VIRY.CZ

Logfile of random's system information tool 1.08 (written by random/random)
Run by Alena at 2014-02-03 20:55:10
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 208 GB (48%) free of 432 GB
Total RAM: 3959 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:55:12, on 3.2.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16428)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\USB Camera\VM331_STI.EXE
C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
c:\PROGRA~2\mcafee\SITEAD~1\saui.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
C:\Program Files\trend micro\Alena.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.simplesearches.info/?p ... Z&unqvl=31
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.simplesearches.info/?p ... Z&unqvl=31
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: BlocKTheoAdss - {2E85C2E0-A342-B0FD-35EF-A28671804B21} - C:\ProgramData\BlocKTheoAdss\YbnH0S.dll
O2 - BHO: BeStSavEForYou - {4DF8374A-358D-74D7-B567-5EDADC449A5E} - C:\ProgramData\BeStSavEForYou\PfQnNHbH.dll
O2 - BHO: EEnjoyyCoupon - {9D89652A-9F78-56D9-F1D8-6627D6C39BD5} - C:\ProgramData\EEnjoyyCoupon\P5yYRYX.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [331BigDog] C:\Program Files (x86)\USB Camera\VM331_STI.EXE
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"
O4 - HKLM\..\Run: [YouCam Mirror Tray icon] "C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe" /s
O4 - HKLM\..\Run: [UpdateP2GShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Send to &Bluetooth Device... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: c:\progra~3\prowebi\prowebi.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Flexlm Service 1 - Macrovision Corporation - C:\Program Files (x86)\SCIA\Engineer2009.0\Flexlm\Lmgrd.exe
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: Mobile Broadband Core Service (WMCoreService) - Unknown owner - C:\Program Files (x86)\Mobile Broadband Drivers\WMCore\mini_WMCore.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13058 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\nvvsvc.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k NetworkService
winlogon.exe
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\windows\system32\nvvsvc.exe -session -first
taskeng.exe {C1480280-C6A1-4FD5-8595-DA21E3A69914}
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\windows\system32\rundll32.exe" "c:\progra~3\prowebi\ProwebiSvc.dll",service
"taskhost.exe"
"C:\windows\system32\rundll32.exe" "c:\progra~3\prowebi\ProwebiSvc.dll",service
"C:\windows\system32\Dwm.exe"
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
C:\windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe"
"C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe"
"C:\Program Files (x86)\SCIA\Engineer2009.0\Flexlm\Lmgrd.exe" -z2
\??\C:\windows\system32\conhost.exe "-1353375631228528170-8607006381840981625-1009744019-178522457319642162291655338166
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe
SCIA.exe -T Alena-PC 10.8 -1 --lmgrd_start 52efefcd
\??\C:\windows\system32\conhost.exe "-36860129919807941411291690638-1473536713-72112537531082956-78003280-140906773
"C:\windows\system32\rundll32.exe" "c:\PROGRA~2\mcafee\SITEAD~1\saHook.dll", saHooker_Initialize_and_Wait
"C:\windows\system32\rundll32.exe" "c:\PROGRA~2\mcafee\SITEAD~1\x64\saHook.dll", saHooker_Initialize_and_Wait
"C:\windows\system32\rundll32.exe" "c:\PROGRA~2\mcafee\SITEAD~1\saHook.dll", saHooker_Initialize_and_Wait
C:\windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe"
"C:\Program Files\Elantech\ETDCtrl.exe"
"C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe"
WLIDSvcM.exe 2100
"C:\Program Files (x86)\Lenovo\Energy Management\utility.exe"
"C:\Program Files (x86)\Mobile Broadband Drivers\WMCore\mini_WMCore.exe" servicemode
C:\windows\system32\svchost.exe -k bthsvcs
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe"
"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
C:\windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe"
"C:\Program Files\Lenovo\Bluetooth Software\BtStackServer.exe" -Embedding
"C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe"
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Program Files (x86)\USB Camera\VM331_STI.EXE"
"C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe" /s
"C:\Program Files (x86)\Winamp\winampa.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe"
C:\windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"c:\PROGRA~2\mcafee\SITEAD~1\saui.exe" -Embedding
C:\windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=5084.dfc6500.1275858383 "C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" E7CF176E110C211B 5084 "\\.\pipe\gecko-crash-server-pipe.5084" plugin
"C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe" --proxy-stub-channel=Flash2352.6837B990.19987 --host-broker-channel=Flash2352.6837B990.24256 --host-pid=2352 --host-npapi-version=27 --plugin-path="C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll"
"C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe" --channel=3200.0022F3AC.827040328 --proxy-stub-channel=Flash2352.6837B990.19987 --plugin-path="C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll" --host-npapi-version=27 --type=renderer
"C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\windows\System32\svchost.exe -k secsvcs
C:\windows\system32\wbem\wmiprvse.exe
taskeng.exe {C14CACD8-6182-4777-A172-F73AA66286D2}
"C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\windows\system32\SearchFilterHost.exe" 0 524 528 536 65536 532
C:\windows\System32\svchost.exe -k WerSvcGroup
C:\windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Alena\Desktop\RSITx64.exe"
C:\windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\windows\tasks\Adobe Flash Player Updater.job
C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E85C2E0-A342-B0FD-35EF-A28671804B21}]
BlocKTheoAdss - C:\ProgramData\BlocKTheoAdss\YbnH0S.x64.dll [2014-01-31 476160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4DF8374A-358D-74D7-B567-5EDADC449A5E}]
BeStSavEForYou - C:\ProgramData\BeStSavEForYou\PfQnNHbH.x64.dll [2014-01-01 473088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D89652A-9F78-56D9-F1D8-6627D6C39BD5}]
EEnjoyyCoupon - C:\ProgramData\EEnjoyyCoupon\P5yYRYX.x64.dll [2014-01-01 473088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll [2014-01-24 301104]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E85C2E0-A342-B0FD-35EF-A28671804B21}]
BlocKTheoAdss - C:\ProgramData\BlocKTheoAdss\YbnH0S.dll [2014-01-31 427520]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4DF8374A-358D-74D7-B567-5EDADC449A5E}]
BeStSavEForYou - C:\ProgramData\BeStSavEForYou\PfQnNHbH.dll [2014-01-01 424960]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D89652A-9F78-56D9-F1D8-6627D6C39BD5}]
EEnjoyyCoupon - C:\ProgramData\EEnjoyyCoupon\P5yYRYX.dll [2014-01-01 424960]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll [2014-01-24 252664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll [2014-01-24 301104]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll [2014-01-24 252664]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\windows\system32\NvCpl.dll [2010-05-07 16416360]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [2010-03-22 521272]
"ETDWare"=C:\Program Files\Elantech\ETDCtrl.exe [2010-06-24 2598280]
"OnekeyStudio"=C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [2009-12-19 776608]
"EnergyUtility"=C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [2009-12-17 4367808]
"Energy Management"=C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [2009-12-17 6988736]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2011-01-20 1305408]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"=C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [2010-03-03 284696]
"331BigDog"=C:\Program Files (x86)\USB Camera\VM331_STI.EXE [2010-01-15 536576]
"UCam_Menu"=C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [2009-05-19 222504]
"YouCam Mirror Tray icon"=C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [2010-06-30 171104]
"UpdateP2GShortCut"=C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [2008-12-03 218408]
"WinampAgent"=C:\Program Files (x86)\Winamp\winampa.exe [2010-01-12 37888]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2009-02-26 30040]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2013-10-18 3567800]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\PROGRA~3\Prowebi\PROWEB~1.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2014-02-03 20:55:10 ----D---- C:\rsit
2014-02-03 20:47:38 ----D---- C:\Program Files\trend micro
2014-01-31 07:11:55 ----D---- C:\ProgramData\BlocKTheoAdss
2014-01-31 07:11:54 ----D---- C:\ProgramData\bgackmgcbldmcaiflaehnlhjigdjjcnn
2014-01-15 09:38:49 ----A---- C:\windows\system32\drivers\usbport.sys
2014-01-15 09:38:49 ----A---- C:\windows\system32\drivers\usbehci.sys
2014-01-15 09:38:48 ----A---- C:\windows\system32\drivers\usbuhci.sys
2014-01-15 09:38:48 ----A---- C:\windows\system32\drivers\usbohci.sys
2014-01-15 09:38:48 ----A---- C:\windows\system32\drivers\usbhub.sys
2014-01-15 09:38:48 ----A---- C:\windows\system32\drivers\usbd.sys
