklama vpravo dole a pusteny program winsafe(myslim) s chybovou hlaskou.
a jeste ted pribyl nejaky program do start nabidky...
a jeste ted pribyl nejaky program do start nabidky...
-
Rudy
- Site Admin
- Příspěvky: 119673
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: čínsky virus
Dejte nový log FRST.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: čínsky virus
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-02-2016
Ran by masekv (administrator) on EPRW7HFN012 (29-02-2016 17:41:26)
Running from C:\Users\masekv\Desktop
Loaded Profiles: masekv (Available Profiles: masekv & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apache Software Foundation) C:\Program Files (x86)\EasyPHP-12.1\apache\bin\apache.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(truconneXion, a. s.) C:\AuditPro\SCAN.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(McAfee, Inc.) C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe
(Apache Software Foundation) C:\Program Files (x86)\EasyPHP-12.1\apache\bin\apache.exe
(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IFXSPMGT.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IFXTCS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
() C:\Program Files (x86)\EasyPHP-12.1\mysql\bin\mysqld.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\Teamviewer\Version5\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(ArcSoft, Inc.) C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
() C:\Windows\SoftwareProtection\systemvital.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
(TODO: <公司名>) C:\Program Files (x86)\winsafe\winsafe.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(TODO: <公司名>) C:\Program Files (x86)\winsafe\winsafe.exe
() C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\PSDrt.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\McTray.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSDKHelperx64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\McScript_InUse.exe
(forum.viry.cz) C:\Users\masekv\Desktop\FRSTLauncher.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2919992 2011-01-27] (Hewlett-Packard Company)
HKLM\...\Run: [MfeEpePcMonitor] => C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe [200704 2011-02-09] ()
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [McAfee Host Intrusion Prevention Tray] => C:\Program Files\McAfee\Host Intrusion Prevention\FireTray.exe [255640 2010-12-20] (McAfee, Inc.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2013-06-08] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3011824 2013-06-15] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-23] (Apple Inc.)
HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [514544 2011-01-12] ()
HKLM-x32\...\Run: [File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-03] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] => c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [HPConnectionManager] => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-04-05] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [HPQuickWebProxy] => c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [76344 2011-02-11] (Hewlett-Packard Company)
HKLM-x32\...\Run: [IFXSPMGT] => c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe [1125728 2011-01-20] (Infineon Technologies AG)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-05-06] (PDF Complete Inc)
HKLM-x32\...\Run: [HPUsageTrackingLEDM] => C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)
HKLM-x32\...\Run: [ShStatEXE] => C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE [244080 2015-08-20] (McAfee, Inc.)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [312376 2011-03-21] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)
HKLM-x32\...\Run: [McAfeeUpdaterUI] => C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe [337776 2015-02-10] (McAfee, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [gmsd_re_021010249] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [594992 2016-01-29] (Oracle Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [] => [X]
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [system34] => C:\windows\SoftwareProtection\systemvital.exe [624608 2013-01-23] ()
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673696 2013-08-01] (Disc Soft Ltd)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-07-13] (TomTom)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [60688 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [103696 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [349968 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [winsafe] => C:\Program Files (x86)\winsafe\winsafe.exe [3302912 2016-02-24] (TODO: <公司名>)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\MountPoints2: {947e3d3a-2488-11e3-8e07-402cf417409c} - G:\SETUP.EXE
Lsa: [Notification Packages] EpePcNp64 DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2011-08-12]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{03D1F58F-0CAC-4459-A02C-27C2654B0582}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{1A6A6104-BFC2-454C-9D89-1433B252FA81}: [DhcpNameServer] 213.46.172.37 213.46.172.36
Tcpip\..\Interfaces\{A966572D-083C-42F4-86D7-3EFCDA8BE685}: [DhcpNameServer] 10.212.1.16 10.212.1.3
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.bing.com?pc=CMNTDF
SearchScopes: HKLM -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKU\S-1-5-21-1801674531-606747145-2147026105-5754 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL =
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20150922213547.dll [2015-09-22] (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll [2011-02-07] (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-02-26] (Oracle Corporation)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20150922213553.dll [2015-09-22] (McAfee, Inc.)
BHO-x32: No Name -> {83B80A9C-D91A-4F22-8DCF-EA7204039F79} -> No File
BHO-x32: Pomocná služba pro přihlášení k účtu Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-26] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
FireFox:
========
FF ProfilePath: C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1
FF Homepage: hxxps://www.google.cz
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_20_0_0_306.dll [2016-02-10] ()
FF Plugin: @iqiyi.com/npclient -> C:\Program Files (x86)\IQIYI Video\LStyle\npclient.dll [No File]
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-10] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-02-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-02-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin -> C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll [2012-10-13] ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1801674531-606747145-2147026105-5754: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\masekv\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-08-18] (Unity Technologies ApS)
FF user.js: detected! => C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\091i76kz.default\user.js [2016-02-26]
FF user.js: detected! => C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\user.js [2016-02-26]
FF SearchPlugin: C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\searchplugins\DD1B66D4.xml [2016-02-25]
FF Extension: Firebug - C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\091i76kz.default\Extensions\firebug@software.joehewitt.com.xpi [2016-02-08]
FF Extension: GsearchFinder - C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi [2016-02-02]
FF Extension: Firebug - C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\firebug@software.joehewitt.com.xpi [2016-02-08]
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2011-08-12] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: McAfee ScriptScan for Firefox - C:\Program Files (x86)\Common Files\McAfee\SystemCore [2015-09-23] [not signed]
Chrome:
=======
CHR Profile: C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-26]
CHR Extension: (Disk Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-26]
CHR Extension: (YouTube) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-26]
CHR Extension: (Vyhledávání Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-26]
CHR Extension: (Lumin - Best Document Viewer) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbkidnlfklnjanneifjjojofckpcogcl [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dblpoacaeekoaelbbahfdgjfohpapkgh [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhipmoghimfdldnocmopeoanjmoolofl [2016-02-26]
CHR Extension: (Leafly) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpmboknidiiemiokdpihmmfokoljfamo [2016-02-26]
CHR Extension: (Gmail Offline) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-02-29]
CHR Extension: (Král Crash) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\gnhnlfnigjjkiphcnbnpedcpfoggjhba [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\haebnnbpedcbhciplfhjjkbafijpncjl [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcpejamelebpigblebnbabhndaaffjok [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljgpiikiibdligadiaifmdemkbkahfnf [2016-02-26]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-02-26]
CHR Extension: (\) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\picpigdgdkaekefkpcaenndmjhibibnk [2016-02-26]
CHR Extension: (Gmail) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-26]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apache2.2; C:\Program Files (x86)\EasyPHP-12.1\apache\bin\apache.exe [20992 2012-04-21] (Apache Software Foundation) [File not signed]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)
R2 AuditPro Scan; C:\AuditPro\Scan.exe [2623808 2015-03-03] (truconneXion, a. s.)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [481104 2011-02-12] (DigitalPersona, Inc.)
R2 enterceptAgent; C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe [640312 2010-12-20] (McAfee, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [464480 2011-02-03] (Hewlett-Packard Company)
R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [File not signed]
R3 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2011-01-12] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [133688 2011-01-28] (Hewlett-Packard Company)
R2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [320000 2011-02-07] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [293944 2011-03-21] (Hewlett-Packard Company)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IFXSpMgtSrv; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe [1125728 2011-01-20] (Infineon Technologies AG)
R2 IFXTCS; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxtcs.exe [980320 2011-01-20] (Infineon Technologies AG)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
R2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1318912 2011-02-09] () [File not signed]
R2 McAfeeFramework; C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [129904 2015-02-10] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [262544 2015-09-22] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe [208936 2015-08-20] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [203104 2010-11-23] (McAfee, Inc.)
