VIRY.CZ

omlouvám se za chybu v logu... posílám nový

Zdravím, prosím o preventivní kontrolu. Eset našel viry v java.exe BAT/CoinMiner a v java cache exploit.agent.omi. Je to tím, že jsem vlezl na infikovanou webovou stránku kde se chtěla spustit java. Při výběru jsem dal nespuštět.

Logfile of random's system information tool 1.09 (written by random/random)
Run by Gastovsky at 2013-06-09 14:26:13
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 9 GB (17%) free of 55 GB
Total RAM: 8157 MB (74% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:26:20, on 9.6.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16483)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Media Key\MagicKey.exe
C:\Program Files (x86)\Media Key\OSD.exe
C:\Program Files (x86)\Trillian\trillian.exe
C:\Program Files\trend micro\Gastovsky.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 212.233.184.189:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe
O4 - Global Startup: GamePark klient 2.lnk = C:\Program Files\GamePark2\gpcl.exe
O4 - Global Startup: Media Key.lnk = C:\Program Files (x86)\Media Key\MagicKey.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O20 - AppInit_DLLs:
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: COMODO Virtual Service Manager (cmdvirth) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) ME Service - Unknown owner - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8852 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe"
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Logitech\SetPointP\SetPoint.exe" /launchGaming
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
"C:\Program Files\COMODO\COMODO Internet Security\cistray.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
KHALMNPR.EXE /API
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files (x86)\PowerISO\PWRISOVM.EXE" -startup
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Media Key\MagicKey.exe"
"C:\Program Files (x86)\Media Key\OSD.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-16318793-9ab1-441b-9678-df8e7ff9754e -SystemEventPortName:HostProcess-f57ce469-aa9a-4941-8987-932ad3ae7b85 -IoCancelEventPortName:HostProcess-5b94a817-3d3c-49ca-8c7b-64ddefdabbd0 -NonStateChangingEventPortName:HostProcess-578e96b3-206d-4a3f-bf75-a4ae17bdfb70 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:79c8fe59-51a9-4d0c-88ba-421a1a24e2c5 -DeviceGroupId:WpdFsGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe" /ModeAvMonitor -Embedding
"C:\Program Files (x86)\Trillian\trillian.exe"
"C:\Program Files\COMODO\COMODO Internet Security\cis.exe" --alertsUI
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe8_ Global\UsGthrCtrlFltPipeMssGthrPipe8 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 812 816 824 65536 820
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
"F:\Downloady\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Gastovsky\AppData\Roaming\Mozilla\Firefox\Profiles\6bzrzweu.default

prefs.js - "browser.startup.homepage" - "https://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.202 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 11.7.700.202 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll


C:\Users\Gastovsky\AppData\Roaming\Mozilla\Firefox\Profiles\6bzrzweu.default\extensions\
{77d2ed30-4cd2-11e0-b8af-0800200c9a66}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-04-04 462752]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-04-04 171424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6"=C:\Program Files\Logitech\SetPointP\SetPoint.exe [2011-10-07 1744152]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2012-11-26 6325936]
"COMODO Internet Security"=C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2013-04-15 3603152]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-03-29 13513288]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"AdobeBridge"= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
C:\PROGRA~1\Eraser\Eraser.exe [2012-05-22 980920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Java Update]
C:\Program Files\Java\Java.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2012-12-10 2254768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE4]
C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [2006-10-11 75304]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-03-12 253816]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2012-02-27 291608]
"PWRISOVM.EXE"=C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [2012-08-24 336992]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-03-12 253816]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
GamePark klient 2.lnk - C:\Program Files\GamePark2\gpcl.exe
Media Key.lnk - C:\Program Files (x86)\Media Key\MagicKey.exe

