VIRY.CZ

Mám to spustit v nouzovém režimu?

MBAM spustte v normalnim

Díval jsem se jestli lze spustit firewall v nouzovém režim, ale nejde ani v nouzovém režim.

v nouzaku se nerozjede ani antivir, je to specificky rezim

Jinak zatim nejde antivir ani firewall i v normalnim. Kdyz jdu do upresneneho nastaveni firewallu, tak mi to napise:

Obrázek

a antivir vypada zase takhle:

Obrázek

Tak samozrejme kdyz je to plne viru...

Asi takto, bud si hrajte a zkousejte lecit sam, nebo se prosim ridte pokyny...Oboji dohromady nejde

Velice se omlouvám. Samozřejmě nebudu zbytečně přetěžovat počítač a spamovat forum a budu se řídit vašimi pokyny.

Zde je výpis MBAM:

Malwarebytes Anti-Malware (Zkušební verze Malwarebytes Anti-Malware) 1.61.0.1400
www.malwarebytes.org

Verze databáze: v2012.05.22.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Fil-kun :: JIRKA-PC [administrátor]

Ochrana: Povolena

22.5.2012 20:40:42
mbam-log-2012-05-22 (21-23-37).txt

Typ: Úplná kontrola
Nastavení kontroly povoleno: Paměť | Po spuštění | Registr | Systémové soubory | Heuristická analýza Extra | Heuristická analýza Shuriken | PUP | PUM
Nastavení kontroly zakázáno: P2P
Kontrolované objekty: 497953
Uplynulý čas: 39 minut, 28 sekund

Nalezené procesy v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené moduly v paměti: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené klíče v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené hodnoty v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené datové položky v registru: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené složky: 0
(Žádné škodlivé položky nebyly zjištěny)

Nalezené soubory: 2
C:\Users\Fil-kun\AppData\Local\Temp\xsjn11.exe (Rootkit.0Access) -> Žádná instrukce nebyla provedena.
C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ (Trojan.BitMiner) -> Žádná instrukce nebyla provedena.

(konec)

Nalezy MBAMu smazte

TFC http://oldtimer.geekstogo.com/TFC.exe

Stahnete a spustte
Kliknete na Start a potvrdte OK
Program uklidi a restartuje pc
Po pouziti utilitu smazte

PROSIM CTETE DUKLADNE NAVOD - TATO UTILITA MA VELKOU SCHOPNOST MAZAT A JE NUTNE JI APLIKOVAT JEN NA DOPORUCENI, JINAK VAM MUZE JIT SYSTEM DO KYTEK

Stahnete a ulozte na plochu Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypnete vsechny rezidentni bezpecnostní programy - firewally, antiviry, antispywary apod.
Pokud mate Win XP spustte pod uctem Spravce\Administratora
Pokud mate Win Vista ci Win 7, kliknete na Combofix pravym a dejte Run As Administrator ci Spustit jako spravce
Ihned po startu se zobrazi stranka s licencnim ujednanim, pokracujte kliknutim na Ano
Pokud Vam CF nabidne instalaci Konzoly pro zotaveni, tak souhlaste
Dale postupujte dle pokynu, behem scanu nechte PC naprosto v klidu - nespoustejte zadne aplikace a neklikejte do zobrazujiciho se okna
Scan by mel trvat cca 10 min, ale pokud bude PC hodne zaneseno, muze se cas prodlouzit
Po dokonceni skenu a pripadnem restartu CF zobrazi log, pripadne jej najdete zde C:\ComboFix.txt, jeho obsah sem vlozte
Detailni postup vc. obrazku mate zde http://www.bleepingcomputer.com/combofi ... t-combofix

Dobrý den, pomocí TFC jsem pročistil počítač, ale ComboFix stále nelze zapnout (dělá pořád to samé).

Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
Pokud pouzivate 64bitovy OS, zkontrolujte, zda-li je zaskrtnuty ctverecek u Pro 64 bitové OS, pokud ne, zaskrtnete jej
Zaskrtnete okenko Pro vsechny uzivatele
Zaskrtnete okenko Kontrola na havet "LOP"
Zaskrtnete okenko Kontrola na havet "Purity"
Stari souboru zmente z 30 dnu na 7 dnu
Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

Kód: Vybrat vše

CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
atapi.sys
autochk.exe
cdrom.sys
explorer.exe
hal.dll
scecli.dll
svchost.exe
tcpip.sys
userinit.exe
winlogon.exe
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s

%PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5
%PROGRAMFILES%\Internet Explorer\iexplore.exe /md5
%PROGRAMFILES%\Opera\opera.exe /md5
%PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5

%SystemDrive%\PhysicalMBR.bin /md5 

*crack* /s
*keygen* /s
*loader* /s

Kliknete na tlacitko Prohledat
Po dokonceni skenu (cca 10 az 15 min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte

Zde je log z OTL:

¨OTL logfile created on: 23.5.2012 16:41:21 - Run 3
OTL by OldTimer - Version 3.2.43.1 Folder = C:\Users\Fil-kun\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000405 | Country: Česká republika | Language: CSY | Date Format: d.M.yyyy

3,99 Gb Total Physical Memory | 2,45 Gb Available Physical Memory | 61,29% Memory free
7,98 Gb Paging File | 6,16 Gb Available in Paging File | 77,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 102,44 Gb Total Space | 55,83 Gb Free Space | 54,50% Space Free | Partition Type: NTFS
Drive D: | 828,97 Gb Total Space | 211,78 Gb Free Space | 25,55% Space Free | Partition Type: NTFS

Computer Name: JIRKA-PC | User Name: Fil-kun | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 7 Days

========== Processes (SafeList) ==========

PRC - [2012.05.23 16:39:54 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Fil-kun\Desktop\OTL.exe
PRC - [2012.05.19 17:13:42 | 000,529,232 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe
PRC - [2012.05.19 14:51:00 | 000,880,496 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe
PRC - [2012.04.30 09:11:24 | 001,242,448 | ---- | M] (Valve Corporation) -- D:\Fil\stream\Steam.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.03.13 06:36:40 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.08.03 13:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.08.03 03:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011.08.02 09:33:30 | 004,910,912 | ---- | M] (DT Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.07.13 21:57:18 | 008,155,648 | ---- | M] () -- D:\Fil\EasyPHP-5.3.8.0\mysql\bin\mysqld.exe
PRC - [2011.07.13 12:07:40 | 000,496,640 | ---- | M] (EasyPHP) -- D:\Fil\EasyPHP-5.3.8.0\EasyPHP-5.3.8.0.exe
PRC - [2011.05.21 17:47:24 | 000,018,432 | ---- | M] (Apache Software Foundation) -- D:\Fil\EasyPHP-5.3.8.0\apache\bin\apache.exe
PRC - [2011.05.20 10:10:26 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.05.20 10:10:12 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.09.07 11:46:56 | 000,072,280 | ---- | M] () -- C:\Windows\SysWOW64\XSrvSetup.exe

