VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Preventivka + dotazy

https://forum.viry.cz:443/viewtopic.php?t=128878

Stránka 1 z 2

Preventivka + dotazy

Napsal: 18 bře 2013 18:56
od draGOn
Dobrý den.

Prosím o kontrolu logu. Děkuji.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Tomáš at 2013-03-18 18:35:48
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 71 GB (45%) free of 160 GB
Total RAM: 4094 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:36:11, on 18.3.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Program Files\trend micro\Tomáš.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [KeePass 2 PreLoad] "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2942648829-1626241122-2352968032-1001\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2942648829-1626241122-2352968032-1001\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7406 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
"C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe"
C:\Windows\System32\spoolsv.exe
"C:\Windows\system32\Dwm.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe"
"C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe"
"C:\Program Files (x86)\Google\Update\1.3.21.135\GoogleCrashHandler.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files (x86)\Google\Update\1.3.21.135\GoogleCrashHandler64.exe"
"C:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe"
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\svchost.exe -k SDRSVC
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
"C:\Program Files\Microsoft Security Client\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey D1B92F36-EC4C-433E-FAA3-F492F2623938 -Reinvoke
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Users\Tomáš\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2012-08-16 6670496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 689040]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~2\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2012-08-16 4171424]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun64"=C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [2009-04-09 320000]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2013-01-27 1281512]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2012-06-11 12503184]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]
"KeePass 2 PreLoad"=C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2013-02-03 1937920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2012-08-16 6670496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2012-08-16 4171424]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"msacm.l3codecp"=l3codecp.acm
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-03-18 18:35:48 ----D---- C:\rsit
2013-03-18 18:35:48 ----D---- C:\Program Files\trend micro
2013-03-13 20:01:12 ----A---- C:\Windows\system32\mshtml.dll
2013-03-13 20:01:10 ----A---- C:\Windows\system32\ieframe.dll
2013-03-13 20:01:08 ----A---- C:\Windows\system32\iertutil.dll
2013-03-13 20:01:07 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-03-13 20:01:06 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-03-13 20:01:05 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-03-13 20:01:05 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-03-13 20:01:05 ----A---- C:\Windows\system32\msfeeds.dll
2013-03-13 20:01:02 ----SHD---- C:\Windows\system32\%APPDATA%
2013-03-13 20:01:02 ----A---- C:\Windows\system32\urlmon.dll
2013-03-13 20:01:01 ----A---- C:\Windows\system32\wininet.dll
2013-03-13 20:01:00 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-03-13 20:00:58 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-03-13 20:00:57 ----A---- C:\Windows\system32\mshtmled.dll
2013-03-13 20:00:56 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2013-03-13 20:00:55 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-03-13 20:00:55 ----A---- C:\Windows\system32\url.dll
2013-03-13 20:00:55 ----A---- C:\Windows\system32\ieui.dll
2013-03-13 20:00:54 ----A---- C:\Windows\SYSWOW64\url.dll
2013-03-13 20:00:54 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-03-13 20:00:54 ----A---- C:\Windows\system32\jsproxy.dll
2013-03-13 19:58:10 ----SHD---- C:\Windows\SYSWOW64\%APPDATA%
2013-03-03 18:46:32 ----D---- C:\Users\Tomáš\AppData\Roaming\Media Player Classic
2013-03-03 18:41:02 ----D---- C:\Program Files (x86)\K-Lite Codec Pack
2013-03-02 11:43:28 ----D---- C:\Program Files (x86)\Loutkove divadlo - Ztracene mesto - Sberatelska Edice
2013-02-27 18:30:18 ----A---- C:\Windows\SYSWOW64\msmpeg2vdec.dll
2013-02-27 18:30:17 ----A---- C:\Windows\SYSWOW64\UIAnimation.dll
2013-02-27 18:30:17 ----A---- C:\Windows\system32\UIAnimation.dll
2013-02-27 18:30:17 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2013-02-27 18:30:12 ----A---- C:\Windows\SYSWOW64\WMPhoto.dll
2013-02-27 18:30:12 ----A---- C:\Windows\system32\WMPhoto.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-02-27 18:30:08 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2013-02-27 18:30:08 ----A---- C:\Windows\SYSWOW64\d3d10_1.dll