C:\Users\Gastovsky\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Trillian.lnk - C:\Program Files (x86)\Trillian\trillian.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2011-09-27 68376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"aux4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux5"=wdmaud.drv
"VIDC.FPS1"=frapsv64.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2013-06-09 11:49:07 ----D---- C:\rsit
2013-06-09 11:49:07 ----D---- C:\Program Files\trend micro
2013-06-08 12:15:53 ----D---- C:\Users\Gastovsky\AppData\Roaming\NVIDIA
2013-06-08 11:19:51 ----D---- C:\ProgramData\NVIDIA
2013-06-08 11:19:40 ----A---- C:\Windows\system32\nvvsvc.exe
2013-06-08 11:19:40 ----A---- C:\Windows\system32\nvsvcr.dll
2013-06-08 11:19:40 ----A---- C:\Windows\system32\nvsvc64.dll
2013-06-08 11:19:40 ----A---- C:\Windows\system32\nvshext.dll
2013-06-08 11:19:40 ----A---- C:\Windows\system32\nvmctray.dll
2013-06-08 11:19:40 ----A---- C:\Windows\system32\nvcpl.dll
2013-06-08 11:19:26 ----A---- C:\Windows\SYSWOW64\OpenCL.dll
2013-06-08 11:19:26 ----A---- C:\Windows\system32\OpenCL.dll
2013-06-08 11:19:20 ----D---- C:\ProgramData\NVIDIA Corporation
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\nvwgf2um.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\nvumdshim.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\nvopencl.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\nvoglv32.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\nvoglshim32.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\nvinit.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\NvIFR.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\NvFBC.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\nvd3dum.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\nvcuvid.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\nvcuvenc.dll
2013-06-08 11:18:30 ----A---- C:\Windows\SYSWOW64\nvcuda.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvwgf2umx.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvumdshimx.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvopencl.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvoglv64.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvoglshim64.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvinitx.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\NvIFR64.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\NvFBC64.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvdispgenco6432018.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvdispco6432018.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvd3dumx.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvcuvid.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvcuvenc.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\nvcuda.dll
2013-06-08 11:18:30 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2013-06-08 11:18:29 ----A---- C:\Windows\SYSWOW64\nvcompiler.dll
2013-06-08 11:18:29 ----A---- C:\Windows\SYSWOW64\nvapi.dll
2013-06-08 11:18:29 ----A---- C:\Windows\system32\nvcompiler.dll
2013-06-08 11:18:29 ----A---- C:\Windows\system32\nvapi64.dll
2013-06-02 11:22:49 ----D---- C:\ProgramData\Bohemia Interactive
2013-05-31 19:17:10 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2013-05-31 16:46:43 ----D---- C:\Users\Gastovsky\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2013-05-31 16:46:43 ----D---- C:\Users\Gastovsky\AppData\Roaming\Adobe Mini Bridge CS5
2013-05-31 16:07:39 ----D---- C:\Users\Gastovsky\AppData\Roaming\MAXON
2013-05-26 17:52:45 ----D---- C:\Program Files\Blender Foundation
2013-05-25 19:28:29 ----D---- C:\Program Files\Sony
2013-05-25 19:28:29 ----D---- C:\Program Files (x86)\Sony
2013-05-17 23:12:55 ----D---- C:\Program Files\Realtek
2013-05-17 23:12:54 ----D---- C:\Windows\SYSWOW64\RTCOM
2013-05-17 23:12:32 ----A---- C:\Windows\system32\WavesGUILib64.dll
2013-05-17 23:12:32 ----A---- C:\Windows\system32\tossaeapo64.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\toseaeapo64.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\tosasfapo64.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\tosade.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\tepeqapo64.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\tadefxapo264.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\tadefxapo.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\SRSWOW64.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\SRSTSX64.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\SRSTSH64.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\SRSHP64.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\sltech64.dll
2013-05-17 23:12:31 ----A---- C:\Windows\system32\slprp64.dll
2013-05-17 23:12:30 ----A---- C:\Windows\system32\slcnt64.dll
2013-05-17 23:12:30 ----A---- C:\Windows\system32\sl3apo64.dll
2013-05-17 23:12:30 ----A---- C:\Windows\system32\SFSS_APO.dll
2013-05-17 23:12:30 ----A---- C:\Windows\system32\SFNHK64.dll
2013-05-17 23:12:29 ----A---- C:\Windows\SYSWOW64\SFCOM.dll
2013-05-17 23:12:29 ----A---- C:\Windows\system32\SFCOM64.dll
2013-05-17 23:12:29 ----A---- C:\Windows\system32\SFAPO64.dll
2013-05-17 23:12:29 ----A---- C:\Windows\system32\RtPgEx64.dll
2013-05-17 23:12:29 ----A---- C:\Windows\system32\RtlCPAPI64.dll
2013-05-17 23:12:29 ----A---- C:\Windows\system32\drivers\rtvienna.dat
2013-05-17 23:12:29 ----A---- C:\Windows\system32\drivers\RTKVHD64.sys
2013-05-17 23:12:28 ----A---- C:\Windows\system32\RTKSMSettingsIPC.dll
2013-05-17 23:12:28 ----A---- C:\Windows\system32\RTKSMlfx.dll
2013-05-17 23:12:27 ----A---- C:\Windows\system32\RtkCoLDR64.dll
2013-05-17 23:12:27 ----A---- C:\Windows\system32\RtkCfg64.dll
2013-05-17 23:12:27 ----A---- C:\Windows\system32\RtkAPO64.dll
2013-05-17 23:12:27 ----A---- C:\Windows\system32\RtkApi64.dll
2013-05-17 23:12:27 ----A---- C:\Windows\system32\RTEEP64A.dll
2013-05-17 23:12:27 ----A---- C:\Windows\system32\RTEEL64A.dll
2013-05-17 23:12:27 ----A---- C:\Windows\system32\RTEEG64A.dll