========== Modules (No Company Name) ==========

MOD - [2012.05.19 17:13:41 | 020,313,384 | ---- | M] () -- D:\Fil\stream\bin\libcef.dll
MOD - [2012.05.19 17:13:39 | 001,099,576 | ---- | M] () -- D:\Fil\stream\bin\avcodec-53.dll
MOD - [2012.05.19 17:13:39 | 000,895,312 | ---- | M] () -- D:\Fil\stream\bin\chromehtml.dll
MOD - [2012.05.19 17:13:39 | 000,190,776 | ---- | M] () -- D:\Fil\stream\bin\avformat-53.dll
MOD - [2012.05.19 17:13:39 | 000,123,192 | ---- | M] () -- D:\Fil\stream\bin\avutil-51.dll
MOD - [2012.05.09 13:35:58 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\a742cb2e77b47300756506d52c96a8d1\IAStorUtil.ni.dll
MOD - [2012.05.09 13:35:58 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\e7cd67fc34ad0fc611c1e1244cfc6584\IAStorCommon.ni.dll
MOD - [2012.05.09 12:51:26 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\03dee80574f4ec770b6f77ca030ded6c\System.Runtime.Remoting.ni.dll
MOD - [2012.05.09 12:51:06 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\90555968565afd59bce4b0974e9903bd\System.Windows.Forms.ni.dll
MOD - [2012.05.09 12:51:00 | 001,590,784 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\69f6e582cb79f107c61308b468c1a215\System.Drawing.ni.dll
MOD - [2012.05.09 12:50:49 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012.05.09 12:50:45 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.09 12:50:42 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.09 12:50:42 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.09 12:50:35 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2012.03.13 06:36:53 | 001,969,080 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011.08.03 03:31:28 | 000,255,592 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2011.07.13 21:57:18 | 008,155,648 | ---- | M] () -- D:\Fil\EasyPHP-5.3.8.0\mysql\bin\mysqld.exe
MOD - [2010.11.20 14:19:56 | 000,232,448 | ---- | M] () -- \\?\globalroot\systemroot\syswow64\mswsock.DLL
MOD - [2010.11.20 14:19:56 | 000,232,448 | ---- | M] () -- \\.\globalroot\systemroot\syswow64\mswsock.dll
MOD - [2010.11.13 04:36:45 | 000,303,104 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_cs_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.14 17:17:22 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_cs_b77a5c561934e089\System.Runtime.Remoting.resources.dll

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2010.09.22 19:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.05.19 17:13:42 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.04.21 03:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.08.03 13:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.08.03 03:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011.05.20 10:10:26 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Úložná technologie Intel(R)
SRV - [2010.09.07 11:46:56 | 000,072,280 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\XSrvSetup.exe -- (JMB36X)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.09.08 08:59:00 | 000,575,488 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.04.01 15:46:52 | 000,311,968 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2012.04.01 15:21:38 | 000,043,168 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.10.27 14:21:48 | 000,270,912 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.10.03 17:41:58 | 000,146,736 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2011.10.01 14:05:40 | 000,082,816 | ---- | M] (VSO Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pcouffin.sys -- (pcouffin)
DRV:64bit: - [2011.07.27 11:30:40 | 000,024,456 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BtHidBus.sys -- (BtHidBus)
DRV:64bit: - [2011.06.01 05:16:50 | 000,535,656 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.05.20 09:53:44 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.05.13 16:37:54 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2011.03.18 14:46:06 | 000,085,384 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftser2k.sys -- (FTSER2K)
DRV:64bit: - [2010.11.20 15:34:04 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm)
DRV:64bit: - [2010.11.20 15:34:04 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 15:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010.11.20 13:35:34 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)
DRV:64bit: - [2010.11.20 13:35:22 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.09.07 04:37:28 | 000,121,432 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2010.07.12 08:49:14 | 000,072,648 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ftdibus.sys -- (FTDIBUS)
DRV:64bit: - [2010.04.06 19:33:10 | 000,030,088 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btnetBus.sys -- (btnetBUs)
DRV:64bit: - [2010.04.06 19:32:48 | 000,027,016 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IvtBtBus.sys -- (IvtBtBUs)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.08.28 13:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV - [2011.09.28 20:58:05 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\gdrv.sys -- (gdrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1514392467-4284944609-46126548-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
IE - HKU\S-1-5-21-1514392467-4284944609-46126548-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1514392467-4284944609-46126548-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
IE - HKU\S-1-5-21-1514392467-4284944609-46126548-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1514392467-4284944609-46126548-1005\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1514392467-4284944609-46126548-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
IE - HKU\S-1-5-21-1514392467-4284944609-46126548-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.soom.cz/"
FF - prefs.js..network.proxy.http: "195.217.105.67"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Fil-kun\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Fil-kun\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.11.01 19:49:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.04.22 09:02:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.18 20:24:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.25 19:49:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.11 14:33:36 | 000,000,000 | ---D | M]

[2011.09.29 17:10:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fil-kun\AppData\Roaming\Mozilla\Extensions
[2012.05.17 17:19:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fil-kun\AppData\Roaming\Mozilla\Firefox\Profiles\l24gq2p6.default\extensions
[2011.12.27 20:45:10 | 000,000,000 | ---D | M] (Centrum.cz nastavenĂ) -- C:\Users\Fil-kun\AppData\Roaming\Mozilla\Firefox\Profiles\l24gq2p6.default\extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2012.02.17 18:04:24 | 000,000,000 | ---D | M] (CCK Wizard) -- C:\Users\Fil-kun\AppData\Roaming\Mozilla\Firefox\Profiles\l24gq2p6.default\extensions\cckwizard@extensions.mozilla.org
[2011.12.27 20:45:10 | 000,000,000 | ---D | M] (Centrum domĂ©novĂ˝ pomocnĂk) -- C:\Users\Fil-kun\AppData\Roaming\Mozilla\Firefox\Profiles\l24gq2p6.default\extensions\centrumpomocnik@centrum.cz
[2012.02.17 18:04:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fil-kun\AppData\Roaming\Mozilla\Firefox\Profiles\l24gq2p6.default\extensions\cckwizard@extensions.mozilla.org\components
[2012.02.17 18:04:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fil-kun\AppData\Roaming\Mozilla\Firefox\Profiles\l24gq2p6.default\extensions\cckwizard@extensions.mozilla.org\defaults
[2012.02.17 18:04:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Fil-kun\AppData\Roaming\Mozilla\Firefox\Profiles\l24gq2p6.default\extensions\cckwizard@extensions.mozilla.org\chrome
[2012.04.25 19:49:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011.11.01 19:49:38 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2011.09.29 17:57:39 | 000,080,872 | ---- | M] () (No name found) -- C:\USERS\FIL-KUN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L24GQ2P6.DEFAULT\EXTENSIONS\{9C51BD27-6ED8-4000-A2BF-36CB95C0C947}.XPI
[2012.05.17 17:19:03 | 001,335,949 | ---- | M] () (No name found) -- C:\USERS\FIL-KUN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\L24GQ2P6.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI
[2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.04.21 05:17:43 | 000,002,208 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\heureka-cz.xml
[2012.04.21 05:17:43 | 000,000,638 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\jyxo-cz.xml
[2012.04.21 05:17:44 | 000,001,367 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\seznam-cz.xml
[2012.04.21 05:17:44 | 000,000,654 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\slunecnice-cz.xml
[2012.04.21 05:17:44 | 000,001,179 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-cz.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.46\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.46\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\19.0.1084.46\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Fil-kun\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Fil-kun\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\Fil-kun\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Windows Activation Technologies (Enabled) = C:\Windows\system32\Wat\npWatWeb.dll
CHR - Extension: YouTube = C:\Users\Fil-kun\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Vyhled\u00E1v\u00E1n\u00ED Google = C:\Users\Fil-kun\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\Fil-kun\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\
CHR - Extension: Gmail = C:\Users\Fil-kun\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012.05.22 20:25:17 | 000,000,843 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (uTorrentControl2 Toolbar) - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (uTorrentControl2 Toolbar) - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1001..\Run: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun File not found
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1001..\Run: [PCSpeedUp] C:\Program Files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk File not found
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1001..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1001..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1005..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1005..\Run: [EasyPHP] D:\Fil\EasyPHP-5.3.8.0\EasyPHP-5.3.8.0.exe (EasyPHP)
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1005..\Run: [Facebook Update] "C:\Users\Fil-kun\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver File not found
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1005..\Run: [PCSpeedUp] C:\Program Files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk File not found
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1005..\Run: [Steam] D:\Fil\stream\Steam.exe (Valve Corporation)
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1005..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-1514392467-4284944609-46126548-1001..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Download with mediAvatar Free YouTube Download - I:\Free YouTube Download\upod_link.HTM File not found
O8 - Extra context menu item: Download with mediAvatar Free YouTube Download - I:\Free YouTube Download\upod_link.HTM File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta ... s-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.46.172.36 213.46.172.37
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{02415BDA-3303-4EEC-8C33-8F35DD2B8918}: DhcpNameServer = 213.46.172.36 213.46.172.37
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-1514392467-4284944609-46126548-1005\...com [@ = comfile] -- Reg Error: Key error. File not found
O37 - HKU\S-1-5-21-1514392467-4284944609-46126548-1005\...exe [@ = exefile] -- Reg Error: Key error. File not found
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.ac3filter - C:\Windows\SysWow64\ac3filter.acm ()
Drivers32: msacm.divxa32 - C:\Windows\SysWow64\DivXa32.acm (Packed With Joy !)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (http://www.mp3dev.org/)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.divx - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: vidc.ffds - C:\Windows\SysWow64\ff_vfw.dll ()
Drivers32: vidc.wmv3 - C:\Windows\SysWow64\wmv9vcm.dll (Microsoft Corporation)
Drivers32: vidc.xvid - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
PhysicalDisk0 MBR saved to C:\PhysicalMBR.bin

