VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

PČR opět v akci - Victimer

https://forum.viry.cz:443/viewtopic.php?t=131119

Stránka 1 z 2

PČR opět v akci - Victimer

Napsal: 26 čer 2013 20:37
od Victimer
Počítač se mi zaviroval virem policie čr, v nouzovém režimu se mi povedlo získat log z FRST ale už nevím jak dál

log:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-06-2013 02
Ran by Bal (administrator) on 26-06-2013 21:07:20
Running from F:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 10
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\cmd.exe

==================== Registry (Whitelisted) ==================

HKCU\...\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent [1641896 2013-06-07] (Valve Corporation)
HKCU\...\Run: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart [19676256 2013-06-06] (Google)
MountPoints2: {b745145a-7f0f-11e1-ad51-806e6f6e6963} - D:\Launch.exe
MountPoints2: {b9bebbb5-c475-11e1-952a-7071bce87380} - F:\Startme.exe
MountPoints2: {c5292759-0948-11e2-a99b-7071bce87380} - F:\Startme.exe
MountPoints2: {dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} - E:\INSTALL.EXE
HKLM-x32\...\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe" [135536 2010-12-13] (Microsoft Corporation)
HKLM-x32\...\Run: [DATAMNGR] C:\PROGRA~2\WI3C8A~1\Datamngr\DATAMN~1.EXE [1694608 2012-03-06] (Bandoo Media, inc)
HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-29] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [2236080 2013-06-26] ()
HKU\Matěj\...\Run: [Smart Driver Updater] C:\Program Files (x86)\Smart Driver Updater\SDULauncher.exe [338576 2012-09-20] (Avanquest Software)
HKU\Matěj\...\Run: [ctfmon32.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\797je.dat,XFG00 [131072 2013-06-26] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll [1791384 2012-03-06] (Bandoo Media, inc)
AppInit_DLLs-x32: C:\PROGRA~2\WI3C8A~1\Datamngr\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll [1233816 2012-03-06] (Bandoo Media, inc)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\797je.dat (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
HKLM-x32 SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.mocaflix.com/?l=1&q={searchTerms}
HKCU SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
SearchScopes: HKCU - {1BE0EDCE-4B79-4E17-AED2-7147AD286174} URL = http://search.conduit.com/ResultsExt.as ... 02299&UM=1
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={AE6D ... 2013-05-26 20:48:23&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... earchTerms}
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.mocaflix.com/?l=1&q={searchTerms}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: phpnuke Helper Object - {890CA547-B66C-48BF-9663-DBE0BFDC7D0C} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\bh\phpnuke.dll (PHPNuke.org)
BHO-x32: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO-x32: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll ()
BHO-x32: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc)
BHO-x32: DealPly - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files (x86)\DealPly\DealPlyIE.dll (DealPly Technologies Ltd)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MIF5BA~1\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - phpnuke Toolbar - {7B206A1E-933F-4A50-9E60-5167598BDB03} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\phpnukeTlbr.dll (PHPNuke.org)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll ()
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll (AVG Secure Search)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:
=======
CHR Extension: (YouTube) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1
CHR Extension: (Google Search) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1
CHR Extension: (DealPly) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje\3.0.7.2_0
CHR Extension: (avast! WebRep) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1483_0
CHR Extension: (Skype Click to Call) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.7.0.12055_0
CHR Extension: (Gmail) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

==================== Services (Whitelisted) =================

S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-14] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)
S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-03-25] ()
S2 vToolbarUpdater15.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-26] (AVG Secure Search)

==================== Drivers (Whitelisted) ====================

S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-29] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-08] (AVG Technologies CZ, s.r.o.)
S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-08] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-08] (AVG Technologies CZ, s.r.o.)
S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-21] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-06-26] (AVG Technologies)
S1 hola_net; C:\Windows\System32\DRIVERS\hola_net.sys [86512 2013-04-06] (Hola Networks Ltd.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation)
S3 Sftfs; C:\Windows\System32\DRIVERS\Sftfswin7.sys [765288 2011-10-01] (Microsoft Corporation)
S3 Sftplay; C:\Windows\System32\DRIVERS\Sftplaywin7.sys [268648 2011-10-01] (Microsoft Corporation)
S3 Sftredir; C:\Windows\System32\DRIVERS\Sftredirwin7.sys [25960 2011-10-01] (Microsoft Corporation)
S3 Sftvol; C:\Windows\System32\DRIVERS\Sftvolwin7.sys [22376 2011-10-01] (Microsoft Corporation)

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\System32\Drivers\ssadadb.sys 4DE0D5D747A73797C95A97DCCE5018B5
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\avgidsdrivera.sys 139BD30C32BEE830D0CF39C5324D79DE
C:\Windows\System32\DRIVERS\avgidsha.sys 2940FACB6EF92BD1936E4A1E2502468E
C:\Windows\System32\DRIVERS\avgldx64.sys 54B66C4AEEC6C4F742F3569EBA03EBB8
C:\Windows\System32\DRIVERS\avgloga.sys 13667B5D6310228A9FEF2BA5FCD9081F
C:\Windows\System32\DRIVERS\avgmfx64.sys BE82F9A1F2CCF4CE746D0C645D94079E
C:\Windows\System32\DRIVERS\avgrkx64.sys 5D11620DEF66F9DC9468FEE385A8429B
C:\Windows\System32\DRIVERS\avgtdia.sys 69BD90E337625F96C718CACE7A9C9E29
C:\Windows\system32\drivers\avgtpx64.sys 34E9A86B0EF71BA72B58D72215EBFABC
C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD
C:\Windows\system32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D
C:\Windows\System32\DRIVERS\e1c62x64.sys 03F4C5C12FC1C69F838DA723475EF650
C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fssfltr.sys B16B626996C74B564005BA855C5DEE90
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ggflt.sys 16C2A6BCDDA8952C2035DEC861492A19
C:\Windows\System32\DRIVERS\ggsemc.sys 6B503DF845EABF3457E49FBBDA26C10E
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hola_net.sys 6E66C859C47343172B070B7C93EAFB7C
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys 0089B53F1BEFD34B7D8CA4AB021335FA
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHD64.sys 150AC23F21DBDBF8488408BA944B0D65
C:\Windows\System32\DRIVERS\IntcDAud.sys AE594CC17C33AC146739494615E14851
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mcdbus.sys 79D51E7F5926E8CE1B3EBECEBAE28CFF
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys A6518DCC42F7A6E999BB3BEA8FD87567
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\Drivers\nx6000.sys BB590070D606AE6F008341FC9A7B2AD7
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netr28x.sys D9A089E17112F04F452D22254B959D87
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nusb3hub.sys B227E75AD10A142DD326B4CC8D73A6D9
C:\Windows\System32\DRIVERS\nusb3xhc.sys 55959DB860E4E484681586824D09E52C
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\drivers\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\drivers\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\s0016bus.sys EA268BCE30691C2DD24F02E617FD2EB5
C:\Windows\System32\DRIVERS\s0016mdfl.sys F5F9DEB89996D333EF976624D37E24E3
C:\Windows\System32\DRIVERS\s0016mdm.sys C17CE2AEE67480FEBCC36ECCB54C0BE8
C:\Windows\System32\DRIVERS\s0016mgmt.sys CC267F04C54C5EC5B7BD658D7628469F
C:\Windows\System32\DRIVERS\s0016nd5.sys 30A35BBCE09D9FE67482FD62C61911FC
C:\Windows\System32\DRIVERS\s0016obex.sys CA394DCC38579C7AD82E83EE64D798A0
C:\Windows\System32\DRIVERS\s0016unic.sys EB267CCEA84E6E8598D92F73332AC67B
C:\Windows\System32\DRIVERS\s1039bus.sys 0031DD0C5D4446DA0A3E02617DC6D642
C:\Windows\System32\DRIVERS\s1039mdfl.sys 98C7DBE2290D8CB0235E9528F6A1A53D
C:\Windows\System32\DRIVERS\s1039mdm.sys 7EF052A067D862ECD2A2335914611074
C:\Windows\System32\DRIVERS\s1039mgmt.sys BCC3F31F1FE1E78A5BA2CD6A0E44BA64
C:\Windows\System32\DRIVERS\s1039nd5.sys A0CF11BFFA41176CCD54E701CEB68921
C:\Windows\System32\DRIVERS\s1039obex.sys BD2DA968C5DCEF51BA8014FBAC7A0B6A
C:\Windows\System32\DRIVERS\s1039unic.sys 96B4051B65C1974258A8A33A03C0B082
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\serenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Sftfswin7.sys B2F21560016B3C200FC34F2BD13DE469
C:\Windows\System32\DRIVERS\Sftplaywin7.sys AD9449F3BF407DBD1742A465F2163847
C:\Windows\System32\DRIVERS\Sftredirwin7.sys 78A1496BA75C7D5700CECB77DDD291BB
C:\Windows\System32\DRIVERS\Sftvolwin7.sys DA674FD0164D64BD4980A619410D57E3
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\System32\DRIVERS\ssadbus.sys 8F8324ED1DE63FFC7B1A02CD2D963C72
C:\Windows\System32\DRIVERS\ssadmdfl.sys 58221EFCB74167B73667F0024C661CE0
C:\Windows\System32\DRIVERS\ssadmdm.sys 4DA7C71BFAC5AD71255B7E4CAB980163
C:\Windows\System32\DRIVERS\ssadserd.sys D33D1BD3EC0E766211A234F56A12726D
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\taphss.sys F33FDC72298DF4BF9813A55D21F4EB31
C:\Windows\System32\drivers\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\DRIVERS\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\system32\drivers\TsUsbGD.sys 9CC2CCAE8A84820EAECB886D477CBCB8
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\drivers\usbaudio.sys 82E8F44688E6FAC57B5B7C6FC7ADBC2A
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\system32\drivers\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-26 21:06 - 2013-06-26 21:06 - 00000000 ____D C:\FRST
2013-06-26 19:40 - 2013-06-26 20:12 - 95023320 ___AT C:\ProgramData\ej797.pad
2013-06-26 19:40 - 2013-06-26 20:09 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-06-26 19:40 - 2013-06-26 19:40 - 00131072 ____A (Microsoft Corporation) C:\ProgramData\797je.dat
2013-06-26 19:40 - 2013-06-26 19:40 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-06-26 19:40 - 2013-06-26 19:40 - 00000151 ____A C:\ProgramData\ej797.reg
2013-06-26 19:40 - 2013-06-26 19:40 - 00000056 ____A C:\ProgramData\ej797.bat
2013-06-26 17:51 - 2013-06-26 17:51 - 00000000 ____D C:\ProgramData\AVG Secure Search
2013-06-26 15:32 - 2013-06-26 15:46 - 42945880 ____A C:\Users\Bal\Desktop\Aquaman 021 (2013) (Digital) (Zone-Empire).cbr
2013-06-26 00:06 - 2013-06-26 00:06 - 00022428 ____A C:\Users\Bal\Desktop\continuum-S02E08-web-dl-By-bladesip-clear-garan_-jolinar-vanthomass.zip
2013-06-26 00:06 - 2013-06-26 00:06 - 00022318 ____A C:\Users\Bal\Desktop\continuum-S02E08-hdtv-By-bladesip-clear-garan_-jolinar.zip
2013-06-25 22:26 - 2013-06-26 00:52 - 1360963091 ____A C:\Users\Bal\Desktop\Continuum.S02E08.Second.Listen.720p.WEB-DL.AAC2.0.H264.mkv
2013-06-25 16:10 - 2013-06-25 17:29 - 1403177416 ____A C:\Users\Bal\Desktop\Continuum.S02E07.Second.Degree.720p.WEB-DL.AAC2.0.H264.mkv
2013-06-25 15:26 - 2013-06-25 15:09 - 00056653 ____A C:\Users\Bal\Desktop\Continuum.S02E06.HDTV.XviD.srt
2013-06-25 15:09 - 2013-06-25 15:49 - 372852874 ____A C:\Users\Bal\Desktop\Continuum.S02E06.HDTV.XviD.avi
2013-06-25 15:09 - 2013-06-25 15:09 - 00023672 ____A C:\Users\Bal\Desktop\Continuum-S02E06(0000219302).zip
2013-06-24 23:37 - 2013-06-24 23:37 - 00050463 ____A C:\Users\Bal\Desktop\Continuum.S02E05.HDTV.XVID.srt
2013-06-24 23:37 - 2013-06-24 23:37 - 00021522 ____A C:\Users\Bal\Desktop\Continuum-S02E05(0000218968).zip
2013-06-24 21:29 - 2013-06-24 22:10 - 374328254 ____A C:\Users\Bal\Desktop\Continuum.S02E05.HDTV.XVID.avi
2013-06-24 20:58 - 2013-06-24 20:11 - 00044893 ____A C:\Users\Bal\Desktop\Continuum.S02E04.HDTV.XviD.srt
2013-06-24 20:12 - 2013-06-24 20:12 - 00019132 ____A C:\Users\Bal\Desktop\Continuum-S02E04(0000218313).zip
2013-06-24 20:07 - 2013-06-24 21:15 - 365310588 ____A C:\Users\Bal\Desktop\Continuum.S02E04.HDTV.XviD.avi
2013-06-23 11:39 - 2013-06-23 11:39 - 00002122 ____A C:\Users\Public\Desktop\Medieval II Total War.lnk
2013-06-23 11:24 - 2013-06-23 11:24 - 00000000 ____D C:\ProgramData\InstallShield
2013-06-21 16:32 - 2013-06-21 16:32 - 00000000 ____D C:\Users\Bal\Desktop\2010 - Burlesque - soundtrack [320]
2013-06-21 16:18 - 2013-06-21 16:29 - 76053228 ____A C:\Users\Bal\Desktop\2010---Burlesque---soundtrack-[320].rar
2013-06-18 19:51 - 2013-06-19 00:53 - 1603668072 ____A C:\Users\Bal\Desktop\Burlesque 2010 BluRay 720p DTS x264-CHD [brrip.net].mkv
2013-06-17 15:58 - 2013-06-17 15:58 - 00000000 ____D C:\Users\Matěj\AppData\LocalGoogle
2013-06-17 08:25 - 2013-06-26 10:52 - 00000000 ___SD C:\Users\Bal\Disk Google
2013-06-17 08:25 - 2013-06-17 08:25 - 00001712 ____A C:\Users\Bal\Desktop\Disk Google.lnk
2013-06-17 08:22 - 2013-06-17 08:22 - 00000000 ____D C:\Users\Bal\AppData\LocalGoogle
2013-06-16 20:29 - 2013-06-16 20:29 - 00000000 ____D C:\Windows\SysWOW64\saves
2013-06-16 20:23 - 2013-06-23 11:40 - 00475376 ____A C:\Windows\DirectX.log
2013-06-15 08:46 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-15 08:46 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-15 08:46 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-15 08:46 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-15 08:46 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-15 08:46 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-15 08:46 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-15 08:46 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-15 08:46 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-15 08:46 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-15 08:46 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-15 08:46 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-15 07:59 - 2013-06-23 11:19 - 00002582 ____A C:\Windows\PFRO.log
2013-06-14 22:28 - 2013-06-14 22:28 - 02032700 ____A C:\Users\Matěj\Desktop\minecraftforge-universal-1.5.2-7.8.0.736.zip
2013-06-14 21:09 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\Podcasts
2013-06-14 21:09 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\Documents\Media Go
2013-06-14 21:07 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\AppData\Local\Sony
2013-06-14 21:07 - 2013-06-14 21:07 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-06-14 21:06 - 2013-06-14 21:06 - 00000000 ____D C:\Users\Matěj\AppData\Local\Downloaded Installations
2013-06-14 21:04 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Sony
2013-06-14 21:04 - 2013-06-14 21:06 - 00000000 ____D C:\Program Files (x86)\Sony Media Go Install
2013-06-13 00:19 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 00:19 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 00:19 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 00:19 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 00:19 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 00:19 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 00:19 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 00:19 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 16:58 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 16:58 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 16:58 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 16:58 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 16:58 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 16:58 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 16:58 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 16:58 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 16:58 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 16:58 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 16:58 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 16:58 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 16:58 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 16:58 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 16:58 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 16:58 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 16:58 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 16:58 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 16:58 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-11 15:44 - 2013-06-11 15:44 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_ssadadb_01005.Wdf
2013-06-10 22:59 - 2013-06-11 00:21 - 00000000 ____D C:\Users\Bal\Documents\Děják
2013-06-10 14:42 - 2013-06-10 14:42 - 00000000 ____D C:\Users\Default\AppData\Roaming\TuneUp Software
2013-06-10 14:42 - 2013-06-10 14:42 - 00000000 ____D C:\Users\Default User\AppData\Roaming\TuneUp Software
2013-06-09 16:00 - 2013-06-09 16:01 - 00001175 ____A C:\Users\Bal\Desktop\iw3sp – zástupce.lnk
2013-06-09 14:49 - 2013-06-09 14:49 - 00000000 ____D C:\Users\Bal\AppData\Local\Microsoft Games
2013-06-09 10:29 - 2013-06-09 10:29 - 00000282 ____A C:\SSUUpdater.log
2013-06-08 20:13 - 2013-06-08 20:21 - 00000000 ____D C:\Users\Bal\Documents\Euro Truck Simulator 2
2013-06-07 16:02 - 2013-06-07 16:02 - 00001392 ____A C:\Users\Matěj\Desktop\Spustit Euro Truck Simulator 2.lnk
2013-06-06 20:08 - 2013-06-06 20:09 - 00000000 ____D C:\Program Files (x86)\Euro Truck Simulator 2
2013-06-06 20:08 - 2012-10-20 16:34 - 544087432 ____A (SCS Software ) C:\Users\Matěj\Desktop\EuroTruckSimulator2.exe
2013-06-06 19:56 - 2013-06-16 20:28 - 00000000 ____D C:\Users\Matěj\Documents\Euro Truck Simulator 2
2013-06-06 19:11 - 2013-06-06 19:54 - 00000000 ____D C:\Users\Matěj\Desktop\Euro Truck Simulator 2
2013-06-06 16:37 - 2013-06-06 18:55 - 1185251012 ____A C:\Users\Matěj\Desktop\euro-truck-simulator-2(cz-sk)plna-verzia-(verze).rar
2013-06-06 11:59 - 2013-06-06 13:28 - 00000000 ____D C:\Users\Bal\Documents\Fyzika
2013-06-05 20:42 - 2013-06-05 20:42 - 00000013 ____A C:\Users\Matěj\Desktop\sirka.txt
2013-06-03 16:15 - 2013-06-03 16:15 - 00000117 ____A C:\Users\Public\sdelevURL.tmp
2013-06-03 15:03 - 2013-06-03 15:03 - 00000000 ____D C:\Users\Matěj\Desktop\SCPContainmentBreachv021
2013-06-03 15:01 - 2013-06-03 15:03 - 31044328 ____A C:\Users\Matěj\Desktop\SCPContainmentBreachv021.zip
2013-06-01 01:39 - 2013-06-01 01:39 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2013-06-01 01:33 - 2013-06-02 17:33 - 00001554 ____A C:\Users\Bal\Desktop\Terraria.lnk
2013-05-30 19:36 - 2013-06-10 20:10 - 00000045 ____A C:\Users\Matěj\Desktop\france.txt
2013-05-29 00:14 - 2013-05-29 00:14 - 00001959 ____A C:\Users\Bal\Desktop\Opera Mail.lnk
2013-05-29 00:14 - 2013-05-29 00:14 - 00000000 ____D C:\Users\Bal\AppData\Roaming\Opera Mail
2013-05-29 00:14 - 2013-05-29 00:14 - 00000000 ____D C:\Users\Bal\AppData\Local\Opera Mail
2013-05-28 19:56 - 2013-05-31 14:26 - 00000000 ____D C:\Program Files (x86)\Opera Next
2013-05-27 16:30 - 2013-06-06 20:00 - 00000000 ____D C:\Users\Matěj\AppData\Local\Avg2013
2013-05-27 16:30 - 2013-05-27 16:30 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\AVG2013
2013-05-27 16:30 - 2013-05-27 16:30 - 00000000 ____D C:\Users\Matěj\AppData\Local\AVG Secure Search
2013-05-27 14:28 - 2013-06-26 21:01 - 00005238 ____A C:\Windows\setupact.log