R2 mfevtp; C:\windows\system32\mfevtps.exe [254792 2015-09-22] (McAfee, Inc.)
R2 MSSQL$PHARMSYS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MySQL; C:\Program Files (x86)\EasyPHP-12.1\mysql\bin\mysqld.exe [8186368 2012-07-20] () [File not signed]
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-05-06] (PDF Complete Inc)
R2 PersonalSecureDriveService; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe [203104 2011-01-20] (Infineon Technologies AG)
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2013-01-23] ()
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [336824 2010-11-30] (arvato digital services llc)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [323072 2013-06-08] (IDT, Inc.) [File not signed]
R2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Bonjour Service; C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)
S3 Axtmvflt; C:\Windows\System32\DRIVERS\Axtmvflt.sys [6144 2007-03-26] (Axesstel)
S3 Axtmvmdm; C:\Windows\System32\DRIVERS\Axtmvmdm.sys [54272 2007-03-26] (Axesstel)
S3 Axtmvprt; C:\Windows\System32\Drivers\Axtmvprt.sys [52224 2007-03-26] (Axesstel)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [63336 2011-02-07] (Hewlett-Packard Company)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-09-26] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 FireNfcp; C:\Windows\System32\drivers\FireNfcp.sys [48840 2011-10-06] (McAfee, Inc.)
R3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [195280 2010-12-20] (McAfee, Inc.)
R3 johci; C:\Windows\System32\DRIVERS\johci.sys [26208 2013-06-08] (JMicron Technology Corp.)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [412440 2015-09-22] (McAfee, Inc.)
R3 mfeaacsk; C:\Windows\System32\drivers\mfeaacsk.sys [64416 2015-09-22] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [192512 2015-08-26] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [347800 2015-09-22] (McAfee, Inc.)
U3 mfeavfk01; no ImagePath
R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [168008 2011-02-09] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [496888 2015-09-22] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [875928 2015-09-22] (McAfee, Inc.)
R1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [74904 2010-11-28] (McAfee, Inc.)
R3 mfeplk; C:\Windows\System32\drivers\mfeplk.sys [66080 2015-09-22] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [114880 2015-09-22] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [344704 2015-09-22] (McAfee, Inc.)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2011-04-27] (Marvell Semiconductor, Inc.)
R1 PersonalSecureDrive; C:\Windows\System32\drivers\psd.sys [44576 2010-01-26] (Infineon Technologies AG)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1826048 2010-12-21] ()
S3 NPF; system32\drivers\NPF.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-02-29 17:41 - 2016-02-29 17:42 - 00033573 _____ C:\Users\masekv\Desktop\FRST.txt
2016-02-29 07:48 - 2016-02-29 07:52 - 00000000 ____D C:\AdwCleaner
2016-02-29 07:46 - 2016-02-29 07:47 - 01518592 _____ C:\Users\masekv\Desktop\adwcleaner_5.037.exe
2016-02-26 20:34 - 2016-02-29 17:41 - 00000000 ____D C:\FRST
2016-02-26 20:32 - 2016-02-26 20:32 - 00112640 _____ (forum.viry.cz) C:\Users\masekv\Desktop\FRSTLauncher.exe
2016-02-26 20:30 - 2016-02-26 20:30 - 02371072 _____ (Farbar) C:\Users\masekv\Desktop\FRST64.exe
2016-02-26 20:12 - 2016-02-26 20:12 - 00000046 _____ C:\Users\masekv\FunShion.ini
2016-02-26 19:39 - 2016-02-26 19:39 - 00002284 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-02-26 19:39 - 2016-02-26 19:39 - 00002255 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-02-26 19:36 - 2016-02-26 19:37 - 00987728 _____ (Google Inc.) C:\Users\masekv\Downloads\ChromeSetup.exe
2016-02-26 14:50 - 2016-02-26 19:50 - 01396216 _____ (苏州聚和网络科技有限公司) C:\windows\SysWOW64\xy.exe
2016-02-26 14:50 - 2016-02-26 19:50 - 01067320 _____ (9377, Inc.) C:\windows\SysWOW64\ht.exe
2016-02-26 08:46 - 2016-02-26 08:46 - 00000000 ____D C:\Users\masekv\AppData\LocalLow\VirtualStore
2016-02-26 08:46 - 2016-02-26 08:46 - 00000000 ____D C:\Users\masekv\.android
2016-02-26 07:21 - 2016-02-26 07:21 - 00000000 ____D C:\Users\Public\QiYi
2016-02-26 07:21 - 2016-02-26 07:21 - 00000000 ____D C:\Users\masekv\AppData\LocalLow\Unity
2016-02-26 07:21 - 2016-02-26 07:21 - 00000000 ____D C:\Users\masekv\AppData\Local\Unity
2016-02-25 22:40 - 2016-02-26 19:51 - 40657864 _____ (爱奇艺) C:\windows\SysWOW64\pps.exe
2016-02-25 22:20 - 2016-02-29 14:59 - 00000000 _____ C:\windows\SysWOW64\lock.dat
2016-02-25 22:20 - 2016-02-25 22:20 - 00000000 _____ C:\windows\SysWOW64\in.dat
2016-02-25 22:19 - 2016-02-25 22:19 - 00001423 _____ C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-02-25 21:55 - 2016-02-25 22:12 - 00000000 ____D C:\Users\masekv\AppData\Local\3810282D-6C19-47B0-8283-5C6C29A7E108
2016-02-25 21:51 - 2016-02-25 21:53 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-02-25 21:50 - 2016-02-26 20:12 - 00000000 ____D C:\Program Files (x86)\winsafe
2016-02-25 21:46 - 2016-02-26 06:56 - 00000000 ____D C:\Users\masekv\AppData\Roaming\Seznam.cz
2016-02-25 21:33 - 2016-02-25 21:33 - 00000000 ____D C:\Users\masekv\Documents\Aquafadas
2016-02-25 21:09 - 2016-02-25 21:09 - 00000000 ____D C:\ProgramData\IsolatedStorage
2016-02-25 20:54 - 2016-02-25 20:54 - 17334952 _____ C:\Users\masekv\Downloads\BannerZest_Setup.exe
2016-02-25 20:45 - 2016-02-25 20:45 - 16399568 _____ (Devsoft, Inc ) C:\Users\masekv\Downloads\BannerEffectTrial.exe
2016-02-23 18:41 - 2016-02-23 18:42 - 00001209 _____ C:\Users\masekv\Downloads\Seznam_zasilek_detaily.csv
2016-02-19 00:08 - 2016-02-21 22:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-02-18 19:00 - 2016-02-18 19:00 - 00000864 _____ C:\Users\masekv\AppData\Local\recently-used.xbel
2016-02-14 10:25 - 2016-02-14 10:25 - 00186048 _____ C:\Users\masekv\Desktop\Husa 86x140.pdf
2016-02-11 19:28 - 2016-02-11 19:28 - 00000000 ____D C:\Users\masekv\AppData\LocalLow\Temp
2016-02-05 07:27 - 2016-01-16 20:06 - 00025024 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2016-02-05 07:27 - 2016-01-16 19:54 - 01162240 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2016-02-05 07:27 - 2016-01-11 20:05 - 03169792 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2016-02-05 07:27 - 2016-01-11 20:05 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2016-02-05 07:27 - 2016-01-11 20:05 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2016-02-05 07:27 - 2016-01-11 19:52 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2016-02-05 07:27 - 2016-01-11 19:47 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2016-02-05 07:27 - 2016-01-11 19:26 - 02610176 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2016-02-05 07:27 - 2016-01-11 19:24 - 00709120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2016-02-05 07:27 - 2016-01-11 19:23 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2016-02-05 07:27 - 2016-01-11 19:23 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2016-02-05 07:27 - 2016-01-11 19:23 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2016-02-05 07:27 - 2016-01-11 19:23 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2016-02-05 07:27 - 2016-01-11 19:23 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2016-02-05 07:27 - 2016-01-11 19:14 - 00573440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2016-02-05 07:27 - 2016-01-11 19:14 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2016-02-05 07:27 - 2016-01-11 19:14 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2016-02-05 07:27 - 2016-01-11 19:14 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 01362944 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00677376 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00499200 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2016-02-05 07:26 - 2016-01-22 07:19 - 14179840 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2016-02-05 07:26 - 2016-01-22 07:15 - 01866752 _____ (Microsoft Corporation) C:\windows\system32\ExplorerFrame.dll