========== Files/Folders - Created Within 7 Days ==========

[2012.05.23 16:39:59 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Fil-kun\Desktop\OTL.exe
[2012.05.22 20:28:37 | 000,000,000 | ---D | C] -- C:\Users\Fil-kun\AppData\Roaming\Malwarebytes
[2012.05.22 20:28:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.05.22 20:28:34 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.05.22 20:28:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.05.22 20:28:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.05.22 20:27:15 | 004,502,181 | R--- | C] (Swearware) -- C:\Users\Fil-kun\Desktop\beruska.com.exe
[2012.05.22 18:27:25 | 000,000,000 | --SD | C] -- C:\32788R22FWJFW
[2012.05.22 17:56:36 | 000,000,000 | ---D | C] -- C:\Users\Fil-kun\Desktop\RK_Quarantine
[2012.05.22 16:55:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\trend micro
[2012.05.22 16:55:34 | 000,000,000 | ---D | C] -- C:\rsit
[2012.05.20 15:41:58 | 000,000,000 | RH-D | C] -- C:\Users\Fil-kun\AppData\Roaming\SecuROM
[2012.05.19 21:14:24 | 000,000,000 | ---D | C] -- C:\Users\Fil-kun\AppData\Roaming\Google
[2012.05.19 19:00:07 | 000,000,000 | ---D | C] -- C:\Users\Fil-kun\Documents\WB Games
[2012.05.19 14:51:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Conduit
[2012.05.19 14:51:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\uTorrentControl2
[2012.05.19 14:25:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III Beta
[2010.11.19 06:27:00 | 000,587,776 | ---- | C] (Igor Pavlov) -- C:\Users\Fil-kun\AppData\Roaming\7za.exe

========== Files - Modified Within 7 Days ==========

[2012.05.23 16:43:06 | 000,000,512 | ---- | M] () -- C:\PhysicalMBR.bin
[2012.05.23 16:39:54 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Fil-kun\Desktop\OTL.exe
[2012.05.23 16:38:51 | 000,000,950 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.05.23 16:38:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.05.23 16:38:36 | 3214,528,512 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.23 07:49:44 | 000,014,224 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.05.23 07:49:44 | 000,014,224 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.05.23 07:48:43 | 001,584,058 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.05.23 07:48:43 | 000,670,326 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat
[2012.05.23 07:48:43 | 000,654,836 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.05.23 07:48:43 | 000,141,874 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat
[2012.05.23 07:48:43 | 000,122,668 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.05.23 06:53:00 | 000,000,936 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1514392467-4284944609-46126548-1005UA.job
[2012.05.23 05:56:11 | 000,000,954 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.05.22 20:28:35 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.22 20:03:18 | 000,000,703 | ---- | M] () -- C:\Users\Fil-kun\Documents\Fil-kun – zástupce.lnk
[2012.05.22 19:04:51 | 000,007,602 | ---- | M] () -- C:\Users\Fil-kun\AppData\Local\resmon.resmoncfg
[2012.05.22 18:25:53 | 004,502,181 | R--- | M] (Swearware) -- C:\Users\Fil-kun\Desktop\beruska.com.exe
[2012.05.22 17:51:26 | 001,454,080 | ---- | M] () -- C:\Users\Fil-kun\Desktop\RogueKiller.exe
[2012.05.21 15:53:00 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1514392467-4284944609-46126548-1005Core.job

========== Files Created - No Company Name ==========

[2012.05.23 16:43:06 | 000,000,512 | ---- | C] () -- C:\PhysicalMBR.bin
[2012.05.22 20:28:35 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.05.22 20:03:18 | 000,000,703 | ---- | C] () -- C:\Users\Fil-kun\Documents\Fil-kun – zástupce.lnk
[2012.05.22 17:56:21 | 001,454,080 | ---- | C] () -- C:\Users\Fil-kun\Desktop\RogueKiller.exe
[2012.05.20 09:55:48 | 000,007,602 | ---- | C] () -- C:\Users\Fil-kun\AppData\Local\resmon.resmoncfg
[2012.05.19 21:14:24 | 000,102,400 | ---- | C] () -- C:\Users\Fil-kun\AppData\Roaming\googleoez.exe
[2012.04.02 22:17:38 | 000,040,985 | ---- | C] () -- C:\Users\Fil-kun\AppData\Roaming\a.7z
[2012.03.25 13:13:25 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll
[2012.03.25 13:13:25 | 000,002,411 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
[2012.01.22 11:09:39 | 000,000,079 | ---- | C] () -- C:\Users\Fil-kun\AppData\Local\CrystalDiskMark30.ini
[2011.10.15 16:55:46 | 000,000,668 | ---- | C] () -- C:\Users\Fil-kun\AppData\Roaming\vso_ts_preview.xml
[2011.09.28 20:40:18 | 000,072,280 | ---- | C] () -- C:\Windows\SysWow64\XSrvSetup.exe
[2011.09.28 20:24:07 | 001,606,854 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.08.03 03:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.04.09 19:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.05.24 21:33:00 | 004,670,829 | ---- | C] () -- C:\Windows\SysWow64\libavcodec.dll
[2010.05.24 21:33:00 | 001,529,856 | ---- | C] () -- C:\Windows\SysWow64\ff_samplerate.dll
[2010.05.24 21:33:00 | 001,447,921 | ---- | C] () -- C:\Windows\SysWow64\ffmpegmt.dll
[2010.05.24 21:33:00 | 000,877,385 | ---- | C] () -- C:\Windows\SysWow64\ff_x264.dll
[2010.05.24 21:33:00 | 000,810,113 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.05.24 21:33:00 | 000,336,384 | ---- | C] () -- C:\Windows\SysWow64\ff_libfaad2.dll
[2010.05.24 21:33:00 | 000,324,096 | ---- | C] () -- C:\Windows\SysWow64\TomsMoComp_ff.dll
[2010.05.24 21:33:00 | 000,248,320 | ---- | C] () -- C:\Windows\SysWow64\ff_kernelDeint.dll
[2010.05.24 21:33:00 | 000,216,576 | ---- | C] () -- C:\Windows\SysWow64\ff_libdts.dll
[2010.05.24 21:33:00 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\ff_libmad.dll
[2010.05.24 21:33:00 | 000,145,408 | ---- | C] () -- C:\Windows\SysWow64\libmpeg2_ff.dll
[2010.05.24 21:33:00 | 000,139,944 | ---- | C] () -- C:\Windows\SysWow64\libmplayer.dll
[2010.05.24 21:33:00 | 000,121,856 | ---- | C] () -- C:\Windows\SysWow64\ff_liba52.dll
[2010.05.24 21:33:00 | 000,116,736 | ---- | C] () -- C:\Windows\SysWow64\ff_tremor.dll
[2010.05.24 21:33:00 | 000,108,032 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.05.24 21:33:00 | 000,100,864 | ---- | C] () -- C:\Windows\SysWow64\ff_wmv9.dll
[2010.05.24 21:33:00 | 000,097,792 | ---- | C] () -- C:\Windows\SysWow64\ff_unrar.dll

