Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz
Pomůže mi někdo?
Moderátor: Moderátoři
Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.
!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Pomůže mi někdo?
Pc mi hlasí chybu nějakého ovladače a začaly se mi odesílat mi e-maily a chodit nedoručitelnost e-mailu.
-
Rudy
- Site Admin
- Příspěvky: 119536
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Pomůže mi někdo?
Zdravím!
Zkuste tento postup: http://forum.viry.cz/viewtopic.php?f=13&t=133100 .
Zkuste tento postup: http://forum.viry.cz/viewtopic.php?f=13&t=133100 .
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Pomůže mi někdo?
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 (ATTENTION: ====> FRST version is 27 days old and could be outdated)
Ran by Hondzik (administrator) on HONDZIK-PC on 09-04-2014 10:48:15
Running from C:\Users\Hondzik\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(VIA Technologies, Inc.) C:\Windows\system32\viakaraokesrv.exe
(Highresolution Enterprises) C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonSvc.exe
(Highresolution Enterprises) C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(ICQ, LLC.) C:\Program Files (x86)\ICQ7M\ICQ.exe
(forum.viry.cz) C:\Users\Hondzik\Desktop\FRSTLauncher.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-15] (Adobe Systems Incorporated)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5199984 2011-06-20] (VIA)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Privatefirewall] - C:\Program Files (x86)\Privacyware\Privatefirewall 7.0\PFGUI.exe [3048480 2013-12-17] (Privacyware/PWI, Inc.)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-10-04] (Microsoft Corporation)
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\Run: [AIMP3] - C:\Program Files (x86)\AIMP3\AIMP3.exe [1701832 2013-11-04] (AIMP DevTeam)
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\MountPoints2: {77bda6c4-73e1-11e3-b104-bc5ff4813621} - E:\Startme.exe
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\MountPoints2: {77bda6ec-73e1-11e3-b104-bc5ff4813621} - F:\AutoRun.exe
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\MountPoints2: {7a418874-504f-11e3-8a3d-bc5ff4813621} - E:\AutoRun.exe
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\MountPoints2: {8a74bc6e-699b-11e3-af05-bc5ff4813621} - F:\AutoRun.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ru.redirect.wrapper.services.alawar.ru/startpage.php?lang=cs&wspv=3.0&locale=cs&pid=10202
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {5347542D-5637-006A-76A7-7A786E7484D7} - No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 94.127.128.130 94.127.129.2
FireFox:
========
FF ProfilePath: C:\Users\Hondzik\AppData\Roaming\Mozilla\Firefox\Profiles\pqxrm19p.default-1390910878329
FF Homepage: hxxp://www.seznam.cz/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mapy-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: Seznam lištička - C:\Users\Hondzik\AppData\Roaming\Mozilla\Firefox\Profiles\pqxrm19p.default-1390910878329\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2014-01-29]
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (YoutubeAdblocker) - C:\Users\Hondzik\AppData\Local\Google\Chrome\User Data\Default\Extensions\anolnnnemcgijmcclcnonmkigafmnnhp [2014-01-11]
CHR Extension: (YTBBooKMark) - C:\Users\Hondzik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apnajgjdfdakaonckjlbnldpncchgnkh [2014-01-11]
CHR Extension: (greatsaveir) - C:\Users\Hondzik\AppData\Local\Google\Chrome\User Data\Default\Extensions\benldiilgebhehebekhdkdckmiecaahc [2014-01-11]
CHR Extension: (Save Me) - C:\Users\Hondzik\AppData\Local\Google\Chrome\User Data\Default\Extensions\boemmnepglcoinjcdlfcpcbmhiecichi [2014-01-11]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
S2 AxAutoMntSrv; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [266240 2007-01-15] (Nero AG)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PFNet; C:\Program Files (x86)\Privacyware\Privatefirewall 7.0\pfsvc.exe [374600 2013-12-17] (Privacyware/PWI, Inc.)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-06-14] (VIA Technologies, Inc.)