2013-05-17 23:12:27 ----A---- C:\Windows\system32\RTEED64A.dll
2013-05-17 23:12:27 ----A---- C:\Windows\system32\RtDataProc64.dll
2013-05-17 23:12:26 ----A---- C:\Windows\system32\RTCOM64.dll
2013-05-17 23:12:26 ----A---- C:\Windows\system32\RP3DHT64.dll
2013-05-17 23:12:26 ----A---- C:\Windows\system32\RP3DAA64.dll
2013-05-17 23:12:26 ----A---- C:\Windows\system32\drivers\RTAIODAT.DAT
2013-05-17 23:12:25 ----A---- C:\Windows\system32\RCoRes64.dat
2013-05-17 23:12:25 ----A---- C:\Windows\system32\RCoInstII64.dll
2013-05-17 23:12:24 ----A---- C:\Windows\system32\R4EEP64A.dll
2013-05-17 23:12:24 ----A---- C:\Windows\system32\R4EEL64A.dll
2013-05-17 23:12:24 ----A---- C:\Windows\system32\R4EEG64A.dll
2013-05-17 23:12:24 ----A---- C:\Windows\system32\R4EED64A.dll
2013-05-17 23:12:24 ----A---- C:\Windows\system32\R4EEA64A.dll
2013-05-17 23:12:24 ----A---- C:\Windows\system32\MISS_APO.dll
2013-05-17 23:12:23 ----A---- C:\Windows\system32\MaxxVolumeSDAPO.dll
2013-05-17 23:12:22 ----A---- C:\Windows\system32\MaxxAudioVnA64.dll
2013-05-17 23:12:22 ----A---- C:\Windows\system32\MaxxAudioRealtek64.dll
2013-05-17 23:12:21 ----A---- C:\Windows\system32\MaxxAudioRealtek264.dll
2013-05-17 23:12:21 ----A---- C:\Windows\system32\MaxxAudioEQ64.dll
2013-05-17 23:12:21 ----A---- C:\Windows\system32\MaxxAudioAPOShell64.dll
2013-05-17 23:12:20 ----A---- C:\Windows\system32\MaxxAudioAPO5064.dll
2013-05-17 23:12:20 ----A---- C:\Windows\system32\MaxxAudioAPO4064.dll
2013-05-17 23:12:20 ----A---- C:\Windows\system32\MaxxAudioAPO30.dll
2013-05-17 23:12:20 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2013-05-17 23:12:20 ----A---- C:\Windows\system32\KAAPORT64.dll
2013-05-17 23:12:17 ----A---- C:\Windows\system32\FMAPO64.dll
2013-05-17 23:12:17 ----A---- C:\Windows\system32\DTSVoiceClarityDLL64.dll
2013-05-17 23:12:16 ----A---- C:\Windows\system32\DTSU2PREC64.dll
2013-05-17 23:12:16 ----A---- C:\Windows\system32\DTSU2PLFX64.dll
2013-05-17 23:12:16 ----A---- C:\Windows\system32\DTSU2PGFX64.dll
2013-05-17 23:12:16 ----A---- C:\Windows\system32\DTSSymmetryDLL64.dll
2013-05-17 23:12:16 ----A---- C:\Windows\system32\DTSS2SpeakerDLL64.dll
2013-05-17 23:12:16 ----A---- C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2013-05-17 23:12:16 ----A---- C:\Windows\system32\DTSNeoPCDLL64.dll
2013-05-17 23:12:16 ----A---- C:\Windows\system32\DTSLimiterDLL64.dll
2013-05-17 23:12:16 ----A---- C:\Windows\system32\DTSLFXAPO64.dll
2013-05-17 23:12:15 ----A---- C:\Windows\system32\DTSGFXAPONS64.dll
2013-05-17 23:12:15 ----A---- C:\Windows\system32\DTSGFXAPO64.dll
2013-05-17 23:12:15 ----A---- C:\Windows\system32\DTSGainCompensatorDLL64.dll
2013-05-17 23:12:15 ----A---- C:\Windows\system32\DTSBoostDLL64.dll
2013-05-17 23:12:15 ----A---- C:\Windows\system32\DTSBassEnhancementDLL64.dll
2013-05-17 23:12:15 ----A---- C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2013-05-17 23:12:14 ----A---- C:\Windows\system32\AERTAR64.dll
2013-05-17 23:12:14 ----A---- C:\Windows\system32\AERTAC64.dll
2013-05-16 18:02:58 ----D---- C:\ProgramData\AVS4YOU
2013-05-16 18:02:52 ----D---- C:\Users\Gastovsky\AppData\Roaming\AVS4YOU
2013-05-16 18:01:34 ----A---- C:\Windows\SYSWOW64\msxml3a.dll
2013-05-15 23:43:52 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-05-15 23:43:51 ----A---- C:\Windows\system32\mshtml.dll
2013-05-15 23:43:21 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2013-05-15 23:43:21 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2013-05-15 23:43:21 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-05-15 23:43:21 ----A---- C:\Windows\system32\mshtmled.dll
2013-05-15 23:43:21 ----A---- C:\Windows\system32\iertutil.dll
2013-05-15 23:43:20 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-05-15 23:43:20 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-05-15 23:43:20 ----A---- C:\Windows\SYSWOW64\url.dll
2013-05-15 23:43:20 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-05-15 23:43:20 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2013-05-15 23:43:20 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-05-15 23:43:20 ----A---- C:\Windows\system32\wininet.dll
2013-05-15 23:43:20 ----A---- C:\Windows\system32\urlmon.dll
2013-05-15 23:43:20 ----A---- C:\Windows\system32\url.dll
2013-05-15 23:43:20 ----A---- C:\Windows\system32\msfeeds.dll
2013-05-15 23:43:20 ----A---- C:\Windows\system32\jscript9.dll
2013-05-15 23:43:20 ----A---- C:\Windows\system32\ieUnatt.exe
2013-05-15 23:43:20 ----A---- C:\Windows\system32\ieui.dll
2013-05-15 23:43:19 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-05-15 23:43:19 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-05-15 23:43:19 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-05-15 23:43:19 ----A---- C:\Windows\system32\vbscript.dll
2013-05-15 23:43:19 ----A---- C:\Windows\system32\jsproxy.dll
2013-05-15 23:43:19 ----A---- C:\Windows\system32\jscript.dll
2013-05-15 23:43:18 ----A---- C:\Windows\system32\ieframe.dll
2013-05-15 23:43:17 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-05-15 16:37:31 ----D---- C:\Users\Gastovsky\AppData\Roaming\Sony Creative Software Inc
2013-05-15 14:36:57 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2013-05-15 14:36:57 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2013-05-15 14:36:57 ----A---- C:\Windows\system32\cdd.dll
2013-05-15 14:36:55 ----A---- C:\Windows\system32\wwansvc.dll
2013-05-15 14:36:55 ----A---- C:\Windows\system32\wwanprotdim.dll
2013-05-15 14:36:48 ----A---- C:\Windows\system32\shell32.dll
2013-05-15 14:36:47 ----A---- C:\Windows\SYSWOW64\shell32.dll
2013-05-15 14:36:47 ----A---- C:\Windows\SYSWOW64\shdocvw.dll
2013-05-15 14:36:47 ----A---- C:\Windows\SYSWOW64\authui.dll
2013-05-15 14:36:47 ----A---- C:\Windows\system32\shdocvw.dll
2013-05-15 14:36:47 ----A---- C:\Windows\system32\consent.exe
2013-05-15 14:36:47 ----A---- C:\Windows\system32\authui.dll
2013-05-15 14:36:47 ----A---- C:\Windows\system32\appinfo.dll
2013-05-15 14:36:43 ----A---- C:\Windows\system32\win32k.sys