2013-02-27 18:30:08 ----A---- C:\Windows\system32\d3d10warp.dll
2013-02-27 18:30:08 ----A---- C:\Windows\system32\d3d10_1.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-02-27 18:30:07 ----A---- C:\Windows\SYSWOW64\XpsGdiConverter.dll
2013-02-27 18:30:07 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2013-02-27 18:30:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-02-27 18:30:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-02-27 18:30:06 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-02-27 18:30:06 ----AH---- C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-02-27 18:30:06 ----A---- C:\Windows\SYSWOW64\dxgi.dll
2013-02-27 18:30:06 ----A---- C:\Windows\SYSWOW64\d3d10level9.dll
2013-02-27 18:30:06 ----A---- C:\Windows\SYSWOW64\d3d10core.dll
2013-02-27 18:30:06 ----A---- C:\Windows\SYSWOW64\d3d10_1core.dll
2013-02-27 18:30:06 ----A---- C:\Windows\system32\dxgi.dll
2013-02-27 18:30:06 ----A---- C:\Windows\system32\d3d10level9.dll
2013-02-27 18:30:06 ----A---- C:\Windows\system32\d3d10core.dll
2013-02-27 18:30:05 ----A---- C:\Windows\SYSWOW64\XpsPrint.dll
2013-02-27 18:30:05 ----A---- C:\Windows\SYSWOW64\d3d11.dll
2013-02-27 18:30:05 ----A---- C:\Windows\SYSWOW64\d3d10.dll
2013-02-27 18:30:05 ----A---- C:\Windows\system32\XpsPrint.dll
2013-02-27 18:30:05 ----A---- C:\Windows\system32\d3d11.dll
2013-02-27 18:30:05 ----A---- C:\Windows\system32\d3d10_1core.dll
2013-02-27 18:30:05 ----A---- C:\Windows\system32\d3d10.dll
2013-02-27 18:30:04 ----A---- C:\Windows\SYSWOW64\WindowsCodecsExt.dll
2013-02-27 18:30:04 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2013-02-27 18:30:04 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2013-02-27 18:30:04 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2013-02-27 18:30:04 ----A---- C:\Windows\system32\FntCache.dll
2013-02-27 18:30:04 ----A---- C:\Windows\system32\DWrite.dll
2013-02-27 18:30:03 ----A---- C:\Windows\SYSWOW64\d2d1.dll
2013-02-27 18:30:03 ----A---- C:\Windows\system32\WindowsCodecs.dll
2013-02-27 18:30:03 ----A---- C:\Windows\system32\d2d1.dll
2013-02-26 22:17:29 ----D---- C:\Users\Tomáš\AppData\Roaming\KeePass
2013-02-26 22:12:29 ----D---- C:\Program Files (x86)\KeePass Password Safe 2
2013-02-20 16:56:11 ----D---- C:\ProgramData\Spybot - Search & Destroy
2013-02-20 16:56:11 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2013-02-20 15:58:58 ----D---- C:\Windows\SYSWOW64\RTCOM
2013-02-20 15:58:58 ----D---- C:\Program Files\Realtek
2013-02-20 15:58:14 ----A---- C:\Windows\system32\WavesGUILib.dll
2013-02-20 15:58:14 ----A---- C:\Windows\system32\tosade.dll
2013-02-20 15:58:14 ----A---- C:\Windows\system32\tepeqapo64.dll
2013-02-20 15:58:14 ----A---- C:\Windows\system32\tadefxapo264.dll
2013-02-20 15:58:13 ----A---- C:\Windows\system32\tadefxapo.dll
2013-02-20 15:58:13 ----A---- C:\Windows\system32\SRSWOW64.dll
2013-02-20 15:58:13 ----A---- C:\Windows\system32\SRSTSX64.dll
2013-02-20 15:58:13 ----A---- C:\Windows\system32\SRSTSH64.dll
2013-02-20 15:58:13 ----A---- C:\Windows\system32\SRSHP64.dll
2013-02-20 15:58:12 ----A---- C:\Windows\SYSWOW64\SFCOM.dll
2013-02-20 15:58:12 ----A---- C:\Windows\system32\SFSS_APO.dll
2013-02-20 15:58:12 ----A---- C:\Windows\system32\SFNHK64.dll
2013-02-20 15:58:12 ----A---- C:\Windows\system32\SFCOM64.dll
2013-02-20 15:58:12 ----A---- C:\Windows\system32\SFAPO64.dll
2013-02-20 15:58:11 ----A---- C:\Windows\system32\RtPgEx64.dll
2013-02-20 15:58:11 ----A---- C:\Windows\system32\RtlCPAPI64.dll
2013-02-20 15:58:11 ----A---- C:\Windows\system32\drivers\RTKVHD64.sys
2013-02-20 15:58:10 ----A---- C:\Windows\system32\RtkCoLDR64.dll
2013-02-20 15:58:10 ----A---- C:\Windows\system32\RtkCfg64.dll
2013-02-20 15:58:10 ----A---- C:\Windows\system32\RtkAPO64.dll
2013-02-20 15:58:10 ----A---- C:\Windows\system32\RtkApi64.dll
2013-02-20 15:58:10 ----A---- C:\Windows\system32\RTEEP64A.dll
2013-02-20 15:58:10 ----A---- C:\Windows\system32\RTEEL64A.dll
2013-02-20 15:58:10 ----A---- C:\Windows\system32\RTEEG64A.dll
2013-02-20 15:58:10 ----A---- C:\Windows\system32\RTEED64A.dll
2013-02-20 15:58:09 ----A---- C:\Windows\system32\RTCOM64.dll
2013-02-20 15:58:09 ----A---- C:\Windows\system32\RP3DHT64.dll
2013-02-20 15:58:09 ----A---- C:\Windows\system32\RP3DAA64.dll
2013-02-20 15:58:09 ----A---- C:\Windows\system32\RCoRes64.dat
2013-02-20 15:58:09 ----A---- C:\Windows\system32\RCoInstII64.dll
2013-02-20 15:58:09 ----A---- C:\Windows\system32\R4EEP64A.dll
2013-02-20 15:58:09 ----A---- C:\Windows\system32\R4EEL64A.dll
2013-02-20 15:58:09 ----A---- C:\Windows\system32\R4EEG64A.dll
2013-02-20 15:58:09 ----A---- C:\Windows\system32\R4EED64A.dll
2013-02-20 15:58:09 ----A---- C:\Windows\system32\drivers\RTAIODAT.DAT
2013-02-20 15:58:08 ----A---- C:\Windows\system32\R4EEA64A.dll
2013-02-20 15:58:08 ----A---- C:\Windows\system32\MaxxVolumeSDAPO.dll
2013-02-20 15:58:08 ----A---- C:\Windows\system32\MaxxAudioRealtek264.dll