==================== One Month Modified Files and Folders =======

2013-06-26 21:06 - 2013-06-26 21:06 - 00000000 ____D C:\FRST
2013-06-26 21:01 - 2013-05-27 14:28 - 00005238 ____A C:\Windows\setupact.log
2013-06-26 21:01 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-26 20:58 - 2011-04-12 10:34 - 00666874 ____A C:\Windows\System32\perfh005.dat
2013-06-26 20:58 - 2011-04-12 10:34 - 00140312 ____A C:\Windows\System32\perfc005.dat
2013-06-26 20:58 - 2009-07-14 07:13 - 01579034 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-26 20:40 - 2012-04-05 13:14 - 01139508 ____A C:\Windows\WindowsUpdate.log
2013-06-26 20:12 - 2013-06-26 19:40 - 95023320 ___AT C:\ProgramData\ej797.pad
2013-06-26 20:09 - 2013-06-26 19:40 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-06-26 20:09 - 2012-04-12 19:49 - 00000942 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-26 19:41 - 2013-05-26 20:33 - 00000000 ____D C:\ProgramData\MFAData
2013-06-26 19:41 - 2012-04-12 19:41 - 00000914 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-26 19:40 - 2013-06-26 19:40 - 00131072 ____A (Microsoft Corporation) C:\ProgramData\797je.dat
2013-06-26 19:40 - 2013-06-26 19:40 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-06-26 19:40 - 2013-06-26 19:40 - 00000151 ____A C:\ProgramData\ej797.reg
2013-06-26 19:40 - 2013-06-26 19:40 - 00000056 ____A C:\ProgramData\ej797.bat
2013-06-26 19:28 - 2012-04-12 19:49 - 00000946 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-26 17:51 - 2013-06-26 17:51 - 00000000 ____D C:\ProgramData\AVG Secure Search
2013-06-26 17:51 - 2013-05-26 20:48 - 00045856 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx64.sys
2013-06-26 17:51 - 2013-05-26 20:48 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search
2013-06-26 15:46 - 2013-06-26 15:32 - 42945880 ____A C:\Users\Bal\Desktop\Aquaman 021 (2013) (Digital) (Zone-Empire).cbr
2013-06-26 12:30 - 2013-02-24 13:30 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-06-26 11:07 - 2012-08-21 10:44 - 00000000 ____D C:\Users\Bal\Documents\Instalace
2013-06-26 11:03 - 2013-05-07 20:47 - 00000000 ____D C:\Users\Bal\AppData\Roaming\.technic
2013-06-26 10:58 - 2009-07-14 06:45 - 00021888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-26 10:58 - 2009-07-14 06:45 - 00021888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-26 10:52 - 2013-06-17 08:25 - 00000000 ___SD C:\Users\Bal\Disk Google
2013-06-26 10:51 - 2012-06-15 18:15 - 00000000 ____D C:\Program Files (x86)\Steam
2013-06-26 00:59 - 2012-04-14 18:54 - 00000000 ____D C:\Users\Bal\AppData\Roaming\vlc
2013-06-26 00:52 - 2013-06-25 22:26 - 1360963091 ____A C:\Users\Bal\Desktop\Continuum.S02E08.Second.Listen.720p.WEB-DL.AAC2.0.H264.mkv
2013-06-26 00:06 - 2013-06-26 00:06 - 00022428 ____A C:\Users\Bal\Desktop\continuum-S02E08-web-dl-By-bladesip-clear-garan_-jolinar-vanthomass.zip
2013-06-26 00:06 - 2013-06-26 00:06 - 00022318 ____A C:\Users\Bal\Desktop\continuum-S02E08-hdtv-By-bladesip-clear-garan_-jolinar.zip
2013-06-25 21:53 - 2012-04-14 11:04 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Skype
2013-06-25 21:52 - 2012-04-14 10:48 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\.minecraft
2013-06-25 17:29 - 2013-06-25 16:10 - 1403177416 ____A C:\Users\Bal\Desktop\Continuum.S02E07.Second.Degree.720p.WEB-DL.AAC2.0.H264.mkv
2013-06-25 15:49 - 2013-06-25 15:09 - 372852874 ____A C:\Users\Bal\Desktop\Continuum.S02E06.HDTV.XviD.avi
2013-06-25 15:09 - 2013-06-25 15:26 - 00056653 ____A C:\Users\Bal\Desktop\Continuum.S02E06.HDTV.XviD.srt
2013-06-25 15:09 - 2013-06-25 15:09 - 00023672 ____A C:\Users\Bal\Desktop\Continuum-S02E06(0000219302).zip
2013-06-24 23:37 - 2013-06-24 23:37 - 00050463 ____A C:\Users\Bal\Desktop\Continuum.S02E05.HDTV.XVID.srt
2013-06-24 23:37 - 2013-06-24 23:37 - 00021522 ____A C:\Users\Bal\Desktop\Continuum-S02E05(0000218968).zip
2013-06-24 22:10 - 2013-06-24 21:29 - 374328254 ____A C:\Users\Bal\Desktop\Continuum.S02E05.HDTV.XVID.avi
2013-06-24 21:15 - 2013-06-24 20:07 - 365310588 ____A C:\Users\Bal\Desktop\Continuum.S02E04.HDTV.XviD.avi
2013-06-24 20:43 - 2013-02-24 18:37 - 00000000 ____D C:\Users\Bal\AppData\Local\Windows Live
2013-06-24 20:12 - 2013-06-24 20:12 - 00019132 ____A C:\Users\Bal\Desktop\Continuum-S02E04(0000218313).zip
2013-06-24 20:11 - 2013-06-24 20:58 - 00044893 ____A C:\Users\Bal\Desktop\Continuum.S02E04.HDTV.XviD.srt
2013-06-23 11:40 - 2013-06-16 20:23 - 00475376 ____A C:\Windows\DirectX.log
2013-06-23 11:39 - 2013-06-23 11:39 - 00002122 ____A C:\Users\Public\Desktop\Medieval II Total War.lnk
2013-06-23 11:29 - 2012-04-05 20:01 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-23 11:24 - 2013-06-23 11:24 - 00000000 ____D C:\ProgramData\InstallShield
2013-06-23 11:21 - 2012-04-14 10:24 - 00128680 ____A C:\Users\Matěj\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-23 11:19 - 2013-06-15 07:59 - 00002582 ____A C:\Windows\PFRO.log
2013-06-22 20:36 - 2012-04-05 20:03 - 00128680 ____A C:\Users\Bal\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-21 22:01 - 2009-07-14 06:45 - 00500280 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-21 16:32 - 2013-06-21 16:32 - 00000000 ____D C:\Users\Bal\Desktop\2010 - Burlesque - soundtrack [320]
2013-06-21 16:29 - 2013-06-21 16:18 - 76053228 ____A C:\Users\Bal\Desktop\2010---Burlesque---soundtrack-[320].rar
2013-06-21 15:44 - 2013-03-06 10:11 - 00000000 ____D C:\Users\Bal\AppData\Roaming\SoftGrid Client
2013-06-20 15:47 - 2012-04-14 18:55 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\vlc
2013-06-19 16:46 - 2013-04-20 00:03 - 00000000 ____D C:\Users\Bal\AppData\Roaming\BitLord
2013-06-19 00:53 - 2013-06-18 19:51 - 1603668072 ____A C:\Users\Bal\Desktop\Burlesque 2010 BluRay 720p DTS x264-CHD [brrip.net].mkv
2013-06-18 19:51 - 2013-04-20 00:03 - 00000000 ____D C:\Users\Bal\Documents\BitLord
2013-06-18 18:36 - 2012-05-11 23:09 - 00000000 ____D C:\Users\Bal\AppData\Local\Paint.NET
2013-06-17 15:58 - 2013-06-17 15:58 - 00000000 ____D C:\Users\Matěj\AppData\LocalGoogle
2013-06-17 15:58 - 2012-04-14 20:03 - 00000000 ____D C:\Users\Matěj\AppData\Local\Google
2013-06-17 08:25 - 2013-06-17 08:25 - 00001712 ____A C:\Users\Bal\Desktop\Disk Google.lnk
2013-06-17 08:25 - 2012-04-05 13:15 - 00000000 ____D C:\users\Bal
2013-06-17 08:22 - 2013-06-17 08:22 - 00000000 ____D C:\Users\Bal\AppData\LocalGoogle
2013-06-17 08:22 - 2012-04-12 19:49 - 00000000 ____D C:\Users\Bal\AppData\Local\Google
2013-06-17 08:22 - 2012-04-12 19:49 - 00000000 ____D C:\Program Files (x86)\Google
2013-06-16 20:29 - 2013-06-16 20:29 - 00000000 ____D C:\Windows\SysWOW64\saves
2013-06-16 20:28 - 2013-06-06 19:56 - 00000000 ____D C:\Users\Matěj\Documents\Euro Truck Simulator 2
2013-06-15 16:38 - 2012-04-14 10:47 - 00000000 ____D C:\Users\Matěj\Downloads\.minecraft – kopie
2013-06-14 22:28 - 2013-06-14 22:28 - 02032700 ____A C:\Users\Matěj\Desktop\minecraftforge-universal-1.5.2-7.8.0.736.zip
2013-06-14 21:41 - 2012-04-12 19:41 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-14 21:41 - 2012-04-12 19:41 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-14 21:09 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\Podcasts
2013-06-14 21:09 - 2013-06-14 21:09 - 00000000 ____D C:\Users\Matěj\Documents\Media Go
2013-06-14 21:09 - 2013-06-14 21:07 - 00000000 ____D C:\Users\Matěj\AppData\Local\Sony
2013-06-14 21:09 - 2013-06-14 21:04 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Sony
2013-06-14 21:09 - 2012-04-12 21:06 - 00000000 ____D C:\users\Matěj
2013-06-14 21:07 - 2013-06-14 21:07 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-06-14 21:07 - 2012-07-25 10:43 - 00000000 ____D C:\Program Files (x86)\Sony
2013-06-14 21:06 - 2013-06-14 21:06 - 00000000 ____D C:\Users\Matěj\AppData\Local\Downloaded Installations
2013-06-14 21:06 - 2013-06-14 21:04 - 00000000 ____D C:\Program Files (x86)\Sony Media Go Install
2013-06-14 16:43 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-13 17:39 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-13 00:20 - 2012-04-12 19:43 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 00:17 - 2013-03-09 16:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-11 15:44 - 2013-06-11 15:44 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_ssadadb_01005.Wdf
2013-06-11 00:21 - 2013-06-10 22:59 - 00000000 ____D C:\Users\Bal\Documents\Děják
2013-06-10 20:10 - 2013-05-30 19:36 - 00000045 ____A C:\Users\Matěj\Desktop\france.txt
2013-06-10 20:07 - 2012-04-14 19:03 - 00000000 ___RD C:\Users\Matěj\Desktop\Clone wars