========== LOP Check ==========

[2012.05.03 13:48:14 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Canon
[2011.10.27 15:14:33 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\DAEMON Tools Lite
[2011.10.02 18:43:17 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\DAEMON Tools Pro
[2012.02.23 21:47:24 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\ExpressFiles
[2012.02.19 19:04:32 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Opera
[2011.10.27 17:49:59 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Origin
[2012.05.20 21:06:09 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\uTorrent
[2012.02.08 15:52:10 | 000,000,000 | ---D | M] -- C:\Users\dom\AppData\Roaming\Vso
[2012.04.16 15:32:00 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\.minecraft
[2012.05.12 09:07:45 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\calibre
[2012.05.15 17:43:48 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Canon
[2011.10.27 14:23:47 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\DAEMON Tools Lite
[2011.10.01 19:14:44 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\DAEMON Tools Pro
[2012.02.22 22:15:07 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\ExpressFiles
[2012.05.23 06:16:17 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\FileZilla
[2012.05.01 10:44:54 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\fltk.org
[2012.01.28 17:55:54 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\GetRightToGo
[2011.10.18 15:53:09 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\mediAvatar

[2011.10.27 14:22:09 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\OpenCandy
[2012.01.04 21:06:12 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Opera
[2011.10.27 14:15:47 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Origin
[2012.01.31 21:39:18 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Synthesia
[2012.05.04 12:22:44 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Unity
[2012.05.23 16:42:02 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\uTorrent
[2011.10.15 16:59:00 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Vso
[2012.05.07 08:57:26 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\wargaming.net
[2012.01.26 18:06:15 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Windows Live Writer
[2012.02.12 13:17:02 | 000,000,000 | ---D | M] -- C:\Users\Jirka\AppData\Roaming\Babylon
[2012.04.25 20:41:03 | 000,000,000 | ---D | M] -- C:\Users\Jirka\AppData\Roaming\Canon
[2011.10.30 11:56:51 | 000,000,000 | ---D | M] -- C:\Users\Jirka\AppData\Roaming\DAEMON Tools Lite
[2011.10.01 20:57:48 | 000,000,000 | ---D | M] -- C:\Users\Jirka\AppData\Roaming\DAEMON Tools Pro
[2012.04.30 21:16:02 | 000,000,000 | ---D | M] -- C:\Users\Jirka\AppData\Roaming\fltk.org
[2011.09.30 17:55:30 | 000,000,000 | ---D | M] -- C:\Users\Jirka\AppData\Roaming\OpenCandy
[2012.01.08 22:40:32 | 000,000,000 | ---D | M] -- C:\Users\Jirka\AppData\Roaming\Opera
[2012.05.23 08:21:44 | 000,000,000 | ---D | M] -- C:\Users\Jirka\AppData\Roaming\uTorrent
[2012.04.07 22:37:26 | 000,000,000 | ---D | M] -- C:\Users\Jirka\AppData\Roaming\Vso
[2012.05.08 11:13:34 | 000,000,000 | ---D | M] -- C:\Users\Jirka\AppData\Roaming\wargaming.net
[2012.05.21 15:53:00 | 000,000,914 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1514392467-4284944609-46126548-1005Core.job
[2012.05.23 06:53:00 | 000,000,936 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1514392467-4284944609-46126548-1005UA.job
[2012.05.23 06:23:07 | 000,032,628 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< >

< >

< MD5 for: ATAPI.SYS >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys

< MD5 for: AUTOCHK.EXE >
[2010.11.20 15:24:26 | 000,777,728 | ---- | M] (Microsoft Corporation) MD5=3B536A8BEC3B4F23FFDFD78B11A2AB93 -- C:\Windows\SysNative\autochk.exe
[2010.11.20 15:24:26 | 000,777,728 | ---- | M] (Microsoft Corporation) MD5=3B536A8BEC3B4F23FFDFD78B11A2AB93 -- C:\Windows\winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_4019f2b8d860ad30\autochk.exe
[2009.07.14 03:14:12 | 000,668,160 | ---- | M] (Microsoft Corporation) MD5=41E4C8EBA464E7D6A5BA5E8827732AEB -- C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_e1ca436d2314b860\autochk.exe
[2009.07.14 03:38:56 | 000,777,728 | ---- | M] (Microsoft Corporation) MD5=8B7F8E882A649D81CEA1EDE9BBB68FFF -- C:\Windows\winsxs\amd64_microsoft-windows-autochk_31bf3856ad364e35_6.1.7600.16385_none_3de8def0db722996\autochk.exe
[2010.11.20 14:16:54 | 000,668,160 | ---- | M] (Microsoft Corporation) MD5=F88A52EB62019D6A62FDD9E08034DBD8 -- C:\Windows\SysWOW64\autochk.exe
[2010.11.20 14:16:54 | 000,668,160 | ---- | M] (Microsoft Corporation) MD5=F88A52EB62019D6A62FDD9E08034DBD8 -- C:\Windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.1.7601.17514_none_e3fb573520033bfa\autochk.exe

< MD5 for: CDROM.SYS >
[2009.07.14 01:19:54 | 000,147,456 | ---- | M] (Microsoft Corporation) MD5=83D2D75E1EFB81B3450C18131443F7DB -- C:\Windows\winsxs\amd64_cdrom.inf_31bf3856ad364e35_6.1.7600.16385_none_bb9e4d89bd7870f1\cdrom.sys
[2010.11.20 11:19:21 | 000,147,456 | ---- | M] (Microsoft Corporation) MD5=F036CE71586E93D94DAB220D7BDF4416 -- C:\Windows\SysNative\drivers\cdrom.sys
[2010.11.20 11:19:21 | 000,147,456 | ---- | M] (Microsoft Corporation) MD5=F036CE71586E93D94DAB220D7BDF4416 -- C:\Windows\SysNative\DriverStore\FileRepository\cdrom.inf_amd64_neutral_0b3d0d1942ab684b\cdrom.sys
[2010.11.20 11:19:21 | 000,147,456 | ---- | M] (Microsoft Corporation) MD5=F036CE71586E93D94DAB220D7BDF4416 -- C:\Windows\winsxs\amd64_cdrom.inf_31bf3856ad364e35_6.1.7601.17514_none_bdcf6151ba66f48b\cdrom.sys