2013-02-20 15:58:08 ----A---- C:\Windows\system32\MaxxAudioRealtek.dll
2013-02-20 15:58:08 ----A---- C:\Windows\system32\MaxxAudioEQ.dll
2013-02-20 15:58:07 ----A---- C:\Windows\system32\MaxxAudioAPOShell64.dll
2013-02-20 15:58:07 ----A---- C:\Windows\system32\MaxxAudioAPO30.dll
2013-02-20 15:58:07 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2013-02-20 15:58:07 ----A---- C:\Windows\system32\KAAPORT64.dll
2013-02-20 15:58:05 ----A---- C:\Windows\system32\FMAPO64.dll
2013-02-20 15:58:05 ----A---- C:\Windows\system32\DTSVoiceClarityDLL64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSU2PREC64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSU2PLFX64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSU2PGFX64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSSymmetryDLL64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSS2SpeakerDLL64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSNeoPCDLL64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSLimiterDLL64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSLFXAPO64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSGFXAPONS64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSGFXAPO64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSGainCompensatorDLL64.dll
2013-02-20 15:58:04 ----A---- C:\Windows\system32\DTSBoostDLL64.dll
2013-02-20 15:58:03 ----A---- C:\Windows\system32\DTSBassEnhancementDLL64.dll
2013-02-20 15:58:03 ----A---- C:\Windows\system32\AERTAR64.dll
2013-02-20 15:58:03 ----A---- C:\Windows\system32\AERTAC64.dll
2013-02-20 15:57:59 ----HD---- C:\Program Files (x86)\Temp
2013-02-20 15:57:59 ----A---- C:\Windows\RtlExUpd.dll
2013-02-20 15:54:19 ----A---- C:\Windows\system32\RTNUninst64.dll
2013-02-20 15:54:19 ----A---- C:\Windows\system32\RtNicProp64.dll
2013-02-20 15:54:19 ----A---- C:\Windows\system32\drivers\Rt64win7.sys
2013-02-20 15:54:15 ----D---- C:\Program Files (x86)\Realtek
2013-02-20 15:51:22 ----D---- C:\Program Files (x86)\Intel
2013-02-20 15:51:22 ----A---- C:\Windows\SYSWOW64\CSVer.dll
2013-02-20 15:39:13 ----D---- C:\Users\Tomáš\AppData\Roaming\GHISLER
2013-02-20 15:39:13 ----D---- C:\Program Files\Totalcmd
2013-02-20 15:30:53 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2013-02-20 15:30:24 ----A---- C:\Windows\system32\nvvsvc.exe
2013-02-20 15:30:24 ----A---- C:\Windows\system32\nvsvc64.dll
2013-02-20 15:30:24 ----A---- C:\Windows\system32\nvshext.dll
2013-02-20 15:30:23 ----A---- C:\Windows\system32\nvsvcr.dll
2013-02-20 15:30:23 ----A---- C:\Windows\system32\nvmctray.dll
2013-02-20 15:30:23 ----A---- C:\Windows\system32\nvcpl.dll
2013-02-20 15:29:48 ----A---- C:\Windows\SYSWOW64\OpenCL.dll
2013-02-20 15:29:48 ----A---- C:\Windows\system32\OpenCL.dll
2013-02-20 15:28:28 ----A---- C:\Windows\SYSWOW64\nvopencl.dll
2013-02-20 15:28:28 ----A---- C:\Windows\SYSWOW64\nvoglv32.dll
2013-02-20 15:28:28 ----A---- C:\Windows\system32\nvopencl.dll
2013-02-20 15:28:28 ----A---- C:\Windows\system32\nvoglv64.dll
2013-02-20 15:28:28 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2013-02-20 15:28:27 ----A---- C:\Windows\SYSWOW64\nvcuvid.dll
2013-02-20 15:28:27 ----A---- C:\Windows\SYSWOW64\nvcuvenc.dll
2013-02-20 15:28:27 ----A---- C:\Windows\SYSWOW64\nvcuda.dll
2013-02-20 15:28:27 ----A---- C:\Windows\system32\nvdispgenco64.dll
2013-02-20 15:28:27 ----A---- C:\Windows\system32\nvdispco64.dll
2013-02-20 15:28:27 ----A---- C:\Windows\system32\nvcuvid.dll
2013-02-20 15:28:27 ----A---- C:\Windows\system32\nvcuvenc.dll
2013-02-20 15:28:27 ----A---- C:\Windows\system32\nvcuda.dll
2013-02-20 15:28:24 ----A---- C:\Windows\SYSWOW64\nvcompiler.dll
2013-02-20 15:28:24 ----A---- C:\Windows\SYSWOW64\nvapi.dll
2013-02-20 15:28:24 ----A---- C:\Windows\system32\nvcompiler.dll
2013-02-20 15:28:24 ----A---- C:\Windows\system32\nvapi64.dll
2013-02-20 15:11:37 ----A---- C:\Windows\system32\ntoskrnl.exe
2013-02-20 15:11:35 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2013-02-20 15:11:34 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2013-02-20 15:11:21 ----A---- C:\Windows\system32\win32k.sys
2013-02-20 15:10:49 ----A---- C:\Windows\system32\winsrv.dll
2013-02-20 15:10:47 ----A---- C:\Windows\SYSWOW64\wow32.dll
2013-02-20 15:10:47 ----A---- C:\Windows\SYSWOW64\setup16.exe
2013-02-20 15:10:47 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2013-02-20 15:10:47 ----A---- C:\Windows\SYSWOW64\instnm.exe
2013-02-20 15:10:46 ----A---- C:\Windows\SYSWOW64\user.exe
2013-02-20 15:09:11 ----A---- C:\Windows\system32\drivers\tcpip.sys
2013-02-20 15:09:11 ----A---- C:\Windows\system32\drivers\FWPKCLNT.SYS
2013-02-20 14:31:41 ----D---- C:\ProgramData\SoftSafe
2013-02-20 14:31:26 ----D---- C:\ProgramData\BetterSoft
2013-02-20 14:31:16 ----D---- C:\ProgramData\continuetosave
2013-02-20 14:17:27 ----D---- C:\ProgramData\NVIDIA
2013-02-20 14:11:47 ----D---- C:\ProgramData\NVIDIA Corporation
2013-02-20 14:11:39 ----D---- C:\Program Files\NVIDIA Corporation