2013-06-10 14:42 - 2013-06-10 14:42 - 00000000 ____D C:\Users\Default\AppData\Roaming\TuneUp Software
2013-06-10 14:42 - 2013-06-10 14:42 - 00000000 ____D C:\Users\Default User\AppData\Roaming\TuneUp Software
2013-06-10 14:42 - 2013-05-26 20:48 - 00000977 ____A C:\Users\Public\Desktop\AVG 2013.lnk
2013-06-09 23:24 - 2013-03-10 13:00 - 00000000 ____D C:\Users\Bal\Documents\Astrokurz
2013-06-09 16:01 - 2013-06-09 16:00 - 00001175 ____A C:\Users\Bal\Desktop\iw3sp – zástupce.lnk
2013-06-09 14:49 - 2013-06-09 14:49 - 00000000 ____D C:\Users\Bal\AppData\Local\Microsoft Games
2013-06-09 10:29 - 2013-06-09 10:29 - 00000282 ____A C:\SSUUpdater.log
2013-06-08 22:35 - 2012-09-19 17:14 - 00000000 ____D C:\Users\Bal\AppData\Roaming\Audacity
2013-06-08 22:20 - 2013-02-24 18:47 - 00007168 ____A C:\Users\Bal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-08 20:21 - 2013-06-08 20:13 - 00000000 ____D C:\Users\Bal\Documents\Euro Truck Simulator 2
2013-06-08 16:08 - 2013-06-15 08:46 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-15 08:46 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-15 08:46 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-15 08:46 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-15 08:46 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-15 08:46 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-15 08:46 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-15 08:46 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:40 - 2013-06-15 08:46 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-15 08:46 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-15 08:46 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:13 - 2013-06-15 08:46 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-07 16:02 - 2013-06-07 16:02 - 00001392 ____A C:\Users\Matěj\Desktop\Spustit Euro Truck Simulator 2.lnk
2013-06-06 20:09 - 2013-06-06 20:08 - 00000000 ____D C:\Program Files (x86)\Euro Truck Simulator 2
2013-06-06 20:00 - 2013-05-27 16:30 - 00000000 ____D C:\Users\Matěj\AppData\Local\Avg2013
2013-06-06 19:54 - 2013-06-06 19:11 - 00000000 ____D C:\Users\Matěj\Desktop\Euro Truck Simulator 2
2013-06-06 18:55 - 2013-06-06 16:37 - 1185251012 ____A C:\Users\Matěj\Desktop\euro-truck-simulator-2(cz-sk)plna-verzia-(verze).rar
2013-06-06 13:47 - 2013-04-22 17:25 - 00000000 ____D C:\Users\Bal\Documents\Nová složka
2013-06-06 13:28 - 2013-06-06 11:59 - 00000000 ____D C:\Users\Bal\Documents\Fyzika
2013-06-05 22:50 - 2013-03-01 22:20 - 00008704 ____A C:\Users\Matěj\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-05 20:42 - 2013-06-05 20:42 - 00000013 ____A C:\Users\Matěj\Desktop\sirka.txt
2013-06-03 16:15 - 2013-06-03 16:15 - 00000117 ____A C:\Users\Public\sdelevURL.tmp
2013-06-03 15:03 - 2013-06-03 15:03 - 00000000 ____D C:\Users\Matěj\Desktop\SCPContainmentBreachv021
2013-06-03 15:03 - 2013-06-03 15:01 - 31044328 ____A C:\Users\Matěj\Desktop\SCPContainmentBreachv021.zip
2013-06-02 17:34 - 2013-04-17 23:47 - 00000000 ____D C:\Users\Bal\Documents\Cemie
2013-06-02 17:33 - 2013-06-01 01:33 - 00001554 ____A C:\Users\Bal\Desktop\Terraria.lnk
2013-06-01 12:45 - 2013-03-06 10:08 - 01557320 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-06-01 01:40 - 2012-06-15 15:57 - 00000000 ____D C:\Users\Bal\Documents\My Games
2013-06-01 01:39 - 2013-06-01 01:39 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2013-05-31 15:31 - 2012-04-14 11:04 - 00000000 ____D C:\ProgramData\Skype
2013-05-31 15:31 - 2012-04-14 11:04 - 00000000 ____D C:\Program Files (x86)\Skype
2013-05-31 14:26 - 2013-05-28 19:56 - 00000000 ____D C:\Program Files (x86)\Opera Next
2013-05-30 16:20 - 2012-04-13 21:06 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Opera
2013-05-30 16:20 - 2012-04-13 21:06 - 00000000 ____D C:\Users\Matěj\AppData\Local\Opera
2013-05-29 00:14 - 2013-05-29 00:14 - 00001959 ____A C:\Users\Bal\Desktop\Opera Mail.lnk
2013-05-29 00:14 - 2013-05-29 00:14 - 00000000 ____D C:\Users\Bal\AppData\Roaming\Opera Mail
2013-05-29 00:14 - 2013-05-29 00:14 - 00000000 ____D C:\Users\Bal\AppData\Local\Opera Mail
2013-05-28 19:56 - 2012-04-12 19:38 - 00000000 ____D C:\Users\Bal\AppData\Roaming\Opera
2013-05-28 19:56 - 2012-04-12 19:38 - 00000000 ____D C:\Users\Bal\AppData\Local\Opera
2013-05-27 20:41 - 2013-05-20 20:16 - 00000000 ____D C:\Users\Matěj\Desktop\?oporno
2013-05-27 16:30 - 2013-05-27 16:30 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\AVG2013
2013-05-27 16:30 - 2013-05-27 16:30 - 00000000 ____D C:\Users\Matěj\AppData\Local\AVG Secure Search
2013-05-27 16:24 - 2013-05-26 20:45 - 00000000 ____D C:\Program Files (x86)\AVG

Files to move or delete:
====================
C:\ProgramData\rundll32.exe
C:\ProgramData\797je.dat
C:\ProgramData\7off.pad
C:\ProgramData\ej797.bat
C:\ProgramData\ej797.pad
C:\ProgramData\ej797.reg
C:\ProgramData\ffo7.dat

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== BCD ================================

Spr vce spouçtŘnˇ firmwaru
---------------------
identifik tor {fwbootmgr}
displayorder {bootmgr}
{bd1becec-7f16-11e1-b188-abff605d4282}
{bd1beced-7f16-11e1-b188-abff605d4282}
{bd1becee-7f16-11e1-b188-abff605d4282}
{b745145f-7f0f-11e1-ad51-806e6f6e6963}
timeout 1

Spr vce spouçtŘnˇ syst‚mu Windows
--------------------
identifik tor {bootmgr}
device partition=\Device\HarddiskVolume1
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
locale cs-CZ
inherit {globalsettings}
default {current}
resumeobject {bd1becf0-7f16-11e1-b188-abff605d4282}
displayorder {current}
toolsdisplayorder {memdiag}
timeout 30

Firmwarov  aplikace (101fffff)
-------------------------------
identifik tor {b745145f-7f0f-11e1-ad51-806e6f6e6963}
device partition=\Device\HarddiskVolume1
path \EFI\BOOT\BOOTX64.EFI
description UEFI: ST31000524AS

Firmwarov  aplikace (101fffff)
-------------------------------
identifik tor {bd1becec-7f16-11e1-b188-abff605d4282}
description Hard Drive

Firmwarov  aplikace (101fffff)
-------------------------------
identifik tor {bd1beced-7f16-11e1-b188-abff605d4282}
description Network Card

Firmwarov  aplikace (101fffff)
-------------------------------
identifik tor {bd1becee-7f16-11e1-b188-abff605d4282}
description CD/DVD Drive

Zav dŘcˇ program pro spouçtŘnˇ syst‚mu Windows
-------------------
identifik tor {current}
device partition=C:
path \Windows\system32\winload.efi
description Windows 7
locale cs-CZ
inherit {bootloadersettings}
recoverysequence {bd1becf2-7f16-11e1-b188-abff605d4282}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {bd1becf0-7f16-11e1-b188-abff605d4282}
nx OptIn

Zav dŘcˇ program pro spouçtŘnˇ syst‚mu Windows
-------------------
identifik tor {bd1becf2-7f16-11e1-b188-abff605d4282}
device ramdisk=[C:]\Recovery\bd1becf2-7f16-11e1-b188-abff605d4282\Winre.wim,{bd1becf3-7f16-11e1-b188-abff605d4282}
path \windows\system32\winload.efi
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\bd1becf2-7f16-11e1-b188-abff605d4282\Winre.wim,{bd1becf3-7f16-11e1-b188-abff605d4282}
systemroot \windows
nx OptIn
winpe Yes

Obnovenˇ z hibernace
---------------------
identifik tor {bd1becf0-7f16-11e1-b188-abff605d4282}
device partition=C:
path \Windows\system32\winresume.efi
description Windows Resume Application
locale cs-CZ
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No

Testov nˇ pamŘti syst‚mu Windows
---------------------
identifik tor {memdiag}
device partition=\Device\HarddiskVolume1
path \EFI\Microsoft\Boot\memtest.efi
description Diagnostika pamŘti syst‚mu Windows
locale cs-CZ
inherit {globalsettings}
badmemoryaccess Yes

Nastavenˇ slu§by EMS
------------
identifik tor {emssettings}
bootems Yes

Nastavenˇ ladicˇho programu
-----------------
identifik tor {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200

Chyby pamŘti RAM
-----------
identifik tor {badmemory}

Glob lnˇ nastavenˇ
---------------
identifik tor {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}

Nastavenˇ spouçtŘcˇho zavadŘźe
--------------------
identifik tor {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}

Nastavenˇ hypervisoru
-------------------
identifik tor {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200

Nastavenˇ zavadŘźe obnovenˇ
----------------------
identifik tor {resumeloadersettings}
inherit {globalsettings}

Parametry zaýˇzenˇ
--------------
identifik tor {bd1becf3-7f16-11e1-b188-abff605d4282}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\bd1becf2-7f16-11e1-b188-abff605d4282\boot.sdi



LastRegBack: 2013-06-23 12:56

==================== End Of Log ============================

Re: PČR opět v akci - Victimer

Napsal: 26 čer 2013 22:25
od vyosek
Zdravim :)