======List of files/folders modified in the last 1 month======

2013-06-09 14:26:20 ----D---- C:\Windows\Prefetch
2013-06-09 14:26:16 ----D---- C:\Windows\Temp
2013-06-09 11:49:07 ----RD---- C:\Program Files
2013-06-09 11:08:05 ----D---- C:\Program Files\Java
2013-06-09 11:05:39 ----D---- C:\Windows\System32
2013-06-09 11:05:39 ----D---- C:\Windows\inf
2013-06-09 11:05:39 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-06-09 11:02:49 ----A---- C:\Windows\SYSWOW64\log.txt
2013-06-09 11:00:53 ----D---- C:\Windows\system32\Tasks
2013-06-09 00:42:56 ----D---- C:\Windows\system32\config
2013-06-08 23:09:26 ----D---- C:\Users\Gastovsky\AppData\Roaming\TS3Client
2013-06-08 22:26:27 ----D---- C:\Windows\SysWOW64
2013-06-08 22:26:22 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2013-06-08 22:06:52 ----D---- C:\Fraps
2013-06-08 15:24:03 ----RSD---- C:\Windows\assembly
2013-06-08 15:23:49 ----SHD---- C:\System Volume Information
2013-06-08 11:19:51 ----HD---- C:\ProgramData
2013-06-08 11:19:36 ----D---- C:\Windows\Help
2013-06-08 11:19:36 ----D---- C:\Program Files\NVIDIA Corporation
2013-06-08 11:19:16 ----D---- C:\Windows\system32\drivers
2013-06-08 11:19:15 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2013-06-08 11:19:14 ----D---- C:\Windows\system32\catroot
2013-06-08 11:19:11 ----D---- C:\Windows\system32\DriverStore
2013-06-08 08:54:38 ----D---- C:\Windows\system32\catroot2
2013-06-07 21:17:03 ----D---- C:\Windows\system32\NDF
2013-06-02 15:18:00 ----SD---- C:\Users\Gastovsky\AppData\Roaming\Microsoft
2013-06-01 12:04:16 ----D---- C:\Windows\Microsoft.NET
2013-06-01 11:03:41 ----SHD---- C:\Windows\Installer
2013-05-31 19:31:23 ----D---- C:\Windows
2013-05-31 18:28:40 ----D---- C:\Users\Gastovsky\AppData\Roaming\Adobe
2013-05-30 18:05:18 ----D---- C:\ProgramData\Codemasters
2013-05-26 17:53:35 ----D---- C:\tmp
2013-05-25 22:17:44 ----D---- C:\Users\Gastovsky\AppData\Roaming\Sony
2013-05-25 19:28:29 ----RD---- C:\Program Files (x86)
2013-05-25 19:28:29 ----D---- C:\ProgramData\Sony
2013-05-21 17:39:06 ----D---- C:\Program Files (x86)\SpeedFan
2013-05-18 22:29:37 ----D---- C:\Windows\rescache
2013-05-17 23:13:08 ----HD---- C:\Program Files (x86)\Temp
2013-05-17 23:12:13 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2013-05-16 18:12:02 ----D---- C:\Windows\winsxs
2013-05-16 18:02:16 ----RSD---- C:\Windows\Fonts
2013-05-16 18:02:01 ----D---- C:\Program Files (x86)\Common Files
2013-05-16 13:10:46 ----D---- C:\Windows\AppPatch
2013-05-16 13:10:45 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-05-16 13:10:45 ----D---- C:\Windows\system32\cs-CZ
2013-05-16 13:10:44 ----D---- C:\Program Files (x86)\Internet Explorer
2013-05-16 13:10:43 ----D---- C:\Windows\SYSWOW64\migration
2013-05-16 13:10:43 ----D---- C:\Windows\system32\migration
2013-05-16 13:10:43 ----D---- C:\Program Files\Internet Explorer
2013-05-15 23:46:19 ----A---- C:\Windows\system32\MRT.exe
2013-05-15 14:29:27 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2013-05-15 14:29:26 ----D---- C:\Program Files (x86)\Mozilla Firefox
2013-05-15 14:13:44 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2012-02-27 16152]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2011-03-18 29592]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 cmderd;COMODO Internet Security Eradication Driver; C:\Windows\System32\DRIVERS\cmderd.sys [2013-04-15 23168]
R1 cmdGuard;COMODO Internet Security Sandbox Driver; C:\Windows\system32\DRIVERS\cmdguard.sys [2013-04-15 706560]
R1 cmdHlp;COMODO Internet Security Helper Driver; C:\Windows\System32\DRIVERS\cmdhlp.sys [2013-04-15 48360]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2012-10-08 211344]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2012-10-08 149592]
R1 inspect;COMODO Internet Security Firewall Driver; C:\Windows\system32\DRIVERS\inspect.sys [2013-04-25 96800]
R1 SCDEmu;SCDEmu; C:\Windows\system32\drivers\SCDEmu.sys [2012-08-24 126944]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2012-10-08 138744]
R2 SMTDrvr;SMTDrvr; \??\C:\Program Files (x86)\TRIXX MB\smtdrvr64.sys [2012-04-09 13728]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2013-03-29 3379272]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2012-02-27 356120]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2012-02-27 788760]
R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\KBFILTER.SYS [2005-10-11 10240]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys [2011-09-02 66840]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys [2011-09-02 60696]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2011-11-10 60184]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-11-23 648808]
S3 cpuz136;cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-11 65640]
R2 cmdAgent;COMODO Internet Security Helper Service; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2013-04-25 5784472]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2012-11-26 1329304]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-02-02 628448]
R2 Intel(R) ME Service;Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2012-02-21 128280]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-02-21 161560]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2012-02-28 277784]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-05-12 884512]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-10-03 76888]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-02-28 363800]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-05-15 256904]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 cmdvirth;COMODO Virtual Service Manager; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2013-04-15 158928]
S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2012-12-17 137488]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [2011-09-27 359192]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-05-15 117144]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-06-07 543656]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-12-10 2465712]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------

Zdravim

Jen se zeptam pouzivate legalni operacni system, nejvyssi licence Ultimate zrovna neni bezna.