2016-02-05 07:26 - 2016-01-22 07:12 - 01940992 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2016-02-05 07:26 - 2016-01-22 07:05 - 12877824 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2016-02-05 07:26 - 2016-01-22 07:00 - 01498624 _____ (Microsoft Corporation) C:\windows\SysWOW64\ExplorerFrame.dll
2016-02-05 07:26 - 2016-01-22 06:59 - 01805824 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2016-02-05 07:26 - 2016-01-22 06:19 - 03231232 _____ (Microsoft Corporation) C:\windows\explorer.exe
2016-02-05 07:26 - 2016-01-22 06:12 - 02973184 _____ (Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-02-29 17:39 - 2012-07-14 21:28 - 00000952 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-02-29 17:39 - 2012-05-24 09:23 - 00000914 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2016-02-29 15:01 - 2009-07-14 05:45 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-02-29 15:01 - 2009-07-14 05:45 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-02-29 15:00 - 2014-12-26 13:03 - 00000000 ___RD C:\Users\masekv\iCloudDrive
2016-02-29 14:59 - 2012-07-14 21:28 - 00000948 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-02-29 14:53 - 2011-08-12 04:48 - 00000000 ____D C:\ProgramData\PDFC
2016-02-29 14:53 - 2011-08-12 04:44 - 00000000 ____D C:\ProgramData\HPQLOG
2016-02-29 14:51 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-02-29 07:58 - 2009-07-14 05:45 - 00484744 _____ C:\windows\system32\FNTCACHE.DAT
2016-02-29 07:42 - 2014-01-05 18:06 - 00003192 _____ C:\windows\System32\Tasks\HPCeeScheduleFormasekv
2016-02-29 07:42 - 2014-01-05 18:06 - 00000336 _____ C:\windows\Tasks\HPCeeScheduleFormasekv.job
2016-02-27 23:04 - 2012-07-14 19:46 - 00000000 ____D C:\Users\masekv\AppData\Roaming\vlc
2016-02-27 18:40 - 2011-08-12 05:00 - 00718866 _____ C:\windows\system32\perfh005.dat
2016-02-27 18:40 - 2011-08-12 05:00 - 00160232 _____ C:\windows\system32\perfc005.dat
2016-02-27 18:40 - 2009-07-14 06:13 - 01718940 _____ C:\windows\system32\PerfStringBackup.INI
2016-02-27 18:40 - 2009-07-14 04:20 - 00000000 ____D C:\windows\inf
2016-02-27 09:02 - 2012-06-26 10:18 - 00000000 ____D C:\Users\masekv\AppData\Local\Adobe
2016-02-26 22:08 - 2012-07-02 22:26 - 00000000 ____D C:\Users\masekv\AppData\Local\ElevatedDiagnostics
2016-02-26 20:28 - 2014-11-25 16:58 - 00000000 ____D C:\Users\masekv\Documents\Soukromy
2016-02-26 20:27 - 2012-06-25 09:11 - 00127376 _____ C:\Users\masekv\AppData\Local\GDIPFONTCACHEV1.DAT
2016-02-26 20:12 - 2012-06-25 09:10 - 00000000 ____D C:\Users\masekv
2016-02-26 19:52 - 2015-04-02 21:40 - 00000000 ____D C:\Program Files (x86)\Safari
2016-02-26 19:39 - 2012-06-27 08:24 - 00000000 ____D C:\Users\masekv\AppData\Local\Google
2016-02-26 19:38 - 2011-12-27 18:57 - 00000000 ____D C:\Program Files (x86)\Google
2016-02-26 17:39 - 2011-08-12 04:37 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-02-26 07:12 - 2013-12-07 13:51 - 00000000 ____D C:\ProgramData\Oracle
2016-02-26 07:09 - 2014-10-29 21:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-02-26 07:09 - 2013-12-07 13:50 - 00000000 ____D C:\Program Files (x86)\Java
2016-02-26 07:07 - 2015-08-28 08:21 - 00000000 ____D C:\Users\masekv\.oracle_jre_usage
2016-02-26 07:07 - 2014-10-29 21:23 - 00097888 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2016-02-26 06:54 - 2014-11-10 23:40 - 00001873 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-02-26 06:52 - 2011-08-12 04:58 - 00000000 ____D C:\Program Files (x86)\Bing Bar Installer
2016-02-26 06:50 - 2012-06-27 08:23 - 00000000 ____D C:\Users\masekv\AppData\Local\Deployment
2016-02-25 22:38 - 2012-09-08 18:58 - 00000000 ____D C:\Quarantine
2016-02-25 22:20 - 2009-07-14 06:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
2016-02-25 22:19 - 2012-06-25 09:11 - 00001389 _____ C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-02-25 22:18 - 2012-06-25 09:11 - 00000000 ___RD C:\Users\masekv\Virtual Machines
2016-02-25 22:18 - 2009-07-14 05:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-02-25 22:11 - 2015-11-23 07:49 - 00007607 _____ C:\Users\masekv\AppData\Local\Resmon.ResmonCfg
2016-02-25 21:05 - 2011-11-10 12:23 - 00000224 _____ C:\windows\system32\config\netlogon.ftl
2016-02-25 17:21 - 2014-11-10 23:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-02-24 19:06 - 2013-01-22 20:39 - 00000000 ____D C:\Users\masekv\AppData\Roaming\dvdcss
2016-02-19 00:50 - 2015-11-17 20:21 - 00000000 ____D C:\Users\masekv\Desktop\konferencewww
2016-02-18 19:33 - 2014-09-16 14:19 - 00000000 ____D C:\Users\masekv\.gimp-2.8
2016-02-18 19:00 - 2014-09-16 14:21 - 00000000 ____D C:\Users\masekv\AppData\Local\gtk-2.0
2016-02-18 18:52 - 2015-12-14 22:06 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-02-10 20:27 - 2012-05-24 09:23 - 00796864 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2016-02-10 20:27 - 2012-05-24 09:23 - 00003852 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2016-02-10 20:27 - 2011-12-27 18:57 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-02-09 16:43 - 2015-10-07 16:32 - 00000000 ____D C:\Users\masekv\Downloads\bo videa
2016-02-06 21:46 - 2015-01-26 17:04 - 00000000 ____D C:\windows\system32\appraiser
2016-02-06 21:46 - 2014-04-26 15:01 - 00000000 ___SD C:\windows\system32\CompatTel
2016-02-03 19:53 - 2013-01-27 19:29 - 00000000 ____D C:\Users\masekv\Downloads\boruvka pisnicky
2016-02-02 19:24 - 2012-07-08 20:51 - 00000000 ____D C:\Users\masekv\Documents\Moje dokumenty
2016-02-01 21:24 - 2012-07-14 21:28 - 00003948 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-02-01 21:24 - 2012-07-14 21:28 - 00003696 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
==================== Files in the root of some directories =======
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Quartz Composer
2015-01-17 20:11 - 2015-01-17 20:11 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Radio Sounds
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Receipts
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Sampler Instruments
2016-02-18 19:00 - 2016-02-18 19:00 - 0000864 _____ () C:\Users\masekv\AppData\Local\recently-used.xbel
2015-11-23 07:49 - 2016-02-25 22:11 - 0007607 _____ () C:\Users\masekv\AppData\Local\Resmon.ResmonCfg
2011-11-04 16:39 - 2011-11-04 16:39 - 0000120 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2015-01-17 20:10 - 2015-01-17 20:10 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2015-01-17 20:11 - 2015-01-17 20:11 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2015-01-17 20:10 - 2016-01-01 17:55 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2015-01-17 20:10 - 2016-01-01 17:56 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\ProgramData\Resources
2015-01-17 20:11 - 2015-01-17 20:11 - 0000268 ___RH () C:\ProgramData\Reverb
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\ProgramData\Robot