======List of files/folders modified in the last 1 month======

2013-03-18 18:36:01 ----D---- C:\Windows\Prefetch
2013-03-18 18:35:48 ----RD---- C:\Program Files
2013-03-18 18:35:23 ----D---- C:\Windows\Temp
2013-03-18 18:28:20 ----D---- C:\Windows\system32\config
2013-03-18 18:27:38 ----D---- C:\Windows
2013-03-18 15:42:39 ----D---- C:\Windows\inf
2013-03-18 15:42:39 ----D---- C:\Windows\debug
2013-03-17 19:00:30 ----SHD---- C:\System Volume Information
2013-03-17 11:32:54 ----D---- C:\Windows\system32\catroot2
2013-03-16 16:49:42 ----D---- C:\Windows\rescache
2013-03-14 06:18:42 ----D---- C:\Windows\winsxs
2013-03-14 06:17:09 ----D---- C:\Windows\SYSWOW64\migration
2013-03-14 06:17:09 ----D---- C:\Windows\SysWOW64
2013-03-14 06:17:09 ----D---- C:\Windows\system32\migration
2013-03-14 06:17:09 ----D---- C:\Windows\System32
2013-03-14 06:17:09 ----D---- C:\Program Files\Internet Explorer
2013-03-14 06:17:09 ----D---- C:\Program Files (x86)\Internet Explorer
2013-03-14 06:17:08 ----D---- C:\Windows\AppPatch
2013-03-14 06:13:58 ----SHD---- C:\Windows\Installer
2013-03-14 06:13:42 ----D---- C:\ProgramData\Microsoft Help
2013-03-14 06:10:29 ----A---- C:\Windows\system32\MRT.exe
2013-03-14 06:04:15 ----D---- C:\Program Files\Microsoft Silverlight
2013-03-14 06:04:12 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2013-03-13 19:59:45 ----D---- C:\Windows\system32\catroot
2013-03-04 18:46:20 ----SD---- C:\Users\Tomáš\AppData\Roaming\Microsoft
2013-03-04 18:34:49 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-03-03 18:41:02 ----RD---- C:\Program Files (x86)
2013-03-03 18:33:06 ----D---- C:\Windows\SoftwareDistribution
2013-03-03 18:25:08 ----HD---- C:\ProgramData
2013-03-03 18:10:18 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-03-03 18:07:06 ----D---- C:\Windows\Tasks
2013-03-03 18:07:06 ----D---- C:\Windows\system32\Tasks
2013-03-02 11:47:11 ----D---- C:\Users\Tomáš\AppData\Roaming\ERS Game Studios
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\zh-TW
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\zh-HK
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\tr-TR
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\sv-SE
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\pt-PT
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\pt-BR
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\pl-PL
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\nl-NL
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\ko-KR
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\it-IT
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\hu-HU
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\fr-FR
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\fi-FI
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\es-ES
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\el-GR
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\de-DE
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\zh-CN
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\ru-RU
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\nb-NO
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\ja-JP
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\en-US
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\da-DK
2013-02-27 18:44:43 ----D---- C:\Windows\system32\zh-HK
2013-02-27 18:44:43 ----D---- C:\Windows\system32\pt-PT
2013-02-27 18:44:43 ----D---- C:\Windows\system32\pt-BR
2013-02-27 18:44:43 ----D---- C:\Windows\system32\pl-PL
2013-02-27 18:44:43 ----D---- C:\Windows\system32\ko-KR
2013-02-27 18:44:43 ----D---- C:\Windows\system32\it-IT
2013-02-27 18:44:43 ----D---- C:\Windows\system32\hu-HU
2013-02-27 18:44:43 ----D---- C:\Windows\system32\el-GR
2013-02-27 18:44:42 ----D---- C:\Windows\system32\zh-TW
2013-02-27 18:44:42 ----D---- C:\Windows\system32\zh-CN
2013-02-27 18:44:42 ----D---- C:\Windows\system32\tr-TR
2013-02-27 18:44:42 ----D---- C:\Windows\system32\sv-SE
2013-02-27 18:44:42 ----D---- C:\Windows\system32\ru-RU
2013-02-27 18:44:42 ----D---- C:\Windows\system32\nl-NL
2013-02-27 18:44:42 ----D---- C:\Windows\system32\ja-JP
2013-02-27 18:44:42 ----D---- C:\Windows\system32\fr-FR
2013-02-27 18:44:42 ----D---- C:\Windows\system32\fi-FI
2013-02-27 18:44:42 ----D---- C:\Windows\system32\es-ES
2013-02-27 18:44:42 ----D---- C:\Windows\system32\de-DE
2013-02-27 18:44:42 ----D---- C:\Windows\system32\cs-CZ
2013-02-27 18:44:41 ----D---- C:\Windows\system32\nb-NO
2013-02-27 18:44:41 ----D---- C:\Windows\system32\en-US
2013-02-27 18:44:41 ----D---- C:\Windows\system32\da-DK
2013-02-26 22:12:44 ----RSD---- C:\Windows\assembly
2013-02-26 21:59:39 ----D---- C:\Program Files (x86)\DsNET Corp
2013-02-26 21:58:33 ----D---- C:\Program Files (x86)\Loutkove divadlo - Zahada Stestikova
2013-02-26 21:57:33 ----D---- C:\Program Files (x86)\Pikova dama - Sberatelska edice
2013-02-26 19:52:53 ----D---- C:\Program Files (x86)\Sanatorium Green Hills - Sberatelska edice
2013-02-26 19:52:24 ----D---- C:\Program Files (x86)\Fantom - Zlocin v Benatkach - Sberatelska edice
2013-02-26 19:51:05 ----D---- C:\Program Files (x86)\Loutkove divadlo - Nevinne duse
2013-02-26 19:50:37 ----D---- C:\Program Files (x86)\Posledni jednorozec
2013-02-26 19:50:27 ----D---- C:\Program Files (x86)\Vykutalena kouzla
2013-02-26 19:49:55 ----D---- C:\Program Files (x86)\Zachvev - Ztracena stoparka
2013-02-26 19:48:07 ----D---- C:\Windows\Logs
2013-02-26 18:02:24 ----D---- C:\ProgramData\Adobe
2013-02-22 15:05:04 ----D---- C:\Windows\system32\drivers\etc
2013-02-20 17:17:25 ----D---- C:\Windows\Microsoft.NET
2013-02-20 16:26:12 ----D---- C:\Windows\system32\drivers
2013-02-20 16:13:59 ----D---- C:\Program Files\Microsoft Security Client
2013-02-20 16:13:58 ----D---- C:\Program Files (x86)\Microsoft Security Client
2013-02-20 15:58:50 ----D---- C:\Windows\system32\DriverStore
2013-02-20 15:58:03 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2013-02-20 15:57:53 ----D---- C:\Program Files (x86)\Common Files
2013-02-20 15:30:56 ----RD---- C:\Users
2013-02-20 15:30:16 ----D---- C:\Windows\Help
2013-02-20 15:02:53 ----D---- C:\Windows\system32\wbem
2013-02-20 15:01:56 ----RSD---- C:\Windows\Media
2013-02-20 15:01:56 ----D---- C:\Windows\system32\wfp
2013-02-20 15:01:55 ----D---- C:\Windows\system32\Macromed
2013-02-20 15:01:55 ----D---- C:\Windows\system32\CodeIntegrity
2013-02-20 15:01:44 ----D---- C:\Program Files\Common Files\Microsoft Shared
2013-02-20 15:01:27 ----D---- C:\Windows\registration
2013-02-20 14:35:32 ----D---- C:\Windows\LiveKernelReports