2014-01-15 09:38:48 ----A---- C:\windows\system32\drivers\usbccgp.sys
2014-01-15 09:38:47 ----A---- C:\windows\system32\win32k.sys
2014-01-15 09:38:45 ----A---- C:\windows\system32\drivers\netio.sys

======List of files/folders modified in the last 1 months======

2014-02-03 20:55:10 ----D---- C:\windows\Temp
2014-02-03 20:55:09 ----D---- C:\windows\Prefetch
2014-02-03 20:50:42 ----D---- C:\windows\system32\config
2014-02-03 20:47:38 ----RD---- C:\Program Files
2014-02-03 20:36:55 ----HD---- C:\ProgramData
2014-02-03 20:36:46 ----A---- C:\windows\SYSWOW64\log.txt
2014-02-03 20:36:26 ----D---- C:\Windows
2014-02-03 08:06:23 ----D---- C:\Users\Alena\AppData\Roaming\Winamp
2014-02-02 08:59:00 ----D---- C:\Users\Alena\AppData\Roaming\DAEMON Tools Lite
2014-02-02 08:58:40 ----D---- C:\windows\Panther
2014-02-02 08:58:40 ----D---- C:\windows\inf
2014-02-02 08:58:39 ----D---- C:\windows\Minidump
2014-02-02 08:58:39 ----D---- C:\windows\Logs
2014-02-02 08:58:39 ----D---- C:\windows\debug
2014-02-02 08:44:04 ----D---- C:\windows\system32\Tasks
2014-02-02 08:44:00 ----D---- C:\Program Files\CCleaner
2014-02-02 08:43:59 ----RD---- C:\Program Files (x86)
2014-02-02 08:43:59 ----D---- C:\Program Files (x86)\Google
2014-02-02 02:08:13 ----D---- C:\windows\System32
2014-02-02 02:08:13 ----A---- C:\windows\system32\PerfStringBackup.INI
2014-02-01 20:53:40 ----D---- C:\windows\system32\NDF
2014-01-31 07:12:04 ----D---- C:\ProgramData\9001855eaf1f81f4
2014-01-31 07:11:55 ----HD---- C:\windows\system32\GroupPolicy
2014-01-31 07:11:55 ----D---- C:\windows\SYSWOW64\GroupPolicy
2014-01-30 11:49:18 ----D---- C:\Users\Alena\AppData\Roaming\Skype
2014-01-29 14:39:32 ----SHD---- C:\System Volume Information
2014-01-20 10:47:00 ----D---- C:\windows\system32\catroot
2014-01-19 08:36:33 ----SHD---- C:\windows\Installer
2014-01-19 08:35:51 ----D---- C:\windows\SysWOW64
2014-01-16 04:58:45 ----D---- C:\windows\winsxs
2014-01-16 04:55:52 ----D---- C:\windows\system32\drivers
2014-01-16 04:55:50 ----D---- C:\windows\system32\DriverStore
2014-01-15 22:07:00 ----D---- C:\ProgramData\Microsoft Help
2014-01-15 09:39:46 ----D---- C:\windows\system32\MRT
2014-01-15 09:38:35 ----D---- C:\windows\system32\catroot2
2014-01-15 09:36:39 ----A---- C:\windows\system32\MRT.exe
2014-01-05 09:38:53 ----D---- C:\ProgramData\tmp

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2013-10-16 65776]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2013-10-16 205320]
R0 iaStor;Intel AHCI Controller; C:\windows\system32\DRIVERS\iaStor.sys [2010-03-03 540696]
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 aswRdr;aswRdr; \??\C:\windows\system32\drivers\aswRdr2.sys [2013-10-16 92544]
R1 aswSnx;aswSnx; \??\C:\windows\system32\drivers\aswSnx.sys [2013-10-16 1032416]
R1 aswSP;aswSP; \??\C:\windows\system32\drivers\aswSP.sys [2013-11-08 409832]
R1 aswTdi;aswTdi; \??\C:\windows\system32\drivers\aswTdi.sys [2013-10-16 65264]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-05-05 254528]
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 aswFsBlk;aswFsBlk; \??\C:\windows\system32\drivers\aswFsBlk.sys [2013-10-16 38984]
R2 aswMonFlt;aswMonFlt; \??\C:\windows\system32\drivers\aswMonFlt.sys [2013-10-16 84328]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver; C:\windows\system32\DRIVERS\AcpiVpc.sys [2009-10-19 28176]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\windows\system32\DRIVERS\athrx.sys [2009-11-06 1550848]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btusbflt;Bluetooth USB Filter; C:\windows\system32\drivers\btusbflt.sys [2009-07-01 52264]
R3 btwaudio;Bluetooth Audio Device Service; C:\windows\system32\drivers\btwaudio.sys [2009-07-01 98344]
R3 btwavdt;Bluetooth AVDT; C:\windows\system32\DRIVERS\btwavdt.sys [2009-07-01 132648]
R3 btwl2cap;Bluetooth L2CAP Service; C:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]
R3 btwrchid;btwrchid; C:\windows\system32\DRIVERS\btwrchid.sys [2009-07-01 21160]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\windows\system32\drivers\CHDRT64.sys [2010-01-18 717368]
R3 ETD;ELAN PS/2 Port Input Device; C:\windows\system32\DRIVERS\ETD.sys [2010-06-24 167816]
R3 HECIx64;Intel(R) Management Engine Interface; C:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\windows\system32\drivers\nvhda64v.sys [2010-01-28 86120]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RTL8167;Realtek 8167 NT Driver; C:\windows\system32\DRIVERS\Rt64win7.sys [2009-08-20 239616]
R3 vm331avs;Digital Camera 1; C:\windows\System32\Drivers\vm331avs.sys [2010-03-18 215168]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S2 Sentinel;Sentinel; C:\windows\System32\Drivers\SENTINEL.SYS []
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2009-06-10 6108416]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0; C:\windows\system32\DRIVERS\k57nd60a.sys [2009-06-10 270848]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit; C:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader; C:\windows\System32\Drivers\RtsUStor.sys [2010-03-12 242720]
S3 TsUsbFlt;TsUsbFlt; C:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 usbscan;Ovladač skeneru USB; C:\windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 WimFltr;WimFltr; C:\windows\system32\DRIVERS\wimfltr.sys [2008-08-06 151656]
S3 WinUsb;WinUsb; C:\windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]
S3 wsvd;wsvd; C:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 121840]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 6ea8c3d5;Prowebi; C:\windows\syswow64\rundll32.exe [2009-07-14 44544]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-10-16 50344]
R2 btwdins;Bluetooth Service; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [2009-08-11 864032]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-03 13336]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2009-12-09 268824]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [2014-01-22 123384]
R2 nvsvc;NVIDIA Display Driver Service; C:\windows\system32\nvvsvc.exe [2010-05-07 392296]
R2 UNS;Intel(R) Management & Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-09 2320920]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R2 WMCoreService;Mobile Broadband Core Service; C:\Program Files (x86)\Mobile Broadband Drivers\WMCore\mini_WMCore.exe [2009-09-24 430080]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
S2 Flexlm Service 1;Flexlm Service 1; C:\Program Files (x86)\SCIA\Engineer2009.0\Flexlm\Lmgrd.exe [2008-04-02 974848]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-23 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-09-05 171680]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11 257416]
S3 aspnet_state;Stavová služba ASP.NET; C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2010-03-18 44376]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2012-03-12 1431888]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-23 116648]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\windows\system32\IEEtwCollector.exe [2013-11-26 111616]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [2013-09-06 288776]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-12-20 119408]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2011-05-13 1255736]
S4 NetMsmqActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetPipeActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 NetTcpActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2010-03-18 124240]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------

Zdravim

Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe

• Ulozte nejlepe na plochu
• Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
• Probehne vytvoreni zalohy a nasledne prohledavani
• Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

• Ulozte nejlepe na plochu
• Ukoncete vsechny programy
• Kliknete na Scan a nasledne Clean
• Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by Alena on po 03.02.2014 at 21:53:56,53
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-1808414493-4098895497-794563187-1000\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440}



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\dt soft\daemon tools toolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yahoopartnertoolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\sprotector
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dt soft\daemon tools toolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\dttoolbar.toolbandobj
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\dttoolbar.toolbandobj.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\daemon tools toolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\sp global
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\sprotector
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\ApnToolbarInstaller_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\ApnToolbarInstaller_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6F7C28A4-2243-4825-9B16-76541A810B50}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4DF8374A-358D-74D7-B567-5EDADC449A5E}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4DF8374A-358D-74D7-B567-5EDADC449A5E}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4DF8374A-358D-74D7-B567-5EDADC449A5E}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D89652A-9F78-56D9-F1D8-6627D6C39BD5}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{9D89652A-9F78-56D9-F1D8-6627D6C39BD5}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9D89652A-9F78-56D9-F1D8-6627D6C39BD5}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\starapp"