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\ProgramData\Scripts Menu
Some files in TEMP:
====================
C:\Users\egis\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\egis\AppData\Local\Temp\Resource.exe
C:\Users\egis\AppData\Local\Temp\sp54373.exe
C:\Users\egis\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\egis\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\masekv\AppData\Local\Temp\Browser_V5.5.10106.5_f_4674_(Build1601261105).exe
C:\Users\masekv\AppData\Local\Temp\gb2.exe
C:\Users\masekv\AppData\Local\Temp\gma.dll
C:\Users\masekv\AppData\Local\Temp\jre-8u73-windows-au.exe
C:\Users\masekv\AppData\Local\Temp\MSN96E4.exe
C:\Users\masekv\AppData\Local\Temp\ose00000.exe
C:\Users\masekv\AppData\Local\Temp\set.exe
C:\Users\masekv\AppData\Local\Temp\setup.exe
C:\Users\masekv\AppData\Local\Temp\sqlite3.dll
C:\Users\masekv\AppData\Local\Temp\{E638ABC1-0067-474b-A379-87CFE81E7848}.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\SysWOW64\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
==================== MBR and Partition Table ==================
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleFormasekv.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
AV: McAfee VirusScan Enterprise (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee VirusScan Enterprise Antispyware Module (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Host Intrusion Prevention Firewall (Enabled) {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\masekv\Desktop" je 254 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000001
==================== End Of Log ==============================
Ran by masekv (administrator) on EPRW7HFN012 (29-02-2016 17:41:26)
Running from C:\Users\masekv\Desktop
Loaded Profiles: masekv (Available Profiles: masekv & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apache Software Foundation) C:\Program Files (x86)\EasyPHP-12.1\apache\bin\apache.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(truconneXion, a. s.) C:\AuditPro\SCAN.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(McAfee, Inc.) C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe
(Apache Software Foundation) C:\Program Files (x86)\EasyPHP-12.1\apache\bin\apache.exe
(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(HP) C:\Windows\System32\HPSIsvc.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IFXSPMGT.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IFXTCS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\VirusScan Enterprise\mfeann.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
() C:\Program Files (x86)\EasyPHP-12.1\mysql\bin\mysqld.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\Teamviewer\Version5\TeamViewer_Service.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(ArcSoft, Inc.) C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
() C:\Windows\SoftwareProtection\systemvital.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
(TODO: <公司名>) C:\Program Files (x86)\winsafe\winsafe.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(TODO: <公司名>) C:\Program Files (x86)\winsafe\winsafe.exe
() C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
(Infineon Technologies AG) C:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\PSDrt.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\McTray.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSDKHelperx64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\Common Framework\McScript_InUse.exe
(forum.viry.cz) C:\Users\masekv\Desktop\FRSTLauncher.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2919992 2011-01-27] (Hewlett-Packard Company)
HKLM\...\Run: [MfeEpePcMonitor] => C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe [200704 2011-02-09] ()
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [McAfee Host Intrusion Prevention Tray] => C:\Program Files\McAfee\Host Intrusion Prevention\FireTray.exe [255640 2010-12-20] (McAfee, Inc.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2013-06-08] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3011824 2013-06-15] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-23] (Apple Inc.)
HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [514544 2011-01-12] ()
HKLM-x32\...\Run: [File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-03] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] => c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [HPConnectionManager] => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-04-05] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [HPQuickWebProxy] => c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [76344 2011-02-11] (Hewlett-Packard Company)
HKLM-x32\...\Run: [IFXSPMGT] => c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe [1125728 2011-01-20] (Infineon Technologies AG)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-05-06] (PDF Complete Inc)
HKLM-x32\...\Run: [HPUsageTrackingLEDM] => C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)
HKLM-x32\...\Run: [ShStatEXE] => C:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE [244080 2015-08-20] (McAfee, Inc.)
HKLM-x32\...\Run: [QLBController] => C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [312376 2011-03-21] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)
HKLM-x32\...\Run: [McAfeeUpdaterUI] => C:\Program Files (x86)\McAfee\Common Framework\udaterui.exe [337776 2015-02-10] (McAfee, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM-x32\...\Run: [gmsd_re_021010249] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [594992 2016-01-29] (Oracle Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [] => [X]
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [system34] => C:\windows\SoftwareProtection\systemvital.exe [624608 2013-01-23] ()
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673696 2013-08-01] (Disc Soft Ltd)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-07-13] (TomTom)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [60688 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [103696 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [349968 2015-10-21] (Apple Inc.)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [winsafe] => C:\Program Files (x86)\winsafe\winsafe.exe [3302912 2016-02-24] (TODO: <公司名>)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\MountPoints2: {947e3d3a-2488-11e3-8e07-402cf417409c} - G:\SETUP.EXE
Lsa: [Notification Packages] EpePcNp64 DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2011-08-12]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{03D1F58F-0CAC-4459-A02C-27C2654B0582}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{1A6A6104-BFC2-454C-9D89-1433B252FA81}: [DhcpNameServer] 213.46.172.37 213.46.172.36
Tcpip\..\Interfaces\{A966572D-083C-42F4-86D7-3EFCDA8BE685}: [DhcpNameServer] 10.212.1.16 10.212.1.3
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.bing.com?pc=CMNTDF
SearchScopes: HKLM -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKU\S-1-5-21-1801674531-606747145-2147026105-5754 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL =
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20150922213547.dll [2015-09-22] (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll [2011-02-07] (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-02-26] (Oracle Corporation)
BHO-x32: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20150922213553.dll [2015-09-22] (McAfee, Inc.)