S2 Crypkey License; crypserv.exe [X]
==================== Drivers (Whitelisted) ====================
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2014-03-30] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2014-03-30] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S3 s1018bus; C:\Windows\System32\DRIVERS\s1018bus.sys [113704 2009-03-25] (MCCI Corporation)
S3 s1018mdfl; C:\Windows\System32\DRIVERS\s1018mdfl.sys [19496 2009-03-25] (MCCI Corporation)
S3 s1018mdm; C:\Windows\System32\DRIVERS\s1018mdm.sys [153128 2009-03-25] (MCCI Corporation)
S3 s1018mgmt; C:\Windows\System32\DRIVERS\s1018mgmt.sys [133160 2009-03-25] (MCCI Corporation)
S3 s1018nd5; C:\Windows\System32\DRIVERS\s1018nd5.sys [34856 2009-03-25] (MCCI Corporation)
S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [128552 2009-03-25] (MCCI Corporation)
S3 s1018unic; C:\Windows\System32\DRIVERS\s1018unic.sys [146472 2009-03-25] (MCCI Corporation)
S4 speedfan; C:\Windows\SysWow64\speedfan.sys [5120 2005-06-15] (Windows (R) Server 2003 DDK provider)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2013-10-01] (Duplex Secure Ltd.)
U3 ah6xhcmw; C:\Windows\System32\Drivers\ah6xhcmw.sys [0 ] (NVIDIA Corporation)
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [X]
S3 cpudrv64; \??\C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 EverestDriver; \??\C:\Program Files (x86)\Lavalys\EVEREST Ultimate Edition\kerneld.amd64 [X]
S1 NetworkX; \SystemRoot\system32\ckldrv.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-09 10:48 - 2014-04-09 10:48 - 00012520 _____ () C:\Users\Hondzik\Desktop\FRST.txt
2014-04-09 10:47 - 2014-04-09 10:48 - 00000000 ____D () C:\FRST
2014-04-09 10:46 - 2014-04-09 10:46 - 02157056 _____ (Farbar) C:\Users\Hondzik\Desktop\FRST64.exe
2014-04-09 10:46 - 2014-04-09 10:46 - 00112640 _____ (forum.viry.cz) C:\Users\Hondzik\Desktop\FRSTLauncher.exe
2014-04-07 21:00 - 2014-04-07 21:00 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Farm Mania 2
2014-04-07 20:58 - 2014-04-07 20:59 - 00000000 ____D () C:\ProgramData\Youdagames
2014-04-07 20:58 - 2014-04-07 20:58 - 00000000 ____D () C:\Program Files (x86)\Youdagames
2014-04-05 19:20 - 2014-04-05 19:20 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2014-04-05 18:02 - 2009-03-18 17:35 - 00033856 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2014-04-05 17:54 - 2014-04-05 17:54 - 00002196 _____ () C:\Users\Public\Desktop\EFLC.lnk
2014-04-05 12:57 - 2014-04-05 12:57 - 00000000 ____D () C:\Program Files (x86)\Black_Box
2014-04-05 12:56 - 2010-08-03 11:11 - 00819200 ___SH () C:\Windows\SysWOW64\xvidcore.dll
2014-04-05 12:56 - 2010-08-03 11:11 - 00180224 ___SH () C:\Windows\SysWOW64\xvidvfw.dll
2014-04-01 05:04 - 2014-04-01 05:04 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Malwarebytes
2014-04-01 05:04 - 2014-04-01 05:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-01 05:04 - 2010-04-29 12:19 - 00024664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-30 11:26 - 2014-03-30 11:29 - 00310984 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-03-30 11:26 - 2014-03-30 11:26 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-03-24 15:18 - 2014-03-24 15:33 - 00000000 ____D () C:\Users\Public\StarStableOnline
2014-03-21 23:47 - 2014-04-09 10:43 - 00000000 ____D () C:\Users\Hondzik\Desktop\mp3 auto + new hop
2014-03-14 12:25 - 2014-03-29 09:38 - 00000849 _____ () C:\Users\Hondzik\Desktop\Emergency 4.lnk
2014-03-14 12:19 - 2014-04-03 15:33 - 00000000 ____D () C:\Program Files\Emergency 4
2014-03-12 12:52 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-12 12:52 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-12 12:52 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-12 12:52 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-12 12:52 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-12 12:52 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-12 12:52 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-12 12:52 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-12 12:52 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-12 12:52 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-12 12:52 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-12 12:52 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-12 12:52 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-12 12:52 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-12 12:52 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-12 12:52 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-12 12:52 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-12 12:52 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-12 12:52 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-12 