:arrow: Tema jsem oddelil, do cizich se nevstupuju

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    HKLM-x32\...\Run: [DATAMNGR] C:\PROGRA~2\WI3C8A~1\Datamngr\DATAMN~1.EXE [1694608 2012-03-06] (Bandoo Media, inc)
HKLM-x32\...\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [2236080 2013-06-26] ()
HKU\Matěj\...\Run: [Smart Driver Updater] C:\Program Files (x86)\Smart Driver Updater\SDULauncher.exe [338576 2012-09-20] (Avanquest Software)
HKU\Matěj\...\Run: [ctfmon32.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\797je.dat,XFG00 [131072 2013-06-26] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll [1791384 2012-03-06] (Bandoo Media, inc)
AppInit_DLLs-x32: C:\PROGRA~2\WI3C8A~1\Datamngr\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll [1233816 2012-03-06] (Bandoo Media, inc)
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\797je.dat (Microsoft Corporation)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchnu.com/406
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
HKLM-x32 SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.mocaflix.com/?l=1&q={searchTerms}
HKCU SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
SearchScopes: HKCU - {1BE0EDCE-4B79-4E17-AED2-7147AD286174} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2549263&CUI=UN59978950911702299&UM=1
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={AE6DC3C3-A4CA-40E5-B9F8-E58A35E8F616}&mid=12d42df4f83147d39d66a138fa0c9a73-da647ecb9a0c3f7b4635f741d2e1c344c29f73e4&lang=cs&ds=AVG&pr=fr&d=2013-05-26 20:48:23&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ie ... 06&sr=0&q={searchTerms}
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.mocaflix.com/?l=1&q={searchTerms}
BHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - No File
BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc)
BHO-x32: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO-x32: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll ()
BHO-x32: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll ()
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll (AVG Secure Search)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.3.0\ViProtocol.dll (AVG Secure Search)
S2 vToolbarUpdater15.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-26] (AVG Secure Search)
C:\Program Files (x86)\Common Files\AVG Secure Search
C:\Program Files (x86)\AVG Secure Search
C:\PROGRA~2\WI3C8A~1\Datamngr
2013-06-26 19:40 - 2013-06-26 20:12 - 95023320 ___AT C:\ProgramData\ej797.pad
2013-06-26 19:40 - 2013-06-26 20:09 - 00000000 ____A C:\ProgramData\g252qs.txt
2013-06-26 19:40 - 2013-06-26 19:40 - 00131072 ____A (Microsoft Corporation) C:\ProgramData\797je.dat
2013-06-26 19:40 - 2013-06-26 19:40 - 00001005 ____A C:\ProgramData\sdaksda.txt
2013-06-26 19:40 - 2013-06-26 19:40 - 00000151 ____A C:\ProgramData\ej797.reg
2013-06-26 19:40 - 2013-06-26 19:40 - 00000056 ____A C:\ProgramData\ej797.bat
2013-06-26 17:51 - 2013-06-26 17:51 - 00000000 ____D C:\ProgramData\AVG Secure Search
C:\ProgramData\rundll32.exe
C:\ProgramData\797je.dat
C:\ProgramData\7off.pad
C:\ProgramData\ej797.bat
C:\ProgramData\ej797.pad
C:\ProgramData\ej797.reg
C:\ProgramData\ffo7.dat
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny log na flashku k FRST
:arrow: Spustte znovu FRST.exe na tom poskozenem PC
  • Kliknete na Fix
  • Probehne oprava a na flash disku se vytvori log Fixlog.txt
:arrow: Pokuste se nastartovat do bezneho rezimu

Re: PČR opět v akci - Victimer

Napsal: 27 čer 2013 00:27
od Victimer
děkuju, už zase šlape jako hodinky :happy:

Re: PČR opět v akci - Victimer

Napsal: 27 čer 2013 06:41
od vyosek
:arrow: Jenze to neni zdaleka vse

:arrow: Dejte mi sem log fixlog.txt, je umisten na flesce

:arrow: Dejte log z RSIT http://forum.viry.cz/viewtopic.php?f=24&t=130784

Re: PČR opět v akci - Victimer

Napsal: 27 čer 2013 15:26
od Victimer
log z RSIT:
Logfile of random's system information tool 1.08 (written by random/random)
Run by Bal at 2013-06-27 16:16:05
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 653 GB (68%) free of 954 GB
Total RAM: 4003 MB (38% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:16:19, on 27.6.2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16611)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files (x86)\MagicDisc\MagicDisc.exe
C:\Program Files (x86)\AVG\AVG2013\avgui.exe
C:\Program Files (x86)\Google\Drive\googledrivesync.exe
C:\Program Files (x86)\Opera\opera.exe
C:\Program Files (x86)\BitLord 2\Bitlord files\bitlord.exe
C:\Program Files\trend micro\Bal.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: phpnuke Helper Object - {890CA547-B66C-48BF-9663-DBE0BFDC7D0C} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\bh\phpnuke.dll
O2 - BHO: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: DealPly - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files (x86)\DealPly\DealPlyIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MIF5BA~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: phpnuke Toolbar - {7B206A1E-933F-4A50-9E60-5167598BDB03} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\phpnukeTlbr.dll
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: MagicDisc.lnk = C:\Program Files (x86)\MagicDisc\MagicDisc.exe
O4 - Startup: OpenOffice.org 3.3.lnk = C:\FRST\Quarantine\quickstart.exe
O8 - Extra context menu item: E&xportovat do Microsoft Excelu - res://C:\PROGRA~2\MIF5BA~1\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do OneNotu - res://C:\PROGRA~2\MIF5BA~1\Office15\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do OneNotu - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Volání kliknutím v Lyncu - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Ralink Registry Writer (RalinkRegistryWriter) - Ralink Technology, Corp. - C:\Program Files (x86)\Edimax\Common\RaRegistry.exe
O23 - Service: Ralink Registry Writer 64 (RalinkRegistryWriter64) - Ralink Technology, Corp. - C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe
O23 - Service: Splashtop® Remote Service (SplashtopRemoteService) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Splashtop Software Updater Service (SSUService) - Splashtop Inc. - C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11931 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
C:\PROGRA~2\AVG\AVG2013\avgrsa.exe /boot
C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe /pipeName=869a7449-763b-453b-ac49-6113afe5b00f /coreSdkOptions=4382 /logConfFile="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2013\temp\046a316a-b656-423c-abc4-190336f86304-1e4-oopp.tmp" /loggerName=AVG.RS.Core /binaryPath="C:\Program Files (x86)\AVG\AVG2013\" /registryPath="SYSTEM\CurrentControlSet\Services\Avg\Avg2013" /tempPath="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2013\temp\"
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe 23324640
\??\C:\Windows\system32\conhost.exe "16556669671831722046-1012413716-347855499818627516-1160478407504507128621180202
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe"
"C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe"
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files\Microsoft LifeCam\MSCamS64.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files (x86)\Edimax\Common\RaRegistry.exe"
"C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe"
"C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe"
"C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe"
"C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe"
WLIDSvcM.exe 2780
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe"
"C:\Program Files (x86)\AVG\AVG2013\avgemca.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"taskhost.exe"
-h
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"SRFeature.exe"
"C:\Program Files (x86)\Steam\Steam.exe" -silent
"C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
"C:\Program Files (x86)\MagicDisc\MagicDisc.exe"
"C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY
"C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Common Files\Steam\SteamService.exe" /RunAsService
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Program Files (x86)\Opera\opera.exe"
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe /pipeName=bf15201b-e0de-427b-9517-ba6a3b79ea73 /coreSdkOptions=4114 /logConfFile="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2013\temp\fa3f0045-5e69-4462-a11b-265567679818-cf4-oopp.tmp" /loggerName=AVG.NS.Core /binaryPath="C:\Program Files (x86)\AVG\AVG2013\" /registryPath="SYSTEM\CurrentControlSet\Services\Avg\Avg2013" /tempPath="C:\Windows\system32\config\systemprofile\AppData\Local\Avg2013\temp\"
"C:\Program Files (x86)\BitLord 2\Bitlord files\bitlord.exe" "magnet:?xt=urn:btih:5468e2402d1676f4f5a2c213f8a912f38c703f97&dn=DC+NEW+52+WEEK+95&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80&tr=udp%3A%2F%2Ftracker.istole.it%3A6969&tr=udp%3A%2F%2Ftracker.ccc.de%3A80&tr=udp%3A%2F%2Fopen.demonii.com%3A1337"
taskhost.exe $(Arg0)
taskeng.exe {52813C4A-AD1E-4EB9-B423-2F3369F476AA}
"C:\Users\Bal\Documents\Instalace\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01 205416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 529664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-05-14 6307960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office15\URLREDIR.DLL [2013-03-10 877760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~1\MICROS~3\Office15\GROOVEEX.DLL [2013-05-20 2328776]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2013-01-15 139344]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2013-01-15 330160]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{890CA547-B66C-48BF-9663-DBE0BFDC7D0C}]
phpnuke Helper Object - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\bh\phpnuke.dll [2013-02-14 271256]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení k účtu Microsoft - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}]
DealPly - C:\Program Files (x86)\DealPly\DealPlyIE.dll [2013-01-16 100048]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-05-14 4531320]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MIF5BA~1\Office15\URLREDIR.DLL [2013-03-09 704704]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MIF5BA~1\Office15\GROOVEEX.DLL [2013-05-20 1725128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2013-01-15 59824]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{7B206A1E-933F-4A50-9E60-5167598BDB03} - phpnuke Toolbar - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\phpnukeTlbr.dll [2013-02-14 344472]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Steam"=C:\Program Files (x86)\Steam\Steam.exe [2013-06-07 1641896]
"GoogleDriveSync"=C:\Program Files (x86)\Google\Drive\googledrivesync.exe [2013-06-06 19676256]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\Windows\system32\hkcmd.exe [2011-10-21 392472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\Windows\system32\igfxtray.exe [2011-10-21 167704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NUSB3MON]
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [2011-09-16 115048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Optimizer Pro]
C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\Windows\system32\igfxpers.exe [2011-10-21 416024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDVCPL]
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-12-13 13374568]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-04-19 18678376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files (x86)\Steam\Steam.exe [2013-06-07 1641896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-09-17 254896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Wireless Utility.lnk]
C:\PROGRA~2\Edimax\Common\RaUI.exe [2009-12-19 1638400]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Matěj^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]
C:\PROGRA~2\OPENOF~1.ORG\program\QUICKS~1.EXE []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"LifeCam"=C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [2010-12-13 135536]
"AVG_UI"=C:\Program Files (x86)\AVG\AVG2013\avgui.exe [2013-04-29 4408368]

C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MagicDisc.lnk - C:\Program Files (x86)\MagicDisc\MagicDisc.exe
OpenOffice.org 3.3.lnk - C:\FRST\Quarantine\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2011-10-21 390144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2013-06-27 16:16:05 ----D---- C:\rsit
2013-06-27 16:16:05 ----D---- C:\Program Files\trend micro
2013-06-26 21:14:19 ----A---- C:\ProgramData\ej797.js
2013-06-26 21:06:56 ----D---- C:\FRST
2013-06-26 20:22:44 ----A---- C:\Windows\ntbtlog.txt
2013-06-26 19:40:42 ----A---- C:\ProgramData\g252qs.txt
2013-06-23 11:24:02 ----D---- C:\ProgramData\InstallShield
2013-06-16 20:29:35 ----D---- C:\Windows\SYSWOW64\saves
2013-06-16 20:29:35 ----D---- C:\Windows\SYSWOW64\logs
2013-06-16 20:29:35 ----A---- C:\Windows\SYSWOW64\system.log.txt
2013-06-15 08:46:37 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2013-06-15 08:46:36 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2013-06-15 08:46:36 ----A---- C:\Windows\system32\urlmon.dll
2013-06-15 08:46:36 ----A---- C:\Windows\system32\iertutil.dll
2013-06-15 08:46:35 ----A---- C:\Windows\SYSWOW64\ieui.dll
2013-06-15 08:46:35 ----A---- C:\Windows\system32\ieui.dll
2013-06-15 08:46:34 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2013-06-15 08:46:34 ----A---- C:\Windows\system32\ieframe.dll
2013-06-15 08:46:33 ----A---- C:\Windows\system32\mshtml.dll
2013-06-15 08:46:32 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2013-06-14 21:07:44 ----D---- C:\ProgramData\Sony Corporation
2013-06-14 21:04:40 ----D---- C:\Program Files (x86)\Sony Media Go Install
2013-06-13 00:19:53 ----A---- C:\Windows\SYSWOW64\RegisterIEPKEYs.exe
2013-06-13 00:19:53 ----A---- C:\Windows\SYSWOW64\iesysprep.dll
2013-06-13 00:19:53 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2013-06-13 00:19:53 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2013-06-13 00:19:53 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2013-06-13 00:19:53 ----A---- C:\Windows\system32\iesysprep.dll
2013-06-13 00:19:53 ----A---- C:\Windows\system32\iesetup.dll
2013-06-13 00:19:53 ----A---- C:\Windows\system32\iernonce.dll
2013-06-13 00:19:53 ----A---- C:\Windows\system32\ie4uinit.exe
2013-06-13 00:19:52 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2013-06-13 00:19:52 ----A---- C:\Windows\SYSWOW64\jscript.dll
2013-06-13 00:19:52 ----A---- C:\Windows\system32\msfeeds.dll
2013-06-13 00:19:52 ----A---- C:\Windows\system32\jscript9.dll
2013-06-13 00:19:52 ----A---- C:\Windows\system32\jscript.dll
2013-06-13 00:19:51 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2013-06-13 00:19:50 ----A---- C:\Windows\SYSWOW64\wininet.dll
2013-06-13 00:19:50 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2013-06-13 00:19:50 ----A---- C:\Windows\system32\wininet.dll
2013-06-13 00:19:50 ----A---- C:\Windows\system32\jsproxy.dll
2013-06-12 16:58:44 ----A---- C:\Windows\SYSWOW64\cryptdlg.dll
2013-06-12 16:58:44 ----A---- C:\Windows\system32\cryptdlg.dll
2013-06-12 16:58:36 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2013-06-12 16:58:36 ----A---- C:\Windows\system32\win32spl.dll
2013-06-12 16:58:33 ----A---- C:\Windows\system32\drivers\tcpip.sys
2013-06-12 16:58:31 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2013-06-12 16:58:31 ----A---- C:\Windows\system32\WindowsCodecs.dll
2013-06-12 16:58:29 ----A---- C:\Windows\SYSWOW64\cryptsvc.dll
2013-06-12 16:58:29 ----A---- C:\Windows\SYSWOW64\cryptnet.dll
2013-06-12 16:58:29 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2013-06-12 16:58:29 ----A---- C:\Windows\SYSWOW64\certutil.exe
2013-06-12 16:58:29 ----A---- C:\Windows\SYSWOW64\certenc.dll
2013-06-12 16:58:29 ----A---- C:\Windows\system32\cryptsvc.dll
2013-06-12 16:58:29 ----A---- C:\Windows\system32\cryptnet.dll
2013-06-12 16:58:29 ----A---- C:\Windows\system32\crypt32.dll
2013-06-12 16:58:29 ----A---- C:\Windows\system32\certutil.exe
2013-06-12 16:58:29 ----A---- C:\Windows\system32\certenc.dll
2013-06-12 16:58:21 ----A---- C:\Windows\SYSWOW64\d3d11.dll
2013-06-12 16:58:21 ----A---- C:\Windows\system32\d3d11.dll
2013-06-06 20:08:55 ----D---- C:\Program Files (x86)\Euro Truck Simulator 2
2013-06-01 01:39:41 ----D---- C:\Program Files (x86)\Microsoft XNA
2013-05-29 00:14:40 ----D---- C:\Users\Bal\AppData\Roaming\Opera Mail
2013-05-28 19:56:41 ----D---- C:\Program Files (x86)\Opera Next