BHO-x32: No Name -> {83B80A9C-D91A-4F22-8DCF-EA7204039F79} -> No File
BHO-x32: Pomocná služba pro přihlášení k účtu Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-26] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
FireFox:
========
FF ProfilePath: C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1
FF Homepage: hxxps://www.google.cz
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_20_0_0_306.dll [2016-02-10] ()
FF Plugin: @iqiyi.com/npclient -> C:\Program Files (x86)\IQIYI Video\LStyle\npclient.dll [No File]
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-10] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-02-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-02-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin -> C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll [2012-10-13] ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-01] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1801674531-606747145-2147026105-5754: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\masekv\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-08-18] (Unity Technologies ApS)
FF user.js: detected! => C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\091i76kz.default\user.js [2016-02-26]
FF user.js: detected! => C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\user.js [2016-02-26]
FF SearchPlugin: C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\searchplugins\DD1B66D4.xml [2016-02-25]
FF Extension: Firebug - C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\091i76kz.default\Extensions\firebug@software.joehewitt.com.xpi [2016-02-08]
FF Extension: GsearchFinder - C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi [2016-02-02]
FF Extension: Firebug - C:\Users\masekv\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\firebug@software.joehewitt.com.xpi [2016-02-08]
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2011-08-12] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: McAfee ScriptScan for Firefox - C:\Program Files (x86)\Common Files\McAfee\SystemCore [2015-09-23] [not signed]
Chrome:
=======
CHR Profile: C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-26]
CHR Extension: (Disk Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-26]
CHR Extension: (YouTube) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-26]
CHR Extension: (Vyhledávání Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-26]
CHR Extension: (Lumin - Best Document Viewer) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbkidnlfklnjanneifjjojofckpcogcl [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dblpoacaeekoaelbbahfdgjfohpapkgh [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhipmoghimfdldnocmopeoanjmoolofl [2016-02-26]
CHR Extension: (Leafly) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpmboknidiiemiokdpihmmfokoljfamo [2016-02-26]
CHR Extension: (Gmail Offline) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-02-29]
CHR Extension: (Král Crash) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\gnhnlfnigjjkiphcnbnpedcpfoggjhba [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\haebnnbpedcbhciplfhjjkbafijpncjl [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcpejamelebpigblebnbabhndaaffjok [2016-02-26]
CHR Extension: (Prezentace Google) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljgpiikiibdligadiaifmdemkbkahfnf [2016-02-26]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-02-26]
CHR Extension: (\) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\picpigdgdkaekefkpcaenndmjhibibnk [2016-02-26]
CHR Extension: (Gmail) - C:\Users\masekv\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-26]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apache2.2; C:\Program Files (x86)\EasyPHP-12.1\apache\bin\apache.exe [20992 2012-04-21] (Apache Software Foundation) [File not signed]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)
R2 AuditPro Scan; C:\AuditPro\Scan.exe [2623808 2015-03-03] (truconneXion, a. s.)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [481104 2011-02-12] (DigitalPersona, Inc.)
R2 enterceptAgent; C:\Program Files\McAfee\Host Intrusion Prevention\FireSvc.exe [640312 2010-12-20] (McAfee, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [464480 2011-02-03] (Hewlett-Packard Company)
R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [File not signed]
R3 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2011-01-12] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [133688 2011-01-28] (Hewlett-Packard Company)
R2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [320000 2011-02-07] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [293944 2011-03-21] (Hewlett-Packard Company)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IFXSpMgtSrv; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxspmgt.exe [1125728 2011-01-20] (Infineon Technologies AG)
R2 IFXTCS; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\ifxtcs.exe [980320 2011-01-20] (Infineon Technologies AG)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-05-19] (Hewlett-Packard Company) [File not signed]
R2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1318912 2011-02-09] () [File not signed]
R2 McAfeeFramework; C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe [129904 2015-02-10] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [262544 2015-09-22] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe [208936 2015-08-20] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [203104 2010-11-23] (McAfee, Inc.)
R2 mfevtp; C:\windows\system32\mfevtps.exe [254792 2015-09-22] (McAfee, Inc.)
R2 MSSQL$PHARMSYS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MySQL; C:\Program Files (x86)\EasyPHP-12.1\mysql\bin\mysqld.exe [8186368 2012-07-20] () [File not signed]
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-05-06] (PDF Complete Inc)
R2 PersonalSecureDriveService; c:\Program Files (x86)\Hewlett-Packard\Embedded Security Software\IfxPsdSv.exe [203104 2011-01-20] (Infineon Technologies AG)
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2013-01-23] ()
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [336824 2010-11-30] (arvato digital services llc)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [323072 2013-06-08] (IDT, Inc.) [File not signed]
R2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Bonjour Service; C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)
S3 Axtmvflt; C:\Windows\System32\DRIVERS\Axtmvflt.sys [6144 2007-03-26] (Axesstel)
S3 Axtmvmdm; C:\Windows\System32\DRIVERS\Axtmvmdm.sys [54272 2007-03-26] (Axesstel)
S3 Axtmvprt; C:\Windows\System32\Drivers\Axtmvprt.sys [52224 2007-03-26] (Axesstel)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [63336 2011-02-07] (Hewlett-Packard Company)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-09-26] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 FireNfcp; C:\Windows\System32\drivers\FireNfcp.sys [48840 2011-10-06] (McAfee, Inc.)
R3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [195280 2010-12-20] (McAfee, Inc.)
R3 johci; C:\Windows\System32\DRIVERS\johci.sys [26208 2013-06-08] (JMicron Technology Corp.)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [412440 2015-09-22] (McAfee, Inc.)
R3 mfeaacsk; C:\Windows\System32\drivers\mfeaacsk.sys [64416 2015-09-22] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [192512 2015-08-26] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [347800 2015-09-22] (McAfee, Inc.)
U3 mfeavfk01; no ImagePath
R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [168008 2011-02-09] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [496888 2015-09-22] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [875928 2015-09-22] (McAfee, Inc.)
R1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [74904 2010-11-28] (McAfee, Inc.)
R3 mfeplk; C:\Windows\System32\drivers\mfeplk.sys [66080 2015-09-22] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [114880 2015-09-22] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [344704 2015-09-22] (McAfee, Inc.)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2011-04-27] (Marvell Semiconductor, Inc.)