< MD5 for: EXPLORER.EXE >
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SysWOW64\explorer.exe
[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009.08.03 08:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2009.10.31 08:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\explorer.exe
[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009.10.31 08:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009.08.03 08:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe

< MD5 for: HAL.DLL >
[2009.07.14 03:47:48 | 000,263,232 | ---- | M] (Microsoft Corporation) MD5=C0A6F6E05E14FBCAEDE7796C8590B7AC -- C:\Windows\winsxs\amd64_microsoft-windows-hal_31bf3856ad364e35_6.1.7600.16385_none_071de44b735b3dfc\hal.dll
[2010.11.20 15:33:34 | 000,263,040 | ---- | M] (Microsoft Corporation) MD5=CFB8C673F9188F99466E76C6972191E0 -- C:\Windows\SysNative\hal.dll
[2010.11.20 15:33:34 | 000,263,040 | ---- | M] (Microsoft Corporation) MD5=CFB8C673F9188F99466E76C6972191E0 -- C:\Windows\winsxs\amd64_microsoft-windows-hal_31bf3856ad364e35_6.1.7601.17514_none_094ef8137049c196\hal.dll

< MD5 for: SCECLI.DLL >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll

< MD5 for: SVCHOST.EXE >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2009.07.14 03:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\SysWOW64\svchost.exe
[2009.07.14 03:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009.07.14 03:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\SysNative\svchost.exe
[2009.07.14 03:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D -- C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: TCPIP.SYS >
[2011.04.25 07:28:24 | 001,893,248 | ---- | M] (Microsoft Corporation) MD5=1F748D5439B65E0BEBD92F65048F030D -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.20951_none_0fb918de99201ffb\tcpip.sys
[2011.09.29 19:41:37 | 001,912,176 | ---- | M] (Microsoft Corporation) MD5=3810F06A4D74A7D62641EE73D6B3C660 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21828_none_11c6e9949627e69c\tcpip.sys
[2010.11.20 15:33:57 | 001,924,480 | ---- | M] (Microsoft Corporation) MD5=509383E505C973ED7534A06B3D19688D -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17514_none_114417c17d05cb37\tcpip.sys
[2011.06.21 08:16:55 | 001,888,128 | ---- | M] (Microsoft Corporation) MD5=5279D4DD69C7C71524B8E7A5746D15CC -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.20992_none_0f8ed978993fa916\tcpip.sys
[2012.03.30 12:19:17 | 001,877,872 | ---- | M] (Microsoft Corporation) MD5=5EFD096DEF47F8B88EF591DA92143440 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.21178_none_0faa5514992a39a7\tcpip.sys
[2011.04.25 07:32:22 | 001,896,832 | ---- | M] (Microsoft Corporation) MD5=61DC720BB065D607D5823F13D2A64321 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16802_none_0f668bf97fd90dd3\tcpip.sys
[2012.03.30 13:09:53 | 001,895,280 | ---- | M] (Microsoft Corporation) MD5=624C5B3AA4C99B3184BB922D9ECE3FF0 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16986_none_0f140fa780164fde\tcpip.sys
[2010.04.09 13:06:28 | 001,898,376 | ---- | M] (Microsoft Corporation) MD5=7FC877A25796D8ADF539E64703FCA7E1 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16569_none_0f2ca8c580036f65\tcpip.sys
[2012.03.30 12:26:36 | 001,901,424 | ---- | M] (Microsoft Corporation) MD5=885B202006EE17AE99B9FBCEC9AF88C9 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21954_none_11a27a8e9643d23a\tcpip.sys
[2009.07.14 03:45:55 | 001,898,576 | ---- | M] (Microsoft Corporation) MD5=912107716BAB424C7870E8E6AF5E07E1 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16385_none_0f1303f98017479d\tcpip.sys
[2011.04.25 07:33:51 | 001,923,968 | ---- | M] (Microsoft Corporation) MD5=92CE29D95AC9DD2D0EE9061D551BA250 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17603_none_114de9497cfe9316\tcpip.sys
[2011.06.21 08:20:30 | 001,914,752 | ---- | M] (Microsoft Corporation) MD5=A0EB71E0DC047C7CC95CD6AB4036296E -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21754_none_11a276c29643d7ec\tcpip.sys
[2010.04.09 09:56:29 | 001,892,232 | ---- | M] (Microsoft Corporation) MD5=A9C0F786AC1F736891D05CE0A1D29DEB -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.20687_none_0f9ea52499331463\tcpip.sys
[2011.09.29 18:17:51 | 001,886,064 | ---- | M] (Microsoft Corporation) MD5=AC3E29880DB5659532A1AA3439304A43 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.21060_none_0fad20ca992955d7\tcpip.sys
[2012.03.30 13:35:47 | 001,918,320 | ---- | M] (Microsoft Corporation) MD5=ACB82BDA8F46C84F465C1AFA517DC4B9 -- C:\Windows\SysNative\drivers\tcpip.sys
[2012.03.30 13:35:47 | 001,918,320 | ---- | M] (Microsoft Corporation) MD5=ACB82BDA8F46C84F465C1AFA517DC4B9 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17802_none_114ceccb7cff740d\tcpip.sys
[2011.04.25 08:16:34 | 001,927,552 | ---- | M] (Microsoft Corporation) MD5=B77977AEB2FF159D01DB08A309989C5F -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21712_none_11cbb5de9625357a\tcpip.sys
[2011.06.21 08:27:14 | 001,896,832 | ---- | M] (Microsoft Corporation) MD5=B9D87C7707F058AC652A398CD28DE14B -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16839_none_0f4d1e3b7feb1307\tcpip.sys
[2011.06.21 08:34:00 | 001,923,968 | ---- | M] (Microsoft Corporation) MD5=F0E98C00A09FDF791525829A1D14240F -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17638_none_11327af77d12659c\tcpip.sys
[2011.09.29 18:24:44 | 001,897,328 | ---- | M] (Microsoft Corporation) MD5=F18F56EFC0BFB9C87BA01C37B27F4DA5 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16889_none_0f170e9f80139ebc\tcpip.sys
[2011.09.29 18:29:28 | 001,923,952 | ---- | M] (Microsoft Corporation) MD5=FC62769E7BFF2896035AEED399108162 -- C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17697_none_10f09b257d43f3eb\tcpip.sys

< MD5 for: USERINIT.EXE >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe

< >

< %systemroot%*.* /U /s >
[2 C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp files -> C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\*.tmp -> ]
[5 C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\*.tmp files -> C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\*.tmp -> ]