======List of files/folders modified in the last 1 months======

2013-06-27 16:16:19 ----D---- C:\Windows\Prefetch
2013-06-27 16:16:05 ----RD---- C:\Program Files
2013-06-27 16:13:17 ----D---- C:\Windows\Temp
2013-06-27 16:10:28 ----A---- C:\Users\Bal\AppData\Roaming\bitlord_log.txt
2013-06-27 16:02:32 ----D---- C:\Windows\System32
2013-06-27 16:02:32 ----D---- C:\Windows\inf
2013-06-27 16:02:32 ----A---- C:\Windows\system32\PerfStringBackup.INI
2013-06-27 16:00:26 ----A---- C:\Windows\SYSWOW64\log.txt
2013-06-27 16:00:15 ----D---- C:\Program Files (x86)\Steam
2013-06-27 15:23:14 ----D---- C:\Windows\system32\config
2013-06-27 08:30:50 ----D---- C:\ProgramData\MFAData
2013-06-27 01:22:41 ----HD---- C:\ProgramData
2013-06-27 01:22:04 ----D---- C:\Program Files (x86)\Windows iLivid Toolbar
2013-06-27 01:22:03 ----RD---- C:\Program Files (x86)
2013-06-27 01:22:02 ----D---- C:\Program Files (x86)\Common Files
2013-06-27 01:13:22 ----D---- C:\Users\Bal\AppData\Roaming\vlc
2013-06-26 22:09:56 ----SHD---- C:\System Volume Information
2013-06-26 21:06:57 ----D---- C:\Windows
2013-06-26 12:30:01 ----D---- C:\Program Files (x86)\DealPly
2013-06-26 11:03:44 ----D---- C:\Users\Bal\AppData\Roaming\.technic
2013-06-26 10:56:42 ----SHD---- C:\Windows\Installer
2013-06-23 11:40:42 ----RSD---- C:\Windows\assembly
2013-06-23 11:29:33 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2013-06-22 13:29:13 ----D---- C:\Windows\system32\catroot2
2013-06-21 15:44:19 ----D---- C:\Users\Bal\AppData\Roaming\SoftGrid Client
2013-06-21 15:44:02 ----RSD---- C:\Windows\Fonts
2013-06-19 16:46:46 ----D---- C:\Users\Bal\AppData\Roaming\BitLord
2013-06-17 08:22:49 ----D---- C:\Program Files (x86)\Google
2013-06-16 20:29:35 ----D---- C:\Windows\SysWOW64
2013-06-16 20:29:23 ----D---- C:\Windows\system32\Tasks
2013-06-15 09:55:18 ----D---- C:\Windows\winsxs
2013-06-15 09:54:44 ----D---- C:\Program Files (x86)\Internet Explorer
2013-06-15 09:54:43 ----D---- C:\Program Files\Internet Explorer
2013-06-15 08:46:52 ----D---- C:\Windows\system32\catroot
2013-06-14 21:41:39 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2013-06-14 21:07:57 ----D---- C:\Program Files (x86)\Sony
2013-06-14 16:43:59 ----D---- C:\Windows\rescache
2013-06-13 20:34:13 ----D---- C:\Windows\Microsoft.NET
2013-06-13 15:58:02 ----D---- C:\Windows\system32\drivers
2013-06-13 15:57:58 ----D---- C:\Windows\SYSWOW64\cs-CZ
2013-06-13 15:57:58 ----D---- C:\Windows\system32\cs-CZ
2013-06-13 00:20:25 ----A---- C:\Windows\system32\MRT.exe
2013-06-13 00:17:58 ----D---- C:\ProgramData\Microsoft Help
2013-06-11 15:44:34 ----D---- C:\Windows\system32\DriverStore
2013-06-08 22:35:53 ----D---- C:\Users\Bal\AppData\Roaming\Audacity
2013-06-01 12:45:36 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2013-06-01 01:34:16 ----D---- C:\Windows\SoftwareDistribution
2013-05-31 15:31:59 ----D---- C:\ProgramData\Skype
2013-05-31 15:31:58 ----D---- C:\Program Files (x86)\Skype
2013-05-28 19:56:44 ----D---- C:\Users\Bal\AppData\Roaming\Opera

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHA;AVGIDSHA; C:\Windows\system32\DRIVERS\avgidsha.sys [2013-02-08 71480]
R0 Avgloga;AVG Logging Driver; C:\Windows\system32\DRIVERS\avgloga.sys [2013-02-08 311096]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx64.sys [2013-02-08 116536]
R0 Avgrkx64;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx64.sys [2013-02-08 45880]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\avgidsdrivera.sys [2013-03-29 246072]
R1 Avgldx64;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx64.sys [2013-02-08 206136]
R1 Avgtdia;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdia.sys [2013-03-21 240952]
R1 avgtp;avgtp; \??\C:\Windows\system32\drivers\avgtpx64.sys [2013-06-26 45856]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2012-01-11 360624]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2011-10-21 12310112]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2011-12-13 4718952]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2011-08-23 317440]
R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\Windows\system32\DRIVERS\mcdbus.sys [2009-02-24 255552]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver; C:\Windows\System32\Drivers\nx6000.sys [2010-12-13 36720]
R3 netr28x;Ralink 802.11n Extensible Wireless Driver; C:\Windows\system32\DRIVERS\netr28x.sys [2009-10-06 737792]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver; C:\Windows\system32\DRIVERS\nusb3hub.sys [2011-10-25 96768]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver; C:\Windows\system32\DRIVERS\nusb3xhc.sys [2011-10-25 213504]
R3 Sftfs;Sftfs; C:\Windows\system32\DRIVERS\Sftfswin7.sys [2011-10-01 765288]
R3 Sftplay;Sftplay; C:\Windows\system32\DRIVERS\Sftplaywin7.sys [2011-10-01 268648]
R3 Sftredir;Sftredir; C:\Windows\system32\DRIVERS\Sftredirwin7.sys [2011-10-01 25960]
R3 Sftvol;Sftvol; C:\Windows\system32\DRIVERS\Sftvolwin7.sys [2011-10-01 22376]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S1 hola_net;Hola Fast Internet Adapter; C:\Windows\system32\DRIVERS\hola_net.sys [2013-04-06 86512]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver; C:\Windows\System32\Drivers\ssadadb.sys [2011-05-13 36328]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2012-09-12 57856]
S3 ggflt;SEMC USB Flash Driver Filter; C:\Windows\system32\DRIVERS\ggflt.sys [2012-09-28 14448]
S3 ggsemc;SEMC USB Flash Driver; C:\Windows\system32\DRIVERS\ggsemc.sys [2012-09-28 27760]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\Windows\system32\DRIVERS\s0016bus.sys [2008-05-16 115240]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 19496]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 158760]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 137256]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\Windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 34344]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s0016obex.sys [2008-05-16 136744]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\Windows\system32\DRIVERS\s0016unic.sys [2008-05-16 151592]
S3 s1039bus;Sony Ericsson Device 1039 driver (WDM); C:\Windows\system32\DRIVERS\s1039bus.sys [2010-03-15 127600]
S3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter; C:\Windows\system32\DRIVERS\s1039mdfl.sys [2010-03-15 19568]
S3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver; C:\Windows\system32\DRIVERS\s1039mdm.sys [2010-03-15 161904]
S3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM); C:\Windows\system32\DRIVERS\s1039mgmt.sys [2010-03-15 141424]
S3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS); C:\Windows\system32\DRIVERS\s1039nd5.sys [2010-03-15 34416]
S3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface; C:\Windows\system32\DRIVERS\s1039obex.sys [2010-03-15 137328]
S3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM); C:\Windows\system32\DRIVERS\s1039unic.sys [2010-03-15 158320]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-05-13 157672]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 16872]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 177640]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2011-05-13 146920]
S3 taphss;Anchorfree HSS Adapter; C:\Windows\system32\DRIVERS\taphss.sys [2012-01-05 37888]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-05-10 65640]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2013-05-14 4937264]
R2 avgwd;AVG WatchDog; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2013-04-18 283136]
R2 cvhsvc;Client Virtualization Handler; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-02-07 822624]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2011-11-09 189608]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2011-08-08 325912]
R2 MSCamSvc;MSCamSvc; C:\Program Files\Microsoft LifeCam\MSCamS64.exe [2010-12-13 194416]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2013-03-25 76888]
R2 RalinkRegistryWriter;Ralink Registry Writer; C:\Program Files (x86)\Edimax\Common\RaRegistry.exe [2009-10-06 185632]
R2 RalinkRegistryWriter64;Ralink Registry Writer 64; C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe [2009-10-06 212256]
R2 sftlist;Application Virtualization Client; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
R2 Skype C2C Service;Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-05-14 3289208]
R2 SplashtopRemoteService;Splashtop® Remote Service; C:\Program Files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe [2013-04-03 551264]
R2 SSUService;Splashtop Software Updater Service; C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [2013-05-08 583968]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-08-08 2656536]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2012-07-17 2292480]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
R3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-06-07 543656]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-12 136176]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-14 256904]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 fsssvc;Windows Live Family Safety Service; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2012-09-12 1512448]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-12 136176]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-12-08 150600]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2012-10-01 5132888]
S3 Sony PC Companion;Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [2012-01-18 155320]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-04-06 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]

-----------------EOF-----------------


fixlog.txt:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-06-2013 02
Ran by Bal at 2013-06-27 01:22:01 Run:1
Running from F:\
Boot Mode: Normal
==============================================

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\DATAMNGR => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\vProt => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\Smart Driver Updater => Value not found.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon32.exe => Value not found.
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe => Moved successfully.
C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk => Moved successfully.
C:\PROGRA~3\797je.dat => Moved successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1BE0EDCE-4B79-4E17-AED2-7147AD286174} => Key deleted successfully.
HKCR\CLSID\{1BE0EDCE-4B79-4E17-AED2-7147AD286174} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key deleted successfully.
HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} => Key deleted successfully.
HKCR\CLSID\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908} => Key deleted successfully.
HKCR\CLSID\{3706EE7C-3CAD-445D-8A43-03EBC3B75908} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0} => Key deleted successfully.
HKCR\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{9D717F81-9148-4f12-8568-69135F087DB0} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{95B7759C-8C7F-4BF1-B163-73684A933233} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key not found.
HKCR\Wow6432Node\PROTOCOLS\Handler\viprotocol => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9} => Key deleted successfully.
vToolbarUpdater15.3.0 => Service deleted successfully.
C:\Program Files (x86)\Common Files\AVG Secure Search => Moved successfully.
C:\Program Files (x86)\AVG Secure Search => Moved successfully.
C:\PROGRA~2\WI3C8A~1\Datamngr => Moved successfully.
C:\ProgramData\ej797.pad => Moved successfully.
Could not move C:\ProgramData\g252qs.txt. => Scheduled to move on reboot.
C:\ProgramData\797je.dat => File/Directory not found.
C:\ProgramData\sdaksda.txt => Moved successfully.
C:\ProgramData\ej797.reg => Moved successfully.
C:\ProgramData\ej797.bat => Moved successfully.
C:\ProgramData\AVG Secure Search => Moved successfully.
C:\ProgramData\rundll32.exe => Moved successfully.
C:\ProgramData\797je.dat => File/Directory not found.
C:\ProgramData\7off.pad => Moved successfully.
C:\ProgramData\ej797.bat => File/Directory not found.
C:\ProgramData\ej797.pad => File/Directory not found.
C:\ProgramData\ej797.reg => File/Directory not found.
C:\ProgramData\ffo7.dat => Moved successfully.