Poprosim i o druhy log z RSIT s nazvem info.txt, je ulozen v c:\rsit

Predpokladam, ze ten ESET jak ma byt = zakoupena licence

ano vše je legální

info.txt logfile of random's system information tool 1.09 2013-06-09 11:49:45

======Uninstall list======

-->MsiExec /X{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}
3DMark Demo-->"D:\Steam\steam.exe" steam://uninstall/231350
Adobe Flash Player 11 Plugin-->C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_202_Plugin.exe -maintain plugin
Adobe Reader XI (11.0.03) - Czech-->MsiExec.exe /I{AC76BA86-7AD7-1029-7B44-AB0000000001}
Adobe Shockwave Player 11.6-->"C:\Windows\SysWOW64\Adobe\Shockwave 11\uninstaller.exe"
Age of Empires II HD (c) Microsoft Studios version 1-->"D:\Age of Empires II HD\unins000.exe"
AIDA64 Extreme Edition v2.60-->"C:\Program Files (x86)\FinalWire\AIDA64 Extreme Edition\unins000.exe"
ArmA 2 Uninstall-->D:\ArmA 2\UnInstall.exe
Arma 3 Alpha Lite-->"D:\Steam\steam.exe" steam://uninstall/228800
AviSynth 2.5-->"C:\Program Files (x86)\AviSynth 2.5\Uninstall.exe"
BattlEye Uninstall-->D:\ArmA 2\BattlEye\UnInstallBE.exe
Black Mesa Source-->"D:\Black Mesa Source LOL\unins000.exe"
Blender (remove only)-->"C:\Program Files (x86)\Blender Foundation\Blender\uninstall.exe"
Blender-->"C:\Program Files\Blender Foundation\Blender\uninstall.exe"
Call of Duty Black Ops II-->"D:\Call of Duty Black Ops II\unins000.exe"
Call of Duty(R) 2 Patch 1.3-->D:\Call of Duty 2\Uninst_Call of Duty(R) 2 Patch 1.3.exe /U "D:\Call of Duty 2\Uninst_Call of Duty(R) 2 Patch 1.3.log"
Call of Duty(R) 2-->C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{D0A05794-48C2-4424-A15A-9F20FCFDD374} /l2057
Call of Duty: Black Ops-->"D:\Call of Duty - Black Ops\unins000.exe"
Canon MP Navigator 3.0-->"C:\Program Files (x86)\Canon\MP Navigator 3.0\Maint.exe" /UninstallRemove C:\Program Files (x86)\Canon\MP Navigator 3.0\uninst.ini
Canon MP600-->"C:\Windows\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP600\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP600 /L0x0005
Canon Utilities Easy-PhotoPrint-->C:\Program Files (x86)\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
CCleaner-->"C:\Program Files\CCleaner\uninst.exe"
CD-LabelPrint-->"C:\Program Files (x86)\Canon\CD-LabelPrint\Uninstal.exe" Canon.CDLabelPrint.Application
COMODO Internet Security-->MsiExec.exe /I{0E9AFD45-C3BA-41D1-B54B-495A22CB3409}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{14574B7F-75D1-4718-B7F2-EBF6E2862A35}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{199E6632-EB28-4F73-AECB-3E192EB92D18}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{25724802-CC14-4B90-9F3B-3D6955EE27B1}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{50193078-F553-4EBA-AA77-64C9FAA12F98}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{51D718D1-DA81-4FAD-919F-5C1CE3C33379}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{66F78C51-D108-4F0C-A93C-1CBE74CE338F}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{80D03817-7943-4839-8E96-B9F924C5E67D}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{97E5205F-EA4F-438F-B211-F1846419F1C1}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{99A7722D-9ACB-43F3-A222-ABC7133F159E}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{BA801B94-C28D-46EE-B806-E1E021A3D519}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{D4D244D1-05E0-4D24-86A2-B2433C435671}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{EAF636A9-F664-4703-A659-85A894DA264F}
Company of Heroes - Opposing Fronts-->"D:\COH\Uninstall_English.exe"
Company of Heroes 2 - Beta Stress Test-->"D:\Steam\steam.exe" steam://uninstall/231550
Company of Heroes 2-->"D:\Steam\steam.exe" steam://uninstall/231430
Counter-Strike: Global Offensive-->"D:\Steam\steam.exe" steam://uninstall/730
Crazybump (remove only)-->"C:\Program Files (x86)\Crazybump\uninst.exe"
Crysis® 2-->MsiExec.exe /X{6033673D-2530-4587-8AD0-EB059FC263F9}
Eraser 6.0.10.2620-->MsiExec.exe /I{6E5159B4-A519-41EF-80EF-AD58371515DF}
eReg-->MsiExec.exe /I{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}
EVGA OC Scanner X 2.2.2-->"C:\Program Files (x86)\EVGA\EVGA OC Scanner X\unins000.exe"
EVGA Precision X 3.0.4-->"C:\Program Files (x86)\EVGA Precision X\uninstall.exe"
Far Cry 3-->"C:\Program Files (x86)\InstallShield Installation Information\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}\setup.exe" -runfromtemp -l0x0409 -removeonly
Fraps-->"C:\Fraps\uninstall.exe"
Futuremark SystemInfo-->"C:\Program Files (x86)\InstallShield Installation Information\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}\setup.exe" -runfromtemp -l0x0409 -removeonly
GamePark klient 2.0.9.0-->"C:\Program Files\GamePark2\unins000.exe"
GamePark-->"C:\Program Files (x86)\GamePark\unins000.exe"
Graph 4.3-->"C:\Program Files (x86)\Graph\unins000.exe"
GRID 2 (c) Codemasters version 1-->"D:\GRID 2\unins000.exe"
Heroes of Might and Magic® IV-->C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{192E2132-E977-4D3E-90BA-9DBCE1B57F8C}
Heroes of Might and Magic® IV-->C:\Windows\IsUn0405.exe -f"D:\Heroes of Might and Magic IV orig\Heroes of Might and Magic IV.isu" -c"C:\Program Files (x86)\Common Files\3DO Shared\3DOUnInst.dll
Inkscape 0.48.4-->C:\Program Files (x86)\Inkscape\Uninstall.exe
Intel(R) Manageability Engine Firmware Recovery Agent-->MsiExec.exe /X{A6C48A9F-694A-4234-B3AA-62590B668927}
Intel(R) Management Engine Components-->C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\Uninstall\setup.exe -uninstall
Intel(R) USB 3.0 eXtensible Host Controller Driver-->C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Uninstall\setup.exe -uninstall
Intel® Trusted Connect Service Client-->MsiExec.exe /X{09536BA1-E498-4CC3-B834-D884A67D7E34}
Java 7 Update 21-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83217017FF}
K-Lite Codec Pack 9.6.0 (Standard)-->"C:\Program Files (x86)\K-Lite Codec Pack\unins000.exe"
Logitech SetPoint 6.32-->C:\Program Files\Common Files\LogiShrd\sp6_Uninstall\setup.exe
LogMeIn Hamachi-->C:\Windows\SysWOW64\\msiexec.exe /i {106B4413-ACBB-4CDE-8707-587DB9BD77EC} REMOVE=ALL
LogMeIn Hamachi-->MsiExec.exe /I{106B4413-ACBB-4CDE-8707-587DB9BD77EC}
Media Key-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files (x86)\Media Key\uninst.isu" -c"C:\Program Files (x86)\Media Key\UnInst.dll"
Microsoft .NET Framework 4 Client Profile CSY Language Pack-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\ClientLP\Setup.exe /repair /x86 /x64 /lcid 1029 /parameterfolder ClientLP
Microsoft .NET Framework 4 Client Profile CSY Language Pack-->MsiExec.exe /X{790E02A1-145A-3843-8C13-A4F41C9B48B7}
Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /x64 /parameterfolder Client
Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}
Microsoft .NET Framework 4 Extended CSY Language Pack-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\ExtendedLP\Setup.exe /repair /x86 /x64 /lcid 1029 /parameterfolder ExtendedLP
Microsoft .NET Framework 4 Extended CSY Language Pack-->MsiExec.exe /X{A324DC11-FF02-3CE8-9D6F-67EBC006D970}
Microsoft .NET Framework 4 Extended-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\Setup.exe /repair /x86 /x64 /parameterfolder Extended
Microsoft .NET Framework 4 Extended-->MsiExec.exe /X{8E34682C-8118-31F1-BC4C-98CD9675E1C2}
Microsoft Office Access MUI (Czech) 2007-->MsiExec.exe /X{90120000-0015-0405-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Czech) 2007-->MsiExec.exe /X{90120000-0016-0405-0000-0000000FF1CE}
Microsoft Office Groove MUI (Czech) 2007-->MsiExec.exe /X{90120000-00BA-0405-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Czech) 2007-->MsiExec.exe /X{90120000-0044-0405-0000-0000000FF1CE}
Microsoft Office Office 64-bit Components 2007-->MsiExec.exe /X{90120000-002A-0000-1000-0000000FF1CE}