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-01-20 230320]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-06-19 4065296]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-09-29 646248]
S2 WCMVCAM;WebcamMax, WDM Video Capture; C:\Windows\system32\DRIVERS\wcmvcam64.sys [2012-04-15 1071032]
S3 AmUStor;AM USB Stroage Driver; C:\Windows\system32\drivers\AmUStor.SYS [2009-05-26 40448]
S3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-06-27 2753536]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-07-30 6038016]
S3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E62x64.sys [2009-08-23 56320]
S3 MOSUMAC;USB-Ethernet Driver; C:\Windows\system32\DRIVERS\USBMAC64.SYS [2012-04-10 48640]
S3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATK64AMD.sys [2007-08-09 13680]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-07-29 203264]
R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe [2009-06-15 84536]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-01-27 22056]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-01-03 878520]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2013-01-03 1259448]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 136176]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 136176]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2012-09-20 30785672]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-08-10 1255736]

-----------------EOF-----------------

Re: Preventivka + dotazy

Napsal: 18 bře 2013 22:11
od Roli
Zdravím, v první řadě přes Odebrat programy odinstaluj Spybot S&D který je už za zenitem.


Smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

čištění registru je třeba několikrát zopakovat !

Nástroje - tady lze odinstalovat programy, upravit co se spustí po Startu systému a obnovit systém


Přes Start >> Všechny programy >> Příslušenství >> Spustit >> napiš - services.msc >> Enter. Najdi službu :

Služba Google Update (gupdate)

Služba Google Update (gupdatem)

NVIDIA Update Service Daemon

dvojklikem se otevře karta kde nejprve službu zastav tlačítkem Zastavit u položky Typ spouštění vyber Zakázáno a klik na OK.


Jinak v pořádku a co ty dotazy ?

Re: Preventivka + dotazy

Napsal: 18 bře 2013 22:36
od draGOn
První je ohledně Spybotu – při odinstalaci na mě vyklopil tohle
Obrázek

Dále chci vyměnit Microsoft Security Essentials za buď Aviru (free) nebo AVAST (free). Co byste doporučil vy, popř. napsal plusy a mínusy.

Znáte nějaký dobrý program na vyhledávání aktualizací?

Re: Preventivka + dotazy

Napsal: 19 bře 2013 21:25
od Roli
Kompletní odinstalaci Spybot potvrď kliknutím na ano.

Jako antivir bych doporučil nový Avast 8, minimálně zatěžuje PC a na to že je free má slušnou detekci.

Avira je cizojazyčná, občas otravuje reklamama, mívá nemístné hlášky kterým laik nerozumí.

Co se týče programu na vyhledávání aktualizací, osobně nepotřebuji žádný protože :

systém se aktualizuje sám

antivir také

no a co jiného je tak důležitého, že bych musel k vůli tomu mít nějaký softík který to ohlídá ?

Že by grafika ?

Jiný kus hardware ?

Tolik toho v PC zase není abych když bude potřeba tohle nezvládl ručně.

Re: Preventivka + dotazy

Napsal: 19 bře 2013 22:14
od draGOn
Stalo se tohle
Obrázek

:arrow: Jdu provést, co jste mi napsal v 1. příspěvku.

:arrow: Díky za tip na antivir :) Jdu nainstalovat AVAST.

:arrow: A když jsem nad tím popřemýšlel, tak máte pravdu s tím, že je soft na hledání aktualizací nepotřebný. Stejně by to bylo jen na pár programů.

Další várka dotazů:
• V jaké kvalitě si myslíte, že půjdou přehrávat bez sekání filmy a videa na YT, když mám procesor Intel Pentium E2180 2 GHz a 4 GB RAM?
• Když si změním uživatelské jméno (myslím to, co je např. zde: Run by Tomáš at 2013-03-18 18:35:48) přes control userpasswords2, je to bezpečné?

Re: Preventivka + dotazy

Napsal: 19 bře 2013 22:27
od draGOn
► Připadá vám něco z následujících programů jako zbytečnost? (Je to výpis programů z CCleaneru. Ty co používám jsem tu nenapsal.)

7-Zip 9.20 (x64 edition) Igor Pavlov 12.8.2012 4,53MB 9.20.00.0
Aktualizace NVIDIA 1.10.8 NVIDIA Corporation 20.2.2013 1.10.8
Alcor Micro USB Card Reader Alcor Micro Corp. 12.8.2012 2,86MB 1.2.17.25001
ATK Hotkey ASUS 12.8.2012 5,74MB 1.0.0052
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 12.8.2012 38,8MB 4.0.30319
Microsoft .NET Framework 4 Client Profile CSY Language Pack Microsoft Corporation 12.8.2012 2,93MB 4.0.30319
Microsoft Games for Windows - LIVE Redistributable Microsoft Corporation 29.8.2012 28,3MB 1.2.0241
Microsoft Silverlight Microsoft Corporation 13.3.2013 100MB 5.1.20125.0
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 12.8.2012 708KB 8.0.61000
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Corporation 29.8.2012 2,06MB 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 14.9.2012 598KB 9.0.30729.6161
NVIDIA Ovladače grafiky 307.74 NVIDIA Corporation 20.2.2013 307.74
Realtek Ethernet Controller Driver Realtek 20.2.2013 7.49.927.2011
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 20.2.2013 6.0.1.6662
Total Commander 64-bit (Remove or Repair) Ghisler Software GmbH 20.2.2013 8.01

Re: Preventivka + dotazy

Napsal: 20 bře 2013 22:18
od Roli
draGOn píše:Stalo se tohle
Obrázek
To doladíme, dej mi sem aktuální log z Rsit podívám se co tam zůstalo.
draGOn píše:Další várka dotazů:
• V jaké kvalitě si myslíte, že půjdou přehrávat bez sekání filmy a videa na YT, když mám procesor Intel Pentium E2180 2 GHz a 4 GB RAM?
Ono tohle není až tak o hardware i když grafika na to má trochu vliv, ale hlavně o rychlosti netu.
draGOn píše:Další várka dotazů:
• Když si změním uživatelské jméno (myslím to, co je např. zde: Run by Tomáš at 2013-03-18 18:35:48) přes control userpasswords2, je to bezpečné?
V PC nemám nic tak tajného abych ho musel zabezpečovat heslem či měnit jméno, jinak ano je to bezpečné.
draGOn píše:► Připadá vám něco z následujících programů jako zbytečnost?
Vypsaný softík je buď součástí systému nebo jsou to ovladače od hardware tak že ponechat, vyjma :