R1 PersonalSecureDrive; C:\Windows\System32\drivers\psd.sys [44576 2010-01-26] (Infineon Technologies AG)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1826048 2010-12-21] ()
S3 NPF; system32\drivers\NPF.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-02-29 17:41 - 2016-02-29 17:42 - 00033573 _____ C:\Users\masekv\Desktop\FRST.txt
2016-02-29 07:48 - 2016-02-29 07:52 - 00000000 ____D C:\AdwCleaner
2016-02-29 07:46 - 2016-02-29 07:47 - 01518592 _____ C:\Users\masekv\Desktop\adwcleaner_5.037.exe
2016-02-26 20:34 - 2016-02-29 17:41 - 00000000 ____D C:\FRST
2016-02-26 20:32 - 2016-02-26 20:32 - 00112640 _____ (forum.viry.cz) C:\Users\masekv\Desktop\FRSTLauncher.exe
2016-02-26 20:30 - 2016-02-26 20:30 - 02371072 _____ (Farbar) C:\Users\masekv\Desktop\FRST64.exe
2016-02-26 20:12 - 2016-02-26 20:12 - 00000046 _____ C:\Users\masekv\FunShion.ini
2016-02-26 19:39 - 2016-02-26 19:39 - 00002284 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-02-26 19:39 - 2016-02-26 19:39 - 00002255 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-02-26 19:36 - 2016-02-26 19:37 - 00987728 _____ (Google Inc.) C:\Users\masekv\Downloads\ChromeSetup.exe
2016-02-26 14:50 - 2016-02-26 19:50 - 01396216 _____ (苏州聚和网络科技有限公司) C:\windows\SysWOW64\xy.exe
2016-02-26 14:50 - 2016-02-26 19:50 - 01067320 _____ (9377, Inc.) C:\windows\SysWOW64\ht.exe
2016-02-26 08:46 - 2016-02-26 08:46 - 00000000 ____D C:\Users\masekv\AppData\LocalLow\VirtualStore
2016-02-26 08:46 - 2016-02-26 08:46 - 00000000 ____D C:\Users\masekv\.android
2016-02-26 07:21 - 2016-02-26 07:21 - 00000000 ____D C:\Users\Public\QiYi
2016-02-26 07:21 - 2016-02-26 07:21 - 00000000 ____D C:\Users\masekv\AppData\LocalLow\Unity
2016-02-26 07:21 - 2016-02-26 07:21 - 00000000 ____D C:\Users\masekv\AppData\Local\Unity
2016-02-25 22:40 - 2016-02-26 19:51 - 40657864 _____ (爱奇艺) C:\windows\SysWOW64\pps.exe
2016-02-25 22:20 - 2016-02-29 14:59 - 00000000 _____ C:\windows\SysWOW64\lock.dat
2016-02-25 22:20 - 2016-02-25 22:20 - 00000000 _____ C:\windows\SysWOW64\in.dat
2016-02-25 22:19 - 2016-02-25 22:19 - 00001423 _____ C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-02-25 21:55 - 2016-02-25 22:12 - 00000000 ____D C:\Users\masekv\AppData\Local\3810282D-6C19-47B0-8283-5C6C29A7E108
2016-02-25 21:51 - 2016-02-25 21:53 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-02-25 21:50 - 2016-02-26 20:12 - 00000000 ____D C:\Program Files (x86)\winsafe
2016-02-25 21:46 - 2016-02-26 06:56 - 00000000 ____D C:\Users\masekv\AppData\Roaming\Seznam.cz
2016-02-25 21:33 - 2016-02-25 21:33 - 00000000 ____D C:\Users\masekv\Documents\Aquafadas
2016-02-25 21:09 - 2016-02-25 21:09 - 00000000 ____D C:\ProgramData\IsolatedStorage
2016-02-25 20:54 - 2016-02-25 20:54 - 17334952 _____ C:\Users\masekv\Downloads\BannerZest_Setup.exe
2016-02-25 20:45 - 2016-02-25 20:45 - 16399568 _____ (Devsoft, Inc ) C:\Users\masekv\Downloads\BannerEffectTrial.exe
2016-02-23 18:41 - 2016-02-23 18:42 - 00001209 _____ C:\Users\masekv\Downloads\Seznam_zasilek_detaily.csv
2016-02-19 00:08 - 2016-02-21 22:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-02-18 19:00 - 2016-02-18 19:00 - 00000864 _____ C:\Users\masekv\AppData\Local\recently-used.xbel
2016-02-14 10:25 - 2016-02-14 10:25 - 00186048 _____ C:\Users\masekv\Desktop\Husa 86x140.pdf
2016-02-11 19:28 - 2016-02-11 19:28 - 00000000 ____D C:\Users\masekv\AppData\LocalLow\Temp
2016-02-05 07:27 - 2016-01-16 20:06 - 00025024 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2016-02-05 07:27 - 2016-01-16 19:54 - 01162240 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2016-02-05 07:27 - 2016-01-11 20:05 - 03169792 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2016-02-05 07:27 - 2016-01-11 20:05 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2016-02-05 07:27 - 2016-01-11 20:05 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2016-02-05 07:27 - 2016-01-11 19:52 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2016-02-05 07:27 - 2016-01-11 19:47 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2016-02-05 07:27 - 2016-01-11 19:26 - 02610176 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2016-02-05 07:27 - 2016-01-11 19:24 - 00709120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2016-02-05 07:27 - 2016-01-11 19:23 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2016-02-05 07:27 - 2016-01-11 19:23 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2016-02-05 07:27 - 2016-01-11 19:23 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2016-02-05 07:27 - 2016-01-11 19:23 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2016-02-05 07:27 - 2016-01-11 19:23 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2016-02-05 07:27 - 2016-01-11 19:14 - 00573440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2016-02-05 07:27 - 2016-01-11 19:14 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2016-02-05 07:27 - 2016-01-11 19:14 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2016-02-05 07:27 - 2016-01-11 19:14 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 01362944 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00677376 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00499200 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2016-02-05 07:27 - 2016-01-11 15:08 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2016-02-05 07:26 - 2016-01-22 07:19 - 14179840 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2016-02-05 07:26 - 2016-01-22 07:15 - 01866752 _____ (Microsoft Corporation) C:\windows\system32\ExplorerFrame.dll
2016-02-05 07:26 - 2016-01-22 07:12 - 01940992 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2016-02-05 07:26 - 2016-01-22 07:05 - 12877824 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2016-02-05 07:26 - 2016-01-22 07:00 - 01498624 _____ (Microsoft Corporation) C:\windows\SysWOW64\ExplorerFrame.dll
2016-02-05 07:26 - 2016-01-22 06:59 - 01805824 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2016-02-05 07:26 - 2016-01-22 06:19 - 03231232 _____ (Microsoft Corporation) C:\windows\explorer.exe
2016-02-05 07:26 - 2016-01-22 06:12 - 02973184 _____ (Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-02-29 17:39 - 2012-07-14 21:28 - 00000952 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-02-29 17:39 - 2012-05-24 09:23 - 00000914 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2016-02-29 15:01 - 2009-07-14 05:45 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-02-29 15:01 - 2009-07-14 05:45 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-02-29 15:00 - 2014-12-26 13:03 - 00000000 ___RD C:\Users\masekv\iCloudDrive
2016-02-29 14:59 - 2012-07-14 21:28 - 00000948 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-02-29 14:53 - 2011-08-12 04:48 - 00000000 ____D C:\ProgramData\PDFC
2016-02-29 14:53 - 2011-08-12 04:44 - 00000000 ____D C:\ProgramData\HPQLOG
2016-02-29 14:51 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-02-29 07:58 - 2009-07-14 05:45 - 00484744 _____ C:\windows\system32\FNTCACHE.DAT
2016-02-29 07:42 - 2014-01-05 18:06 - 00003192 _____ C:\windows\System32\Tasks\HPCeeScheduleFormasekv
2016-02-29 07:42 - 2014-01-05 18:06 - 00000336 _____ C:\windows\Tasks\HPCeeScheduleFormasekv.job
2016-02-27 23:04 - 2012-07-14 19:46 - 00000000 ____D C:\Users\masekv\AppData\Roaming\vlc
2016-02-27 18:40 - 2011-08-12 05:00 - 00718866 _____ C:\windows\system32\perfh005.dat
2016-02-27 18:40 - 2011-08-12 05:00 - 00160232 _____ C:\windows\system32\perfc005.dat
2016-02-27 18:40 - 2009-07-14 06:13 - 01718940 _____ C:\windows\system32\PerfStringBackup.INI
2016-02-27 18:40 - 2009-07-14 04:20 - 00000000 ____D C:\windows\inf
2016-02-27 09:02 - 2012-06-26 10:18 - 00000000 ____D C:\Users\masekv\AppData\Local\Adobe
2016-02-26 22:08 - 2012-07-02 22:26 - 00000000 ____D C:\Users\masekv\AppData\Local\ElevatedDiagnostics
2016-02-26 20:28 - 2014-11-25 16:58 - 00000000 ____D C:\Users\masekv\Documents\Soukromy
2016-02-26 20:27 - 2012-06-25 09:11 - 00127376 _____ C:\Users\masekv\AppData\Local\GDIPFONTCACHEV1.DAT
2016-02-26 20:12 - 2012-06-25 09:10 - 00000000 ____D C:\Users\masekv
2016-02-26 19:52 - 2015-04-02 21:40 - 00000000 ____D C:\Program Files (x86)\Safari
2016-02-26 19:39 - 2012-06-27 08:24 - 00000000 ____D C:\Users\masekv\AppData\Local\Google
2016-02-26 19:38 - 2011-12-27 18:57 - 00000000 ____D C:\Program Files (x86)\Google
2016-02-26 17:39 - 2011-08-12 04:37 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-02-26 07:12 - 2013-12-07 13:51 - 00000000 ____D C:\ProgramData\Oracle
2016-02-26 07:09 - 2014-10-29 21:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-02-26 07:09 - 2013-12-07 13:50 - 00000000 ____D C:\Program Files (x86)\Java
2016-02-26 07:07 - 2015-08-28 08:21 - 00000000 ____D C:\Users\masekv\.oracle_jre_usage
2016-02-26 07:07 - 2014-10-29 21:23 - 00097888 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2016-02-26 06:54 - 2014-11-10 23:40 - 00001873 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-02-26 06:52 - 2011-08-12 04:58 - 00000000 ____D C:\Program Files (x86)\Bing Bar Installer