Re: PČR opět v akci - Victimer

Napsal: 27 čer 2013 15:52
od vyosek
:arrow: Trvate na antiviru AVG - u nas neni moc obliben - vysoka zatez systemu, slabsi detekce :?:

:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Kliknete na Prohledat
  • Probehne skenovani a pak se objevi log, pripadne bude ulozen na systemovem disku jako AdwCleaner[R?].txt, ten sem vlozte

Re: PČR opět v akci - Victimer

Napsal: 27 čer 2013 21:01
od Victimer
na AVG netrvám, jen mi byl dopuručen kolegou. Jakoukoliv radu vítám :)

ADwCleaner log:

# AdwCleaner v2.303 - Log vytvooen 27/06/2013 v 21:59:28
# Aktualizováno 08/06/2013 Xplode
# Operaení systém : Windows 7 Home Premium Service Pack 1 (64 bits)
# Uživatel : Bal - BAL-PC
# Spuštin systém : Normální
# Spuštino z : C:\Users\Bal\Desktop\adwcleaner.exe
# Volba [Prohledat]


***** [Služby] *****


***** [Soubory / Složky] *****

Složka Nalezeno : C:\Program Files (x86)\Conduit
Složka Nalezeno : C:\Program Files (x86)\DealPly
Složka Nalezeno : C:\Program Files (x86)\MocaFlix
Složka Nalezeno : C:\Program Files (x86)\Smart Driver Updater
Složka Nalezeno : C:\Program Files (x86)\Windows iLivid Toolbar
Složka Nalezeno : C:\ProgramData\Babylon
Složka Nalezeno : C:\ProgramData\boost_interprocess
Složka Nalezeno : C:\ProgramData\clsoft ltd
Složka Nalezeno : C:\ProgramData\InstallMate
Složka Nalezeno : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly
Složka Nalezeno : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Driver Updater
Složka Nalezeno : C:\ProgramData\Premium
Složka Nalezeno : C:\Users\Bal\AppData\Local\AVG Secure Search
Složka Nalezeno : C:\Users\Bal\AppData\Local\Conduit
Složka Nalezeno : C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Složka Nalezeno : C:\Users\Bal\AppData\Local\Ilivid Player
Složka Nalezeno : C:\Users\Bal\AppData\Local\PackageAware
Složka Nalezeno : C:\Users\Bal\AppData\LocalLow\AVG Secure Search
Složka Nalezeno : C:\Users\Bal\AppData\LocalLow\Conduit
Složka Nalezeno : C:\Users\Bal\AppData\LocalLow\PriceGong
Složka Nalezeno : C:\Users\Bal\AppData\LocalLow\Searchqutoolbar
Složka Nalezeno : C:\Users\Bal\AppData\Roaming\DealPly
Složka Nalezeno : C:\Users\Matěj\AppData\Local\AVG Secure Search
Složka Nalezeno : C:\Users\Matěj\AppData\LocalLow\AVG Secure Search
Složka Nalezeno : C:\Users\Matěj\AppData\Roaming\Babylon
Složka Nalezeno : C:\Users\Matěj\AppData\Roaming\DealPly
Složka Nalezeno : C:\Users\Matěj\AppData\Roaming\Smart Driver Updater
Soubor Nalezeno : C:\user.js

***** [Registry] *****

Hodnota Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]
Hodnota Nalezeno : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [10]
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\Conduit
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\PriceGong
Klíe Nalezeno : HKCU\Software\AppDataLow\Software\SmartBar
Klíe Nalezeno : HKCU\Software\AppDataLow\SProtector
Klíe Nalezeno : HKCU\Software\AVG Secure Search
Klíe Nalezeno : HKCU\Software\Conduit
Klíe Nalezeno : HKCU\Software\DataMngr
Klíe Nalezeno : HKCU\Software\DataMngr_Toolbar
Klíe Nalezeno : HKCU\Software\DealPly
Klíe Nalezeno : HKCU\Software\ilivid
Klíe Nalezeno : HKCU\Software\InstallCore
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Klíe Nalezeno : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Klíe Nalezeno : HKCU\Software\Smart Driver Updater
Klíe Nalezeno : HKLM\Software\AVG Secure Search
Klíe Nalezeno : HKLM\Software\AVG Security Toolbar
Klíe Nalezeno : HKLM\Software\Babylon
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\DNSBHO.dll
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Klíe Nalezeno : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\BrowserConnection.Loader
Klíe Nalezeno : HKLM\SOFTWARE\Classes\BrowserConnection.Loader.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\DnsBHO.BHO
Klíe Nalezeno : HKLM\SOFTWARE\Classes\DnsBHO.BHO.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\escort.escortIEPane
Klíe Nalezeno : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Prod.cap
Klíe Nalezeno : HKLM\SOFTWARE\Classes\S
Klíe Nalezeno : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Klíe Nalezeno : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Klíe Nalezeno : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Toolbar.CT2549263
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Klíe Nalezeno : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Klíe Nalezeno : HKLM\Software\Conduit
Klíe Nalezeno : HKLM\Software\DataMngr
Klíe Nalezeno : HKLM\Software\DealPly
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Klíe Nalezeno : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Klíe Nalezeno : HKLM\Software\SearchquMediabarTb
Klíe Nalezeno : HKLM\Software\SP Global
Klíe Nalezeno : HKLM\Software\SProtector
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Smart Driver Updater_is1
Klíe Nalezeno : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SP_8e4eb48d
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Klíe Nalezeno : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Klíe Nalezeno : HKLM\SOFTWARE\DataMngr
Klíe Nalezeno : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Klíe Nalezeno : HKU\S-1-5-21-2909710318-1461308629-1340934368-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

***** [Internetové prohlížeee] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Registry jsou eisté.

-\\ Google Chrome v27.0.1453.116

Soubor : C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Soubor je eistý.

Soubor : C:\Users\Matěj\AppData\Local\Google\Chrome\User Data\Default\Preferences

Nalezeno [l.29] : icon_url = "hxxp://www.babylon.com/favicon.ico",
Nalezeno [l.32] : keyword = "babylon.com",
Nalezeno [l.36] : search_url = "hxxp://search.babylon.com/?q={searchTerms}&affID=117064&tt=0413_2&babsrc=SP_ss&mntrId=e27dc7e0000000000000001f1fbdd2fc",
Nalezeno [l.2223] : homepage = "hxxp://search.babylon.com/?affID=117064&tt=0413_2&babsrc=HP_ss&mntrId=e27dc7e0000000000000001f1fbdd2fc",

-\\ Opera v12.15.1748.0

Soubor : C:\Users\Bal\AppData\Roaming\Opera\Opera\operaprefs.ini

Nalezeno : Home URL=hxxp://www.searchnu.com/406

Soubor : C:\Users\Matěj\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Soubor je eistý.

*************************

AdwCleaner[R1].txt - [12552 octets] - [27/06/2013 21:59:28]

########## EOF - C:\AdwCleaner[R1].txt - [12613 octets] ##########

Re: PČR opět v akci - Victimer

Napsal: 28 čer 2013 11:54
od vyosek
:arrow: Avg je spise parodie na antivir :arcisit:

:arrow: Odinstalujte Avg a pak pouzijte jeste http://download.avg.com/filedir/util/av ... 3_2706.exe

:arrow: Nainstalujte Avast Free http://www.avast.com/get/gWR5mo92

:arrow: Spustte znovu AdwCleaner
  • Pokud pouzivate Win Vista ci W7, kliknete na AdwCleaner pravym a dejte Run As Administrator ci Spustit jako spravce
  • Kliknete na Smazat
  • PC provede opravu, restartuje se a da Vam log (C:\AdwCleaner [S1].txt) , jeho obsah vlozte sem

Re: PČR opět v akci - Victimer

Napsal: 14 zář 2013 20:09
od Victimer
pardon byl jsem teď několik měsíců mimo svůj počítač...

AVG jsem odstranil a nainstaloval jsem Avast

ale když otevřu AdwCleaner (jako administrátor) tak nemohu najít funkci "smazat"....

Re: PČR opět v akci - Victimer

Napsal: 14 zář 2013 20:10
od vyosek
Zdravicko :)

:arrow: AdwCleaner byl aktualizovan :James008:

:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Kliknete na Scan a nasledne Clean
  • Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

Re: PČR opět v akci - Victimer

Napsal: 14 zář 2013 21:42
od Victimer
# AdwCleaner v3.003 - Report created 14/09/2013 at 22:36:12
# Updated 07/09/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Bal - BAL-PC
# Running from : C:\Users\Bal\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : SSUService

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\ProgramData\clsoft ltd
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\ProgramData\Splashtop
Folder Deleted : C:\ProgramData\wxDownload
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Driver Updater
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\DealPly
Folder Deleted : C:\Program Files (x86)\MocaFlix
Folder Deleted : C:\Program Files (x86)\Smart Driver Updater
Folder Deleted : C:\Program Files (x86)\Splashtop
Folder Deleted : C:\Program Files (x86)\Windows iLivid Toolbar
Folder Deleted : C:\Users\Bal\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Bal\AppData\Local\Conduit
Folder Deleted : C:\Users\Bal\AppData\Local\Ilivid Player
Folder Deleted : C:\Users\Bal\AppData\Local\PackageAware
Folder Deleted : C:\Users\Bal\AppData\Local\Splashtop
Folder Deleted : C:\Users\Bal\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Bal\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Bal\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Bal\AppData\LocalLow\Searchqutoolbar
Folder Deleted : C:\Users\Bal\AppData\Roaming\DealPly
Folder Deleted : C:\Users\Matěj\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Matěj\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Matěj\AppData\Roaming\Babylon
Folder Deleted : C:\Users\Matěj\AppData\Roaming\DealPly
Folder Deleted : C:\Users\Matěj\AppData\Roaming\Smart Driver Updater
Folder Deleted : C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Folder Deleted : C:\Users\Matěj\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Folder Deleted : C:\Users\Matěj\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmghpknhmhbfgbfdnijjmnfdbjdbaehb
File Deleted : C:\Windows\System32\Tasks\Dealply
File Deleted : C:\Windows\System32\Tasks\DealPlyUpdate

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\gaiilaahiahdejapggenmdmafpmbipje
Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
Key Deleted : HKLM\SOFTWARE\Classes\AppID\DNSBHO.dll
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\BrowserConnection.Loader
Key Deleted : HKLM\SOFTWARE\Classes\BrowserConnection.Loader.1
Key Deleted : HKLM\SOFTWARE\Classes\DnsBHO.BHO
Key Deleted : HKLM\SOFTWARE\Classes\DnsBHO.BHO.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_8e4eb48d
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2549263
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_city-life_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_city-life_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\DataMngr_Toolbar
Key Deleted : HKCU\Software\DealPly
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\Smart Driver Updater
Key Deleted : HKCU\Software\Splashtop Inc.
Key Deleted : HKCU\Software\AppDataLow\SProtector
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\DealPly
Key Deleted : HKLM\Software\SearchquMediabarTb
Key Deleted : HKLM\Software\SP Global
Key Deleted : HKLM\Software\Splashtop Inc.
Key Deleted : HKLM\Software\SProtector
Key Deleted : HKLM\Software\systweak
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DealPly
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Smart Driver Updater_is1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Splashtop Software Updater
Key Deleted : [x64] HKLM\SOFTWARE\DataMngr

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16686


-\\ Google Chrome v29.0.1547.66

[ File : C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage
Deleted : urls_to_restore_on_startup
Deleted : search_url

[ File : C:\Users\Matěj\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage
Deleted : icon_url
Deleted : search_url
Deleted : keyword

*************************

AdwCleaner[R0].txt - [12778 octets] - [14/09/2013 21:05:28]
AdwCleaner[R1].txt - [12827 octets] - [14/09/2013 22:35:40]
AdwCleaner[S0].txt - [12496 octets] - [14/09/2013 22:36:12]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [12557 octets] ##########

Re: PČR opět v akci - Victimer

Napsal: 14 zář 2013 21:48
od vyosek
Poprosim o FRSTL http://forum.viry.cz/viewtopic.php?f=13&t=132519

Re: PČR opět v akci - Victimer

Napsal: 14 zář 2013 21:58
od Victimer
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-09-2013 04
Ran by Bal (administrator) on BAL-PC on 14-09-2013 22:57:08
Running from C:\Users\Bal\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Edimax\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(MagicISO, Inc.) C:\Program Files (x86)\MagicDisc\MagicDisc.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

==================== Registry (Whitelisted) ==================

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1811880 2013-08-28] (Valve Corporation)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20097696 2013-06-27] (Google)
MountPoints2: {b9bebbb5-c475-11e1-952a-7071bce87380} - F:\Startme.exe
MountPoints2: {c5292759-0948-11e2-a99b-7071bce87380} - F:\Startme.exe
MountPoints2: {dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} - E:\INSTALL.EXE
HKLM-x32\...\Run: [LifeCam] - C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [135536 2010-12-13] (Microsoft Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-05-23] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKU\Matěj\...\Run: [Smart Driver Updater] - C:\Program Files (x86)\Smart Driver Updater\SDULauncher.exe
HKU\Matěj\...\Run: [ctfmon32.exe] - C:\PROGRA~3\rundll32.exe C:\PROGRA~3\797je.dat,XFG00 <===== ATTENTION
HKU\Matěj\...\Run: [Sony PC Companion] - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449248 2013-05-29] (Sony)
HKU\Matěj\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1561968 2013-05-23] (Samsung)
HKU\Matěj\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Matěj\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-05-23] (Samsung)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\FRST\Quarantine\quickstart.exe ()

==================== Internet (Whitelisted) ====================

SearchScopes: HKLM - DefaultScope value is missing.
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: phpnuke Helper Object - {890CA547-B66C-48BF-9663-DBE0BFDC7D0C} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\bh\phpnuke.dll (PHPNuke.org)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - phpnuke Toolbar - {7B206A1E-933F-4A50-9E60-5167598BDB03} - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\phpnukeTlbr.dll (PHPNuke.org)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: (Search Results) - http://www.google.com
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File
CHR Plugin: (Skype Click to Call) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.11.0.9874_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Extension: (Google Drive) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1
CHR Extension: (Google Search) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1
CHR Extension: (Skype Click to Call) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.9.0.12585_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\Bal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [cngompmodgafkkffefbfbghhciijojjh] - C:\Program Files (x86)\phpnuke\phpnuke\1.8.12.7\phpnuke.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-03-25] ()