< %SYSTEMDRIVE%\*.exe >

< %ALLUSERSPROFILE%\Application Data\*. >

< %ALLUSERSPROFILE%\Application Data\*.exe /s >

< %APPDATA%\*. >
[2012.04.16 15:32:00 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\.minecraft
[2011.10.06 15:56:21 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Adobe
[2012.05.12 09:07:45 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\calibre
[2012.05.15 17:43:48 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Canon
[2011.10.27 14:23:47 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\DAEMON Tools Lite
[2011.10.01 19:14:44 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\DAEMON Tools Pro
[2011.10.16 09:51:41 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\DivX
[2012.04.18 18:37:29 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Download Manager
[2012.02.22 22:15:07 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\ExpressFiles
[2012.05.23 06:16:17 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\FileZilla
[2012.05.01 10:44:54 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\fltk.org
[2012.01.28 17:55:54 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\GetRightToGo
[2012.05.19 21:14:24 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Google
[2011.09.29 17:05:35 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Identities
[2011.09.29 17:05:49 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Intel Corporation
[2011.09.29 17:10:10 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Macromedia
[2012.05.22 20:28:37 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Malwarebytes
[2009.07.14 17:36:38 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Media Center Programs
[2011.10.18 15:53:09 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\mediAvatar
[2012.05.20 21:05:33 | 000,000,000 | --SD | M] -- C:\Users\Fil-kun\AppData\Roaming\Microsoft
[2011.09.29 17:10:07 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Mozilla
[2011.10.03 16:53:53 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\NVIDIA
[2011.10.27 14:22:09 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\OpenCandy
[2012.01.04 21:06:12 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Opera
[2011.10.27 14:15:47 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Origin
[2012.05.20 15:41:58 | 000,000,000 | RH-D | M] -- C:\Users\Fil-kun\AppData\Roaming\SecuROM
[2012.05.23 16:42:03 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Skype
[2012.01.31 21:39:18 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Synthesia
[2012.05.04 12:22:44 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Unity
[2012.05.23 16:42:02 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\uTorrent
[2012.05.20 21:06:09 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\vlc
[2011.10.15 16:59:00 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Vso
[2012.05.07 08:57:26 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\wargaming.net
[2012.01.26 18:06:15 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\Windows Live Writer
[2011.09.29 17:31:41 | 000,000,000 | ---D | M] -- C:\Users\Fil-kun\AppData\Roaming\WinRAR

< %APPDATA%\*.exe /s >
[2010.11.19 06:27:00 | 000,587,776 | ---- | M] (Igor Pavlov) -- C:\Users\Fil-kun\AppData\Roaming\7za.exe
[2012.04.02 22:17:39 | 000,102,400 | ---- | M] () -- C:\Users\Fil-kun\AppData\Roaming\googleoez.exe
[2011.10.26 10:35:34 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Fil-kun\AppData\Roaming\Microsoft\Installer\{0552BD92-B707-42DE-B1A0-715FD56DEF08}\NewShortcut4_64B93B3632B54973AFD05BA9081F8980.exe
[2011.10.26 10:35:33 | 000,061,440 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Fil-kun\AppData\Roaming\Microsoft\Installer\{0552BD92-B707-42DE-B1A0-715FD56DEF08}\NewShortcut5_401206B0408D47779A9166D9F91C75ED.exe
[2011.10.26 10:35:34 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Fil-kun\AppData\Roaming\Microsoft\Installer\{0552BD92-B707-42DE-B1A0-715FD56DEF08}\New_Shortcut_S5781.exe
[2011.10.26 10:35:34 | 000,040,960 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Fil-kun\AppData\Roaming\Microsoft\Installer\{0552BD92-B707-42DE-B1A0-715FD56DEF08}\New_Shortcut_S5784.exe
[2011.12.13 20:36:32 | 000,010,134 | R--- | M] () -- C:\Users\Fil-kun\AppData\Roaming\Microsoft\Installer\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}\ARPPRODUCTICON.exe
[2011.10.27 14:22:10 | 000,416,160 | ---- | M] () -- C:\Users\Fil-kun\AppData\Roaming\OpenCandy\OpenCandy_B9200921C5FB407D87E48C17444BC393\LatestDLMgr.exe
[2011.08.02 00:38:30 | 001,872,896 | ---- | M] (Speedchecker Limited ) -- C:\Users\Fil-kun\AppData\Roaming\OpenCandy\OpenCandy_B9200921C5FB407D87E48C17444BC393\pcspeedup.exe

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job >
[2012.05.21 15:53:00 | 000,000,914 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1514392467-4284944609-46126548-1005Core.job
[2012.05.23 06:53:00 | 000,000,936 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1514392467-4284944609-46126548-1005UA.job
[2012.05.23 16:38:51 | 000,000,950 | ---- | M] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2012.05.23 05:56:11 | 000,000,954 | ---- | M] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\system32\drivers\*.sys /3 >

< %systemroot%\system32\*.* /3 >

< %SYSTEMDRIVE%\*.exe >

< >

< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s >
"uTorrent" = "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED -- [2012.05.19 14:51:00 | 000,880,496 | ---- | M] (BitTorrent, Inc.)
"Skype" = "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized -- [2011.09.12 12:35:24 | 017,351,304 | R--- | M] (Skype Technologies S.A.)
"PCSpeedUp" = C:\Program Files (x86)\Zrychleni Pocitace\PCSpeedUp.lnk
"DAEMON Tools Lite" = "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun -- [2011.08.02 09:33:30 | 004,910,912 | ---- | M] (DT Soft Ltd)
"Facebook Update" = "C:\Users\Fil-kun\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
"EasyPHP" = "D:\Fil\EasyPHP-5.3.8.0\EasyPHP-5.3.8.0.exe" -- [2011.07.13 12:07:40 | 000,496,640 | ---- | M] (EasyPHP)
"Steam" = "D:\Fil\stream\Steam.exe" -silent -- [2012.04.30 09:11:24 | 001,242,448 | ---- | M] (Valve Corporation)

< >

< %PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5 >
[2012.04.21 03:16:21 | 000,924,600 | ---- | M] (Mozilla Corporation) MD5=4F69AABB5D82AA4EF6DFF7871212ADF6 -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe

< %PROGRAMFILES%\Internet Explorer\iexplore.exe /md5 >
[2011.09.28 20:28:31 | 000,748,336 | ---- | M] (Microsoft Corporation) MD5=904E13BA41AF2E353A32CF351CA53639 -- C:\Program Files (x86)\Internet Explorer\iexplore.exe

< %PROGRAMFILES%\Opera\opera.exe /md5 >
[2012.01.04 21:06:09 | 000,949,104 | ---- | M] (Opera Software) MD5=734CACDE3E6D1882AAE2C6F8F8BE4F93 -- C:\Program Files (x86)\Opera\opera.exe

< %PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5 >
[2012.05.09 05:04:54 | 001,240,048 | ---- | M] (Google Inc.) MD5=A7F80FD4BA188EE39735FFA90D338ABA -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

< >

< %SystemDrive%\PhysicalMBR.bin /md5 >
[2012.05.23 16:43:06 | 000,000,512 | ---- | M] () MD5=4346269850782F5C1CAEDC5DAD43E878 -- C:\PhysicalMBR.bin

< >

< *crack* /s >
[2012.05.19 13:47:41 | 000,000,627 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\Microsoft\Windows\Recent\Diablo 3 CRACK SKIDROW.lnk
[2012.05.19 13:47:22 | 000,000,860 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\Microsoft\Windows\Recent\Diablo 3 CRACK SKIDROW.rar.lnk
[2012.05.15 18:11:44 | 000,000,609 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\Microsoft\Windows\Recent\Diablo III CRACK.lnk
[2012.05.19 13:45:58 | 000,000,689 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\Microsoft\Windows\Recent\Diablo_3_CRACK_SKIDROW.torrent.lnk
[2012.05.17 17:21:26 | 000,000,737 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\Microsoft\Windows\Recent\[isoHunt] Diablo III Cracked-Razor1911.torrent.lnk
[2012.04.30 08:59:33 | 000,021,154 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\uTorrent\3DMGAME-Sniper.Elite.v2.Demo.Cracked.Full.Rip-3DM.torrent
[2011.10.15 15:51:12 | 000,011,323 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\uTorrent\Battlefield 3 [Game - Full Download] 2011 (PC) -CRACKED-.rar.torrent
[2012.05.19 13:45:58 | 000,016,749 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\uTorrent\Diablo 3 CRACK SKIDROW.torrent
[2012.05.15 18:10:57 | 000,001,364 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\uTorrent\Diablo III CRACK.torrent
[2012.05.17 17:21:26 | 000,019,483 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\uTorrent\Diablo III Cracked-Razor1911.torrent
[2012.05.04 11:57:54 | 000,003,576 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\uTorrent\Sniper Elite V2 - crack SKIDROW.rar.torrent
[2012.04.07 10:55:16 | 000,001,238 | ---- | M] () -- \Users\Jirka\AppData\Roaming\Microsoft\Windows\Recent\Riddick Assault on Dark Athena Patch crack-DarkCoder.txt.lnk