Microsoft Office OneNote MUI (Czech) 2007-->MsiExec.exe /X{90120000-00A1-0405-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Czech) 2007-->MsiExec.exe /X{90120000-001A-0405-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Czech) 2007-->MsiExec.exe /X{90120000-0018-0405-0000-0000000FF1CE}
Microsoft Office Proof (Czech) 2007-->MsiExec.exe /X{90120000-001F-0405-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Slovak) 2007-->MsiExec.exe /X{90120000-001F-041B-0000-0000000FF1CE}
Microsoft Office Proofing (Czech) 2007-->MsiExec.exe /X{90120000-002C-0405-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Czech) 2007-->MsiExec.exe /X{90120000-0019-0405-0000-0000000FF1CE}
Microsoft Office Shared 64-bit MUI (Czech) 2007-->MsiExec.exe /X{90120000-002A-0405-1000-0000000FF1CE}
Microsoft Office Shared MUI (Czech) 2007-->MsiExec.exe /X{90120000-006E-0405-0000-0000000FF1CE}
Microsoft Office Word MUI (Czech) 2007-->MsiExec.exe /X{90120000-001B-0405-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17-->MsiExec.exe /X{8220EEFE-38CD-377E-8595-13398D740ACE}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219-->MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7}
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219-->MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
Microsoft_VC80_ATL_x86_x64-->MsiExec.exe /I{925D058B-564A-443A-B4B2-7E90C6432E55}
Microsoft_VC80_CRT_x86_x64-->MsiExec.exe /I{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}
Microsoft_VC80_CRT_x86-->MsiExec.exe /I{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}
Microsoft_VC80_MFC_x86_x64-->MsiExec.exe /I{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}
Microsoft_VC80_MFC_x86-->MsiExec.exe /I{D1A19B02-817E-4296-A45B-07853FD74D57}
Microsoft_VC80_MFCLOC_x86_x64-->MsiExec.exe /I{1E9FC118-651D-4934-97BE-E53CAE5C7D45}
Microsoft_VC80_MFCLOC_x86-->MsiExec.exe /I{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}
Microsoft_VC90_ATL_x86_x64-->MsiExec.exe /I{8557397C-A42D-486F-97B3-A2CBC2372593}
Microsoft_VC90_ATL_x86-->MsiExec.exe /I{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}
Microsoft_VC90_CRT_x86_x64-->MsiExec.exe /I{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}
Microsoft_VC90_CRT_x86-->MsiExec.exe /I{08D2E121-7F6A-43EB-97FD-629B44903403}
Microsoft_VC90_MFC_x86_x64-->MsiExec.exe /I{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}
Microsoft_VC90_MFC_x86-->MsiExec.exe /I{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}
MKVToolNix 6.2.0-->C:\Program Files (x86)\MKVToolNix\uninst.exe
Mozilla Firefox 21.0 (x86 cs)-->C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
Mozilla Maintenance Service-->"C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe"
Mp3 Tag Tools v1.2-->"C:\Program Files (x86)\Mp3TagToolsv12\uninstall.exe"
MSVCRT Redists-->MsiExec.exe /I{AB085680-FE98-11E1-A232-F04DA23A5C58}
MSVCRT Redists-->MsiExec.exe /I{C9608300-11F5-11E0-A64B-0013D3D69929}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
NVIDIA Ovladače grafiky 320.18-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.{FDB95A2B-CBBE-468C-ABC2-2AE3784C0C9E}\NVI2.DLL",UninstallPackage Display.Driver
NVIDIA PhysX-->MsiExec.exe /I{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}
NVIDIA Systémový software PhysX 9.12.1031-->"C:\Windows\SysWOW64\RunDll32.EXE" "C:\Program Files\NVIDIA Corporation\Installer2\installer.{CDFB56E2-6C4B-4B0E-AEF3-1D00E3EE8EE2}\NVI2.DLL",UninstallPackage Display.PhysX
OCCT 4.3.1-->C:\Program Files (x86)\OCCTPT\uninst.exe
OpenAL-->"C:\Program Files (x86)\OpenAL\oalinst.exe" /U
Original War-->D:\Original War\\Uninstall.exe
PDF Settings CS5-->MsiExec.exe /I{A78FE97A-C0C8-49CE-89D0-EDD524A17392}
PowerISO-->"C:\Program Files (x86)\PowerISO\uninstall.exe"
PSPad editor-->"C:\Program Files (x86)\PSPad editor\Uninst\unins000.exe"
Python 2.6.6-->MsiExec.exe /I{6151CF20-0BD8-4023-A4A0-6A86DCFE58E5}
Realtek Ethernet Controller Driver-->C:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -removeonly
Registrace uživatele zařízení Canon MP600-->C:\Program Files (x86)\Canon\IJEREG\MP600\UNINST.EXE
RMPrepUSB-->"C:\Program Files (x86)\RMPrepUSB\uninstall.exe"
ScanSoft OmniPage SE 4.0-->MsiExec.exe /I{C1E693A4-B1D5-4DCD-B68D-2087835B7184}
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {6AF6C62E-4E3D-33BF-A591-9E4D53BDF22F} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E59B2174-E924-311F-8549-AD714C14664D} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {DA36C2E5-6B34-3A6A-9C0A-7D1CC1C5A768} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7B82A51A-768B-3A7B-ADFA-F777097A8079} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E40184A4-4A61-3D2E-9035-CB6E1E610E07} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {4736E989-32D9-3B91-90D7-C68848E118CA} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {BA941BCD-BC45-3D64-AB89-0F737907515C} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {F1696E2F-4803-362F-A756-65B363483FE6} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {C8B8456C-6A12-3725-95A8-1C9FBE1E3141} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {8E6848A1-B790-34FE-921A-A5319258E254} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {E7F6B64E-E11F-3D1C-868D-3F1443DA5A15} /parameterfolder Client
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {9D621E6E-E010-3C80-A055-135891134750} /parameterfolder Extended
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {E59B2174-E924-311F-8549-AD714C14664D} /parameterfolder Extended
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {BA941BCD-BC45-3D64-AB89-0F737907515C} /parameterfolder Extended
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {C8B8456C-6A12-3725-95A8-1C9FBE1E3141} /parameterfolder Extended
SimCity 4 Deluxe-->D:\SimCity 4 Deluxe\EAUninstall.exe
SpeedFan (remove only)-->"C:\Program Files (x86)\SpeedFan\uninstall.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Stronghold Crusader Extreme HD-->"D:\Stronghold Crusader Extreme HD\unins000.exe"
swMSM-->MsiExec.exe /I{612C34C7-5E90-47D8-9B5C-0F717DD82726}
TeamSpeak 3 Client-->"C:\Program Files (x86)\TeamSpeak 3 Client\uninstall.exe"
The KMPlayer (remove only)-->"C:\Program Files (x86)\The KMPlayer\uninstall.exe"
The Witcher 2 (CZ)-->"C:\Program Files (x86)\InstallShield Installation Information\{F0A209B7-7F85-4BDD-8F1F-B98EEAD9E04B}\setup.exe" -runfromtemp -l0x0405 -removeonly
Trillian-->C:\Program Files (x86)\Trillian\Trillian.exe /uninstall
TRIXX MB-->MsiExec.exe /I{01A36F67-64AF-4B10-8F5D-D5C12DE75210}
Unigine Valley Benchmark version 1.0-->"C:\Program Files (x86)\Unigine\Valley Benchmark 1.0\unins000.exe"
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {29C7BE97-DE59-37A2-A687-2ADD5321948A} /parameterfolder Client
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {7D799A81-5661-3159-BF92-754161CED6E6} /parameterfolder Client
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Client\setup.exe /uninstallpatch {4DFA8287-EA36-3469-99FE-F568FEC81653} /parameterfolder Client
Update for Microsoft .NET Framework 4 Extended (KB2468871)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {29C7BE97-DE59-37A2-A687-2ADD5321948A} /parameterfolder Extended
Update for Microsoft .NET Framework 4 Extended (KB2533523)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {7D799A81-5661-3159-BF92-754161CED6E6} /parameterfolder Extended
Update for Microsoft .NET Framework 4 Extended (KB2600217)-->C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe /uninstallpatch {4DFA8287-EA36-3469-99FE-F568FEC81653} /parameterfolder Extended
Winamp-->"C:\Program Files (x86)\Winamp\UninstWA.exe"
WinRAR 4.00 (64-bit)-->C:\Program Files\WinRAR\uninstall.exe
WizTree v1.05-->"C:\Program Files (x86)\WizTree\unins000.exe"
YafaRay MinGW32 Build-->C:\Program Files (x86)\YafaRay\uninstall.exe
Zoner Photo Studio 14-->"C:\Program Files\Zoner\Photo Studio 14\unins000.exe" /SILENT