7-Zip - který je potřebný pro rozbalování archívů - ponechal bych

Total Commander - trochu jiný tip průzkumníka - jestliže nepoužíváš odinstalovat

Re: Preventivka + dotazy

Napsal: 23 bře 2013 22:02
od draGOn
aktuální log z RSIT
Logfile of random's system information tool 1.09 (written by random/random)
Run by BM-draGOn at 2013-03-23 21:56:40
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 69 GB (43%) free of 160 GB
Total RAM: 4094 MB (71% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:56:55, on 23.3.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Program Files\trend micro\BM-draGOn.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6084 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe"
atieclxx
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Windows\system32\Dwm.exe"
"taskhost.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Microsoft Security Client\NisSrv.exe"
"C:\Program Files (x86)\Google\Update\1.3.21.135\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.21.135\GoogleCrashHandler64.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
taskeng.exe {480D9BFD-ADDB-4D46-8314-847C2B11C913}
C:\Windows\system32\sppsvc.exe
C:\Windows\servicing\TrustedInstaller.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
C:\Windows\system32\svchost.exe -k SDRSVC
"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Users\Tomáš\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2012-08-16 6670496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2010-12-21 689040]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2012-08-16 4171424]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-12-21 561552]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun64"=C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [2009-04-09 320000]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2013-01-27 1281512]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2012-06-11 12503184]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KeePass 2 PreLoad]
C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2013-02-03 1937920]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-03-13 91520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2012-08-16 6670496]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2012-08-16 4171424]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"msacm.l3codecp"=l3codecp.acm
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-03-20 22:00:36 ----A---- C:\Windows\system32\drivers\usb8023.sys
2013-03-19 16:38:01 ----D---- C:\Program Files (x86)\Cerny kocour - Sberatelska edice
2013-03-18 18:35:48 ----D---- C:\rsit
2013-03-18 18:35:48 ----D---- C:\Program Files\trend micro
2013-03-13 20:01:12 ----A---- C:\Windows\system32\mshtml.dll
2013-03-13 20:01:10 ----A---- C:\Windows\system32\ieframe.dll
2013-03-13 20:01:08 ----A---- C:\Windows\system32\iertutil.dll
2013-03-13 20:01:07 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-03-13 20:01:06 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-03-13 20:01:05 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-03-13 20:01:05 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-03-13 20:01:05 ----A---- C:\Windows\system32\msfeeds.dll
2013-03-13 20:01:02 ----SHD---- C:\Windows\system32\%APPDATA%
2013-03-13 20:01:02 ----A---- C:\Windows\system32\urlmon.dll
2013-03-13 20:01:01 ----A---- C:\Windows\system32\wininet.dll
2013-03-13 20:01:00 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-03-13 20:00:58 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-03-13 20:00:57 ----A---- C:\Windows\system32\mshtmled.dll
2013-03-13 20:00:56 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2013-03-13 20:00:55 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-03-13 20:00:55 ----A---- C:\Windows\system32\url.dll
2013-03-13 20:00:55 ----A---- C:\Windows\system32\ieui.dll
2013-03-13 20:00:54 ----A---- C:\Windows\SYSWOW64\url.dll
2013-03-13 20:00:54 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-03-13 20:00:54 ----A---- C:\Windows\system32\jsproxy.dll
2013-03-13 19:58:10 ----SHD---- C:\Windows\SYSWOW64\%APPDATA%
2013-03-02 11:43:28 ----D---- C:\Program Files (x86)\Loutkove divadlo - Ztracene mesto - Sberatelska Edice
2013-02-27 18:30:18 ----A---- C:\Windows\SYSWOW64\msmpeg2vdec.dll
2013-02-27 18:30:17 ----A---- C:\Windows\SYSWOW64\UIAnimation.dll
2013-02-27 18:30:17 ----A---- C:\Windows\system32\UIAnimation.dll
2013-02-27 18:30:17 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2013-02-27 18:30:12 ----A---- C:\Windows\SYSWOW64\WMPhoto.dll
2013-02-27 18:30:12 ----A---- C:\Windows\system32\WMPhoto.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-02-27 18:30:08 ----AH---- C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-02-27 18:30:08 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2013-02-27 18:30:08 ----A---- C:\Windows\SYSWOW64\d3d10_1.dll
2013-02-27 18:30:08 ----A---- C:\Windows\system32\d3d10warp.dll
2013-02-27 18:30:08 ----A---- C:\Windows\system32\d3d10_1.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-02-27 18:30:07 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-02-27 18:30:07 ----A---- C:\Windows\SYSWOW64\XpsGdiConverter.dll
2013-02-27 18:30:07 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2013-02-27 18:30:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-02-27 18:30:06 ----AH---- C:\Windows\SYSWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-02-27 18:30:06 ----AH---- C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-02-27 18:30:06 ----AH---- C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-02-27 18:30:06 ----A---- C:\Windows\SYSWOW64\dxgi.dll
2013-02-27 18:30:06 ----A---- C:\Windows\SYSWOW64\d3d10level9.dll
2013-02-27 18:30:06 ----A---- C:\Windows\SYSWOW64\d3d10core.dll
2013-02-27 18:30:06 ----A---- C:\Windows\SYSWOW64\d3d10_1core.dll
2013-02-27 18:30:06 ----A---- C:\Windows\system32\dxgi.dll
2013-02-27 18:30:06 ----A---- C:\Windows\system32\d3d10level9.dll
2013-02-27 18:30:06 ----A---- C:\Windows\system32\d3d10core.dll
2013-02-27 18:30:05 ----A---- C:\Windows\SYSWOW64\XpsPrint.dll
2013-02-27 18:30:05 ----A---- C:\Windows\SYSWOW64\d3d11.dll
2013-02-27 18:30:05 ----A---- C:\Windows\SYSWOW64\d3d10.dll
2013-02-27 18:30:05 ----A---- C:\Windows\system32\XpsPrint.dll
2013-02-27 18:30:05 ----A---- C:\Windows\system32\d3d11.dll
2013-02-27 18:30:05 ----A---- C:\Windows\system32\d3d10_1core.dll
2013-02-27 18:30:05 ----A---- C:\Windows\system32\d3d10.dll
2013-02-27 18:30:04 ----A---- C:\Windows\SYSWOW64\WindowsCodecsExt.dll
2013-02-27 18:30:04 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2013-02-27 18:30:04 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2013-02-27 18:30:04 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2013-02-27 18:30:04 ----A---- C:\Windows\system32\FntCache.dll
2013-02-27 18:30:04 ----A---- C:\Windows\system32\DWrite.dll
2013-02-27 18:30:03 ----A---- C:\Windows\SYSWOW64\d2d1.dll
2013-02-27 18:30:03 ----A---- C:\Windows\system32\WindowsCodecs.dll
2013-02-27 18:30:03 ----A---- C:\Windows\system32\d2d1.dll
2013-02-26 22:17:29 ----D---- C:\Users\Tomáš\AppData\Roaming\KeePass
2013-02-26 22:12:29 ----D---- C:\Program Files (x86)\KeePass Password Safe 2