< *keygen* /s >

< *loader* /s >
[2012.04.26 19:51:36 | 000,044,032 | R--- | M] () -- \Program Files (x86)\Calibre2\DLLs\PyISAPI_loader.dll
[2012.05.19 15:17:49 | 000,000,194 | ---- | M] () -- \Program Files (x86)\Common Files\Blizzard Entertainment\BlizzardDownloader.ini
[2006.10.26 13:40:34 | 000,057,344 | ---- | M] () -- \Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\coloader.dll
[2006.10.26 13:40:34 | 000,005,120 | ---- | M] () -- \Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\coloader.tlb
[2009.05.31 03:21:00 | 000,071,008 | ---- | M] () -- \Program Files (x86)\NVIDIA Corporation\PhysX\Common\PhysXLoader.dll
[2009.05.31 03:21:00 | 000,073,568 | ---- | M] () -- \Program Files (x86)\NVIDIA Corporation\PhysX\Common\PhysXLoader64.dll
[2008.06.20 19:13:32 | 000,044,032 | ---- | M] () -- \Program Files (x86)\WinRAR\RarExtLoader.exe
[2012.05.23 06:26:53 | 000,000,652 | ---- | M] () -- \Users\Fil-kun\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C0ZN30FE\AdLoader[1].htm
[2012.05.23 06:26:53 | 000,010,519 | ---- | M] () -- \Users\Fil-kun\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NI9TKKYR\AdLoader-aee74f28845638b42a47bb02dc06a7c6.min[1].js
[2012.01.28 17:55:54 | 000,000,000 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\GetRightToGo\Brothersoftdownloader_for_Virtual_Floppy_Drive.data
[2012.05.19 11:21:07 | 000,000,829 | ---- | M] () -- \Users\Fil-kun\AppData\Roaming\Microsoft\Windows\Recent\webgl_loader_obj.html.lnk
[2011.09.30 18:00:02 | 000,057,728 | ---- | M] () -- \Users\Jirka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\DT.gadget\img\dt_dadget_loader.png
[2011.09.30 18:00:02 | 000,057,728 | ---- | M] () -- \Users\Jirka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\DT.gadget\skins\skin1\dt_dadget_loader.png
[2011.09.30 18:00:02 | 000,057,728 | ---- | M] () -- \Users\Jirka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\DT.gadget\skins\skin2\dt_dadget_loader.png
[2011.09.30 18:00:02 | 000,057,728 | ---- | M] () -- \Users\Jirka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\DT.gadget\skins\skin3\dt_dadget_loader.png
[2011.09.30 18:00:03 | 000,057,728 | ---- | M] () -- \Users\Jirka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\DT.gadget\skins\skin4\dt_dadget_loader.png
[2012.04.18 00:39:24 | 000,010,145 | ---- | M] () -- \Users\Jirka\AppData\Roaming\Mozilla\Firefox\Profiles\rhr01boi.default\conduitCommon\modules\3.12.0.8\ExternalLibraryLoader.jsm
[2012.04.18 00:39:24 | 000,010,145 | ---- | M] () -- \Users\Jirka\AppData\Roaming\Mozilla\Firefox\Profiles\rhr01boi.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}\modules\ExternalLibraryLoader.jsm
[2012.05.23 16:49:19 | 000,029,322 | ---- | M] () -- \Windows\Prefetch\RAREXTLOADER.EXE-8405D981.pf
[2011.01.18 01:06:15 | 002,202,645 | ---- | M] () -- \Windows\Setup\SCRIPTS\Windows7Loader.exe
[2011.07.16 06:15:45 | 000,003,584 | -H-- | M] () -- \Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2009.07.14 03:15:12 | 000,038,400 | ---- | M] () -- \Windows\System32\dmloader.dll
[2011.07.16 06:15:45 | 000,003,584 | -H-- | M] () -- \Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
[2009.07.14 03:15:12 | 000,038,400 | ---- | M] () -- \Windows\SysWOW64\dmloader.dll
[2009.07.14 03:40:31 | 000,047,616 | ---- | M] () -- \Windows\winsxs\amd64_microsoft-windows-audio-dmusic_31bf3856ad364e35_6.1.7600.16385_none_a1e90d98a953d601\dmloader.dll
[2009.07.14 03:24:53 | 000,003,584 | -H-- | M] () -- \Windows\winsxs\amd64_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7600.16385_none_66a6e19d9580f9e3\api-ms-win-core-libraryloader-l1-1-0.dll
[2011.07.16 07:04:54 | 000,003,584 | -H-- | M] () -- \Windows\winsxs\amd64_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7600.16850_none_66c2596d956d1920\api-ms-win-core-libraryloader-l1-1-0.dll
[2011.07.16 07:06:43 | 000,003,584 | ---- | M] () -- \Windows\winsxs\amd64_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7600.21010_none_67770e0aae6a7c68\api-ms-win-core-libraryloader-l1-1-0.dll
[2011.07.16 07:21:03 | 000,003,584 | -H-- | M] () -- \Windows\winsxs\amd64_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.17651_none_68a9b6bd92929e63\api-ms-win-core-libraryloader-l1-1-0.dll
[2011.07.16 07:12:44 | 000,003,584 | ---- | M] () -- \Windows\winsxs\amd64_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.21772_none_691eb3faabbf8f66\api-ms-win-core-libraryloader-l1-1-0.dll
[2009.07.14 17:17:49 | 000,004,431 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_8f37605116ba80bc.manifest
[2009.07.14 17:17:49 | 000,033,360 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_8f37605116ba80bc_winload.efi.mui_35ee487d
[2009.07.14 17:17:49 | 000,034,896 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_8f37605116ba80bc_winload.exe.mui_3bc5b827
[2009.07.14 17:17:49 | 000,029,776 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_8f37605116ba80bc_winresume.efi.mui_f412814e
[2009.07.14 17:17:49 | 000,030,288 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_8f37605116ba80bc_winresume.exe.mui_ff8b5358
[2011.10.02 09:17:10 | 000,005,745 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17556_none_b923808583650cfb.manifest
[2011.10.02 09:17:10 | 000,642,944 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17556_none_b923808583650cfb_winload.efi_75834aa0
[2011.10.02 09:17:10 | 000,605,552 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17556_none_b923808583650cfb_winload.exe_75835076
[2011.10.02 09:17:10 | 000,566,208 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17556_none_b923808583650cfb_winresume.efi_85cd069f
[2011.10.02 09:17:10 | 000,518,672 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17556_none_b923808583650cfb_winresume.exe_85cd1215
[2009.07.14 04:57:50 | 000,002,896 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-s..ive-blackbox-loader_31bf3856ad364e35_6.1.7600.16385_none_c72819e06acceb59.manifest
[2009.07.14 04:57:50 | 000,019,008 | ---- | M] () -- \Windows\winsxs\Backup\amd64_microsoft-windows-s..ive-blackbox-loader_31bf3856ad364e35_6.1.7600.16385_none_c72819e06acceb59_spldr.sys_98bd87a0
[2009.07.14 17:15:51 | 000,004,431 | ---- | M] () -- \Windows\winsxs\Manifests\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_8f37605116ba80bc.manifest
[2009.07.14 04:13:42 | 000,005,745 | ---- | M] () -- \Windows\winsxs\Manifests\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7600.16385_none_b71babd98657e6ef.manifest
[2011.02.05 15:09:31 | 000,005,745 | ---- | M] () -- \Windows\winsxs\Manifests\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7600.16757_none_b73e23c9863dba66.manifest
[2011.02.05 15:04:44 | 000,005,745 | ---- | M] () -- \Windows\winsxs\Manifests\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7600.20897_none_b79c80e49f7bc9f4.manifest
[2010.11.20 06:12:44 | 000,005,745 | ---- | M] () -- \Windows\winsxs\Manifests\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89.manifest
[2011.02.05 19:34:23 | 000,005,745 | ---- | M] () -- \Windows\winsxs\Manifests\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17556_none_b923808583650cfb.manifest
[2011.02.05 15:09:57 | 000,005,745 | ---- | M] () -- \Windows\winsxs\Manifests\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.21655_none_b9ac1d069c83936e.manifest
[2009.07.14 04:18:27 | 000,002,896 | ---- | M] () -- \Windows\winsxs\Manifests\amd64_microsoft-windows-s..ive-blackbox-loader_31bf3856ad364e35_6.1.7600.16385_none_c72819e06acceb59.manifest
[2009.07.14 03:15:12 | 000,038,400 | ---- | M] () -- \Windows\winsxs\x86_microsoft-windows-audio-dmusic_31bf3856ad364e35_6.1.7600.16385_none_45ca7214f0f664cb\dmloader.dll
[2009.07.14 03:03:49 | 000,003,584 | -H-- | M] () -- \Windows\winsxs\x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7600.16385_none_0a884619dd2388ad\api-ms-win-core-libraryloader-l1-1-0.dll
[2011.07.16 06:19:58 | 000,003,584 | -H-- | M] () -- \Windows\winsxs\x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7600.16850_none_0aa3bde9dd0fa7ea\api-ms-win-core-libraryloader-l1-1-0.dll
[2011.07.16 06:12:45 | 000,003,584 | ---- | M] () -- \Windows\winsxs\x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7600.21010_none_0b587286f60d0b32\api-ms-win-core-libraryloader-l1-1-0.dll
[2011.07.16 06:15:45 | 000,003,584 | -H-- | M] () -- \Windows\winsxs\x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.17651_none_0c8b1b39da352d2d\api-ms-win-core-libraryloader-l1-1-0.dll
[2011.07.16 06:36:48 | 000,003,584 | ---- | M] () -- \Windows\winsxs\x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.21772_none_0d001876f3621e30\api-ms-win-core-libraryloader-l1-1-0.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 6168 bytes -> C:\Windows\PLA\System\System Diagnostics.xml:0v1ieca3Feahez0jAwxjjk5uRh
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:9AB338B9