======System event log======

Computer Name: Nvidia
Event Code: 6
Message: Filtr systému souborů FileInfo (verze 6.1, ‎2009‎-‎07‎-‎14T00:34:25.000000000Z) byl úspěšně načten a zaregistrován ve Správci filtrů.
Record Number: 39836
Source Name: Microsoft-Windows-FilterManager
Time Written: 20121229151757.796400-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: Nvidia
Event Code: 12
Message: Operační systém byl spuštěn v systémovém čase ‎2012‎-‎12‎-‎29T15:17:57.109999300Z.
Record Number: 39835
Source Name: Microsoft-Windows-Kernel-General
Time Written: 20121229151757.578000-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: Nvidia
Event Code: 13
Message: Operační systém se vypíná v systémovém čase ‎2012‎-‎12‎-‎29T12:45:09.971002900Z.
Record Number: 39834
Source Name: Microsoft-Windows-Kernel-General
Time Written: 20121229124509.971002-000
Event Type: Informace
User:

Computer Name: Nvidia
Event Code: 109
Message: Správce napájení jádra inicioval přechod do režimu vypnutí.
Record Number: 39833
Source Name: Microsoft-Windows-Kernel-Power
Time Written: 20121229124507.786999-000
Event Type: Informace
User:

Computer Name: Nvidia
Event Code: 7036
Message: Stav služby Windows Search byl změněn na: Zastaveno
Record Number: 39832
Source Name: Service Control Manager
Time Written: 20121229124507.506198-000
Event Type: Informace
User:

=====Application event log=====

Computer Name: 37L4247E29-32
Event Code: 1001
Message: Chybný blok , typ 0
Název události: PnPDriverNotFound
Reakce: Není k dispozici
ID souboru CAB: 0

Podpis problému:
P1: x64
P2: PCI\VEN_8086&DEV_1E31&SUBSYS_1013174B&REV_04
P3:
P4:
P5:
P6:
P7:
P8:
P9:
P10:

Připojené soubory:
C:\Windows\Temp\DMI562A.tmp.log.xml

Tyto soubory mohou být k dispozici zde:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_c521a8db89cfa5c67f21314f668ad464cda7dc0_cab_06195678

Symbol analýzy:
Opětovné hledání řešení: 0
ID hlášení: 0f955da9-feca-11e1-ae06-b05a359c78a1
Stav hlášení: 6
Record Number: 5
Source Name: Windows Error Reporting
Time Written: 20120915001240.000000-000
Event Type: Informace
User:

Computer Name: 37L4247E29-32
Event Code: 5617
Message: Windows Management Instrumentation Service subsystems initialized successfully
Record Number: 4
Source Name: Microsoft-Windows-WMI
Time Written: 20120915001152.000000-000
Event Type: Informace
User:

Computer Name: 37L4247E29-32
Event Code: 5615
Message: Windows Management Instrumentation Service started sucessfully
Record Number: 3
Source Name: Microsoft-Windows-WMI
Time Written: 20120915001148.000000-000
Event Type: Informace
User:

Computer Name: 37L4247E29-32
Event Code: 1531
Message: Služba Profil uživatele byla úspěšně spuštěna.


Record Number: 2
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20120915001145.544054-000
Event Type: Informace
User: NT AUTHORITY\SYSTEM

Computer Name: 37L4247E29-32
Event Code: 4625
Message: Subsystém EventSystem zabraňuje vytváření duplicitních záznamů v protokolu událostí po dobu 86400 sekund. Tuto dobu lze změnit pomocí hodnoty REG_DWORD s názvem SuppressDuplicateDuration v následujícím klíči registru: HKLM\Software\Microsoft\EventSystem\EventLog.
Record Number: 1
Source Name: Microsoft-Windows-EventSystem
Time Written: 20120915001145.000000-000
Event Type: Informace
User:

=====Security event log=====

Computer Name: 37L4247E29-32
Event Code: 4735
Message: Byla změněna zabezpečená místní skupina.

Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247E29-32$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7

Skupina:
ID zabezpečení: S-1-5-32-551
Název skupiny: Backup Operators
Doména skupiny: Builtin

Změněné atributy:
Název účtu SAM: -
Historie identifikátoru zabezpečení: -

Další informace:
Oprávnění: -
Record Number: 5
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20120915001132.159231-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247E29-32
Event Code: 4731
Message: Byla vytvořena zabezpečená místní skupina.

Předmět:
ID zabezpečení: S-1-5-18
Název účtu: 37L4247E29-32$
Doména účtu: WORKGROUP
ID přihlášení: 0x3e7

Nová skupina:
ID zabezpečení: S-1-5-32-551
Název skupiny: Backup Operators
Doména skupiny: Builtin

Atributy:
Název účtu SAM: Backup Operators
Historie identifikátoru zabezpečení: -

Další informace:
Oprávnění: -
Record Number: 4
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20120915001132.159231-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247E29-32
Event Code: 4902
Message: Tabulka zásad auditu pro jednotlivé uživatele byla vytvořena.

Počet prvků: 0
ID zásady: 0x30823
Record Number: 3
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20120915001131.956430-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247E29-32
Event Code: 4624
Message: Účet byl úspěšně přihlášen.

Předmět:
ID zabezpečení: S-1-0-0
Název účtu: -
Doména účtu: -
ID přihlášení: 0x0

Typ přihlášení: 0

Nové přihlášení:
ID zabezpečení: S-1-5-18
Název účtu: SYSTEM
Doména účtu: NT AUTHORITY
ID přihlášení: 0x3e7
GUID přihlášení: {00000000-0000-0000-0000-000000000000}

Informace o procesu:
ID procesu: 0x4
Název procesu:

Informace o síti:
Název pracovní stanice: -
Adresa zdrojové sítě -
Zdrojový port: -

Podrobné informace o ověření:
Proces přihlášení: -
Balíček ověření: -
Přenosové služby: -
Název balíčku (pouze NTLM): -
Délka klíče: 0

Tato událost je generována po vytvoření relace přihlášení. Je generována v počítači, ke kterému byl získán přístup.

Pole s předmětem označují účet v místním systému, který požadoval přihlášení. Jedná se nejčastěji o službu, například službu serveru nebo místní proces, například Winlogon.exe nebo Services.exe.

Pole Typ přihlášení označuje, k jakému typu přihlášení došlo. Nejběžnější typy jsou 2 (interaktivní) a 3 (síť).

Pole Nové přihlášení označují účet, pro který bylo nové přihlášení vytvořeno, tj. účet, který byl přihlášen.

Pole Síť označují původ požadavku na vzdálené přihlášení. Název pracovní stanice není vždy k dispozici a v některých případech může být toto pole prázdné.

Pole s informacemi o ověření poskytují podrobné informace o tomto konkrétním požadavku na přihlášení.
- GUID přihlášení je jednoznačný identifikátor, který je možné použít ke spojení této události s událostí KDC.
- Přenosové služby označují, které pomocné služby se podílely na tomto požadavku na přihlášení.
- Název balíčku označuje, který dílčí protokol z protokolů NTLM byl použit.
- Délka klíče označuje délku generovaného klíče relace. Tato hodnota bude 0, pokud nebyl požadován žádný klíč relace.
Record Number: 2
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20120915001130.770828-000
Event Type: Úspěšný audit
User:

Computer Name: 37L4247E29-32
Event Code: 4608
Message: Spouští se systém Windows.

Tato událost je zaznamenána při spuštění procesu LSASS.EXE a inicializaci kontrolního podsystému.
Record Number: 1
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20120915001130.724028-000
Event Type: Úspěšný audit
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\MKVToolNix
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
"NUMBER_OF_PROCESSORS"=4
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 58 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=3a09

-----------------EOF-----------------

Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na OTL pravym a dejte Run As Administrator ci Spustit jako spravce
• Pokud pouzivate 64bitovy OS, zkontrolujte, zda-li je zaskrtnuty ctverecek u Pro 64 bitové OS, pokud ne, zaskrtnete jej
• Zaskrtnete okenko Pro vsechny uzivatele
• Zaskrtnete okenko Kontrola na havet "LOP"
• Zaskrtnete okenko Kontrola na havet "Purity"
• Stari souboru zmente z 30 dnu na 7 dnu
• Do spodniho okenka Vlastni skenovani/opravy vlozte skript nize

• Kód: Vybrat vše

  CREATERESTOREPOINT
  
  netsvcs
  drivers32
  savembr:0
  
  /md5start
  atapi.sys
  autochk.exe
  cdrom.sys
  explorer.exe
  hal.dll
  scecli.dll
  services.exe
  svchost.exe
  tcpip.sys
  userinit.exe
  winlogon.exe
  /md5stop
  
  %systemroot%*.* /U /s
  %SYSTEMDRIVE%\*.exe
  %ALLUSERSPROFILE%\Application Data\*.
  %ALLUSERSPROFILE%\Application Data\*.exe /s
  %APPDATA%\*.
  %APPDATA%\*.exe /s
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\system32\drivers\*.sys /3
  %systemroot%\system32\*.* /3
  %SYSTEMDRIVE%\*.exe
  
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
  
  %PROGRAMFILES%\Mozilla Firefox\firefox.exe /md5
  %PROGRAMFILES%\Internet Explorer\iexplore.exe /md5
  %PROGRAMFILES%\Opera\opera.exe /md5
  %PROGRAMFILES%\Google\Chrome\Application\chrome.exe /md5
  
  %SystemDrive%\PhysicalMBR.bin /md5 
  
  *crack* /s
  *keygen* /s
  *loader* /s

• Kliknete na tlacitko Prohledat
• Po dokonceni skenu (cca 10 az 15 min) se objevi logy OTL.txt a Extras.txt, oba sem vlozte
• Pokud budou logy dlouhe (forum bude kricet o prekroceni maximalniho poctu znaku), tak je rozdelte do vice prispevku

Pro nezajem resit tema na zaklade Pravidla o zamykani temat