======List of files/folders modified in the last 1 month======

2013-03-23 21:56:11 ----D---- C:\Windows\Temp
2013-03-23 21:53:56 ----D---- C:\Windows\system32\config
2013-03-23 21:53:13 ----D---- C:\Windows\SoftwareDistribution
2013-03-23 21:52:37 ----D---- C:\Windows
2013-03-23 21:46:59 ----D---- C:\Windows\inf
2013-03-23 21:43:49 ----RD---- C:\Program Files (x86)
2013-03-23 21:42:58 ----RD---- C:\Program Files
2013-03-23 21:42:57 ----D---- C:\Users\Tomáš\AppData\Roaming\GHISLER
2013-03-23 18:49:47 ----D---- C:\Windows\Prefetch
2013-03-21 13:12:04 ----D---- C:\Windows\System32
2013-03-21 13:12:04 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-03-21 07:39:18 ----D---- C:\Windows\winsxs
2013-03-21 07:37:55 ----D---- C:\Windows\system32\drivers
2013-03-21 07:37:54 ----D---- C:\Windows\system32\DriverStore
2013-03-21 01:38:48 ----SHD---- C:\System Volume Information
2013-03-20 22:00:07 ----D---- C:\Windows\system32\catroot2
2013-03-20 22:00:07 ----D---- C:\Windows\system32\catroot
2013-03-19 21:42:02 ----D---- C:\ProgramData\Spybot - Search & Destroy
2013-03-19 21:42:02 ----D---- C:\Program Files (x86)\Spybot - Search & Destroy
2013-03-19 17:11:42 ----D---- C:\Users\Tomáš\AppData\Roaming\ERS Game Studios
2013-03-18 18:45:33 ----SD---- C:\Users\Tomáš\AppData\Roaming\Microsoft
2013-03-18 18:45:32 ----SD---- C:\ProgramData\Microsoft
2013-03-18 15:42:39 ----D---- C:\Windows\debug
2013-03-16 16:49:42 ----D---- C:\Windows\rescache
2013-03-14 06:17:09 ----D---- C:\Windows\SYSWOW64\migration
2013-03-14 06:17:09 ----D---- C:\Windows\SysWOW64
2013-03-14 06:17:09 ----D---- C:\Windows\system32\migration
2013-03-14 06:17:09 ----D---- C:\Program Files\Internet Explorer
2013-03-14 06:17:09 ----D---- C:\Program Files (x86)\Internet Explorer
2013-03-14 06:17:08 ----D---- C:\Windows\AppPatch
2013-03-14 06:13:58 ----SHD---- C:\Windows\Installer
2013-03-14 06:13:42 ----D---- C:\ProgramData\Microsoft Help
2013-03-14 06:10:29 ----A---- C:\Windows\system32\MRT.exe
2013-03-14 06:04:15 ----D---- C:\Program Files\Microsoft Silverlight
2013-03-14 06:04:12 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2013-03-03 18:25:08 ----HD---- C:\ProgramData
2013-03-03 18:10:18 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-03-03 18:07:06 ----D---- C:\Windows\Tasks
2013-03-03 18:07:06 ----D---- C:\Windows\system32\Tasks
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\zh-TW
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\zh-HK
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\tr-TR
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\sv-SE
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\pt-PT
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\pt-BR
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\pl-PL
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\nl-NL
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\ko-KR
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\it-IT
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\hu-HU
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\fr-FR
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\fi-FI
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\es-ES
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\el-GR
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\de-DE
2013-02-27 18:44:46 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\zh-CN
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\ru-RU
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\nb-NO
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\ja-JP
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\en-US
2013-02-27 18:44:45 ----D---- C:\Windows\SYSWOW64\da-DK
2013-02-27 18:44:43 ----D---- C:\Windows\system32\zh-HK
2013-02-27 18:44:43 ----D---- C:\Windows\system32\pt-PT
2013-02-27 18:44:43 ----D---- C:\Windows\system32\pt-BR
2013-02-27 18:44:43 ----D---- C:\Windows\system32\pl-PL
2013-02-27 18:44:43 ----D---- C:\Windows\system32\ko-KR
2013-02-27 18:44:43 ----D---- C:\Windows\system32\it-IT
2013-02-27 18:44:43 ----D---- C:\Windows\system32\hu-HU
2013-02-27 18:44:43 ----D---- C:\Windows\system32\el-GR
2013-02-27 18:44:42 ----D---- C:\Windows\system32\zh-TW
2013-02-27 18:44:42 ----D---- C:\Windows\system32\zh-CN
2013-02-27 18:44:42 ----D---- C:\Windows\system32\tr-TR
2013-02-27 18:44:42 ----D---- C:\Windows\system32\sv-SE
2013-02-27 18:44:42 ----D---- C:\Windows\system32\ru-RU
2013-02-27 18:44:42 ----D---- C:\Windows\system32\nl-NL
2013-02-27 18:44:42 ----D---- C:\Windows\system32\ja-JP
2013-02-27 18:44:42 ----D---- C:\Windows\system32\fr-FR
2013-02-27 18:44:42 ----D---- C:\Windows\system32\fi-FI
2013-02-27 18:44:42 ----D---- C:\Windows\system32\es-ES
2013-02-27 18:44:42 ----D---- C:\Windows\system32\de-DE
2013-02-27 18:44:42 ----D---- C:\Windows\system32\cs-CZ
2013-02-27 18:44:41 ----D---- C:\Windows\system32\nb-NO
2013-02-27 18:44:41 ----D---- C:\Windows\system32\en-US
2013-02-27 18:44:41 ----D---- C:\Windows\system32\da-DK
2013-02-26 22:12:44 ----RSD---- C:\Windows\assembly
2013-02-26 21:59:39 ----D---- C:\Program Files (x86)\DsNET Corp
2013-02-26 21:58:33 ----D---- C:\Program Files (x86)\Loutkove divadlo - Zahada Stestikova
2013-02-26 21:57:33 ----D---- C:\Program Files (x86)\Pikova dama - Sberatelska edice
2013-02-26 19:52:53 ----D---- C:\Program Files (x86)\Sanatorium Green Hills - Sberatelska edice
2013-02-26 19:52:24 ----D---- C:\Program Files (x86)\Fantom - Zlocin v Benatkach - Sberatelska edice
2013-02-26 19:51:05 ----D---- C:\Program Files (x86)\Loutkove divadlo - Nevinne duse
2013-02-26 19:50:37 ----D---- C:\Program Files (x86)\Posledni jednorozec
2013-02-26 19:50:27 ----D---- C:\Program Files (x86)\Vykutalena kouzla
2013-02-26 19:49:55 ----D---- C:\Program Files (x86)\Zachvev - Ztracena stoparka
2013-02-26 19:48:07 ----D---- C:\Windows\Logs
2013-02-26 18:02:24 ----D---- C:\ProgramData\Adobe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2013-01-20 230320]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-06-19 4065296]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-09-29 646248]
S2 WCMVCAM;WebcamMax, WDM Video Capture; C:\Windows\system32\DRIVERS\wcmvcam64.sys [2012-04-15 1071032]
S3 AmUStor;AM USB Stroage Driver; C:\Windows\system32\drivers\AmUStor.SYS [2009-05-26 40448]
S3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2011-06-27 2753536]
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2009-07-30 6038016]
S3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E62x64.sys [2009-08-23 56320]
S3 MOSUMAC;USB-Ethernet Driver; C:\Windows\system32\DRIVERS\USBMAC64.SYS [2012-04-10 48640]
S3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATK64AMD.sys [2007-08-09 13680]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2009-07-29 203264]
R2 ASLDRService;ASLDR Service; C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe [2009-06-15 84536]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2013-01-27 22056]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-01-03 878520]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2012-09-20 30785672]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-08-10 1255736]
S4 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 136176]
S4 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 136176]
S4 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2013-01-03 1259448]