12:52 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-12 12:52 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-12 12:52 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-12 12:52 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-12 12:52 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-12 12:52 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-12 12:52 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-12 12:52 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-12 12:52 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-12 12:52 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-12 12:52 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-12 12:52 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-12 12:52 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-12 12:52 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-12 12:52 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-12 12:52 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-12 12:52 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-12 12:52 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-12 12:52 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-12 12:52 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-12 12:52 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-12 12:52 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-12 12:52 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-12 12:52 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-12 12:52 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-12 12:50 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-12 12:50 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-12 12:50 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-12 12:50 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
==================== One Month Modified Files and Folders =======
2014-04-09 10:48 - 2014-04-09 10:48 - 00012520 _____ () C:\Users\Hondzik\Desktop\FRST.txt
2014-04-09 10:48 - 2014-04-09 10:47 - 00000000 ____D () C:\FRST
2014-04-09 10:46 - 2014-04-09 10:46 - 02157056 _____ (Farbar) C:\Users\Hondzik\Desktop\FRST64.exe
2014-04-09 10:46 - 2014-04-09 10:46 - 00112640 _____ (forum.viry.cz) C:\Users\Hondzik\Desktop\FRSTLauncher.exe
2014-04-09 10:44 - 2013-10-01 13:44 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\AIMP3
2014-04-09 10:43 - 2014-03-21 23:47 - 00000000 ____D () C:\Users\Hondzik\Desktop\mp3 auto + new hop
2014-04-09 10:43 - 2013-10-26 16:01 - 00000000 ____D () C:\hry
2014-04-09 10:40 - 2013-10-01 13:47 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\ICQ
2014-04-09 10:10 - 2013-10-01 13:21 - 01621525 _____ () C:\Windows\WindowsUpdate.log
2014-04-09 10:09 - 2009-07-14 06:45 - 00014224 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-09 10:09 - 2009-07-14 06:45 - 00014224 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-09 10:06 - 2013-10-01 14:01 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-09 10:01 - 2013-10-06 12:41 - 00065284 _____ () C:\Windows\setupact.log
2014-04-09 10:01 - 2013-10-01 13:27 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-04-09 10:01 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-08 16:45 - 2013-03-13 20:25 - 00000000 ____D () C:\Users\Hondzik\Documents\Rockstar Games
2014-04-08 09:14 - 2013-10-01 15:51 - 00002893 _____ () C:\Users\Hondzik\Documents\ax_files.xml
2014-04-07 21:00 - 2014-04-07 21:00 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Farm Mania 2
2014-04-07 20:59 - 2014-04-07 20:58 - 00000000 ____D () C:\ProgramData\Youdagames
2014-04-07 20:58 - 2014-04-07 20:58 - 00000000 ____D () C:\Program Files (x86)\Youdagames
2014-04-06 15:16 - 2009-07-14 17:18 - 00672158 _____ () C:\Windows\system32\perfh005.dat
2014-04-06 15:16 - 2009-07-14 17:18 - 00142754 _____ () C:\Windows\system32\perfc005.dat
2014-04-06 15:16 - 2009-07-14 07:13 - 01593238 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-05 19:20 - 2014-04-05 19:20 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2014-04-05 17:54 - 2014-04-05 17:54 - 00002196 _____ () C:\Users\Public\Desktop\EFLC.lnk
2014-04-05 17:54 - 2013-10-01 17:28 - 00002306 _____ () C:\Users\Public\Desktop\Grand Theft Auto IV.lnk
2014-04-05 12:57 - 2014-04-05 12:57 - 00000000 ____D () C:\Program Files (x86)\Black_Box
2014-04-05 12:57 - 2014-03-04 00:12 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-04-05 12:57 - 2014-03-04 00:12 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-04-04 10:01 - 2013-12-07 16:50 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-04-03 15:33 - 2014-03-14 12:19 - 00000000 ____D () C:\Program Files\Emergency 4