2016-02-26 06:50 - 2012-06-27 08:23 - 00000000 ____D C:\Users\masekv\AppData\Local\Deployment
2016-02-25 22:38 - 2012-09-08 18:58 - 00000000 ____D C:\Quarantine
2016-02-25 22:20 - 2009-07-14 06:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
2016-02-25 22:19 - 2012-06-25 09:11 - 00001389 _____ C:\Users\masekv\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-02-25 22:18 - 2012-06-25 09:11 - 00000000 ___RD C:\Users\masekv\Virtual Machines
2016-02-25 22:18 - 2009-07-14 05:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-02-25 22:11 - 2015-11-23 07:49 - 00007607 _____ C:\Users\masekv\AppData\Local\Resmon.ResmonCfg
2016-02-25 21:05 - 2011-11-10 12:23 - 00000224 _____ C:\windows\system32\config\netlogon.ftl
2016-02-25 17:21 - 2014-11-10 23:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-02-24 19:06 - 2013-01-22 20:39 - 00000000 ____D C:\Users\masekv\AppData\Roaming\dvdcss
2016-02-19 00:50 - 2015-11-17 20:21 - 00000000 ____D C:\Users\masekv\Desktop\konferencewww
2016-02-18 19:33 - 2014-09-16 14:19 - 00000000 ____D C:\Users\masekv\.gimp-2.8
2016-02-18 19:00 - 2014-09-16 14:21 - 00000000 ____D C:\Users\masekv\AppData\Local\gtk-2.0
2016-02-18 18:52 - 2015-12-14 22:06 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-02-10 20:27 - 2012-05-24 09:23 - 00796864 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2016-02-10 20:27 - 2012-05-24 09:23 - 00003852 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2016-02-10 20:27 - 2011-12-27 18:57 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-02-09 16:43 - 2015-10-07 16:32 - 00000000 ____D C:\Users\masekv\Downloads\bo videa
2016-02-06 21:46 - 2015-01-26 17:04 - 00000000 ____D C:\windows\system32\appraiser
2016-02-06 21:46 - 2014-04-26 15:01 - 00000000 ___SD C:\windows\system32\CompatTel
2016-02-03 19:53 - 2013-01-27 19:29 - 00000000 ____D C:\Users\masekv\Downloads\boruvka pisnicky
2016-02-02 19:24 - 2012-07-08 20:51 - 00000000 ____D C:\Users\masekv\Documents\Moje dokumenty
2016-02-01 21:24 - 2012-07-14 21:28 - 00003948 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-02-01 21:24 - 2012-07-14 21:28 - 00003696 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
==================== Files in the root of some directories =======
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Quartz Composer
2015-01-17 20:11 - 2015-01-17 20:11 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Radio Sounds
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Receipts
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\Users\masekv\AppData\Roaming\Sampler Instruments
2016-02-18 19:00 - 2016-02-18 19:00 - 0000864 _____ () C:\Users\masekv\AppData\Local\recently-used.xbel
2015-11-23 07:49 - 2016-02-25 22:11 - 0007607 _____ () C:\Users\masekv\AppData\Local\Resmon.ResmonCfg
2011-11-04 16:39 - 2011-11-04 16:39 - 0000120 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2015-01-17 20:10 - 2015-01-17 20:10 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT
2015-01-17 20:11 - 2015-01-17 20:11 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2015-01-17 20:10 - 2016-01-01 17:55 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2015-01-17 20:10 - 2016-01-01 17:56 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\ProgramData\Resources
2015-01-17 20:11 - 2015-01-17 20:11 - 0000268 ___RH () C:\ProgramData\Reverb
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\ProgramData\Robot
2015-01-17 20:10 - 2015-01-17 20:10 - 0000268 ___RH () C:\ProgramData\Scripts Menu
Some files in TEMP:
====================
C:\Users\egis\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\egis\AppData\Local\Temp\Resource.exe
C:\Users\egis\AppData\Local\Temp\sp54373.exe
C:\Users\egis\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\egis\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\masekv\AppData\Local\Temp\Browser_V5.5.10106.5_f_4674_(Build1601261105).exe
C:\Users\masekv\AppData\Local\Temp\gb2.exe
C:\Users\masekv\AppData\Local\Temp\gma.dll
C:\Users\masekv\AppData\Local\Temp\jre-8u73-windows-au.exe
C:\Users\masekv\AppData\Local\Temp\MSN96E4.exe
C:\Users\masekv\AppData\Local\Temp\ose00000.exe
C:\Users\masekv\AppData\Local\Temp\set.exe
C:\Users\masekv\AppData\Local\Temp\setup.exe
C:\Users\masekv\AppData\Local\Temp\sqlite3.dll
C:\Users\masekv\AppData\Local\Temp\{E638ABC1-0067-474b-A379-87CFE81E7848}.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\SysWOW64\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
==================== MBR and Partition Table ==================
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleFormasekv.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
AV: McAfee VirusScan Enterprise (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee VirusScan Enterprise Antispyware Module (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Host Intrusion Prevention Firewall (Enabled) {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\masekv\Desktop" je 254 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000001
==================== End Of Log ==============================
-
Rudy
- Site Admin
- Příspěvky: 119673
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: čínsky virus
Otevřte poznámkový blok a zkopírujte do něj:
Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.Start
C:\Program Files (x86)\winsafe\winsafe.exe
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [gmsd_re_021010249] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [594992 2016-01-29] (Oracle Corporation)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [] => [X]
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [system34] => C:\windows\SoftwareProtection\systemvital.exe [624608 2013-01-23] ()
C:\windows\SoftwareProtection
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [winsafe] => C:\Program Files (x86)\winsafe\winsafe.exe [3302912 2016-02-24] (TODO: <公司名>)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\MountPoints2: {947e3d3a-2488-11e3-8e07-402cf417409c} - G:\SETUP.EXE
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.bing.com?pc=CMNTDF
SearchScopes: HKLM -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKU\S-1-5-21-1801674531-606747145-2147026105-5754 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL =
BHO-x32: No Name -> {83B80A9C-D91A-4F22-8DCF-EA7204039F79} -> No File
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
S2 Bonjour Service; C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe [X]
U3 mfeavfk01; no ImagePath
C:\windows\SysWOW64\xy.exe
C:\windows\SysWOW64\pps.exe
C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Users\egis\AppData\Local\Temp
C:\Users\masekv\AppData\Local\Temp
End
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: čínsky virus
Fix result of Farbar Recovery Scan Tool (x64) Version:24-02-2016
Ran by masekv (2016-02-29 17:59:33) Run:1
Running from C:\Users\masekv\Desktop
Loaded Profiles: masekv (Available Profiles: masekv & Administrator)
Boot Mode: Normal
==============================================
fixlist content:
*****************
Start
C:\Program Files (x86)\winsafe\winsafe.exe
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [gmsd_re_021010249] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [594992 2016-01-29] (Oracle Corporation)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [] => [X]
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [system34] => C:\windows\SoftwareProtection\systemvital.exe [624608 2013-01-23] ()
C:\windows\SoftwareProtection
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [winsafe] => C:\Program Files (x86)\winsafe\winsafe.exe [3302912 2016-02-24] (TODO: <???>)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\MountPoints2: {947e3d3a-2488-11e3-8e07-402cf417409c} - G:\SETUP.EXE
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.bing.com?pc=CMNTDF
SearchScopes: HKLM -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKU\S-1-5-21-1801674531-606747145-2147026105-5754 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL =
BHO-x32: No Name -> {83B80A9C-D91A-4F22-8DCF-EA7204039F79} -> No File
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
S2 Bonjour Service; C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe [X]
U3 mfeavfk01; no ImagePath
C:\windows\SysWOW64\xy.exe
C:\windows\SysWOW64\pps.exe
C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Users\egis\AppData\Local\Temp
C:\Users\masekv\AppData\Local\Temp
End
*****************
C:\Program Files (x86)\winsafe\winsafe.exe => moved successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_re_021010249 => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value removed successfully
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Windows\CurrentVersion\Run\\system34 => value removed successfully
"C:\windows\SoftwareProtection" folder move:
Could not move "C:\windows\SoftwareProtection" => Scheduled to move on reboot.