Successfully deleted: [Folder] "C:\Program Files (x86)\daemon tools toolbar"
Successfully deleted: [Folder] "C:\Program Files (x86)\optimizer pro"
Successfully deleted: [Folder] "C:\Program Files (x86)\saveshare"
Successfully deleted: [Folder] "C:\Program Files (x86)\websearch"
Successfully deleted: [Empty Folder] C:\Users\Alena\appdata\local\{59AA0F97-534E-4029-9875-D6015825EEEB}
Successfully deleted: [Empty Folder] C:\Users\Alena\appdata\local\{752A5C4E-CCF1-4252-A442-14053897A232}
Successfully deleted: [Empty Folder] C:\Users\Alena\appdata\local\{76EDA8BF-EE15-48E7-946E-1137A597C2B1}
Successfully deleted: [Empty Folder] C:\Users\Alena\appdata\local\{EAC0D860-FBBA-42EE-BDAB-E6B060BDE938}
Successfully deleted: [Folder] "C:\ProgramData\ask"



~~~ FireFox

Successfully deleted the following from C:\Users\Alena\AppData\Roaming\mozilla\firefox\profiles\uonfvcw7.default\prefs.js

user_pref("aol_toolbar.default.homepage.check", false);
user_pref("aol_toolbar.default.search.check", false);
user_pref("browser.search.defaultenginename,S", "WebSearch");
user_pref("browser.search.defaulturl", "hxxp://websearch.simplesearches.info/?pid=298&r=2013/08/19&hid=3682969300&lg=EN&cc=CZ&unqvl=31&l=1&q=");
user_pref("browser.search.order.1", "WebSearch");
user_pref("browser.search.order.1,S", "WebSearch");
user_pref("browser.search.selectedEngine,S", "WebSearch");
user_pref("extensions.6GrbeQove.scode", "(function(){try{var url=window.self.location.href;if(url.indexOf(\"acebook\")>-1||url.match(/ressbar.com[^f]+fid=65017/)||url.indexOf(
user_pref("extensions.BabylonToolbar.prtkDS", 0);
user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
user_pref("extensions.Xk7nTZsSqC.scode", "(function(){try{var url=window.self.location.href;if(url.indexOf(\"acebook\")>-1||url.match(/ressbar.com[^f]+fid=65017/)||url.indexOf
user_pref("keyword.URL", "hxxp://websearch.simplesearches.info/?pid=298&r=2013/08/19&hid=3682969300&lg=EN&cc=CZ&unqvl=31&l=1&q=");
user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
user_pref("sweetim.toolbar.previous.keyword.URL", "");
user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
user_pref("sweetim.toolbar.searchguard.enable", "");
Emptied folder: C:\Users\Alena\AppData\Roaming\mozilla\firefox\profiles\uonfvcw7.default\minidumps [330 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on po 03.02.2014 at 22:13:12,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# AdwCleaner v3.018 - Report created 03/02/2014 at 22:16:41
# Updated 28/01/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Alena - ALENA-PC
# Running from : C:\Users\Alena\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\EEnjoyyCoupon

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v26.0 (cs)

[ File : C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\prefs.js ]

Line Deleted : user_pref("extensions.6GrbeQove.scode", "(function(){try{var url=window.self.location.href;if(url.indexOf(\"acebook\")>-1||url.match(/ressbar.com[^f]+fid=65017/)||url.indexOf(\"form=u064ht&pc=u064\")>[...]
Line Deleted : user_pref("extensions.Xk7nTZsSqC.scode", "(function(){try{var url=window.self.location.href;if(url.indexOf(\"acebook\")>-1||url.match(/ressbar.com[^f]+fid=65017/)||url.indexOf(\"form=u064ht&pc=u064\")[...]
Line Deleted : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Line Deleted : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Line Deleted : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");

-\\ Google Chrome v32.0.1700.102

[ File : C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [2596 octets] - [03/02/2014 22:14:33]
AdwCleaner[S0].txt - [2533 octets] - [03/02/2014 22:16:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2593 octets] ##########

Dejte log dle tohoto navodu http://forum.viry.cz/viewtopic.php?f=30&t=133101

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014
Ran by Alena (administrator) on ALENA-PC on 04-02-2014 20:39:13
Running from C:\Users\Alena\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
() C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Macrovision Corporation) C:\Program Files (x86)\SCIA\Engineer2009.0\Flexlm\Lmgrd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\Mobile Broadband Drivers\WMCore\mini_WMCore.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
() C:\Program Files (x86)\SCIA\Engineer2009.0\Flexlm\Scia.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(forum.viry.cz) C:\Users\Alena\Desktop\FRSTLauncher.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\PING.EXE


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] - C:\windows\system32\NvCpl.dll [16416360 2010-05-07] (NVIDIA Corporation)
HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [521272 2010-03-22] (Conexant Systems, Inc.)
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [2598280 2010-06-24] (ELAN Microelectronics Corp.)
HKLM\...\Run: [OnekeyStudio] - C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [776608 2009-12-19] (Lenovo)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] - C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [6988736 2009-12-17] (Lenovo (Beijing) Limited)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [331BigDog] - C:\Program Files (x86)\USB Camera\VM331_STI.EXE [536576 2010-01-15] (Vimicro)
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] - C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [171104 2010-06-30] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [37888 2010-01-12] (Nullsoft, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3567800 2013-10-18] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\windows\System32\SPReview\SPReview.exe [301568 2013-05-28] (Microsoft Corporation)
HKU\S-1-5-21-1808414493-4098895497-794563187-1000\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
HKU\S-1-5-21-1808414493-4098895497-794563187-1000\...\MountPoints2: {742105c1-771e-11e0-b649-18f46afdc71a} - G:\autorun.exe
AppInit_DLLs: C:\PROGRA~3\Prowebi\PROWEB~1.DLL => C:\ProgramData\Prowebi\Prowebi_x64.dll [4676096 2013-12-31] ()
AppInit_DLLs-x32: c:\progra~3\prowebi\prowebi.dll => C:\ProgramData\Prowebi\Prowebi.dll [4143104 2013-12-31] ()

==================== Internet (Whitelisted) ====================

HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/
URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO: BlocKTheoAdss - {2E85C2E0-A342-B0FD-35EF-A28671804B21} - C:\ProgramData\BlocKTheoAdss\YbnH0S.x64.dll ()
BHO: BeStSavEForYou - {4DF8374A-358D-74D7-B567-5EDADC449A5E} - C:\ProgramData\BeStSavEForYou\PfQnNHbH.x64.dll ()
BHO: EEnjoyyCoupon - {9D89652A-9F78-56D9-F1D8-6627D6C39BD5} - C:\ProgramData\EEnjoyyCoupon\P5yYRYX.x64.dll No File
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO-x32: BlocKTheoAdss - {2E85C2E0-A342-B0FD-35EF-A28671804B21} - C:\ProgramData\BlocKTheoAdss\YbnH0S.dll ()
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default
FF Homepage: hxxp://www.seznam.cz/
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: BlocKTheoAdss - C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\prcxqpd7@hqdk-.com [2014-01-31]
FF Extension: BeStSavEForYou - C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\trr_bg@auebaadvg.co.uk [2014-01-01]
FF Extension: EEnjoyyCoupon - C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\yiuil@iyvgrs-.org [2014-01-01]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013-12-20]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013-12-20]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2013-12-20]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-05-05]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2012-04-30]

Chrome:
=======
CHR Extension: (Docs) - C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-02]
CHR Extension: (Disk Google) - C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-02]
CHR Extension: (BlocKTheoAdss) - C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgackmgcbldmcaiflaehnlhjigdjjcnn [2014-02-02]
CHR Extension: (YouTube) - C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-02]
CHR Extension: (Vyhledávání Google) - C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-02]
CHR Extension: (Vyhledávání Google) - C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2014-02-02]
CHR Extension: (Peněženka Google) - C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-02]
CHR Extension: (Gmail) - C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-02]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2014-01-29]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-10-16]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 6ea8c3d5; C:\ProgramData\Prowebi\ProwebiSvc.dll [182096 2013-12-31] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-10-16] (AVAST Software)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [864032 2009-08-11] (Broadcom Corporation.)
S2 Flexlm Service 1; C:\Program Files (x86)\SCIA\Engineer2009.0\Flexlm\Lmgrd.exe [974848 2008-04-02] (Macrovision Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe [123384 2014-01-22] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 WMCoreService; C:\Program Files (x86)\Mobile Broadband Drivers\WMCore\mini_WMCore.exe [430080 2009-09-24] ()

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\windows\system32\drivers\aswFsBlk.sys [38984 2013-10-16] (AVAST Software)
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [84328 2013-10-16] (AVAST Software)
R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [92544 2013-10-16] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-10-16] ()
R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [1032416 2013-10-16] (AVAST Software)
R1 aswSP; C:\windows\system32\drivers\aswSP.sys [409832 2013-11-08] (AVAST Software)
R1 aswTdi; C:\windows\system32\drivers\aswTdi.sys [65264 2013-10-16] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-10-16] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2011-05-05] (DT Soft Ltd)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [215168 2010-03-18] (Vimicro Corporation)
U3 BcmSqlStartupSvc;
U3 IGRS;
U2 IviRegMgr;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
S2 Sentinel; \SystemRoot\System32\Drivers\SENTINEL.SYS [X]
U3 SQLWriter;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-04 20:39 - 2014-02-04 20:39 - 00016976 _____ () C:\Users\Alena\Desktop\FRST.txt
2014-02-04 20:38 - 2014-02-04 20:39 - 00000000 ____D () C:\FRST
2014-02-04 20:38 - 2014-02-04 20:38 - 00029696 _____ () C:\Users\Alena\AppData\Local\MSGBOX.EXE
2014-02-04 20:38 - 2014-02-04 20:38 - 00015327 _____ () C:\Users\Alena\Desktop\LM.bat
2014-02-04 20:37 - 2014-02-04 20:37 - 00112640 _____ (forum.viry.cz) C:\Users\Alena\Desktop\FRSTLauncher.exe
2014-02-04 20:36 - 2014-02-04 20:36 - 02080256 _____ (Farbar) C:\Users\Alena\Desktop\FRST64.exe
2014-02-03 22:14 - 2014-02-03 22:16 - 00000000 ____D () C:\AdwCleaner
2014-02-03 22:13 - 2014-02-03 22:13 - 00007804 _____ () C:\Users\Alena\Desktop\JRT.txt
2014-02-03 21:53 - 2014-02-03 21:53 - 00000000 ____D () C:\windows\ERUNT
2014-02-03 21:52 - 2014-02-03 21:53 - 01166132 _____ () C:\Users\Alena\Desktop\adwcleaner.exe
2014-02-03 21:52 - 2014-02-03 21:53 - 01037068 _____ (Thisisu) C:\Users\Alena\Desktop\JRT.exe
2014-02-03 20:55 - 2014-02-03 20:55 - 00000000 ____D () C:\rsit
2014-02-03 20:54 - 2014-02-03 20:47 - 00832273 _____ () C:\Users\Alena\Desktop\RSITx64.exe
2014-02-03 20:47 - 2014-02-03 20:55 - 00000000 ____D () C:\Program Files\trend micro
2014-02-03 20:47 - 2014-02-03 20:47 - 00832273 _____ () C:\Users\Alena\Downloads\RSITx64.exe
2014-02-03 20:36 - 2014-02-03 22:17 - 00000112 _____ () C:\windows\setupact.log
2014-02-03 20:36 - 2014-02-03 20:36 - 00000000 _____ () C:\windows\setuperr.log
2014-02-03 20:35 - 2014-02-03 20:35 - 00000316 _____ () C:\windows\PFRO.log
2014-02-03 09:42 - 2014-02-03 10:10 - 260438138 _____ () C:\Users\Alena\Downloads\pat-a-mat.mp4
2014-02-02 08:44 - 2014-02-02 08:44 - 00002772 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-02-02 08:44 - 2014-02-02 08:44 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-02-02 08:43 - 2014-02-02 08:43 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-02-02 08:42 - 2014-02-02 08:42 - 04721920 _____ (Piriform Ltd) C:\Users\Alena\Downloads\ccsetup410.exe
2014-02-02 08:42 - 2014-02-02 08:42 - 00384529 _____ () C:\Users\Alena\Downloads\Lista_centrum.exe
2014-02-02 08:41 - 2014-02-02 08:41 - 00733368 _____ () C:\Users\Alena\Downloads\ccleaner-lista-centrumcz(1).exe
2014-02-02 08:40 - 2014-02-02 08:41 - 00733368 _____ () C:\Users\Alena\Downloads\ccleaner-lista-centrumcz.exe
2014-01-31 07:11 - 2014-02-03 22:18 - 00000270 __RSH () C:\ProgramData\ntuser.pol
2014-01-31 07:11 - 2014-01-31 07:12 - 00000000 ____D () C:\ProgramData\BlocKTheoAdss
2014-01-31 07:11 - 2014-01-31 07:11 - 00000000 ____D () C:\Users\Alena\AppData\Local\Packages
2014-01-31 07:11 - 2014-01-31 07:11 - 00000000 ____D () C:\ProgramData\bgackmgcbldmcaiflaehnlhjigdjjcnn
2014-01-30 12:02 - 2014-01-30 12:23 - 186656768 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E16---cz-tit..avi
2014-01-27 08:36 - 2014-01-27 09:55 - 730765312 _____ () C:\Users\Alena\Downloads\Sherlock-s01e02-The-blind-banker_Slepý-bankéř-+-cz-titulky.avi
2014-01-25 12:09 - 2014-01-25 12:30 - 178282496 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E15-cz-titulky.avi
2014-01-24 12:15 - 2014-01-24 13:41 - 730773504 _____ () C:\Users\Alena\Downloads\Sherlock-s01e01-Study-in-pink_Studie-v-růžové-+-cz-titulky(1).avi
2014-01-24 10:07 - 2014-01-24 11:04 - 345782229 _____ () C:\Users\Alena\Downloads\Sherlock-s01e01-Study-in-pink_Studie-v-růžové-+-cz-titulky.avi
2014-01-21 20:20 - 2014-01-21 20:20 - 00573668 _____ () C:\Users\Alena\Downloads\Zabijaci---Jussi-Adler-Olsen.mobi
2014-01-16 13:21 - 2014-01-16 13:49 - 249878410 _____ () C:\Users\Alena\Downloads\How.I.Met.Your.Mother.S09E14.HDTV.+cztitulky.avi
2014-01-16 13:21 - 2014-01-16 13:21 - 00046174 _____ () C:\Users\Alena\Downloads\Survivor.S27E15.HDTV.x264-2hd-(titulky-cz).srt
2014-01-15 09:38 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 09:38 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 09:38 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 09:38 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 09:38 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 09:38 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 09:38 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 09:38 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 09:38 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-01-09 19:05 - 2014-01-09 19:05 - 00693336 _____ () C:\Users\Alena\Downloads\Vzkaz-v-lahvi---Jussi-Adler-Olsen.mobi
2014-01-09 19:05 - 2014-01-08 15:20 - 01376088 _____ () C:\Users\Alena\Downloads\Adler-Olsen Jussi - Zena v kleci.mobi
2014-01-09 19:05 - 2014-01-08 15:19 - 00824453 _____ () C:\Users\Alena\Downloads\Jussi Adler-Olsen - Zena v kleci.html
2014-01-09 19:05 - 2014-01-08 15:19 - 00339572 _____ () C:\Users\Alena\Downloads\Adler-Olsen Jussi - Zena v kleci.epub
2014-01-09 19:04 - 2014-01-09 19:04 - 01774605 _____ () C:\Users\Alena\Downloads\Jussi--Adler-Olsen---Zena-v-kleci.zip
2014-01-09 19:03 - 2014-01-07 11:05 - 00711156 _____ () C:\Users\Alena\Downloads\Levhart - Jo Nesbo.epub
2014-01-09 19:03 - 2014-01-07 11:01 - 01063123 _____ () C:\Users\Alena\Downloads\Levhart - Jo Nesbo.mobi
2014-01-09 18:57 - 2014-01-09 18:57 - 00000000 ____D () C:\Users\Alena\Documents\knizky
2014-01-09 18:55 - 2014-01-09 21:46 - 00000000 ____D () C:\Users\Alena\Downloads\Bukowski Charles
2014-01-09 18:54 - 2014-01-09 18:54 - 00035786 _____ () C:\Users\Alena\Downloads\Bukowski_Charles-Laska-je-pes.mobi
2014-01-09 18:53 - 2014-01-09 18:53 - 04451073 _____ () C:\Users\Alena\Downloads\Bukowski-Charles.rar
2014-01-09 18:52 - 2014-01-09 18:52 - 00248640 _____ () C:\Users\Alena\Downloads\Bukowski-Charles---Všechny-řitě-světa-i-ta-má.mobi
2014-01-09 18:48 - 2014-01-09 18:48 - 00255825 _____ () C:\Users\Alena\Downloads\Bukowski-Charles---Poštovní-úřad.mobi
2014-01-08 18:31 - 2014-01-08 18:33 - 36067375 _____ () C:\Users\Alena\Downloads\9913f901f3ddf44ae10eb94f7(1).zip
2014-01-08 18:26 - 2014-01-08 18:28 - 36067375 _____ () C:\Users\Alena\Downloads\9913f901f3ddf44ae10eb94f7.zip
2014-01-08 12:50 - 2014-01-08 13:09 - 181397504 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E13---cz-tit.(1).avi
2014-01-08 12:04 - 2014-01-08 12:04 - 00000723 _____ () C:\Users\Alena\Desktop\Skype.zip
2014-01-07 21:21 - 2014-01-07 21:21 - 01539402 _____ () C:\Users\Alena\Downloads\Jo-Nesbo-Levhart.rar
2014-01-07 20:44 - 2014-01-07 20:44 - 04157635 _____ () C:\Users\Alena\Downloads\Lars-Kepler---Svědkyně-ohně.mobi
2014-01-06 19:44 - 2014-01-06 20:04 - 181397504 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E13---cz-tit..avi
2014-01-06 13:12 - 2014-01-06 13:31 - 169887744 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E12---cz-tit..avi
2014-01-06 12:12 - 2014-01-06 12:32 - 185614336 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E09---cz-tit..avi
2014-01-05 09:33 - 2014-01-05 09:54 - 178274304 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E11---cz-tit..avi
2014-01-05 08:01 - 2014-01-05 08:22 - 185606144 _____ () C:\Users\Alena\Downloads\How.I.Met.Your.Mother.S09E10.CZ-titulky-vloženy.By-Anne.HDTV.XviD-AFG.avi

==================== One Month Modified Files and Folders =======

2014-02-04 20:39 - 2014-02-04 20:39 - 00016976 _____ () C:\Users\Alena\Desktop\FRST.txt
2014-02-04 20:39 - 2014-02-04 20:38 - 00000000 ____D () C:\FRST
2014-02-04 20:38 - 2014-02-04 20:38 - 00029696 _____ () C:\Users\Alena\AppData\Local\MSGBOX.EXE
2014-02-04 20:38 - 2014-02-04 20:38 - 00015327 _____ () C:\Users\Alena\Desktop\LM.bat
2014-02-04 20:38 - 2013-02-23 13:47 - 00000950 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-04 20:37 - 2014-02-04 20:37 - 00112640 _____ (forum.viry.cz) C:\Users\Alena\Desktop\FRSTLauncher.exe
2014-02-04 20:36 - 2014-02-04 20:36 - 02080256 _____ (Farbar) C:\Users\Alena\Desktop\FRST64.exe
2014-02-04 20:35 - 2010-12-21 00:21 - 01822362 _____ () C:\windows\WindowsUpdate.log
2014-02-04 20:14 - 2012-03-31 08:11 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 20:14 - 2012-03-31 08:11 - 00003852 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-02-04 20:14 - 2012-03-31 08:11 - 00000914 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-02-04 20:14 - 2011-10-14 09:38 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 19:38 - 2013-02-23 13:47 - 00000946 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-03 22:25 - 2009-07-14 05:45 - 00013632 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-03 22:25 - 2009-07-14 05:45 - 00013632 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-03 22:18 - 2014-01-31 07:11 - 00000270 __RSH () C:\ProgramData\ntuser.pol
2014-02-03 22:17 - 2014-02-03 20:36 - 00000112 _____ () C:\windows\setupact.log
2014-02-03 22:17 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-02-03 22:16 - 2014-02-03 22:14 - 00000000 ____D () C:\AdwCleaner
2014-02-03 22:13 - 2014-02-03 22:13 - 00007804 _____ () C:\Users\Alena\Desktop\JRT.txt
2014-02-03 21:53 - 2014-02-03 21:53 - 00000000 ____D () C:\windows\ERUNT
2014-02-03 21:53 - 2014-02-03 21:52 - 01166132 _____ () C:\Users\Alena\Desktop\adwcleaner.exe
2014-02-03 21:53 - 2014-02-03 21:52 - 01037068 _____ (Thisisu) C:\Users\Alena\Desktop\JRT.exe
2014-02-03 20:55 - 2014-02-03 20:55 - 00000000 ____D () C:\rsit
2014-02-03 20:55 - 2014-02-03 20:47 - 00000000 ____D () C:\Program Files\trend micro
2014-02-03 20:47 - 2014-02-03 20:54 - 00832273 _____ () C:\Users\Alena\Desktop\RSITx64.exe
2014-02-03 20:47 - 2014-02-03 20:47 - 00832273 _____ () C:\Users\Alena\Downloads\RSITx64.exe
2014-02-03 20:36 - 2014-02-03 20:36 - 00000000 _____ () C:\windows\setuperr.log
2014-02-03 20:35 - 2014-02-03 20:35 - 00000316 _____ () C:\windows\PFRO.log
2014-02-03 20:12 - 2013-01-13 17:09 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2014-02-03 10:10 - 2014-02-03 09:42 - 260438138 _____ () C:\Users\Alena\Downloads\pat-a-mat.mp4
2014-02-03 08:06 - 2011-05-05 15:38 - 00000000 ____D () C:\Users\Alena\AppData\Roaming\Winamp
2014-02-02 08:59 - 2011-05-05 15:14 - 00000000 ____D () C:\Users\Alena\AppData\Roaming\DAEMON Tools Lite
2014-02-02 08:58 - 2012-03-23 17:21 - 00000000 ____D () C:\windows\Minidump
2014-02-02 08:58 - 2009-07-29 08:00 - 00000000 ____D () C:\windows\Panther
2014-02-02 08:44 - 2014-02-02 08:44 - 00002772 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-02-02 08:44 - 2014-02-02 08:44 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-02-02 08:44 - 2013-02-23 13:47 - 00000000 ____D () C:\Users\Alena\AppData\Local\Google
2014-02-02 08:44 - 2011-05-05 15:09 - 00000000 ____D () C:\Program Files\CCleaner
2014-02-02 08:43 - 2014-02-02 08:43 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-02-02 08:43 - 2013-02-23 13:47 - 00000000 ____D () C:\Program Files (x86)\Google
2014-02-02 08:42 - 2014-02-02 08:42 - 04721920 _____ (Piriform Ltd) C:\Users\Alena\Downloads\ccsetup410.exe
2014-02-02 08:42 - 2014-02-02 08:42 - 00384529 _____ () C:\Users\Alena\Downloads\Lista_centrum.exe
2014-02-02 08:41 - 2014-02-02 08:41 - 00733368 _____ () C:\Users\Alena\Downloads\ccleaner-lista-centrumcz(1).exe
2014-02-02 08:41 - 2014-02-02 08:40 - 00733368 _____ () C:\Users\Alena\Downloads\ccleaner-lista-centrumcz.exe
2014-02-02 02:08 - 2010-12-20 15:51 - 00666672 _____ () C:\windows\system32\perfh005.dat
2014-02-02 02:08 - 2010-12-20 15:51 - 00140336 _____ () C:\windows\system32\perfc005.dat
2014-02-02 02:08 - 2009-07-14 06:13 - 01577482 _____ () C:\windows\system32\PerfStringBackup.INI
2014-02-01 20:53 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2014-01-31 07:12 - 2014-01-31 07:11 - 00000000 ____D () C:\ProgramData\BlocKTheoAdss
2014-01-31 07:12 - 2014-01-01 11:27 - 00000000 ____D () C:\ProgramData\9001855eaf1f81f4
2014-01-31 07:11 - 2014-01-31 07:11 - 00000000 ____D () C:\Users\Alena\AppData\Local\Packages
2014-01-31 07:11 - 2014-01-31 07:11 - 00000000 ____D () C:\ProgramData\bgackmgcbldmcaiflaehnlhjigdjjcnn
2014-01-31 07:11 - 2009-07-14 04:20 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-01-31 07:11 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\SysWOW64\GroupPolicy
2014-01-30 12:23 - 2014-01-30 12:02 - 186656768 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E16---cz-tit..avi
2014-01-30 11:49 - 2012-01-16 16:24 - 00000000 ____D () C:\Users\Alena\AppData\Roaming\Skype
2014-01-27 09:55 - 2014-01-27 08:36 - 730765312 _____ () C:\Users\Alena\Downloads\Sherlock-s01e02-The-blind-banker_Slepý-bankéř-+-cz-titulky.avi
2014-01-25 12:30 - 2014-01-25 12:09 - 178282496 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E15-cz-titulky.avi
2014-01-24 13:41 - 2014-01-24 12:15 - 730773504 _____ () C:\Users\Alena\Downloads\Sherlock-s01e01-Study-in-pink_Studie-v-růžové-+-cz-titulky(1).avi
2014-01-24 11:04 - 2014-01-24 10:07 - 345782229 _____ () C:\Users\Alena\Downloads\Sherlock-s01e01-Study-in-pink_Studie-v-růžové-+-cz-titulky.avi
2014-01-21 20:20 - 2014-01-21 20:20 - 00573668 _____ () C:\Users\Alena\Downloads\Zabijaci---Jussi-Adler-Olsen.mobi
2014-01-16 13:49 - 2014-01-16 13:21 - 249878410 _____ () C:\Users\Alena\Downloads\How.I.Met.Your.Mother.S09E14.HDTV.+cztitulky.avi
2014-01-16 13:21 - 2014-01-16 13:21 - 00046174 _____ () C:\Users\Alena\Downloads\Survivor.S27E15.HDTV.x264-2hd-(titulky-cz).srt
2014-01-16 04:58 - 2009-07-14 05:45 - 00464072 _____ () C:\windows\system32\FNTCACHE.DAT
2014-01-15 22:07 - 2011-05-05 15:52 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-15 09:39 - 2013-07-14 20:33 - 00000000 ____D () C:\windows\system32\MRT
2014-01-15 09:36 - 2012-12-30 11:22 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-09 21:46 - 2014-01-09 18:55 - 00000000 ____D () C:\Users\Alena\Downloads\Bukowski Charles
2014-01-09 19:05 - 2014-01-09 19:05 - 00693336 _____ () C:\Users\Alena\Downloads\Vzkaz-v-lahvi---Jussi-Adler-Olsen.mobi
2014-01-09 19:04 - 2014-01-09 19:04 - 01774605 _____ () C:\Users\Alena\Downloads\Jussi--Adler-Olsen---Zena-v-kleci.zip
2014-01-09 18:57 - 2014-01-09 18:57 - 00000000 ____D () C:\Users\Alena\Documents\knizky
2014-01-09 18:54 - 2014-01-09 18:54 - 00035786 _____ () C:\Users\Alena\Downloads\Bukowski_Charles-Laska-je-pes.mobi
2014-01-09 18:53 - 2014-01-09 18:53 - 04451073 _____ () C:\Users\Alena\Downloads\Bukowski-Charles.rar
2014-01-09 18:52 - 2014-01-09 18:52 - 00248640 _____ () C:\Users\Alena\Downloads\Bukowski-Charles---Všechny-řitě-světa-i-ta-má.mobi
2014-01-09 18:48 - 2014-01-09 18:48 - 00255825 _____ () C:\Users\Alena\Downloads\Bukowski-Charles---Poštovní-úřad.mobi
2014-01-08 18:33 - 2014-01-08 18:31 - 36067375 _____ () C:\Users\Alena\Downloads\9913f901f3ddf44ae10eb94f7(1).zip
2014-01-08 18:28 - 2014-01-08 18:26 - 36067375 _____ () C:\Users\Alena\Downloads\9913f901f3ddf44ae10eb94f7.zip
2014-01-08 15:20 - 2014-01-09 19:05 - 01376088 _____ () C:\Users\Alena\Downloads\Adler-Olsen Jussi - Zena v kleci.mobi
2014-01-08 15:19 - 2014-01-09 19:05 - 00824453 _____ () C:\Users\Alena\Downloads\Jussi Adler-Olsen - Zena v kleci.html
2014-01-08 15:19 - 2014-01-09 19:05 - 00339572 _____ () C:\Users\Alena\Downloads\Adler-Olsen Jussi - Zena v kleci.epub
2014-01-08 13:09 - 2014-01-08 12:50 - 181397504 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E13---cz-tit.(1).avi
2014-01-08 12:04 - 2014-01-08 12:04 - 00000723 _____ () C:\Users\Alena\Desktop\Skype.zip
2014-01-07 21:21 - 2014-01-07 21:21 - 01539402 _____ () C:\Users\Alena\Downloads\Jo-Nesbo-Levhart.rar
2014-01-07 20:44 - 2014-01-07 20:44 - 04157635 _____ () C:\Users\Alena\Downloads\Lars-Kepler---Svědkyně-ohně.mobi
2014-01-07 11:05 - 2014-01-09 19:03 - 00711156 _____ () C:\Users\Alena\Downloads\Levhart - Jo Nesbo.epub
2014-01-07 11:01 - 2014-01-09 19:03 - 01063123 _____ () C:\Users\Alena\Downloads\Levhart - Jo Nesbo.mobi
2014-01-06 20:04 - 2014-01-06 19:44 - 181397504 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E13---cz-tit..avi
2014-01-06 13:31 - 2014-01-06 13:12 - 169887744 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E12---cz-tit..avi
2014-01-06 12:32 - 2014-01-06 12:12 - 185614336 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E09---cz-tit..avi
2014-01-05 09:54 - 2014-01-05 09:33 - 178274304 _____ () C:\Users\Alena\Downloads\How-I-Met-Your-Mother-S09E11---cz-tit..avi
2014-01-05 09:38 - 2013-09-24 19:51 - 00000000 ____D () C:\ProgramData\tmp
2014-01-05 08:22 - 2014-01-05 08:01 - 185606144 _____ () C:\Users\Alena\Downloads\How.I.Met.Your.Mother.S09E10.CZ-titulky-vloženy.By-Anne.HDTV.XviD-AFG.avi

Some content of TEMP:
====================
C:\Users\Alena\AppData\Local\Temp\KMP_3.2.0.0.exe
C:\Users\Alena\AppData\Local\Temp\Quarantine.exe
C:\Users\Alena\AppData\Local\Temp\~6CB2.exe
C:\Users\Alena\AppData\Local\Temp\~8284.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-29 20:58

==================== End Of Log ============================

Odinstalujte vse od McAffe (Security Scan, Site Advisor)

Tvorba fixlistu pro FRST

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  Start
  HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
  HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [37888 2010-01-12] (Nullsoft, Inc.)
  HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
  HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
  HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
  HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\windows\System32\SPReview\SPReview.exe [301568 2013-05-28] (Microsoft Corporation)
  HKU\S-1-5-21-1808414493-4098895497-794563187-1000\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
  HKU\S-1-5-21-1808414493-4098895497-794563187-1000\...\MountPoints2: {742105c1-771e-11e0-b649-18f46afdc71a} - G:\autorun.exe
  AppInit_DLLs: C:\PROGRA~3\Prowebi\PROWEB~1.DLL => C:\ProgramData\Prowebi\Prowebi_x64.dll [4676096 2013-12-31] ()
  AppInit_DLLs-x32: c:\progra~3\prowebi\prowebi.dll => C:\ProgramData\Prowebi\Prowebi.dll [4143104 2013-12-31] ()
  
  BHO: BlocKTheoAdss - {2E85C2E0-A342-B0FD-35EF-A28671804B21} - C:\ProgramData\BlocKTheoAdss\YbnH0S.x64.dll ()
  BHO: BeStSavEForYou - {4DF8374A-358D-74D7-B567-5EDADC449A5E} - C:\ProgramData\BeStSavEForYou\PfQnNHbH.x64.dll ()
  BHO: EEnjoyyCoupon - {9D89652A-9F78-56D9-F1D8-6627D6C39BD5} - C:\ProgramData\EEnjoyyCoupon\P5yYRYX.x64.dll No File
  BHO-x32: BlocKTheoAdss - {2E85C2E0-A342-B0FD-35EF-A28671804B21} - C:\ProgramData\BlocKTheoAdss\YbnH0S.dll ()
  
  FF Extension: BlocKTheoAdss - C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\prcxqpd7@hqdk-.com [2014-01-31]
  FF Extension: BeStSavEForYou - C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\trr_bg@auebaadvg.co.uk [2014-01-01]
  FF Extension: EEnjoyyCoupon - C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\yiuil@iyvgrs-.org [2014-01-01]
  
  CHR Extension: (BlocKTheoAdss) - C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgackmgcbldmcaiflaehnlhjigdjjcnn [2014-02-02]
  CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
  
  R2 6ea8c3d5; C:\ProgramData\Prowebi\ProwebiSvc.dll [182096 2013-12-31] ()
  U3 BcmSqlStartupSvc;
  U3 IGRS;
  U2 IviRegMgr;
  U2 ReadyComm.DirectRouter;
  U2 RichVideo;
  S2 Sentinel; \SystemRoot\System32\Drivers\SENTINEL.SYS [X]
  U3 SQLWriter; 
  
  2014-02-04 20:38 - 2014-02-04 20:38 - 00029696 _____ () C:\Users\Alena\AppData\Local\MSGBOX.EXE
  2014-02-04 20:38 - 2014-02-04 20:38 - 00015327 _____ () C:\Users\Alena\Desktop\LM.bat
  2014-02-04 20:37 - 2014-02-04 20:37 - 00112640 _____ (forum.viry.cz) C:\Users\Alena\Desktop\FRSTLauncher.exe
  2014-02-03 22:13 - 2014-02-03 22:13 - 00007804 _____ () C:\Users\Alena\Desktop\JRT.txt
  2014-02-03 21:52 - 2014-02-03 21:53 - 01166132 _____ () C:\Users\Alena\Desktop\adwcleaner.exe
  2014-02-03 21:52 - 2014-02-03 21:53 - 01037068 _____ (Thisisu) C:\Users\Alena\Desktop\JRT.exe
  2014-02-03 20:54 - 2014-02-03 20:47 - 00832273 _____ () C:\Users\Alena\Desktop\RSITx64.exe
  2014-02-03 20:47 - 2014-02-03 20:47 - 00832273 _____ () C:\Users\Alena\Downloads\RSITx64.exe
  2014-02-02 08:42 - 2014-02-02 08:42 - 04721920 _____ (Piriform Ltd) C:\Users\Alena\Downloads\ccsetup410.exe
  2014-02-02 08:42 - 2014-02-02 08:42 - 00384529 _____ () C:\Users\Alena\Downloads\Lista_centrum.exe
  2014-02-02 08:41 - 2014-02-02 08:41 - 00733368 _____ () C:\Users\Alena\Downloads\ccleaner-lista-centrumcz(1).exe
  2014-02-02 08:40 - 2014-02-02 08:41 - 00733368 _____ () C:\Users\Alena\Downloads\ccleaner-lista-centrumcz.exe
  2014-01-31 07:11 - 2014-01-31 07:11 - 00000000 ____D () C:\ProgramData\bgackmgcbldmcaiflaehnlhjigdjjcnn
  C:\Users\Alena\AppData\Local\Temp\KMP_3.2.0.0.exe
  C:\Users\Alena\AppData\Local\Temp\Quarantine.exe
  C:\Users\Alena\AppData\Local\Temp\~6CB2.exe
  C:\Users\Alena\AppData\Local\Temp\~8284.exe
  C:\windows\tasks\Adobe Flash Player Updater.job
  C:\windows\tasks\GoogleUpdateTaskMachineCore.job
  C:\windows\tasks\GoogleUpdateTaskMachineUA.job
  C:\ProgramData\Prowebi
  C:\ProgramData\BlocKTheoAdss
  
  Hosts:
  CMD: shutdown /r /f /t 2
  
  End

• Ulozte vytvoreny TXT jako fixlist.txt
• Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

• Kliknete na Fix
• Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-02-2014
Ran by Alena at 2014-02-05 11:30:47 Run:1
Running from C:\Users\Alena\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [37888 2010-01-12] (Nullsoft, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\windows\System32\SPReview\SPReview.exe [301568 2013-05-28] (Microsoft Corporation)
HKU\S-1-5-21-1808414493-4098895497-794563187-1000\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [1305408 2011-01-20] (DT Soft Ltd)
HKU\S-1-5-21-1808414493-4098895497-794563187-1000\...\MountPoints2: {742105c1-771e-11e0-b649-18f46afdc71a} - G:\autorun.exe
AppInit_DLLs: C:\PROGRA~3\Prowebi\PROWEB~1.DLL => C:\ProgramData\Prowebi\Prowebi_x64.dll [4676096 2013-12-31] ()
AppInit_DLLs-x32: c:\progra~3\prowebi\prowebi.dll => C:\ProgramData\Prowebi\Prowebi.dll [4143104 2013-12-31] ()

BHO: BlocKTheoAdss - {2E85C2E0-A342-B0FD-35EF-A28671804B21} - C:\ProgramData\BlocKTheoAdss\YbnH0S.x64.dll ()
BHO: BeStSavEForYou - {4DF8374A-358D-74D7-B567-5EDADC449A5E} - C:\ProgramData\BeStSavEForYou\PfQnNHbH.x64.dll ()
BHO: EEnjoyyCoupon - {9D89652A-9F78-56D9-F1D8-6627D6C39BD5} - C:\ProgramData\EEnjoyyCoupon\P5yYRYX.x64.dll No File
BHO-x32: BlocKTheoAdss - {2E85C2E0-A342-B0FD-35EF-A28671804B21} - C:\ProgramData\BlocKTheoAdss\YbnH0S.dll ()

FF Extension: BlocKTheoAdss - C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\prcxqpd7@hqdk-.com [2014-01-31]
FF Extension: BeStSavEForYou - C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\trr_bg@auebaadvg.co.uk [2014-01-01]
FF Extension: EEnjoyyCoupon - C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\yiuil@iyvgrs-.org [2014-01-01]

CHR Extension: (BlocKTheoAdss) - C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgackmgcbldmcaiflaehnlhjigdjjcnn [2014-02-02]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

R2 6ea8c3d5; C:\ProgramData\Prowebi\ProwebiSvc.dll [182096 2013-12-31] ()
U3 BcmSqlStartupSvc;
U3 IGRS;
U2 IviRegMgr;
U2 ReadyComm.DirectRouter;
U2 RichVideo;
S2 Sentinel; \SystemRoot\System32\Drivers\SENTINEL.SYS [X]
U3 SQLWriter;

2014-02-04 20:38 - 2014-02-04 20:38 - 00029696 _____ () C:\Users\Alena\AppData\Local\MSGBOX.EXE
2014-02-04 20:38 - 2014-02-04 20:38 - 00015327 _____ () C:\Users\Alena\Desktop\LM.bat
2014-02-04 20:37 - 2014-02-04 20:37 - 00112640 _____ (forum.viry.cz) C:\Users\Alena\Desktop\FRSTLauncher.exe
2014-02-03 22:13 - 2014-02-03 22:13 - 00007804 _____ () C:\Users\Alena\Desktop\JRT.txt
2014-02-03 21:52 - 2014-02-03 21:53 - 01166132 _____ () C:\Users\Alena\Desktop\adwcleaner.exe
2014-02-03 21:52 - 2014-02-03 21:53 - 01037068 _____ (Thisisu) C:\Users\Alena\Desktop\JRT.exe
2014-02-03 20:54 - 2014-02-03 20:47 - 00832273 _____ () C:\Users\Alena\Desktop\RSITx64.exe
2014-02-03 20:47 - 2014-02-03 20:47 - 00832273 _____ () C:\Users\Alena\Downloads\RSITx64.exe
2014-02-02 08:42 - 2014-02-02 08:42 - 04721920 _____ (Piriform Ltd) C:\Users\Alena\Downloads\ccsetup410.exe
2014-02-02 08:42 - 2014-02-02 08:42 - 00384529 _____ () C:\Users\Alena\Downloads\Lista_centrum.exe
2014-02-02 08:41 - 2014-02-02 08:41 - 00733368 _____ () C:\Users\Alena\Downloads\ccleaner-lista-centrumcz(1).exe
2014-02-02 08:40 - 2014-02-02 08:41 - 00733368 _____ () C:\Users\Alena\Downloads\ccleaner-lista-centrumcz.exe
2014-01-31 07:11 - 2014-01-31 07:11 - 00000000 ____D () C:\ProgramData\bgackmgcbldmcaiflaehnlhjigdjjcnn
C:\Users\Alena\AppData\Local\Temp\KMP_3.2.0.0.exe
C:\Users\Alena\AppData\Local\Temp\Quarantine.exe
C:\Users\Alena\AppData\Local\Temp\~6CB2.exe
C:\Users\Alena\AppData\Local\Temp\~8284.exe
C:\windows\tasks\Adobe Flash Player Updater.job
C:\windows\tasks\GoogleUpdateTaskMachineCore.job
C:\windows\tasks\GoogleUpdateTaskMachineUA.job
C:\ProgramData\Prowebi
C:\ProgramData\BlocKTheoAdss

Hosts:
CMD: shutdown /r /f /t 2

End
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\UpdateP2GShortCut => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\WinampAgent => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\GrooveMonitor => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SPReview => Value deleted successfully.
HKU\S-1-5-21-1808414493-4098895497-794563187-1000\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => Value deleted successfully.
HKU\1\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{742105c1-771e-11e0-b649-18f46afdc71a} => Key not found.
HKCR\CLSID\{742105c1-771e-11e0-b649-18f46afdc71a} => Key not found.
"C:\\PROGRA~3\\Prowebi\\PROWEB~1.DLL" => Value Data removed successfully.
"c:\\progra~3\\prowebi\\prowebi.dll" => Value Data removed successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E85C2E0-A342-B0FD-35EF-A28671804B21} => Key deleted successfully.
HKCR\CLSID\{2E85C2E0-A342-B0FD-35EF-A28671804B21} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4DF8374A-358D-74D7-B567-5EDADC449A5E} => Key deleted successfully.
HKCR\CLSID\{4DF8374A-358D-74D7-B567-5EDADC449A5E} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D89652A-9F78-56D9-F1D8-6627D6C39BD5} => Key deleted successfully.
HKCR\CLSID\{9D89652A-9F78-56D9-F1D8-6627D6C39BD5} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E85C2E0-A342-B0FD-35EF-A28671804B21} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{2E85C2E0-A342-B0FD-35EF-A28671804B21} => Key deleted successfully.
C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\prcxqpd7@hqdk-.com => Moved successfully.
C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\trr_bg@auebaadvg.co.uk => Moved successfully.
C:\Users\Alena\AppData\Roaming\Mozilla\Firefox\Profiles\uonfvcw7.default\Extensions\yiuil@iyvgrs-.org => Moved successfully.
C:\Users\Alena\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgackmgcbldmcaiflaehnlhjigdjjcnn => Moved successfully.
HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
6ea8c3d5 => Service deleted successfully.
BcmSqlStartupSvc => Service deleted successfully.
IGRS => Service deleted successfully.
IviRegMgr => Service deleted successfully.
ReadyComm.DirectRouter => Service deleted successfully.
RichVideo => Service deleted successfully.
Sentinel => Service deleted successfully.
SQLWriter => Service deleted successfully.
C:\Users\Alena\AppData\Local\MSGBOX.EXE => Moved successfully.
C:\Users\Alena\Desktop\LM.bat => Moved successfully.
C:\Users\Alena\Desktop\FRSTLauncher.exe => Moved successfully.
C:\Users\Alena\Desktop\JRT.txt => Moved successfully.
C:\Users\Alena\Desktop\adwcleaner.exe => Moved successfully.
C:\Users\Alena\Desktop\JRT.exe => Moved successfully.
C:\Users\Alena\Desktop\RSITx64.exe => Moved successfully.
C:\Users\Alena\Downloads\RSITx64.exe => Moved successfully.
C:\Users\Alena\Downloads\ccsetup410.exe => Moved successfully.
C:\Users\Alena\Downloads\Lista_centrum.exe => Moved successfully.
C:\Users\Alena\Downloads\ccleaner-lista-centrumcz(1).exe => Moved successfully.
C:\Users\Alena\Downloads\ccleaner-lista-centrumcz.exe => Moved successfully.
C:\ProgramData\bgackmgcbldmcaiflaehnlhjigdjjcnn => Moved successfully.
C:\Users\Alena\AppData\Local\Temp\KMP_3.2.0.0.exe => Moved successfully.
C:\Users\Alena\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Alena\AppData\Local\Temp\~6CB2.exe => Moved successfully.
C:\Users\Alena\AppData\Local\Temp\~8284.exe => Moved successfully.
C:\windows\tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\windows\tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\windows\tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.

"C:\ProgramData\Prowebi" directory move:

C:\ProgramData\Prowebi\Prowebi.dll => Moved successfully.
Could not move "C:\ProgramData\Prowebi\ProwebiSvc.dll" => Scheduled to move on reboot.
C:\ProgramData\Prowebi\Prowebi_x64.dll => Moved successfully.
Could not move "C:\ProgramData\Prowebi" directory. => Scheduled to move on reboot.

C:\ProgramData\BlocKTheoAdss => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.

========= shutdown /r /f /t 2 =========
a

========= End of CMD: =========


=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-02-05 11:32:52)<=

C:\ProgramData\Prowebi\ProwebiSvc.dll => Is moved successfully.
C:\ProgramData\Prowebi => Is moved successfully.

==== End of Fixlog ====

Tak jeste uklidime

T-Cleaner http://vyosek.tym.cz/pro_usery/T-Cleaner.exe

• Stahnete a spustte
• Pro potvrzeni volby mackejte A, Enter
• Po pouziti utilitu smazte
• Antiviry touhou utilitu chybne oznacit jako vir - jedna se o falesny poplach - takze v pohode stahnete (pripadne vypnete pri stahovani antivir)

OTC http://oldtimer.geekstogo.com/OTC.exe

• Stahnete a spustte
• Kliknete na CleanUp a potvrdte YES
• Program uklidi a restartuje PC

TFC http://oldtimer.geekstogo.com/TFC.exe

• Stahnete a spustte
• Kliknete na Start a potvrdte OK
• Program uklidi a restartuje pc
• Po pouziti utilitu smazte

Stahnete Ccleaner http://forum.viry.cz/viewtopic.php?t=7478
Panel čistič

• Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner

Panel registry

• dejte Hledej problémy
• nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
• postup opakujte dokud nebude bez problemu - vetsinou cca 3x

Panel nástroje

• Zde muzete odinstalovat nepotrebne programy

CCleaner doporucuji pouzivat cca jednou za tyden

A pokud nejsou problemy ci dotazy, je to z me strany vse

děkuji

Nemate zac, rad jsem pomohl Zase nekdy

A na zaklade Pravidla o zamykani temat