2014-04-03 09:56 - 2013-11-04 10:25 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-04-03 09:55 - 2013-10-01 13:32 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-01 05:04 - 2014-04-01 05:04 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Malwarebytes
2014-04-01 05:04 - 2014-04-01 05:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-31 00:29 - 2013-10-13 10:31 - 00000000 ____D () C:\Users\Hondzik\AppData\Local\Deployment
2014-03-30 11:29 - 2014-03-30 11:26 - 00310984 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-03-30 11:29 - 2013-10-13 20:43 - 00193895 _____ () C:\Windows\DirectX.log
2014-03-30 11:26 - 2014-03-30 11:26 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-03-29 09:38 - 2014-03-14 12:25 - 00000849 _____ () C:\Users\Hondzik\Desktop\Emergency 4.lnk
2014-03-24 15:33 - 2014-03-24 15:18 - 00000000 ____D () C:\Users\Public\StarStableOnline
2014-03-22 02:31 - 2013-11-04 13:59 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-22 02:29 - 2013-11-04 13:59 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-20 16:09 - 2013-10-01 13:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-19 16:46 - 2014-02-14 23:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-13 10:43 - 2009-07-14 06:45 - 05241000 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-11 22:06 - 2013-10-01 14:01 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-11 22:06 - 2013-10-01 14:01 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-11 22:06 - 2013-10-01 14:01 - 00003852 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
Some content of TEMP:
====================
C:\Users\Hondzik\AppData\Local\Temp\1_Offer_2.exe
C:\Users\Hondzik\AppData\Local\Temp\1_Offer_3.exe
C:\Users\Hondzik\AppData\Local\Temp\1_Offer_4.exe
C:\Users\Hondzik\AppData\Local\Temp\AskPIP_FF_.exe
C:\Users\Hondzik\AppData\Local\Temp\AskSLib.dll
C:\Users\Hondzik\AppData\Local\Temp\avgnt.exe
C:\Users\Hondzik\AppData\Local\Temp\bitool.dll
C:\Users\Hondzik\AppData\Local\Temp\BrowserInfo.exe
C:\Users\Hondzik\AppData\Local\Temp\CH.dll
C:\Users\Hondzik\AppData\Local\Temp\Copy.dll
C:\Users\Hondzik\AppData\Local\Temp\DownloadManager.exe
C:\Users\Hondzik\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Hondzik\AppData\Local\Temp\drm_dyndata_7370007.dll
C:\Users\Hondzik\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Hondzik\AppData\Local\Temp\i4jdel0.exe
C:\Users\Hondzik\AppData\Local\Temp\install_flashplayer11x32_mssd_aaa_aih.exe
C:\Users\Hondzik\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Hondzik\AppData\Local\Temp\listicka-partner-13415-1.1.2-offline.exe
C:\Users\Hondzik\AppData\Local\Temp\Mobogenie_Setup_2-1-35_517.exe
C:\Users\Hondzik\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Hondzik\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Hondzik\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Hondzik\AppData\Local\Temp\nvSCPAPISvr.exe
C:\Users\Hondzik\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Hondzik\AppData\Local\Temp\nvStInst.exe
C:\Users\Hondzik\AppData\Local\Temp\ose00000.exe
C:\Users\Hondzik\AppData\Local\Temp\sfextra.dll
C:\Users\Hondzik\AppData\Local\Temp\Tsu85C82D8B.dll
C:\Users\Hondzik\AppData\Local\Temp\ubi7A60.tmp.exe
C:\Users\Hondzik\AppData\Local\Temp\ubi95C6.tmp.exe
C:\Users\Hondzik\AppData\Local\Temp\YTDSETUP.EXE
C:\Users\Hondzik\AppData\Local\Temp\_isC9C4.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-30 03:53
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
Drive c: (NOD) (Fixed) (Total:270.35 GB) (Free:48.68 GB) NTFS
Drive d: (WORK) (Fixed) (Total:195.31 GB) (Free:30.16 GB) NTFS
Drive e: (PROG) (Removable) (Total:7.45 GB) (Free:2.55 GB) FAT32
Available physical RAM: 5866.87 MB
Total physical RAM: 8175.24 MB
Percentage of memory in use: 28%
==================== MBR and Partition Table ==================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 550D5820)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=270 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=195 GB) - (Type=07 NTFS)
Disk: 5 (Size: 7 GB) (Disk ID: 005C9F8A)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)
==================== Scheduled Tasks (whitelisted) ==================
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Alternate Data Streams (whitelisted) ==================
AlternateDataStreams: C:\ProgramData\TEMP:B3D74A13
==================== Security Center ==================
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Privatefirewall (Enabled) {16337F50-A853-219F-6DEC-E7BDA0A7E8E7}
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\Hondzik\Desktop" je 449 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000
==================== End Of Log ==============================
Ran by Hondzik (administrator) on HONDZIK-PC on 09-04-2014 10:48:15