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Windows\CurrentVersion\Run\\winsafe => value removed successfully
"HKU\S-1-5-21-1801674531-606747145-2147026105-5754\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{947e3d3a-2488-11e3-8e07-402cf417409c}" => key removed successfully
HKCR\CLSID\{947e3d3a-2488-11e3-8e07-402cf417409c} => key not found.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main\\First Home Page => value removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}" => key removed successfully
HKCR\CLSID\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}" => key removed successfully
HKCR\Wow6432Node\CLSID\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43} => key not found.
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83B80A9C-D91A-4F22-8DCF-EA7204039F79}" => key removed successfully
HKCR\Wow6432Node\CLSID\{83B80A9C-D91A-4F22-8DCF-EA7204039F79} => key not found.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
Bonjour Service => service removed successfully
mfeavfk01 => service removed successfully
C:\windows\SysWOW64\xy.exe => moved successfully
C:\windows\SysWOW64\pps.exe => moved successfully
C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\Users\egis\AppData\Local\Temp => moved successfully
"C:\Users\masekv\AppData\Local\Temp" folder move:
Could not move "C:\Users\masekv\AppData\Local\Temp" => Scheduled to move on reboot.
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2016-02-29 18:11:13)
C:\windows\SoftwareProtection => Is moved successfully
C:\Users\masekv\AppData\Local\Temp => moved successfully
==== End of Fixlog 18:11:13 ====
Ran by masekv (2016-02-29 17:59:33) Run:1
Running from C:\Users\masekv\Desktop
Loaded Profiles: masekv (Available Profiles: masekv & Administrator)
Boot Mode: Normal
==============================================
fixlist content:
*****************
Start
C:\Program Files (x86)\winsafe\winsafe.exe
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [gmsd_re_021010249] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [594992 2016-01-29] (Oracle Corporation)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [] => [X]
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [system34] => C:\windows\SoftwareProtection\systemvital.exe [624608 2013-01-23] ()
C:\windows\SoftwareProtection
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\Run: [winsafe] => C:\Program Files (x86)\winsafe\winsafe.exe [3302912 2016-02-24] (TODO: <???>)
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\...\MountPoints2: {947e3d3a-2488-11e3-8e07-402cf417409c} - G:\SETUP.EXE
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com?pc=CMNTDF
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://www.bing.com?pc=CMNTDF
SearchScopes: HKLM -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&for ... -SearchBox
SearchScopes: HKU\S-1-5-21-1801674531-606747145-2147026105-5754 -> DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL =
BHO-x32: No Name -> {83B80A9C-D91A-4F22-8DCF-EA7204039F79} -> No File
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
S2 Bonjour Service; C:\Program Files (x86)\IQIYI Video\LStyle\mDNSResponder.exe [X]
U3 mfeavfk01; no ImagePath
C:\windows\SysWOW64\xy.exe
C:\windows\SysWOW64\pps.exe
C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Users\egis\AppData\Local\Temp
C:\Users\masekv\AppData\Local\Temp
End
*****************
C:\Program Files (x86)\winsafe\winsafe.exe => moved successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\gmsd_re_021010249 => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value removed successfully
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Windows\CurrentVersion\Run\\system34 => value removed successfully
"C:\windows\SoftwareProtection" folder move:
Could not move "C:\windows\SoftwareProtection" => Scheduled to move on reboot.
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Windows\CurrentVersion\Run\\winsafe => value removed successfully
"HKU\S-1-5-21-1801674531-606747145-2147026105-5754\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{947e3d3a-2488-11e3-8e07-402cf417409c}" => key removed successfully
HKCR\CLSID\{947e3d3a-2488-11e3-8e07-402cf417409c} => key not found.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\Software\Microsoft\Internet Explorer\Main\\First Home Page => value removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}" => key removed successfully
HKCR\CLSID\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43}" => key removed successfully
HKCR\Wow6432Node\CLSID\{ec29edf6-ad3c-4e1c-a087-d6cb81400c43} => key not found.
HKU\S-1-5-21-1801674531-606747145-2147026105-5754\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83B80A9C-D91A-4F22-8DCF-EA7204039F79}" => key removed successfully
HKCR\Wow6432Node\CLSID\{83B80A9C-D91A-4F22-8DCF-EA7204039F79} => key not found.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
Bonjour Service => service removed successfully
mfeavfk01 => service removed successfully
C:\windows\SysWOW64\xy.exe => moved successfully
C:\windows\SysWOW64\pps.exe => moved successfully
C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\Users\egis\AppData\Local\Temp => moved successfully
"C:\Users\masekv\AppData\Local\Temp" folder move:
Could not move "C:\Users\masekv\AppData\Local\Temp" => Scheduled to move on reboot.
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 2016-02-29 18:11:13)
C:\windows\SoftwareProtection => Is moved successfully
C:\Users\masekv\AppData\Local\Temp => moved successfully
==== End of Fixlog 18:11:13 ====
-
Rudy
- Site Admin
- Příspěvky: 119673
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: čínsky virus
Smazáno. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: čínsky virus
Zatím je to v pořádku, uvidím po par min. a restartu. Můžete to nechat do zítra otevřené?
Rozhodně se ráno ozvu.s
Rozhodně se ráno ozvu.s
-
Rudy
- Site Admin
- Příspěvky: 119673
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: čínsky virus
Určitě mohu. Vyzkoušejte a ozvěte se.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: čínsky virus
Všechno zatim funguje, tak je to supeer
dekujeme
dekujeme
-
Rudy
- Site Admin
- Příspěvky: 119673
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: čínsky virus
Rádo se stalo!
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Přispějete na provoz fóra?