< End of report >

MBAM mi ještě ukazje, že blokuje nějaké procesy, které označil jako Trojan.BitMiner a Trojan.Dropper.BCMinner, takže jsem to dal do karantény. Mám vám poslat log?

Ano, hodte mi sem log z MBAMu, at se podivam co se mu nelibi

2012/05/23 05:56:30 +0200 JIRKA-PC Fil-kun MESSAGE Starting protection
2012/05/23 05:56:32 +0200 JIRKA-PC Fil-kun MESSAGE Protection started successfully
2012/05/23 05:56:35 +0200 JIRKA-PC Fil-kun MESSAGE Starting IP protection
2012/05/23 05:56:35 +0200 JIRKA-PC Fil-kun ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/05/23 06:11:09 +0200 JIRKA-PC Fil-kun MESSAGE Starting protection
2012/05/23 06:11:10 +0200 JIRKA-PC Fil-kun MESSAGE Protection started successfully
2012/05/23 06:11:13 +0200 JIRKA-PC Fil-kun MESSAGE Starting IP protection
2012/05/23 06:11:13 +0200 JIRKA-PC Fil-kun ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/05/23 06:14:18 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner QUARANTINE
2012/05/23 06:17:18 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner DENY
2012/05/23 06:20:18 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner DENY
2012/05/23 06:21:55 +0200 JIRKA-PC dom MESSAGE Starting IP protection
2012/05/23 06:21:55 +0200 JIRKA-PC dom ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/05/23 06:23:25 +0200 JIRKA-PC dom DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner QUARANTINE
2012/05/23 06:26:47 +0200 JIRKA-PC Fil-kun MESSAGE Starting IP protection
2012/05/23 06:26:47 +0200 JIRKA-PC Fil-kun ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/05/23 06:29:29 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner QUARANTINE
2012/05/23 06:32:29 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner DENY
2012/05/23 06:35:29 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner ALLOW
2012/05/23 07:44:16 +0200 JIRKA-PC dom MESSAGE Starting protection
2012/05/23 07:44:18 +0200 JIRKA-PC (null) MESSAGE Protection started successfully
2012/05/23 07:44:21 +0200 JIRKA-PC (null) MESSAGE Starting IP protection
2012/05/23 07:44:21 +0200 JIRKA-PC (null) ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/05/23 07:44:42 +0200 JIRKA-PC Jirka MESSAGE Starting IP protection
2012/05/23 07:44:42 +0200 JIRKA-PC Jirka ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/05/23 07:47:24 +0200 JIRKA-PC Jirka DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner ALLOW
2012/05/23 16:40:48 +0200 JIRKA-PC Fil-kun MESSAGE Starting protection
2012/05/23 16:40:50 +0200 JIRKA-PC Fil-kun MESSAGE Protection started successfully
2012/05/23 16:40:53 +0200 JIRKA-PC Fil-kun MESSAGE Starting IP protection
2012/05/23 16:40:53 +0200 JIRKA-PC Fil-kun ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
2012/05/23 16:44:23 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner QUARANTINE
2012/05/23 16:47:23 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner DENY
2012/05/23 16:49:14 +0200 JIRKA-PC Fil-kun MESSAGE Executing scheduled update: Daily
2012/05/23 16:49:19 +0200 JIRKA-PC Fil-kun MESSAGE Starting database refresh
2012/05/23 16:49:19 +0200 JIRKA-PC Fil-kun MESSAGE Scheduled update executed successfully: database updated from version v2012.05.22.03 to version v2012.05.23.05
2012/05/23 16:49:21 +0200 JIRKA-PC Fil-kun MESSAGE Database refreshed successfully
2012/05/23 16:50:30 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner QUARANTINE
2012/05/23 16:53:30 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 16:53:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\L\00000008.@ Trojan.BitMiner QUARANTINE
2012/05/23 16:56:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 16:59:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:02:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:05:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:08:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:11:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:14:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:17:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:20:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:23:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:26:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:29:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:32:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:35:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:38:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:41:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:44:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:47:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:50:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:53:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:56:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 17:59:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:02:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:05:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:08:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:11:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:14:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:17:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:20:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:23:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:26:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:29:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:32:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:35:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:38:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:41:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:44:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:47:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:50:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:53:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:56:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 18:59:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 19:02:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 19:05:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 19:08:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 19:11:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 19:14:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 19:17:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY
2012/05/23 19:20:35 +0200 JIRKA-PC Fil-kun DETECTION C:\Windows\Installer\{ed0cacf0-a720-f5e1-ce76-d5588cc33e37}\U\00000008.@ Trojan.Dropper.BCMiner DENY

VIRY.CZ

Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus

Re: Flash player aktualizace - virus