Running from C:\Users\Hondzik\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(VIA Technologies, Inc.) C:\Windows\system32\viakaraokesrv.exe
(Highresolution Enterprises) C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonSvc.exe
(Highresolution Enterprises) C:\Program Files\Highresolution Enterprises\X-Mouse Button Control\XMouseButtonControl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(ICQ, LLC.) C:\Program Files (x86)\ICQ7M\ICQ.exe
(forum.viry.cz) C:\Users\Hondzik\Desktop\FRSTLauncher.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-15] (Adobe Systems Incorporated)
HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5199984 2011-06-20] (VIA)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Privatefirewall] - C:\Program Files (x86)\Privacyware\Privatefirewall 7.0\PFGUI.exe [3048480 2013-12-17] (Privacyware/PWI, Inc.)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-10-04] (Microsoft Corporation)
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\Run: [AIMP3] - C:\Program Files (x86)\AIMP3\AIMP3.exe [1701832 2013-11-04] (AIMP DevTeam)
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\MountPoints2: {77bda6c4-73e1-11e3-b104-bc5ff4813621} - E:\Startme.exe
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\MountPoints2: {77bda6ec-73e1-11e3-b104-bc5ff4813621} - F:\AutoRun.exe
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\MountPoints2: {7a418874-504f-11e3-8a3d-bc5ff4813621} - E:\AutoRun.exe
HKU\S-1-5-21-3085194815-1020300490-4046752758-1000\...\MountPoints2: {8a74bc6e-699b-11e3-af05-bc5ff4813621} - F:\AutoRun.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ru.redirect.wrapper.services.alawar.ru/startpage.php?lang=cs&wspv=3.0&locale=cs&pid=10202
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Podpora odkazu pro Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {5347542D-5637-006A-76A7-7A786E7484D7} - No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 94.127.128.130 94.127.129.2
FireFox:
========
FF ProfilePath: C:\Users\Hondzik\AppData\Roaming\Mozilla\Firefox\Profiles\pqxrm19p.default-1390910878329
FF Homepage: hxxp://www.seznam.cz/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\heureka-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mapy-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\seznam-cz.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\slunecnice-cz.xml
FF Extension: Seznam lištička - C:\Users\Hondzik\AppData\Roaming\Mozilla\Firefox\Profiles\pqxrm19p.default-1390910878329\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2014-01-29]
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (YoutubeAdblocker) - C:\Users\Hondzik\AppData\Local\Google\Chrome\User Data\Default\Extensions\anolnnnemcgijmcclcnonmkigafmnnhp [2014-01-11]
CHR Extension: (YTBBooKMark) - C:\Users\Hondzik\AppData\Local\Google\Chrome\User Data\Default\Extensions\apnajgjdfdakaonckjlbnldpncchgnkh [2014-01-11]
CHR Extension: (greatsaveir) - C:\Users\Hondzik\AppData\Local\Google\Chrome\User Data\Default\Extensions\benldiilgebhehebekhdkdckmiecaahc [2014-01-11]
CHR Extension: (Save Me) - C:\Users\Hondzik\AppData\Local\Google\Chrome\User Data\Default\Extensions\boemmnepglcoinjcdlfcpcbmhiecichi [2014-01-11]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
S2 AxAutoMntSrv; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [266240 2007-01-15] (Nero AG)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 PFNet; C:\Program Files (x86)\Privacyware\Privatefirewall 7.0\pfsvc.exe [374600 2013-12-17] (Privacyware/PWI, Inc.)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-06-14] (VIA Technologies, Inc.)
S2 Crypkey License; crypserv.exe [X]
==================== Drivers (Whitelisted) ====================
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2014-03-30] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2014-03-30] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S3 s1018bus; C:\Windows\System32\DRIVERS\s1018bus.sys [113704 2009-03-25] (MCCI Corporation)
S3 s1018mdfl; C:\Windows\System32\DRIVERS\s1018mdfl.sys [19496 2009-03-25] (MCCI Corporation)
S3 s1018mdm; C:\Windows\System32\DRIVERS\s1018mdm.sys [153128 2009-03-25] (MCCI Corporation)
S3 s1018mgmt; C:\Windows\System32\DRIVERS\s1018mgmt.sys [133160 2009-03-25] (MCCI Corporation)
S3 s1018nd5; C:\Windows\System32\DRIVERS\s1018nd5.sys [34856 2009-03-25] (MCCI Corporation)
S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [128552 2009-03-25] (MCCI Corporation)
S3 s1018unic; C:\Windows\System32\DRIVERS\s1018unic.sys [146472 2009-03-25] (MCCI Corporation)
S4 speedfan; C:\Windows\SysWow64\speedfan.sys [5120 2005-06-15] (Windows (R) Server 2003 DDK provider)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2013-10-01] (Duplex Secure Ltd.)
U3 ah6xhcmw; C:\Windows\System32\Drivers\ah6xhcmw.sys [0 ] (NVIDIA Corporation)
S3 AsrCDDrv; \??\C:\Windows\SysWOW64\Drivers\AsrCDDrv.sys [X]
S3 cpudrv64; \??\C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 EverestDriver; \??\C:\Program Files (x86)\Lavalys\EVEREST Ultimate Edition\kerneld.amd64 [X]
S1 NetworkX; \SystemRoot\system32\ckldrv.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-09 10:48 - 2014-04-09 10:48 - 00012520 _____ () C:\Users\Hondzik\Desktop\FRST.txt
2014-04-09 10:47 - 2014-04-09 10:48 - 00000000 ____D () C:\FRST
2014-04-09 10:46 - 2014-04-09 10:46 - 02157056 _____ (Farbar) C:\Users\Hondzik\Desktop\FRST64.exe
2014-04-09 10:46 - 2014-04-09 10:46 - 00112640 _____ (forum.viry.cz) C:\Users\Hondzik\Desktop\FRSTLauncher.exe
2014-04-07 21:00 - 2014-04-07 21:00 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Farm Mania 2
2014-04-07 20:58 - 2014-04-07 20:59 - 00000000 ____D () C:\ProgramData\Youdagames
2014-04-07 20:58 - 2014-04-07 20:58 - 00000000 ____D () C:\Program Files (x86)\Youdagames
2014-04-05 19:20 - 2014-04-05 19:20 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2014-04-05 18:02 - 2009-03-18 17:35 - 00033856 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2014-04-05 17:54 - 2014-04-05 17:54 - 00002196 _____ () C:\Users\Public\Desktop\EFLC.lnk
2014-04-05 12:57 - 2014-04-05 12:57 - 00000000 ____D () C:\Program Files (x86)\Black_Box
2014-04-05 12:56 - 2010-08-03 11:11 - 00819200 ___SH () C:\Windows\SysWOW64\xvidcore.dll
2014-04-05 12:56 - 2010-08-03 11:11 - 00180224 ___SH () C:\Windows\SysWOW64\xvidvfw.dll
2014-04-01 05:04 - 2014-04-01 05:04 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Malwarebytes
2014-04-01 05:04 - 2014-04-01 05:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-01 05:04 - 2010-04-29 12:19 - 00024664 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-30 11:26 - 2014-03-30 11:29 - 00310984 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-03-30 11:26 - 2014-03-30 11:26 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-03-24 15:18 - 2014-03-24 15:33 - 00000000 ____D () C:\Users\Public\StarStableOnline
2014-03-21 23:47 - 2014-04-09 10:43 - 00000000 ____D () C:\Users\Hondzik\Desktop\mp3 auto + new hop
2014-03-14 12:25 - 2014-03-29 09:38 - 00000849 _____ () C:\Users\Hondzik\Desktop\Emergency 4.lnk
2014-03-14 12:19 - 2014-04-03 15:33 - 00000000 ____D () C:\Program Files\Emergency 4
2014-03-12 12:52 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-12 12:52 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-12 12:52 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-12 12:52 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-12 12:52 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-12 12:52 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-12 12:52 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-12 12:52 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-12 12:52 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-12 12:52 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-12 12:52 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-12 12:52 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-12 12:52 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-12 12:52 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-12 12:52 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-12 12:52 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-12 12:52 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-12 12:52 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-12 12:52 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-12 12:52 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-12 12:52 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-12 12:52 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-12 12:52 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-12 12:52 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-12 12:52 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-12 12:52 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-12 12:52 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-12 12:52 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-12 12:52 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-12 12:52 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-12 12:52 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-12 12:52 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-12 12:52 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-12 12:52 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-12 12:52 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-12 12:52 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-12 12:52 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-12 12:52 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-12 12:52 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-12 12:52 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-12 12:52 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-12 12:52 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-12 12:52 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-12 12:52 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-12 12:50 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-12 12:50 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-12 12:50 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-12 12:50 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
==================== One Month Modified Files and Folders =======
2014-04-09 10:48 - 2014-04-09 10:48 - 00012520 _____ () C:\Users\Hondzik\Desktop\FRST.txt
2014-04-09 10:48 - 2014-04-09 10:47 - 00000000 ____D () C:\FRST
2014-04-09 10:46 - 2014-04-09 10:46 - 02157056 _____ (Farbar) C:\Users\Hondzik\Desktop\FRST64.exe
2014-04-09 10:46 - 2014-04-09 10:46 - 00112640 _____ (forum.viry.cz) C:\Users\Hondzik\Desktop\FRSTLauncher.exe
2014-04-09 10:44 - 2013-10-01 13:44 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\AIMP3
2014-04-09 10:43 - 2014-03-21 23:47 - 00000000 ____D () C:\Users\Hondzik\Desktop\mp3 auto + new hop
2014-04-09 10:43 - 2013-10-26 16:01 - 00000000 ____D () C:\hry
2014-04-09 10:40 - 2013-10-01 13:47 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\ICQ
2014-04-09 10:10 - 2013-10-01 13:21 - 01621525 _____ () C:\Windows\WindowsUpdate.log
2014-04-09 10:09 - 2009-07-14 06:45 - 00014224 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-09 10:09 - 2009-07-14 06:45 - 00014224 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-09 10:06 - 2013-10-01 14:01 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-09 10:01 - 2013-10-06 12:41 - 00065284 _____ () C:\Windows\setupact.log
2014-04-09 10:01 - 2013-10-01 13:27 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-04-09 10:01 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-08 16:45 - 2013-03-13 20:25 - 00000000 ____D () C:\Users\Hondzik\Documents\Rockstar Games
2014-04-08 09:14 - 2013-10-01 15:51 - 00002893 _____ () C:\Users\Hondzik\Documents\ax_files.xml
2014-04-07 21:00 - 2014-04-07 21:00 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Farm Mania 2
2014-04-07 20:59 - 2014-04-07 20:58 - 00000000 ____D () C:\ProgramData\Youdagames
2014-04-07 20:58 - 2014-04-07 20:58 - 00000000 ____D () C:\Program Files (x86)\Youdagames
2014-04-06 15:16 - 2009-07-14 17:18 - 00672158 _____ () C:\Windows\system32\perfh005.dat
2014-04-06 15:16 - 2009-07-14 17:18 - 00142754 _____ () C:\Windows\system32\perfc005.dat
2014-04-06 15:16 - 2009-07-14 07:13 - 01593238 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-05 19:20 - 2014-04-05 19:20 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2014-04-05 17:54 - 2014-04-05 17:54 - 00002196 _____ () C:\Users\Public\Desktop\EFLC.lnk
2014-04-05 17:54 - 2013-10-01 17:28 - 00002306 _____ () C:\Users\Public\Desktop\Grand Theft Auto IV.lnk
2014-04-05 12:57 - 2014-04-05 12:57 - 00000000 ____D () C:\Program Files (x86)\Black_Box
2014-04-05 12:57 - 2014-03-04 00:12 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-04-05 12:57 - 2014-03-04 00:12 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-04-04 10:01 - 2013-12-07 16:50 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-04-03 15:33 - 2014-03-14 12:19 - 00000000 ____D () C:\Program Files\Emergency 4
2014-04-03 09:56 - 2013-11-04 10:25 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-04-03 09:55 - 2013-10-01 13:32 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-01 05:04 - 2014-04-01 05:04 - 00000000 ____D () C:\Users\Hondzik\AppData\Roaming\Malwarebytes
2014-04-01 05:04 - 2014-04-01 05:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-31 00:29 - 2013-10-13 10:31 - 00000000 ____D () C:\Users\Hondzik\AppData\Local\Deployment
2014-03-30 11:29 - 2014-03-30 11:26 - 00310984 _____ () C:\Windows\system32\Drivers\atksgt.sys
2014-03-30 11:29 - 2013-10-13 20:43 - 00193895 _____ () C:\Windows\DirectX.log
2014-03-30 11:26 - 2014-03-30 11:26 - 00042696 _____ () C:\Windows\system32\Drivers\lirsgt.sys
2014-03-29 09:38 - 2014-03-14 12:25 - 00000849 _____ () C:\Users\Hondzik\Desktop\Emergency 4.lnk
2014-03-24 15:33 - 2014-03-24 15:18 - 00000000 ____D () C:\Users\Public\StarStableOnline
2014-03-22 02:31 - 2013-11-04 13:59 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-22 02:29 - 2013-11-04 13:59 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-20 16:09 - 2013-10-01 13:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-19 16:46 - 2014-02-14 23:34 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-13 10:43 - 2009-07-14 06:45 - 05241000 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-11 22:06 - 2013-10-01 14:01 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-11 22:06 - 2013-10-01 14:01 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-11 22:06 - 2013-10-01 14:01 - 00003852 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
Some content of TEMP:
====================
C:\Users\Hondzik\AppData\Local\Temp\1_Offer_2.exe
C:\Users\Hondzik\AppData\Local\Temp\1_Offer_3.exe
C:\Users\Hondzik\AppData\Local\Temp\1_Offer_4.exe
C:\Users\Hondzik\AppData\Local\Temp\AskPIP_FF_.exe
C:\Users\Hondzik\AppData\Local\Temp\AskSLib.dll
C:\Users\Hondzik\AppData\Local\Temp\avgnt.exe
C:\Users\Hondzik\AppData\Local\Temp\bitool.dll
C:\Users\Hondzik\AppData\Local\Temp\BrowserInfo.exe
C:\Users\Hondzik\AppData\Local\Temp\CH.dll
C:\Users\Hondzik\AppData\Local\Temp\Copy.dll
C:\Users\Hondzik\AppData\Local\Temp\DownloadManager.exe
C:\Users\Hondzik\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Hondzik\AppData\Local\Temp\drm_dyndata_7370007.dll
C:\Users\Hondzik\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Hondzik\AppData\Local\Temp\i4jdel0.exe
C:\Users\Hondzik\AppData\Local\Temp\install_flashplayer11x32_mssd_aaa_aih.exe
C:\Users\Hondzik\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Hondzik\AppData\Local\Temp\listicka-partner-13415-1.1.2-offline.exe
C:\Users\Hondzik\AppData\Local\Temp\Mobogenie_Setup_2-1-35_517.exe
C:\Users\Hondzik\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Hondzik\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Hondzik\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Hondzik\AppData\Local\Temp\nvSCPAPISvr.exe
C:\Users\Hondzik\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Hondzik\AppData\Local\Temp\nvStInst.exe
C:\Users\Hondzik\AppData\Local\Temp\ose00000.exe
C:\Users\Hondzik\AppData\Local\Temp\sfextra.dll
C:\Users\Hondzik\AppData\Local\Temp\Tsu85C82D8B.dll
C:\Users\Hondzik\AppData\Local\Temp\ubi7A60.tmp.exe
C:\Users\Hondzik\AppData\Local\Temp\ubi95C6.tmp.exe
C:\Users\Hondzik\AppData\Local\Temp\YTDSETUP.EXE
C:\Users\Hondzik\AppData\Local\Temp\_isC9C4.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-30 03:53
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
Drive c: (NOD) (Fixed) (Total:270.35 GB) (Free:48.68 GB) NTFS
Drive d: (WORK) (Fixed) (Total:195.31 GB) (Free:30.16 GB) NTFS
Drive e: (PROG) (Removable) (Total:7.45 GB) (Free:2.55 GB) FAT32
Available physical RAM: 5866.87 MB
Total physical RAM: 8175.24 MB
Percentage of memory in use: 28%
==================== MBR and Partition Table ==================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 550D5820)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=270 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=195 GB) - (Type=07 NTFS)
Disk: 5 (Size: 7 GB) (Disk ID: 005C9F8A)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)
==================== Scheduled Tasks (whitelisted) ==================
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Alternate Data Streams (whitelisted) ==================
AlternateDataStreams: C:\ProgramData\TEMP:B3D74A13
==================== Security Center ==================
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Privatefirewall (Enabled) {16337F50-A853-219F-6DEC-E7BDA0A7E8E7}
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\Hondzik\Desktop" je 449 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000
==================== End Of Log ==============================
-
Rudy
- Site Admin
- Příspěvky: 119536
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Pomůže mi někdo?
Jak to vypadá s legalitou vašeho oper. systému?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Pomůže mi někdo?
no mám je od známého a nic to po mě nikdy nechtělo..tak nevím
-
Rudy
- Site Admin
- Příspěvky: 119536
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Pomůže mi někdo?
Pokud ho máte od známého zkopírovaný, není legální. Legalita s osvědčuje štítkem COA, nalepeným na skříni PC.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Re: Pomůže mi někdo?
to nemám. to znamená že mi nepomůžete?
-
Rudy
- Site Admin
- Příspěvky: 119536
- Registrován: 30 říj 2003 13:42
- Bydliště: Plzeň
- Kontaktovat uživatele:
Re: Pomůže mi někdo?
Přesně tak. Viz pravidla: http://forum.viry.cz/viewtopic.php?f=12&t=115512 .Hondzzikk píše:to nemám. to znamená že mi nepomůžete?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.
Navštivte:
e-mail: rudy(zavináč)forum.viry.cz
Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!
Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Přispějete na provoz fóra?