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-09-14] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-09-14] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-09-14] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-06-26] (AVG Technologies)
S1 hola_net; C:\Windows\System32\DRIVERS\hola_net.sys [86512 2013-04-06] (Hola Networks Ltd.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation)
R3 Sftfs; C:\Windows\System32\DRIVERS\Sftfswin7.sys [768680 2013-06-26] (Microsoft Corporation)
R3 Sftplay; C:\Windows\System32\DRIVERS\Sftplaywin7.sys [273576 2013-06-26] (Microsoft Corporation)
R3 Sftredir; C:\Windows\System32\DRIVERS\Sftredirwin7.sys [29352 2013-06-26] (Microsoft Corporation)
R3 Sftvol; C:\Windows\System32\DRIVERS\Sftvolwin7.sys [23208 2013-06-26] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-14 22:56 - 2013-09-14 22:56 - 00000000 ____D C:\Users\Bal\AppData\Local\qb1118AE.F0
2013-09-14 22:56 - 2013-09-13 21:11 - 01950312 _____ (Farbar) C:\Users\Bal\Desktop\FRST64.exe
2013-09-14 22:55 - 2013-09-14 22:55 - 00000000 ____D C:\Users\Bal\AppData\Local\qb105D6B.C0
2013-09-14 22:35 - 2013-09-14 22:35 - 01037278 _____ C:\Users\Bal\Desktop\adwcleaner.exe
2013-09-14 21:04 - 2013-09-14 22:36 - 00000000 ____D C:\AdwCleaner
2013-09-14 20:56 - 2013-09-14 20:56 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-09-14 20:56 - 2013-09-14 20:56 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-09-14 20:56 - 2013-09-14 20:56 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-09-14 20:56 - 2013-09-14 20:56 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-09-14 20:56 - 2013-05-09 10:59 - 00080816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-09-14 20:56 - 2013-05-09 10:59 - 00072016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-09-14 20:56 - 2013-05-09 10:59 - 00065336 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-09-14 20:56 - 2013-05-09 10:59 - 00064288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-09-14 20:56 - 2013-05-09 10:59 - 00033400 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
2013-09-14 20:56 - 2013-05-09 10:58 - 00041664 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-09-14 20:35 - 2013-09-14 22:39 - 00197229 _____ C:\Users\Bal\Desktop\avgremover.log
2013-09-14 20:27 - 2013-09-14 20:27 - 03222280 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Bal\Desktop\avg_remover_stf_x64_2013_2706.exe
2013-09-12 23:04 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 23:04 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 23:03 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 23:03 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 23:03 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 23:03 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 23:03 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 23:03 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 23:03 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 23:03 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 23:03 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 23:03 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 23:03 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 23:03 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 16:22 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 16:22 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 16:22 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 16:22 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 16:22 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 16:22 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 16:22 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 16:22 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 16:22 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 16:22 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 16:22 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 16:22 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 16:22 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 16:22 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 16:22 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 16:22 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 16:22 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 16:22 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 16:22 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 16:22 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 16:22 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 16:22 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 16:22 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 16:22 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 16:22 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 16:22 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 16:22 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-11 23:39 - 2013-09-11 23:39 - 00021645 _____ C:\Users\Bal\Desktop\[kickass.to]dc.universe.52.week.107.darkhomr.kat.torrent
2013-09-07 09:47 - 2013-09-07 09:48 - 18826828 _____ C:\Users\Bal\Desktop\Sphax_Hexxit _32x(a0.6).zip
2013-09-06 15:33 - 2013-09-06 15:35 - 32565948 _____ C:\Users\Bal\Desktop\Sphax_Hexxit _64x(a0.6).zip
2013-09-06 15:32 - 2013-09-06 15:47 - 43557158 _____ C:\Users\Bal\Desktop\Sphax PureBDcraft 64x MC15.zip
2013-09-03 20:00 - 2013-09-03 20:03 - 00000000 ____D C:\Users\Matěj\Desktop\Editor
2013-09-01 15:09 - 2013-09-01 15:09 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dungeon Keeper 2 CZ ver.1.0
2013-08-31 22:54 - 2013-08-31 22:54 - 00003162 _____ C:\Windows\System32\Tasks\{BC1FF4BF-93A5-44C0-879E-C4A8D12408B4}
2013-08-31 22:51 - 2013-08-31 22:51 - 00003126 _____ C:\Windows\System32\Tasks\{00B2ED70-26B9-4FA2-9B55-A9E8AA45A02A}
2013-08-31 22:45 - 2013-08-31 22:45 - 00000000 ____D C:\Program Files (x86)\Bullfrog
2013-08-31 14:25 - 2013-08-31 14:25 - 00000000 ____D C:\Program Files (x86)\GOGcom
2013-08-18 18:35 - 2013-08-18 18:45 - 179916454 _____ C:\Users\Bal\Desktop\Avengers.Assemble.S01E01.The.Avengers.Protocol.Pt.1.WEB-DL.XviD.MP3.avi
2013-08-18 16:11 - 2013-08-18 16:11 - 00000218 _____ C:\Users\Bal\AppData\Local\recently-used.xbel
2013-08-18 14:48 - 2013-08-18 14:48 - 00000000 ____D C:\Users\Bal\AppData\Roaming\dvdcss
2013-08-17 14:32 - 2013-08-17 17:56 - 4270387200 _____ C:\Users\Bal\Desktop\psig-skyfall.2012.720p.brrip.xvid.avi
2013-08-15 00:58 - 2013-09-12 23:03 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 00:34 - 2013-08-15 00:35 - 00000000 ____D C:\Users\Bal\Desktop\week 102

==================== One Month Modified Files and Folders =======

2013-09-14 22:56 - 2013-09-14 22:56 - 00000000 ____D C:\Users\Bal\AppData\Local\qb1118AE.F0
2013-09-14 22:56 - 2012-04-12 19:38 - 00000000 ____D C:\Program Files (x86)\Opera
2013-09-14 22:55 - 2013-09-14 22:55 - 00000000 ____D C:\Users\Bal\AppData\Local\qb105D6B.C0
2013-09-14 22:55 - 2013-06-26 21:06 - 00000000 ____D C:\FRST
2013-09-14 22:45 - 2009-07-14 06:45 - 00021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-14 22:45 - 2009-07-14 06:45 - 00021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-14 22:42 - 2012-04-05 13:14 - 01347211 _____ C:\Windows\WindowsUpdate.log
2013-09-14 22:41 - 2012-04-12 19:49 - 00000946 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-14 22:41 - 2012-04-12 19:41 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-14 22:39 - 2013-09-14 20:35 - 00197229 _____ C:\Users\Bal\Desktop\avgremover.log
2013-09-14 22:39 - 2013-06-17 08:25 - 00000000 ___RD C:\Users\Bal\Disk Google
2013-09-14 22:39 - 2012-06-15 18:15 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-14 22:38 - 2012-04-12 19:49 - 00000942 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-14 22:37 - 2013-05-27 14:28 - 00014412 _____ C:\Windows\setupact.log
2013-09-14 22:37 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-14 22:36 - 2013-09-14 21:04 - 00000000 ____D C:\AdwCleaner
2013-09-14 22:35 - 2013-09-14 22:35 - 01037278 _____ C:\Users\Bal\Desktop\adwcleaner.exe
2013-09-14 21:04 - 2012-08-21 10:44 - 00000000 ____D C:\Users\Bal\Documents\Instalace
2013-09-14 20:56 - 2013-09-14 20:56 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-09-14 20:56 - 2013-09-14 20:56 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-09-14 20:56 - 2013-09-14 20:56 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-09-14 20:56 - 2013-09-14 20:56 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-09-14 20:56 - 2013-09-14 20:56 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-09-14 20:56 - 2013-03-03 22:30 - 00000175 _____ C:\Windows\system32\Drivers\aswvmm.sys.sum
2013-09-14 20:56 - 2012-04-12 19:48 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-09-14 20:55 - 2012-04-12 19:48 - 00000000 ____D C:\ProgramData\AVAST Software
2013-09-14 20:55 - 2012-04-12 19:48 - 00000000 ____D C:\Program Files\AVAST Software
2013-09-14 20:40 - 2011-04-12 10:34 - 00666874 _____ C:\Windows\system32\perfh005.dat
2013-09-14 20:40 - 2011-04-12 10:34 - 00140312 _____ C:\Windows\system32\perfc005.dat
2013-09-14 20:40 - 2009-07-14 07:13 - 01579034 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-14 20:34 - 2013-06-15 07:59 - 00009146 _____ C:\Windows\PFRO.log
2013-09-14 20:27 - 2013-09-14 20:27 - 03222280 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Bal\Desktop\avg_remover_stf_x64_2013_2706.exe
2013-09-14 17:56 - 2013-03-26 21:27 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2013-09-14 17:56 - 2012-05-07 19:10 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-09-14 11:17 - 2012-05-07 19:10 - 00281688 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-09-13 23:08 - 2012-04-14 11:04 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Skype
2013-09-13 21:11 - 2013-09-14 22:56 - 01950312 _____ (Farbar) C:\Users\Bal\Desktop\FRST64.exe
2013-09-13 19:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 18:30 - 2012-04-12 21:06 - 00000000 ___RD C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 18:30 - 2012-04-12 21:06 - 00000000 ___RD C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 17:41 - 2012-04-12 19:41 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-13 17:41 - 2012-04-12 19:41 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 17:41 - 2012-04-12 19:41 - 00003852 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-13 15:41 - 2012-04-14 18:54 - 00000000 ____D C:\Users\Bal\AppData\Roaming\vlc
2013-09-13 11:56 - 2012-04-05 13:15 - 00000000 ___RD C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 11:56 - 2012-04-05 13:15 - 00000000 ___RD C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 11:56 - 2009-07-14 06:45 - 00500280 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 23:03 - 2013-08-15 00:58 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 23:03 - 2013-03-06 10:08 - 01603194 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-12 23:03 - 2013-03-06 10:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-12 23:02 - 2012-04-12 19:43 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 23:00 - 2013-03-09 16:24 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 23:39 - 2013-09-11 23:39 - 00021645 _____ C:\Users\Bal\Desktop\[kickass.to]dc.universe.52.week.107.darkhomr.kat.torrent
2013-09-11 23:39 - 2013-04-20 00:03 - 00000000 ____D C:\Users\Bal\Documents\BitLord
2013-09-11 17:23 - 2013-04-17 23:47 - 00000000 ____D C:\Users\Bal\Documents\Cemie
2013-09-11 16:45 - 2012-04-14 18:55 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\vlc
2013-09-10 22:26 - 2012-04-14 10:24 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-09-10 21:27 - 2012-04-14 11:04 - 00000000 ____D C:\Program Files (x86)\Skype
2013-09-10 21:26 - 2012-04-14 11:04 - 00000000 ____D C:\ProgramData\Skype
2013-09-10 15:41 - 2013-07-01 19:41 - 00183872 _____ C:\Windows\DPINST.LOG
2013-09-10 15:41 - 2012-07-25 10:43 - 00002026 _____ C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2013-09-10 15:41 - 2012-04-05 20:01 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-08 22:55 - 2013-04-30 14:01 - 00000000 ____D C:\Users\Matěj\Desktop\mobil
2013-09-07 20:40 - 2013-02-24 18:47 - 00006656 _____ C:\Users\Bal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-07 18:44 - 2012-07-31 23:48 - 00225792 ___SH C:\Users\Bal\Documents\Thumbs.db
2013-09-07 09:48 - 2013-09-07 09:47 - 18826828 _____ C:\Users\Bal\Desktop\Sphax_Hexxit _32x(a0.6).zip
2013-09-06 15:47 - 2013-09-06 15:32 - 43557158 _____ C:\Users\Bal\Desktop\Sphax PureBDcraft 64x MC15.zip
2013-09-06 15:35 - 2013-09-06 15:33 - 32565948 _____ C:\Users\Bal\Desktop\Sphax_Hexxit _64x(a0.6).zip
2013-09-06 15:23 - 2013-05-07 20:47 - 00000000 ____D C:\Users\Bal\AppData\Roaming\.technic
2013-09-04 18:04 - 2012-04-14 10:48 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\.minecraft
2013-09-03 20:03 - 2013-09-03 20:00 - 00000000 ____D C:\Users\Matěj\Desktop\Editor
2013-09-03 19:42 - 2013-08-11 17:41 - 00000000 ____D C:\Users\Matěj\Documents\BitLord
2013-09-01 15:09 - 2013-09-01 15:09 - 00000000 ____D C:\Users\Matěj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dungeon Keeper 2 CZ ver.1.0
2013-08-31 22:57 - 2013-04-01 22:10 - 00000000 ____D C:\Users\Matěj\Desktop\LOTR
2013-08-31 22:54 - 2013-08-31 22:54 - 00003162 _____ C:\Windows\System32\Tasks\{BC1FF4BF-93A5-44C0-879E-C4A8D12408B4}
2013-08-31 22:51 - 2013-08-31 22:51 - 00003126 _____ C:\Windows\System32\Tasks\{00B2ED70-26B9-4FA2-9B55-A9E8AA45A02A}
2013-08-31 22:45 - 2013-08-31 22:45 - 00000000 ____D C:\Program Files (x86)\Bullfrog
2013-08-31 22:32 - 2013-04-20 00:03 - 00000000 ____D C:\Users\Bal\AppData\Roaming\BitLord
2013-08-31 14:25 - 2013-08-31 14:25 - 00000000 ____D C:\Program Files (x86)\GOGcom
2013-08-31 13:27 - 2013-04-01 14:42 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-08-31 13:26 - 2013-06-06 19:56 - 00000000 ____D C:\Users\Matěj\Documents\Euro Truck Simulator 2
2013-08-31 13:26 - 2012-11-18 12:49 - 00000000 ____D C:\Program Files (x86)\Shmehao.com
2013-08-18 23:49 - 2012-09-19 17:14 - 00000000 ____D C:\Users\Bal\AppData\Roaming\Audacity
2013-08-18 18:45 - 2013-08-18 18:35 - 179916454 _____ C:\Users\Bal\Desktop\Avengers.Assemble.S01E01.The.Avengers.Protocol.Pt.1.WEB-DL.XviD.MP3.avi
2013-08-18 16:11 - 2013-08-18 16:11 - 00000218 _____ C:\Users\Bal\AppData\Local\recently-used.xbel
2013-08-18 14:48 - 2013-08-18 14:48 - 00000000 ____D C:\Users\Bal\AppData\Roaming\dvdcss
2013-08-17 17:56 - 2013-08-17 14:32 - 4270387200 _____ C:\Users\Bal\Desktop\psig-skyfall.2012.720p.brrip.xvid.avi
2013-08-15 01:05 - 2009-07-14 04:34 - 00000512 _____ C:\Windows\win.ini
2013-08-15 00:35 - 2013-08-15 00:34 - 00000000 ____D C:\Users\Bal\Desktop\week 102

Some content of TEMP:
====================
C:\Users\Bal\AppData\Local\Temp\BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Bal\AppData\Local\Temp\ICReinstall_BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\oi_{65C2992E-132D-48AE-88B8-5D1FB162A3F5}.exe
C:\Users\Bal\AppData\Local\Temp\Quarantine.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.24opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Matěj\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel1.exe
C:\Users\Matěj\AppData\Local\Temp\ouoilddqiyjedlyhnwq.bfg
C:\Users\Matěj\AppData\Local\Temp\SecuExp.exe
C:\Users\Matěj\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Matěj\AppData\Local\Temp\Tsu67742048.dll
C:\Users\Matěj\AppData\Local\Temp\webyeryb3460vavaw.exe
C:\Users\Matěj\AppData\Local\Temp\wervwyuu0.exe
C:\Users\Matěj\AppData\Local\Temp\_is38BB.exe
C:\Users\Matěj\AppData\Local\Temp\_is67F5.exe
C:\Users\Matěj\AppData\Local\Temp\_is6FF1.exe
C:\Users\Matěj\AppData\Local\Temp\_is7BE4.exe
C:\Users\Matěj\AppData\Local\Temp\_is9BB2.exe
C:\Users\Matěj\AppData\Local\Temp\_isB59A.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit



==================== Alternate Data Streams (whitelisted) ====

AlternateDataStreams: C:\ProgramData\TEMP:05EE1EEF

==================== Loaded Modules (whitelisted) ============

2013-02-24 18:38 - 2013-02-24 18:38 - 00244696 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00661448 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\MSVCP110.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00828872 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\MSVCR110.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 02436608 _____ (Python Software Foundation) C:\Users\Bal\AppData\Local\Temp\_MEI48122\python27.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00110080 _____ () C:\Users\Bal\AppData\Local\Temp\_MEI48122\pywintypes27.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00364544 _____ () C:\Users\Bal\AppData\Local\Temp\_MEI48122\pythoncom27.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 01985024 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxbase294u_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00154112 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxbase294u_net_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 04598272 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxmsw294u_core_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 01234944 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxmsw294u_adv_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00595968 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxmsw294u_html_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00091648 _____ (wxWidgets development team) C:\Users\Bal\AppData\Local\Temp\_MEI48122\wxmsw294u_webview_vc90.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00421200 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Temp\_MEI48122\MSVCP100.dll
2013-09-14 22:39 - 2013-09-14 22:39 - 00773968 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Temp\_MEI48122\MSVCR100.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 16192864 _____ (Opera Software) C:\Program Files (x86)\Opera\Opera.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00220632 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00534480 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\MSVCP110.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00862664 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\MSVCR110.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00537560 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\Telemetry.dll
2013-02-24 18:38 - 2013-02-24 18:38 - 00038360 _____ (Microsoft Corporation) C:\Users\Bal\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\logging.dll
2013-09-10 23:41 - 2013-09-10 23:41 - 16177544 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00835584 _____ () C:\Program Files (x86)\Opera\gstreamer\gstreamer.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00093696 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioconvert.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00094208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioresample.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00057344 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstautodetect.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00096256 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstcoreplugins.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00062976 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdecodebin2.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00067072 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdirectsound.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00158208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00312832 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstoggdec.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00038912 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwaveform.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00073728 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwavparse.dll
2012-04-12 19:38 - 2013-07-09 23:58 - 00101888 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwebmdec.dll

==================== Scheduled Tasks (whitelisted) ===========

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Supplementary Scan (All) ================

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds
C:\Windows\system32\hkcmd.exe [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
C:\Windows\system32\igfxtray.exe [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NUSB3MON
"C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Optimizer Pro
C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence
C:\Windows\system32\igfxpers.exe [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDVCPL
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam
"C:\Program Files (x86)\Steam\Steam.exe" -silent [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Wireless Utility.lnk
C:\PROGRA~2\Edimax\Common\RaUI.exe -s [x]

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Mat�j^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk
C:\PROGRA~2\OPENOF~1.ORG\program\QUICKS~1.EXE [x]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000005
"ConsentPromptBehaviorUser"=dword:00000003
"EnableInstallerDetection"=dword:00000001
"EnableLUA"=dword:00000001
"EnableSecureUIAPaths"=dword:00000001
"EnableUIADesktopToggle"=dword:00000000
"EnableVirtualization"=dword:00000001
"PromptOnSecureDesktop"=dword:00000001
"ValidateAdminCodeSignatures"=dword:00000000
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"scforceoption"=dword:00000000
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"FilterAdministratorToken"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=dword:00000001
"NoActiveDesktopChanges"=dword:00000001
"ForceActiveDesktopOn"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval"=dword:00000001
"AntiVirusOverride"=dword:00000000
"AntiSpywareOverride"=dword:00000000
"FirewallOverride"=dword:00000000

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"="msrle32.dll"
"vidc.msvc"="msvidc32.dll"
"msacm.imaadpcm"="imaadp32.acm"
"msacm.msg711"="msg711.acm"
"msacm.msgsm610"="msgsm32.acm"
"msacm.msadpcm"="msadp32.acm"
"midimapper"="midimap.dll"
"wavemapper"="msacm32.drv"
"VIDC.UYVY"="msyuv.dll"
"VIDC.YUY2"="msyuv.dll"
"VIDC.YVYU"="msyuv.dll"
"VIDC.IYUV"="iyuv_32.dll"
"vidc.i420"="iyuv_32.dll"
"VIDC.YVU9"="tsbyuv.dll"
"msacm.l3acm"="C:\\Windows\\System32\\l3codeca.acm"
"wave1"="wdmaud.drv"
"midi1"="wdmaud.drv"
"mixer1"="wdmaud.drv"
"aux1"="wdmaud.drv"
"wave"="wdmaud.drv"
"midi"="wdmaud.drv"
"mixer"="wdmaud.drv"
"aux"="wdmaud.drv"
"VIDC.FPS1"="frapsv64.dll"
"MSVideo8"="VfWWDM32.dll"
"wave2"="wdmaud.drv"
"mixer2"="wdmaud.drv"


==================== Drive and Memory info ===================

Drive c: () (Fixed) (Total:931.29 GB) (Free:614.68 GB) NTFS
Drive d: (GAMBIT) (CDROM) (Total:5.89 GB) (Free:0 GB) UDF
Drive e: (SKYRIM_EN) (CDROM) (Total:5.12 GB) (Free:0 GB) UDF

Available physical RAM: 1750.36 MB
Total physical RAM: 4003.41 MB
Percentage of memory in use: 56%

==================== MBR and Partition Table =================

Disk: 0 (Size: 932 GB) (Disk ID: BA507B0A)

LastRegBack: 2013-09-11 21:17

==================== End Of Log ==============================

Re: PČR opět v akci - Victimer

Napsal: 14 zář 2013 22:02
od vyosek
:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1811880 2013-08-28] (Valve Corporation)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20097696 2013-06-27] (Google)
MountPoints2: {b9bebbb5-c475-11e1-952a-7071bce87380} - F:\Startme.exe
MountPoints2: {c5292759-0948-11e2-a99b-7071bce87380} - F:\Startme.exe
MountPoints2: {dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} - E:\INSTALL.EXE
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-05-23] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\Matěj\...\Run: [ctfmon32.exe] - C:\PROGRA~3\rundll32.exe C:\PROGRA~3\797je.dat,XFG00 <===== ATTENTION
HKU\Matěj\...\Run: [Sony PC Companion] - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449248 2013-05-29] (Sony)
HKU\Matěj\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1561968 2013-05-23] (Samsung)
HKU\Matěj\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Matěj\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-05-23] (Samsung)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

SearchScopes: HKLM - DefaultScope value is missing.

2013-09-14 20:35 - 2013-09-14 22:39 - 00197229 _____ C:\Users\Bal\Desktop\avgremover.log
2013-09-14 20:27 - 2013-09-14 20:27 - 03222280 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Bal\Desktop\avg_remover_stf_x64_2013_2706.exe

C:\Users\Bal\AppData\Local\Temp\BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Bal\AppData\Local\Temp\ICReinstall_BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\oi_{65C2992E-132D-48AE-88B8-5D1FB162A3F5}.exe
C:\Users\Bal\AppData\Local\Temp\Quarantine.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.24opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Matěj\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel1.exe
C:\Users\Matěj\AppData\Local\Temp\ouoilddqiyjedlyhnwq.bfg
C:\Users\Matěj\AppData\Local\Temp\SecuExp.exe
C:\Users\Matěj\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Matěj\AppData\Local\Temp\Tsu67742048.dll
C:\Users\Matěj\AppData\Local\Temp\webyeryb3460vavaw.exe
C:\Users\Matěj\AppData\Local\Temp\wervwyuu0.exe
C:\Users\Matěj\AppData\Local\Temp\_is38BB.exe
C:\Users\Matěj\AppData\Local\Temp\_is67F5.exe
C:\Users\Matěj\AppData\Local\Temp\_is6FF1.exe
C:\Users\Matěj\AppData\Local\Temp\_is7BE4.exe
C:\Users\Matěj\AppData\Local\Temp\_is9BB2.exe
C:\Users\Matěj\AppData\Local\Temp\_isB59A.exe
C:\PROGRA~3\797je.dat

AlternateDataStreams: C:\ProgramData\TEMP:05EE1EEF

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Optimizer Pro" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched" /f

Hosts:
CMD: shutdown /r /f /t 2
End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt

Re: PČR opět v akci - Victimer

Napsal: 14 zář 2013 22:13
od Victimer
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-09-2013 04
Ran by Bal at 2013-09-14 23:07:54 Run:2
Running from C:\Users\Bal\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1811880 2013-08-28] (Valve Corporation)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [20097696 2013-06-27] (Google)
MountPoints2: {b9bebbb5-c475-11e1-952a-7071bce87380} - F:\Startme.exe
MountPoints2: {c5292759-0948-11e2-a99b-7071bce87380} - F:\Startme.exe
MountPoints2: {dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} - E:\INSTALL.EXE
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-05-23] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\Matěj\...\Run: [ctfmon32.exe] - C:\PROGRA~3\rundll32.exe C:\PROGRA~3\797je.dat,XFG00 <===== ATTENTION
HKU\Matěj\...\Run: [Sony PC Companion] - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449248 2013-05-29] (Sony)
HKU\Matěj\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1561968 2013-05-23] (Samsung)
HKU\Matěj\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\Matěj\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1106288 2013-05-23] (Samsung)
Startup: C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk

SearchScopes: HKLM - DefaultScope value is missing.

2013-09-14 20:35 - 2013-09-14 22:39 - 00197229 _____ C:\Users\Bal\Desktop\avgremover.log
2013-09-14 20:27 - 2013-09-14 20:27 - 03222280 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Bal\Desktop\avg_remover_stf_x64_2013_2706.exe

C:\Users\Bal\AppData\Local\Temp\BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Bal\AppData\Local\Temp\ICReinstall_BitLord_Installer.exe
C:\Users\Bal\AppData\Local\Temp\oi_{65C2992E-132D-48AE-88B8-5D1FB162A3F5}.exe
C:\Users\Bal\AppData\Local\Temp\Quarantine.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.24opera_autoupdate.exe
C:\Users\Matěj\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Matěj\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr.dll
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel0.exe
C:\Users\Matěj\AppData\Local\Temp\i4jdel1.exe
C:\Users\Matěj\AppData\Local\Temp\ouoilddqiyjedlyhnwq.bfg
C:\Users\Matěj\AppData\Local\Temp\SecuExp.exe
C:\Users\Matěj\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Matěj\AppData\Local\Temp\Tsu67742048.dll
C:\Users\Matěj\AppData\Local\Temp\webyeryb3460vavaw.exe
C:\Users\Matěj\AppData\Local\Temp\wervwyuu0.exe
C:\Users\Matěj\AppData\Local\Temp\_is38BB.exe
C:\Users\Matěj\AppData\Local\Temp\_is67F5.exe
C:\Users\Matěj\AppData\Local\Temp\_is6FF1.exe
C:\Users\Matěj\AppData\Local\Temp\_is7BE4.exe
C:\Users\Matěj\AppData\Local\Temp\_is9BB2.exe
C:\Users\Matěj\AppData\Local\Temp\_isB59A.exe
C:\PROGRA~3\797je.dat

AlternateDataStreams: C:\ProgramData\TEMP:05EE1EEF

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Optimizer Pro" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam" /f
REG: reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched" /f

Hosts:
CMD: shutdown /r /f /t 2
End
*****************

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Steam => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleDriveSync => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b9bebbb5-c475-11e1-952a-7071bce87380} => Key deleted successfully.
HKCR\CLSID\{b9bebbb5-c475-11e1-952a-7071bce87380} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c5292759-0948-11e2-a99b-7071bce87380} => Key deleted successfully.
HKCR\CLSID\{c5292759-0948-11e2-a99b-7071bce87380} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} => Key deleted successfully.
HKCR\CLSID\{dd4fdbbc-b6ed-11e1-a1e9-7071bce87380} => Key not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\KiesTrayAgent => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon32.exe => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\Sony PC Companion => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\KiesPreload => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\KiesAirMessage => Value deleted successfully.
HKU\Matěj\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
C:\Users\Bal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk => Moved successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
C:\Users\Bal\Desktop\avgremover.log => Moved successfully.
C:\Users\Bal\Desktop\avg_remover_stf_x64_2013_2706.exe => Moved successfully.
C:\Users\Bal\AppData\Local\Temp\BitLord_Installer.exe => Moved successfully.
C:\Users\Bal\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe => Moved successfully.
C:\Users\Bal\AppData\Local\Temp\ICReinstall_BitLord_Installer.exe => Moved successfully.
C:\Users\Bal\AppData\Local\Temp\oi_{65C2992E-132D-48AE-88B8-5D1FB162A3F5}.exe => Moved successfully.
C:\Users\Bal\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.18opera_autoupdate.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\CProgram Files (x86)Opera Next15.0.1147.24opera_autoupdate.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\drm_dialogs.dll => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\drm_dyndata_7340014.dll => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr.dll => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\gwebrbegrbgr0.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\i4jdel0.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\i4jdel1.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\ouoilddqiyjedlyhnwq.bfg => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\SecuExp.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\Tsu67742048.dll => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\webyeryb3460vavaw.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\wervwyuu0.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_is38BB.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_is67F5.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_is6FF1.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_is7BE4.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_is9BB2.exe => Moved successfully.
C:\Users\Matěj\AppData\Local\Temp\_isB59A.exe => Moved successfully.
"C:\PROGRA~3\797je.dat" => File/Directory not found.
C:\ProgramData\TEMP => ":05EE1EEF" ADS removed successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.

========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Optimizer Pro" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched" /f =========

Operace byla dokonźena ŁspŘçnŘ.



========= End of Reg: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

========= shutdown /r /f /t 2 =========


========= End of CMD: =========


==== End of Fixlog ====
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz