Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

JS/Kryptik.I - Trojský kůň

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
LammiN
Návštěvník
Návštěvník
Příspěvky: 15
Registrován: 21 led 2013 19:53

JS/Kryptik.I - Trojský kůň

#1 Příspěvek od LammiN »

Dobrý den,
poseldní tři dny mi po kliknutí na jakoukoliv webovou stránku eset zachytí trojského koně JS/Kryptik.I a dá ho do karantény.
CCleaner, Spybot search & destroy, Avast ani Eset, ho nedokázali odtranit. Upozorní na něj, ale problém trvá stále.
Pomohl by mi někdo s tímhle problémem?
Předem děkuji :)

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119536
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: JS/Kryptik.I - Trojský kůň

#2 Příspěvek od Rudy »

Zdravím!
Zkuste tento postup: http://forum.viry.cz/viewtopic.php?f=13&t=133100 .
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

LammiN
Návštěvník
Návštěvník
Příspěvky: 15
Registrován: 21 led 2013 19:53

Re: JS/Kryptik.I - Trojský kůň

#3 Příspěvek od LammiN »

Vše jsem udělal podle návodu a přikládám výpis z logu FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Jana (administrator) on VAIO on 02-04-2014 15:31:50
Running from C:\Users\Jana\Desktop
Windows 8.1 (X64) OS Language: Czech
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe
(Condusiv Technologies) C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Microsoft Corporation) C:\WINDOWS\SysWOW64\DllHost.exe
(Microsoft Corporation) C:\WINDOWS\System32\vds.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\System32\skydrive.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient.EXE
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
() C:\Program Files\Sony\VAIO Care\listener.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe\LiveComm.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(forum.viry.cz) C:\Users\Jana\Desktop\FRSTLauncher.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\setup\instup.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-09-20] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] - C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [766080 2012-11-05] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-11-05] (Qualcomm Atheros Commnucations)
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET Smart Security\egui.exe [5617432 2013-08-19] (ESET)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2930488 2012-11-09] (Synaptics Incorporated)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [68776 2012-08-18] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [724576 2012-07-27] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(R) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-10-04] (Intel Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [309688 2012-11-12] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-01] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-163857228-3445606662-3509154974-1001\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [968120 2012-11-12] (Samsung)
HKU\S-1-5-21-163857228-3445606662-3509154974-1001\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [577536 2012-11-01] (Samsung Electronics)
HKU\S-1-5-21-163857228-3445606662-3509154974-1001\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1104824 2012-11-12] (Samsung)
HKU\S-1-5-21-163857228-3445606662-3509154974-1001\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-163857228-3445606662-3509154974-1001\...\Run: [BitTorrent] - C:\Users\Jana\AppData\Roaming\BitTorrent\BitTorrent.exe [900696 2014-02-07] (BitTorrent Inc.)
HKU\S-1-5-21-163857228-3445606662-3509154974-1001\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [21822128 2014-01-30] (Google)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://sony13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://vaioportal.sony.eu
URLSearchHook: HKLM-x32 - (No Name) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - No File
URLSearchHook: HKCU - (No Name) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - No File
SearchScopes: HKLM-x32 - DefaultScope {39D8A984-8875-4FCD-969F-802FAFB2879E} URL =
SearchScopes: HKCU - DefaultScope {7BD7E5D1-0B99-45C9-B54C-671662C13D72} URL = http://www.bing.com/search?q={searchTer ... &pc=MASEJS
SearchScopes: HKCU - {39D8A984-8875-4FCD-969F-802FAFB2879E} URL = http://search.conduit.com/ResultsExt.as ... 23616&UM=1
SearchScopes: HKCU - {3C03686A-79C9-4EC8-8F83-FBFA10A0C3DD} URL = http://rover.ebay.com/rover/1/710-42480 ... earchTerms}
SearchScopes: HKCU - {7BD7E5D1-0B99-45C9-B54C-671662C13D72} URL = http://www.bing.com/search?q={searchTer ... &pc=MASEJS
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - No Name - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - No File
Toolbar: HKCU - No Name - {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\d2tuv65v.default
FF user.js: detected! => C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\d2tuv65v.default\user.js
FF Homepage: http://www.seznam.cz
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jana\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mapy-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: Site Finder - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\d2tuv65v.default\Extensions\sitefinder@sitefinder.com [2014-03-22]
FF Extension: BitTorrentControl_v12 - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\d2tuv65v.default\Extensions\{b6ac5e3c-5ceb-4e72-b451-f0e1ba983c14} [2013-12-14]
FF Extension: Foxtab Speed Dial - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\d2tuv65v.default\Extensions\{5ebdca98-43b3-45bb-87e0-716029fb42ab}.xpi [2014-03-25]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-03-29]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-01]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2013-11-12]

Chrome:
=======
CHR Extension: (Docs) - C:\Users\Jana\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-01]
CHR Extension: (Disk Google) - C:\Users\Jana\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-01]
CHR Extension: (YouTube) - C:\Users\Jana\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-01]
CHR Extension: (Vyhledávání Google) - C:\Users\Jana\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-01]
CHR Extension: (avast! Online Security) - C:\Users\Jana\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-01]
CHR Extension: (Peněženka Google) - C:\Users\Jana\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-01]
CHR Extension: (Gmail) - C:\Users\Jana\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-01]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-04-01]

==================== Services (Whitelisted) =================

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [231040 2012-11-05] (Qualcomm Atheros Commnucations)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-01] (AVAST Software)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1363584 2014-03-03] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1748608 2014-03-03] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1337240 2013-08-19] (ESET)
R2 ExpressCache; C:\Program Files\Condusiv Technologies\ExpressCache\ExpressCache.exe [102224 2012-08-17] (Condusiv Technologies)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-05] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation)
S2 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [200728 2012-05-11] (McAfee, Inc.)
S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [623784 2012-10-18] (Sony Corporation)
R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [474208 2012-07-27] (Sony Corporation)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [156672 2012-08-06] ()
S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [964608 2012-09-28] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1368624 2013-08-01] (Sony Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-31] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-31] (Microsoft Corporation)
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-11-05] (Atheros)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-01] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-01] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-01] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-01] (AVAST Software)
S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-01] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-01] ()
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-13] (Windows (R) Win 7 DDK provider)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-11-05] (Qualcomm Atheros)
S3 BTATH_VDP; C:\Windows\system32\drivers\btath_vdp.sys [427416 2012-11-05] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [224768 2013-08-22] (Microsoft Corporation)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-08-20] (ESET)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [239296 2013-08-26] (ESET)
R1 ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [168256 2013-08-20] (ESET)
R2 epfw; C:\Windows\system32\DRIVERS\epfw.sys [220232 2013-08-20] (ESET)
R1 EpfwLWF; C:\Windows\system32\DRIVERS\EpfwLWF.sys [44120 2013-08-20] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-08-20] (ESET)
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [14872 2014-01-07] ()
R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23376 2012-08-17] (Condusiv Technologies)
R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [103248 2012-08-17] (Condusiv Technologies)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-12-17] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-12-17] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [44344 2012-11-09] (Synaptics Incorporated)
R3 SOWS; C:\Windows\System32\drivers\sows.sys [24280 2012-06-11] (Sony Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-14] (Microsoft Corporation)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-31] (Microsoft Corporation)
S3 iscFlash; \??\C:\ProgramData\Sony Corporation\Sony Packaging Manager\PackagingTemp\{F4A59A37-B9D8-4863-8A7C-4D7F7495A600}\iscflashx64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-02 15:31 - 2014-04-02 15:32 - 00021654 _____ () C:\Users\Jana\Desktop\FRST.txt
2014-04-02 15:31 - 2014-04-02 15:31 - 00000000 ____D () C:\FRST
2014-04-02 15:29 - 2014-04-02 15:29 - 00112640 _____ (forum.viry.cz) C:\Users\Jana\Desktop\FRSTLauncher.exe
2014-04-02 15:28 - 2014-04-02 15:28 - 02157056 _____ (Farbar) C:\Users\Jana\Desktop\FRST64.exe
2014-04-02 15:24 - 2014-04-02 15:24 - 00000000 ___SH () C:\DkHyperbootSync
2014-04-01 15:06 - 2014-04-01 15:06 - 00000000 _____ () C:\autoexec.bat
2014-04-01 15:04 - 2014-04-01 15:04 - 00002268 _____ () C:\Users\Jana\Desktop\SpyHunter.lnk
2014-04-01 15:04 - 2014-04-01 15:04 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-04-01 15:04 - 2014-04-01 15:04 - 00000000 ____D () C:\sh4ldr
2014-04-01 15:04 - 2014-04-01 15:04 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-01 15:03 - 2014-04-01 15:04 - 00000000 ____D () C:\WINDOWS\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-04-01 15:01 - 2014-04-01 15:01 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Jana\Downloads\SpyHunter-Installer.exe
2014-04-01 14:49 - 2014-04-01 14:49 - 00000770 _____ () C:\WINDOWS\PFRO.log
2014-04-01 14:29 - 2014-04-01 14:29 - 00001982 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-01 14:29 - 2014-04-01 14:29 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\AVAST Software
2014-04-01 14:28 - 2014-04-01 14:52 - 00002203 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-01 14:28 - 2014-04-01 14:29 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2014-04-01 14:27 - 2014-04-01 14:27 - 01039096 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00423240 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00334648 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2014-04-01 14:27 - 2014-04-01 14:27 - 00208928 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00084816 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00079184 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-04-01 14:26 - 2014-04-01 14:26 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-01 14:25 - 2014-04-01 14:25 - 04732664 _____ (AVAST Software) C:\Users\Jana\Downloads\avast_free_antivirus_setup_online.exe
2014-04-01 14:25 - 2014-04-01 14:25 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-03-31 23:42 - 2014-03-31 23:42 - 00450712 ____R () C:\WINDOWS\system32\Drivers\etc\hosts.20140331-234251.backup
2014-03-31 23:42 - 2014-03-31 23:42 - 00450712 ____R () C:\WINDOWS\system32\Drivers\etc\hosts.20140331-234244.backup
2014-03-31 23:42 - 2014-01-05 17:46 - 00450660 ____R () C:\WINDOWS\system32\Drivers\etc\hosts.20140331-234238.backup
2014-03-31 01:50 - 2014-03-31 01:50 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\iolo
2014-03-30 16:41 - 2014-03-30 16:41 - 00003942 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA1cf4c262dfb5266
2014-03-30 16:41 - 2014-03-30 16:41 - 00000970 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cf4c262dfb5266.job
2014-03-29 11:30 - 2014-03-29 11:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 12:08 - 2014-03-28 12:08 - 58696816 _____ (ZONER software ) C:\Users\Jana\Downloads\zps16_cz.exe
2014-03-28 00:16 - 2014-03-28 13:49 - 00000000 ____D () C:\Users\Jana\Desktop\vlasy
2014-03-24 23:17 - 2014-02-22 14:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-03-24 23:17 - 2014-02-22 13:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-03-24 21:03 - 2014-03-28 00:18 - 00000000 ____D () C:\Users\Jana\Desktop\luxverze
2014-03-20 12:15 - 2014-03-20 12:15 - 00011963 _____ () C:\Users\Jana\AppData\Local\recently-used.xbel
2014-03-19 10:28 - 2014-01-08 03:46 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2014-03-19 10:28 - 2014-01-08 03:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-03-19 10:28 - 2014-01-08 03:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2014-03-19 10:28 - 2014-01-04 17:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll
2014-03-19 10:28 - 2014-01-04 17:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll
2014-03-19 10:28 - 2014-01-04 16:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2014-03-19 10:28 - 2014-01-04 15:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2014-03-19 10:28 - 2014-01-03 01:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll
2014-03-19 10:28 - 2014-01-03 01:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll
2014-03-19 10:28 - 2014-01-01 03:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-03-19 10:28 - 2014-01-01 03:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2014-03-19 10:28 - 2014-01-01 02:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-03-19 10:28 - 2014-01-01 02:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2014-03-19 10:28 - 2014-01-01 01:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2014-03-19 10:28 - 2014-01-01 01:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2014-03-19 10:28 - 2014-01-01 01:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2014-03-19 10:28 - 2013-12-31 01:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll
2014-03-19 10:28 - 2013-12-31 01:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2014-03-19 10:28 - 2013-12-31 01:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll
2014-03-19 10:28 - 2013-12-31 01:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2014-03-19 10:28 - 2013-12-31 01:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2014-03-19 10:28 - 2013-12-27 17:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2014-03-19 10:28 - 2013-12-27 10:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2014-03-19 10:28 - 2013-12-27 10:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2014-03-19 10:28 - 2013-12-27 10:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2014-03-19 10:28 - 2013-12-27 09:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll
2014-03-19 10:28 - 2013-12-27 09:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2014-03-19 10:28 - 2013-12-27 08:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2014-03-19 10:28 - 2013-12-21 09:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll
2014-03-19 10:28 - 2013-12-17 09:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2014-03-19 10:28 - 2013-12-14 08:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-03-19 10:28 - 2013-12-14 08:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-03-19 10:28 - 2013-12-13 12:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe
2014-03-19 10:28 - 2013-12-13 08:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
2014-03-19 10:28 - 2013-12-13 07:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll
2014-03-19 10:28 - 2013-12-09 10:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-03-19 10:28 - 2013-12-09 06:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-03-18 00:20 - 2014-03-18 00:28 - 142179323 _____ () C:\Users\Jana\Desktop\RUKOPISY-Z-NAG-HAMADI-1.rar
2014-03-13 22:32 - 2013-10-31 02:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2014-03-13 22:32 - 2013-10-31 02:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2014-03-13 22:32 - 2013-10-31 02:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
2014-03-13 21:53 - 2014-03-28 00:44 - 00000000 ____D () C:\Users\Jana\Desktop\uprav
2014-03-13 16:43 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-03-13 16:43 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-03-13 16:43 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-03-13 16:43 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-03-13 16:43 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-03-13 16:43 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-03-13 16:43 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-03-13 16:43 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-03-13 16:43 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-03-13 16:43 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-03-13 16:43 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-03-13 16:43 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-03-13 16:43 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-03-13 16:43 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-03-13 16:43 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-03-13 16:43 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-03-13 16:43 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-03-13 16:43 - 2014-01-31 18:15 - 00311640 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2014-03-13 16:43 - 2014-01-31 18:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2014-03-13 16:43 - 2014-01-31 18:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2014-03-13 16:43 - 2014-01-31 15:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2014-03-13 16:43 - 2014-01-31 11:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll
2014-03-13 16:43 - 2014-01-29 11:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2014-03-13 16:43 - 2014-01-29 10:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2014-03-13 16:43 - 2014-01-29 10:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2014-03-13 16:43 - 2014-01-29 10:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2014-03-13 16:43 - 2014-01-29 10:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-03-13 16:43 - 2014-01-29 09:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2014-03-13 16:43 - 2014-01-29 09:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2014-03-13 16:43 - 2014-01-29 09:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2014-03-13 16:43 - 2014-01-29 08:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2014-03-13 16:43 - 2014-01-29 02:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2014-03-13 16:43 - 2014-01-27 21:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2014-03-13 16:43 - 2014-01-27 21:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll
2014-03-13 16:43 - 2014-01-27 21:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE
2014-03-13 16:43 - 2014-01-27 20:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2014-03-13 16:43 - 2014-01-27 20:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2014-03-13 16:43 - 2014-01-27 20:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll
2014-03-13 16:43 - 2014-01-27 20:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE
2014-03-13 16:43 - 2014-01-27 20:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2014-03-13 16:43 - 2014-01-27 19:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
2014-03-13 16:43 - 2014-01-27 19:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2014-03-13 16:43 - 2014-01-27 19:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2014-03-13 16:43 - 2014-01-27 17:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-03-13 16:43 - 2014-01-27 17:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-03-13 16:43 - 2014-01-27 13:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-03-13 16:43 - 2014-01-18 01:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2014-03-13 16:43 - 2014-01-17 23:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2014-03-13 16:43 - 2013-12-21 16:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2014-03-13 16:43 - 2013-12-21 10:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll
2014-03-13 16:43 - 2013-12-20 12:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2014-03-13 16:43 - 2013-12-20 12:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2014-03-13 16:42 - 2014-02-11 05:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-03-13 16:42 - 2014-02-11 04:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll
2014-03-13 16:42 - 2014-02-11 04:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll
2014-03-12 13:29 - 2014-03-20 13:58 - 00000000 ____D () C:\Users\Jana\AppData\Local\gtk-2.0
2014-03-12 13:29 - 2014-03-12 13:29 - 00000000 ____D () C:\Users\Jana\.thumbnails
2014-03-12 13:26 - 2014-03-20 13:58 - 00000000 ____D () C:\Users\Jana\.gimp-2.8
2014-03-12 13:26 - 2014-03-12 13:26 - 00000000 ____D () C:\Users\Jana\AppData\Local\gegl-0.2
2014-03-12 13:24 - 2014-03-12 13:25 - 00000000 ____D () C:\Program Files\GIMP 2
2014-03-12 13:22 - 2014-03-12 13:23 - 90396104 _____ (The GIMP Team ) C:\Users\Jana\Downloads\gimp-2.8.10-setup.exe
2014-03-05 19:20 - 2014-03-05 19:21 - 00000193 _____ () C:\Users\Jana\.htaccess
2014-03-05 19:17 - 2014-03-05 19:17 - 00000013 _____ () C:\Users\Jana\1.htaccess
2014-03-05 19:13 - 2014-03-05 19:13 - 00000030 _____ () C:\Users\Jana\Downloads\index.php
2014-03-04 20:56 - 2014-03-04 20:56 - 00000053 _____ () C:\Users\Jana\Downloads\google13a81ee5b776511f.html
2014-03-04 19:49 - 2014-03-24 16:56 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\FileZilla
2014-03-04 19:49 - 2014-03-04 19:49 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\FoxTab
2014-03-04 19:49 - 2014-03-04 19:49 - 00000000 ____D () C:\Program Files (x86)\SimilarSites
2014-03-04 19:49 - 2014-03-04 19:49 - 00000000 ____D () C:\Program Files (x86)\FileZilla FTP Client
2014-03-04 19:48 - 2014-03-04 19:48 - 04822473 _____ (Tim Kosse) C:\Users\Jana\Downloads\FileZilla_3.7.4.1_win32-setup [1].exe
2014-03-04 19:48 - 2014-03-04 19:48 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\SimilarSites
2014-03-04 19:48 - 2014-03-04 19:48 - 00000000 ____D () C:\Program Files (x86)\Foxtab
2014-03-03 18:18 - 2014-03-03 18:19 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\PSpad
2014-03-03 18:18 - 2014-03-03 18:18 - 00000000 ____D () C:\Program Files (x86)\PSPad editor
2014-03-03 18:17 - 2014-03-03 18:18 - 04014560 _____ (Jan Fiala ) C:\Users\Jana\Downloads\pspad457inst_cz.exe

==================== One Month Modified Files and Folders =======

2014-04-02 15:32 - 2014-04-02 15:31 - 00021654 _____ () C:\Users\Jana\Desktop\FRST.txt
2014-04-02 15:31 - 2014-04-02 15:31 - 00000000 ____D () C:\FRST
2014-04-02 15:29 - 2014-04-02 15:29 - 00112640 _____ (forum.viry.cz) C:\Users\Jana\Desktop\FRSTLauncher.exe
2014-04-02 15:29 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-04-02 15:28 - 2014-04-02 15:28 - 02157056 _____ (Farbar) C:\Users\Jana\Desktop\FRST64.exe
2014-04-02 15:27 - 2013-12-17 21:32 - 00003950 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{E3336DA5-286C-481F-A2A8-132490C63534}
2014-04-02 15:24 - 2014-04-02 15:24 - 00000000 ___SH () C:\DkHyperbootSync
2014-04-02 15:24 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-04-01 23:54 - 2013-10-11 13:18 - 00000914 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-04-01 23:15 - 2013-10-11 12:05 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-163857228-3445606662-3509154974-1001
2014-04-01 23:10 - 2014-02-28 23:39 - 00000000 ___RD () C:\Users\Jana\Disk Google
2014-04-01 23:09 - 2014-02-28 23:36 - 00000954 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-01 23:09 - 2013-12-17 13:13 - 00000000 __RDO () C:\Users\Jana\SkyDrive
2014-04-01 15:32 - 2014-01-05 17:48 - 01576394 _____ () C:\WINDOWS\WindowsUpdate.log
2014-04-01 15:06 - 2014-04-01 15:06 - 00000000 _____ () C:\autoexec.bat
2014-04-01 15:04 - 2014-04-01 15:04 - 00002268 _____ () C:\Users\Jana\Desktop\SpyHunter.lnk
2014-04-01 15:04 - 2014-04-01 15:04 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-04-01 15:04 - 2014-04-01 15:04 - 00000000 ____D () C:\sh4ldr
2014-04-01 15:04 - 2014-04-01 15:04 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-01 15:04 - 2014-04-01 15:03 - 00000000 ____D () C:\WINDOWS\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-04-01 15:01 - 2014-04-01 15:01 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Jana\Downloads\SpyHunter-Installer.exe
2014-04-01 14:56 - 2013-11-14 14:40 - 01745984 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-04-01 14:56 - 2013-11-14 14:24 - 00739924 _____ () C:\WINDOWS\system32\perfh005.dat
2014-04-01 14:56 - 2013-11-14 14:24 - 00151610 _____ () C:\WINDOWS\system32\perfc005.dat
2014-04-01 14:52 - 2014-04-01 14:28 - 00002203 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-01 14:49 - 2014-04-01 14:49 - 00000770 _____ () C:\WINDOWS\PFRO.log
2014-04-01 14:49 - 2013-10-11 13:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-01 14:49 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-04-01 14:29 - 2014-04-01 14:29 - 00001982 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-01 14:29 - 2014-04-01 14:29 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\AVAST Software
2014-04-01 14:29 - 2014-04-01 14:28 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2014-04-01 14:29 - 2013-12-30 00:11 - 00000000 ____D () C:\Users\Jana\AppData\Local\Google
2014-04-01 14:28 - 2013-12-30 00:11 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-01 14:27 - 2014-04-01 14:27 - 01039096 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00423240 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00334648 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2014-04-01 14:27 - 2014-04-01 14:27 - 00208928 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00084816 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00079184 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2014-04-01 14:27 - 2014-04-01 14:27 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-04-01 14:26 - 2014-04-01 14:26 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-01 14:25 - 2014-04-01 14:25 - 04732664 _____ (AVAST Software) C:\Users\Jana\Downloads\avast_free_antivirus_setup_online.exe
2014-04-01 14:25 - 2014-04-01 14:25 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-01 13:41 - 2013-11-23 21:51 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-03-31 23:42 - 2014-03-31 23:42 - 00450712 ____R () C:\WINDOWS\system32\Drivers\etc\hosts.20140331-234251.backup
2014-03-31 23:42 - 2014-03-31 23:42 - 00450712 ____R () C:\WINDOWS\system32\Drivers\etc\hosts.20140331-234244.backup
2014-03-31 01:50 - 2014-03-31 01:50 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\iolo
2014-03-31 01:50 - 2013-03-14 11:06 - 00000000 ____D () C:\ProgramData\iolo
2014-03-31 01:44 - 2013-11-07 18:47 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\BitTorrent
2014-03-31 01:43 - 2013-10-11 12:10 - 00000000 ____D () C:\Users\Jana\AppData\Local\CrashDumps
2014-03-31 01:19 - 2013-10-11 13:22 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Skype
2014-03-30 16:41 - 2014-03-30 16:41 - 00003942 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA1cf4c262dfb5266
2014-03-30 16:41 - 2014-03-30 16:41 - 00000970 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cf4c262dfb5266.job
2014-03-30 16:41 - 2014-02-28 23:36 - 00003694 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-29 11:30 - 2014-03-29 11:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-28 13:49 - 2014-03-28 00:16 - 00000000 ____D () C:\Users\Jana\Desktop\vlasy
2014-03-28 12:08 - 2014-03-28 12:08 - 58696816 _____ (ZONER software ) C:\Users\Jana\Downloads\zps16_cz.exe
2014-03-28 01:07 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-03-28 00:44 - 2014-03-13 21:53 - 00000000 ____D () C:\Users\Jana\Desktop\uprav
2014-03-28 00:18 - 2014-03-24 21:03 - 00000000 ____D () C:\Users\Jana\Desktop\luxverze
2014-03-26 22:17 - 2013-12-17 12:40 - 00000000 ____D () C:\Users\Jana
2014-03-25 01:29 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-03-24 21:05 - 2013-10-12 12:07 - 00006144 ____H () C:\Users\Jana\Desktop\photothumb.db
2014-03-24 18:47 - 2014-02-28 12:53 - 00000000 ___RD () C:\Users\Jana\Desktop\Firemky
2014-03-24 16:56 - 2014-03-04 19:49 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\FileZilla
2014-03-24 15:02 - 2013-10-12 11:57 - 00000000 ____D () C:\Users\Jana\AppData\Local\Microsoft Help
2014-03-24 01:50 - 2012-07-26 10:12 - 00000000 ____D () C:\WINDOWS\LiveKernelReports
2014-03-21 11:22 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-03-21 09:48 - 2013-10-11 13:22 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-20 13:58 - 2014-03-12 13:29 - 00000000 ____D () C:\Users\Jana\AppData\Local\gtk-2.0
2014-03-20 13:58 - 2014-03-12 13:26 - 00000000 ____D () C:\Users\Jana\.gimp-2.8
2014-03-20 12:15 - 2014-03-20 12:15 - 00011963 _____ () C:\Users\Jana\AppData\Local\recently-used.xbel
2014-03-20 10:45 - 2013-10-11 11:57 - 00000000 ___RD () C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-20 10:45 - 2013-10-11 11:57 - 00000000 ___RD () C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-03-20 03:03 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-03-20 03:01 - 2013-10-12 14:55 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-03-20 03:00 - 2013-10-12 14:55 - 90015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-03-20 03:00 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-03-18 00:28 - 2014-03-18 00:20 - 142179323 _____ () C:\Users\Jana\Desktop\RUKOPISY-Z-NAG-HAMADI-1.rar
2014-03-14 15:03 - 2014-01-05 16:27 - 00000000 ____D () C:\WINDOWS\Minidump
2014-03-14 13:35 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-03-14 13:35 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-03-14 13:35 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-03-14 13:35 - 2013-08-22 17:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-03-13 22:01 - 2013-10-12 12:48 - 00000000 ___RD () C:\Users\Jana\Desktop\Škola
2014-03-13 21:49 - 2013-08-22 16:44 - 00504056 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-03-12 13:29 - 2014-03-12 13:29 - 00000000 ____D () C:\Users\Jana\.thumbnails
2014-03-12 13:26 - 2014-03-12 13:26 - 00000000 ____D () C:\Users\Jana\AppData\Local\gegl-0.2
2014-03-12 13:25 - 2014-03-12 13:24 - 00000000 ____D () C:\Program Files\GIMP 2
2014-03-12 13:23 - 2014-03-12 13:22 - 90396104 _____ (The GIMP Team ) C:\Users\Jana\Downloads\gimp-2.8.10-setup.exe
2014-03-12 00:54 - 2013-10-11 13:18 - 00003802 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-03-05 19:21 - 2014-03-05 19:20 - 00000193 _____ () C:\Users\Jana\.htaccess
2014-03-05 19:17 - 2014-03-05 19:17 - 00000013 _____ () C:\Users\Jana\1.htaccess
2014-03-05 19:13 - 2014-03-05 19:13 - 00000030 _____ () C:\Users\Jana\Downloads\index.php
2014-03-05 18:03 - 2013-11-12 13:40 - 00000000 ___RD () C:\Users\Jana\Desktop\Filmy
2014-03-05 00:53 - 2013-08-22 17:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-03-05 00:53 - 2013-08-22 17:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-04 20:56 - 2014-03-04 20:56 - 00000053 _____ () C:\Users\Jana\Downloads\google13a81ee5b776511f.html
2014-03-04 19:49 - 2014-03-04 19:49 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\FoxTab
2014-03-04 19:49 - 2014-03-04 19:49 - 00000000 ____D () C:\Program Files (x86)\SimilarSites
2014-03-04 19:49 - 2014-03-04 19:49 - 00000000 ____D () C:\Program Files (x86)\FileZilla FTP Client
2014-03-04 19:48 - 2014-03-04 19:48 - 04822473 _____ (Tim Kosse) C:\Users\Jana\Downloads\FileZilla_3.7.4.1_win32-setup [1].exe
2014-03-04 19:48 - 2014-03-04 19:48 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\SimilarSites
2014-03-04 19:48 - 2014-03-04 19:48 - 00000000 ____D () C:\Program Files (x86)\Foxtab
2014-03-03 19:29 - 2014-02-28 16:11 - 00000000 ____D () C:\Users\Jana\Desktop\Na prodej
2014-03-03 18:19 - 2014-03-03 18:18 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\PSpad
2014-03-03 18:18 - 2014-03-03 18:18 - 00000000 ____D () C:\Program Files (x86)\PSPad editor
2014-03-03 18:18 - 2014-03-03 18:17 - 04014560 _____ (Jan Fiala ) C:\Users\Jana\Downloads\pspad457inst_cz.exe

Some content of TEMP:
====================
C:\Users\Jana\AppData\Local\Temp\SHSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2014-03-13 16:43] - [2014-01-31 18:15] - 0311640 ___AC (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02




===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cf4c262dfb5266.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: ESET Smart Security 7.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
AS: ESET Smart Security 7.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personální firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Jana\Desktop" je 28312 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================
Přílohy
Addition.rar
Zde ještě přikládám log adition.
(6.97 KiB) Staženo 44 x

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119536
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: JS/Kryptik.I - Trojský kůň

#4 Příspěvek od Rudy »

Otevřte poznámkový blok a zkopírujte do něj:
Start
URLSearchHook: HKLM-x32 - (No Name) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - No File
URLSearchHook: HKCU - (No Name) - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - No File
SearchScopes: HKLM-x32 - DefaultScope {39D8A984-8875-4FCD-969F-802FAFB2879E} URL =
SearchScopes: HKCU - DefaultScope {7BD7E5D1-0B99-45C9-B54C-671662C13D72} URL = http://www.bing.com/search?q={searchTer ... &pc=MASEJS
SearchScopes: HKCU - {39D8A984-8875-4FCD-969F-802FAFB2879E} URL = http://search.conduit.com/ResultsExt.as ... 23616&UM=1
SearchScopes: HKCU - {7BD7E5D1-0B99-45C9-B54C-671662C13D72} URL = http://www.bing.com/search?q={searchTer ... &pc=MASEJS
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
C:\Program Files (x86)\Skype\Toolbars
Toolbar: HKLM-x32 - No Name - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - No File
Toolbar: HKCU - No Name - {FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5} - No File
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1363584 2014-03-03] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1748608 2014-03-03] (Microsoft Corporation)
C:\WINDOWS\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA1cf4c262dfb5266
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cf4c262dfb5266.job
C:\Users\Jana\AppData\Local\Temp
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cf4c262dfb5266.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
End
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

LammiN
Návštěvník
Návštěvník
Příspěvky: 15
Registrován: 21 led 2013 19:53

Re: JS/Kryptik.I - Trojský kůň

#5 Příspěvek od LammiN »

Mohl byste mi více rozepsat postup, jsem laik, nevím jak jste myslel to kliknutí na >MoveIt!<. Vytvořil jsem nový poznámkový blok a zkopíroval do něj Vaši citaci, ale nevím co dál. Předem děkuji

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119536
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: JS/Kryptik.I - Trojský kůň

#6 Příspěvek od Rudy »

Pardon, já to spletl, dal jsem postup na jinou utilitu. Lidi mne tu zdržují přes ICQ. Správně je toto:

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Odpovědět