-----------------EOF-----------------

Re: Preventivka + dotazy

Napsal: 23 bře 2013 22:59
od Roli
Stáhni a spusť OTMoveIt

do levého okna aplikace pod Paste Instructions for Items to be Moved zkopíruj tento text:

Kód: Vybrat vše

:processes
explorer.exe       

:files 
C:\*.tmp
C:\WINDOWS\System32\*.tmp
C:\WINDOWS\*.tmp
C:\ProgramData\Spybot - Search & Destroy
C:\Program Files (x86)\Spybot - Search & Destroy

:commands
[purity]
[emptytemp]
[start explorer]
klikni na MoveIt! a v pravém zeleném okně aplikace se Ti objeví info o provedene akci, obsah okna zkopíruj sem,

pokud aplikace bude požadovat restart, klikni na YES

v tom případě sem chci zkopírovat obsah logu uloženého na C:\_OTMoveIt\MovedFiles\

Re: Preventivka + dotazy

Napsal: 24 bře 2013 10:00
od draGOn
Restart proběhl.
Log:

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
File/Folder C:\*.tmp not found.
File/Folder C:\WINDOWS\System32\*.tmp not found.
File/Folder C:\WINDOWS\*.tmp not found.
C:\ProgramData\Spybot - Search & Destroy\Recovery folder moved successfully.
C:\ProgramData\Spybot - Search & Destroy\Logs folder moved successfully.
C:\ProgramData\Spybot - Search & Destroy folder moved successfully.
C:\Program Files (x86)\Spybot - Search & Destroy\Help folder moved successfully.
C:\Program Files (x86)\Spybot - Search & Destroy folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Tomáš
->Temp folder emptied: 268240 bytes
->Temporary Internet Files folder emptied: 229912 bytes
->Google Chrome cache emptied: 49756180 bytes
->Flash cache emptied: 506 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6678 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33448 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50702 bytes
RecycleBin emptied: 935175 bytes

Total Files Cleaned = 49,00 mb


OTM by OldTimer - Version 3.1.21.0 log created on 03242013_094408

Files moved on Reboot...
C:\Users\Tomáš\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Re: Preventivka + dotazy

Napsal: 24 bře 2013 20:56
od Roli
Znovu spusť OTMoveIt a nahoře v aplikaci klini na CleanUP!

tímto po sobě uklidí.


Pak dej vědět jaký je stav PC.

Re: Preventivka + dotazy

Napsal: 24 bře 2013 21:58
od draGOn
Po úklidu proběhl restart. PC je OK.
User: Tomáš
Vidím, že to je stejně takhle, takže to asi vrátím na Tomáš. Co myslíte vy?

Re: Preventivka + dotazy

Napsal: 25 bře 2013 21:03
od Roli
draGOn píše:
User: Tomáš
Vidím, že to je stejně takhle, takže to asi vrátím na Tomáš. Co myslíte vy?
Tohle je na Tobě :)
draGOn píše:PC je OK.
V tom případě je to z mé strany vše.

Re: Preventivka + dotazy

Napsal: 26 bře 2013 15:52
od draGOn
No, teď se snažím si udělat pořádek v dokumentech apod. Je tu naprostý chaos. Potřeboval bych s tím pomoct, abych nesmazal něco systémového. Mám pokračovat v tomto tématu, nebo v sekci Operační systémy a utility pro opravu anebo se dotazy tohoto typu na tohle fórum nehodí?

Re: Preventivka + dotazy

Napsal: 26 bře 2013 21:51
od Roli
V dokumentech by nic systémového být nemělo, ale pro klid duše udělej Print Screen a obrázek sem vlož

nebo někam nahraj, kouknu na to.
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz