VIRY.CZ

Zdravím. Pomalu se mi přihlašuje do uživatelského účtu - zabere to okolo čtvrt až půl hodiny, než se to ustálí a než se mi začnou plynule pouštět a fungovat aplikace. Chtěl bych se zeptat, jestli se s tím dá něco dělat, nebo jestli by bylo lepší ho rovnou smazat a založit nový účet. Taky jsem nedávno odstraňoval nějaký malware, který na mém PC těžil bitcoiny, tak snad tam nezůstaly zbytky...

Logfile of random's system information tool 1.10 (written by random/random)
Run by Florian at 2014-05-28 16:10:19
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 237 GB (12%) free of 1907 GB
Total RAM: 8175 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:10:47, on 28.5.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17041)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Evaer\videochannel.exe
C:\Users\Florian\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files (x86)\Pamela\Pamela.exe
C:\Users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\Trillian\trillian.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Line6\POD Farm 2\POD Farm 2.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Florian.exe
C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nmd.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Launcher6015N] "C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\Launcher\xrlaunch.exe" /S Xerox WorkCentre 6015N
O4 - HKLM\..\Run: [6015N RUN] "C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmRun.exe"
O4 - HKLM\..\Run: [StatusAutoRun6015N] "C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmpl.exe" Xerox WorkCentre 6015N,hide,\S
O4 - HKLM\..\Run: [cgBXoIziJrRPgl] C:\Users\Florian\AppData\Local\dREbbSq.exe
O4 - HKLM\..\Run: [MSStp] C:\Windows\system32\msstp.vbe
O4 - HKLM\..\Run: [mncdwffymSrv] C:\Windows\inf\mncdwffym.vbe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [avichannel] "C:\Program Files (x86)\Evaer\videochannel.exe"
O4 - HKCU\..\Run: [EADM] "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
O4 - HKCU\..\Run: [SystemProc] C:\Users\Public\Other\run_shc.lnk
O4 - HKCU\..\Run: [uTorrent] "C:\Users\Florian\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [pamela.exe] "C:\Program Files (x86)\Pamela\Pamela.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-27908995-1430856944-1559214145-1010\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'postgres')
O4 - HKUS\S-1-5-21-27908995-1430856944-1559214145-1010\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'postgres')
O4 - Startup: Dropbox.lnk = Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: Rebeat UploadProcess.lnk = C:\Program Files (x86)\Rebeat Digital GmbH Austria\Rebeat\RebeatV1.UploadProcess.exe
O4 - Startup: Trillian.lnk = C:\Program Files (x86)\Trillian\trillian.exe
O8 - Extra context menu item: Add to &Teleport - C:\Program Files (x86)\Teleport Pro\teleport.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Přidat na blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Přidat na blog Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: *.line6.net
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Bing Bar Update Service (BBSvc) - Unknown owner - C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (file missing)
O23 - Service: BBUpdate - Unknown owner - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: PACE License Services (PaceLicenseDServices) - PACE Anti-Piracy, Inc. - C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: postgresql-x64-9.0 - PostgreSQL Server 9.0 (postgresql-x64-9.0) - PostgreSQL Global Development Group - C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: XRcnStatutsDatabase (XRNADB) - Unknown owner - C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmdb.exe

--
End of file - 14537 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe" /service
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
"C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe" runservice -N "postgresql-x64-9.0" -D "C:/Program Files/PostgreSQL/9.0/data" -w
"c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe"
"C:/Program Files/PostgreSQL/9.0/bin/postgres.exe" -D "C:/Program Files/PostgreSQL/9.0/data"
\??\C:\Windows\system32\conhost.exe "-1623751643-5886313719147788771254701600168605687743522967637020320260889510
"C:/Program Files/PostgreSQL/9.0/bin/postgres.exe" "--forklog" "628" "624"
"C:/Program Files/PostgreSQL/9.0/bin/postgres.exe" "--forkboot" "828" "-x3"
"C:/Program Files/PostgreSQL/9.0/bin/postgres.exe" "--forkboot" "832" "-x4"
"C:/Program Files/PostgreSQL/9.0/bin/postgres.exe" "--forkavlauncher" "828"
"C:/Program Files/PostgreSQL/9.0/bin/postgres.exe" "--forkcol" "832"
"C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmdb.exe"
"C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe"
"taskhost.exe"
"C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-ca3e55a1-dd45-4db9-8a4b-fe118cf9e635 -SystemEventPortName:HostProcess-d5d062fc-fa7b-4142-8c8a-59c3698aa1e3 -IoCancelEventPortName:HostProcess-b68ecc6a-c2c5-41a4-aff9-dff501347eac -NonStateChangingEventPortName:HostProcess-6a24530b-8791-47a6-81d8-b845037d43e0 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:b6dee28b-9dba-4ae0-b279-c98272560d47 -DeviceGroupId:WpdFsGroup
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\Steam\Steam.exe" -silent
"C:\Program Files (x86)\Evaer\videochannel.exe"
"C:\Users\Florian\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
C:\Windows\system32\SearchIndexer.exe /Embedding
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
"C:\Program Files (x86)\Pamela\Pamela.exe"
"C:\Users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe" /systemstartup
"C:\Program Files (x86)\Winamp\winampa.exe"
"C:\Program Files (x86)\Trillian\trillian.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Line6\POD Farm 2\POD Farm 2.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmW.exe"
\??\C:\Windows\system32\conhost.exe "90661509719413149071710138295400254707-1507883753-192912619-2060675672-1981508279
"C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmwj.exe"
\??\C:\Windows\system32\conhost.exe "5731699603711342032110034711-143212953687917509-1947727647-1371288680-326237242
"C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmpl.exe" Xerox WorkCentre 6015N,hide,\S
C:\Windows\system32\sppsvc.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\wsqmcons.exe
"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto -scheduled -critical
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe"
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="1100.0.1238712706\533820412" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,15,39 --gpu-vendor-id=0x10de --gpu-device-id=0x1200 --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.1106 --ignored=" --type=renderer " /prefetch:822062411
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserBlacklist/Enabled/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group5 pct:10e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Bootstrap/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/OmniboxStopTimer/Standard/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/SettingsEnforcement/no_enforcement/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-1-Percent/group_17/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --enable-software-compositing --channel="1100.3.1549603730\1341852581" /prefetch:673131151
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserBlacklist/Enabled/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group5 pct:10e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Bootstrap/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/OmniboxStopTimer/Standard/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/SettingsEnforcement/no_enforcement/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-1-Percent/group_17/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --enable-software-compositing --channel="1100.5.233078714\192632685" /prefetch:673131151
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserBlacklist/Enabled/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group5 pct:10e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Bootstrap/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/OmniboxStopTimer/Standard/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/SettingsEnforcement/no_enforcement/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-1-Percent/group_17/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --enable-software-compositing --channel="1100.6.261187141\543196538" /prefetch:673131151
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserBlacklist/Enabled/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group5 pct:10e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Bootstrap/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/OmniboxStopTimer/Standard/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/SettingsEnforcement/no_enforcement/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-1-Percent/group_17/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --enable-software-compositing --channel="1100.9.1351669470\894674270" /prefetch:673131151
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserBlacklist/Enabled/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group5 pct:10e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Bootstrap/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/OmniboxStopTimer/Standard/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/SettingsEnforcement/no_enforcement/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-1-Percent/group_17/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --extension-process --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --enable-software-compositing --channel="1100.20.1968192867\1032377687" /prefetch:673131151
taskeng.exe {6C1302BA-9C1C-448B-B276-F3893031605D}
taskeng.exe {936E0B67-15AD-4C10-AB26-BE5069F5B9CC}
"C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe"
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserBlacklist/Enabled/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group5 pct:10e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Bootstrap/FlashHardwareVideoDecode/Disabled/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/OmniboxStopTimer/Standard/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/SettingsEnforcement/no_enforcement/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-1-Percent/group_17/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --enable-software-compositing --channel="1100.29.89051882\216930068" /prefetch:673131151
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserBlacklist/Enabled/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group5 pct:10e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Bootstrap/FlashHardwareVideoDecode/Disabled/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/OmniboxStopTimer/Standard/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/SettingsEnforcement/no_enforcement/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-1-Percent/group_17/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --enable-software-compositing --channel="1100.30.602914609\1218099082" /prefetch:673131151
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserBlacklist/Enabled/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group5 pct:10e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Bootstrap/FlashHardwareVideoDecode/Disabled/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/OmniboxStopTimer/Standard/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/SettingsEnforcement/no_enforcement/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-1-Percent/group_17/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --enable-software-compositing --channel="1100.31.1548720685\482632227" /prefetch:673131151
"C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserBlacklist/Enabled/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group5 pct:10e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Bootstrap/FlashHardwareVideoDecode/Disabled/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/OmniboxStopTimer/Standard/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/SettingsEnforcement/no_enforcement/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_08/UMA-Uniformity-Trial-1-Percent/group_17/UMA-Uniformity-Trial-10-Percent/group_05/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --renderer-print-preview --enable-threaded-compositing --enable-delegated-renderer --enable-software-compositing --channel="1100.32.457294168\382909150" /prefetch:673131151
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\Florian\Downloads\RSITx64.exe"
"C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe" -background

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002Core.job - C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002UA.job - C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
Windows Live Family Safety Browser Helper Class - C:\Program Files\Windows Live\Family Safety\fssbho.dll [2009-08-05 132448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll [2012-04-04 545152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype add-on for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-03-21 6270336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll [2012-04-04 193416]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-03-10 461216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocník pro přihlášení ke službě Windows Live - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Browser Helper - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-03-21 4502400]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-03-10 170912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2010-10-06 166936]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2010-10-06 391704]
"Persistence"=C:\Windows\system32\igfxpers.exe [2010-10-06 416792]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2014-03-11 1271072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-12 116648]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2012-04-11 3672384]
"AdobeBridge"= []
"Steam"=C:\Program Files (x86)\Steam\Steam.exe [2014-05-28 1775808]
"avichannel"=C:\Program Files (x86)\Evaer\videochannel.exe [2013-03-22 1696816]
"EADM"=C:\Program Files (x86)\Origin\Origin.exe [2014-04-27 3588952]
"SystemProc"=C:\Users\Public\Other\run_shc.lnk []
"uTorrent"=C:\Users\Florian\AppData\Roaming\uTorrent\uTorrent.exe [2014-04-29 1270352]
"pamela.exe"=C:\Program Files (x86)\Pamela\Pamela.exe [2014-03-04 4244952]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-02-10 20922016]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"=C:\Program Files (x86)\Winamp\winampa.exe [2011-12-09 74752]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]
"APSDaemon"=C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [2012-02-20 59240]
"QuickTime Task"=C:\Program Files (x86)\QuickTime\QTTask.exe [2012-04-18 421888]
"AdobeCS5.5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [2011-01-12 1523360]
"AdobeCS6ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03 252848]
"Wondershare Helper Compact.exe"=C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe []
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04 958576]
"Launcher6015N"=C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\Launcher\xrlaunch.exe [2011-05-19 2571264]
"6015N RUN"=C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmRun.exe [2012-07-16 355840]
"StatusAutoRun6015N"=C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmpl.exe [2012-07-16 3984896]
"cgBXoIziJrRPgl"=C:\Users\Florian\AppData\Local\dREbbSq.exe []
"MSStp"=C:\Windows\system32\msstp.vbe []
"mncdwffymSrv"=C:\Windows\inf\mncdwffym.vbe [2014-01-19 1342]
"NeroFilterCheck"=C:\Windows\system32\NeroCheck.exe []

C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe
Rebeat UploadProcess.lnk - C:\Program Files (x86)\Rebeat Digital GmbH Austria\Rebeat\RebeatV1.UploadProcess.exe
Trillian.lnk - C:\Program Files (x86)\Trillian\trillian.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\system32\igfxdev.dll [2010-10-01 380416]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe"="C:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux1"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"aux2"=wdmaud.drv
"vidc.tscc"=C:\Windows\SysWOW64\tsccvid64.dll
"vidc.tsc2"=C:\Windows\SysWOW64\tsc2_codec64.dll
"VIDC.FPS1"=frapsv64.dll
"MSVideo8"=VfWWDM32.dll
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"aux3"=wdmaud.drv
"wave8"=wdmaud.drv
"midi8"=wdmaud.drv
"mixer8"=wdmaud.drv
"aux4"=wdmaud.drv
"wave9"=wdmaud.drv
"midi9"=wdmaud.drv
"mixer9"=wdmaud.drv
"aux5"=wdmaud.drv
"aux6"=wdmaud.drv
"aux7"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-05-20 21:19:52 ----D---- C:\Users\Florian\AppData\Roaming\Recolored
2014-05-20 21:18:35 ----D---- C:\Program Files (x86)\Recolored
2014-05-18 03:13:36 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2014-05-18 03:13:36 ----A---- C:\Windows\system32\mshtmled.dll
2014-05-18 03:13:36 ----A---- C:\Windows\system32\mshtml.dll
2014-05-18 03:13:35 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2014-05-17 22:14:46 ----A---- C:\Windows\system32\shell32.dll
2014-05-17 22:14:43 ----A---- C:\Windows\SYSWOW64\shell32.dll
2014-05-17 22:14:26 ----A---- C:\Windows\system32\aepdu.dll
2014-05-17 22:14:25 ----A---- C:\Windows\system32\aeinv.dll
2014-05-17 22:13:20 ----A---- C:\Windows\system32\lsasrv.dll
2014-05-17 22:13:20 ----A---- C:\Windows\system32\kerberos.dll
2014-05-17 22:13:19 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2014-05-17 22:13:19 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2014-05-17 22:13:18 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2014-05-17 22:13:17 ----A---- C:\Windows\system32\winlogon.exe
2014-05-17 22:13:16 ----A---- C:\Windows\system32\msv1_0.dll
2014-05-17 22:13:15 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2014-05-17 22:13:15 ----A---- C:\Windows\system32\objsel.dll
2014-05-17 22:13:14 ----A---- C:\Windows\system32\ntoskrnl.exe
2014-05-17 22:13:09 ----A---- C:\Windows\SYSWOW64\objsel.dll
2014-05-17 22:13:09 ----A---- C:\Windows\system32\TSpkg.dll
2014-05-17 22:13:08 ----A---- C:\Windows\system32\KernelBase.dll
2014-05-17 22:13:07 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2014-05-17 22:13:07 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2014-05-17 22:13:07 ----A---- C:\Windows\system32\wdigest.dll
2014-05-17 22:13:06 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2014-05-17 22:12:57 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2014-05-17 22:12:56 ----A---- C:\Windows\system32\schannel.dll
2014-05-17 22:12:55 ----A---- C:\Windows\SYSWOW64\schannel.dll
2014-05-17 22:12:55 ----A---- C:\Windows\SYSWOW64\dimsroam.dll
2014-05-17 22:12:55 ----A---- C:\Windows\SYSWOW64\cngprovider.dll
2014-05-17 22:12:55 ----A---- C:\Windows\SYSWOW64\capiprovider.dll
2014-05-17 22:12:55 ----A---- C:\Windows\SYSWOW64\adprovider.dll
2014-05-17 22:12:55 ----A---- C:\Windows\system32\dpapiprovider.dll
2014-05-17 22:12:55 ----A---- C:\Windows\system32\dimsroam.dll
2014-05-17 22:12:55 ----A---- C:\Windows\system32\cngprovider.dll
2014-05-17 22:12:55 ----A---- C:\Windows\system32\capiprovider.dll
2014-05-17 22:12:55 ----A---- C:\Windows\system32\adprovider.dll
2014-05-17 22:12:54 ----A---- C:\Windows\SYSWOW64\dpapiprovider.dll
2014-05-17 22:12:53 ----A---- C:\Windows\system32\sspicli.dll
2014-05-17 22:12:53 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2014-05-17 22:12:52 ----A---- C:\Windows\system32\wincredprovider.dll
2014-05-17 22:12:51 ----A---- C:\Windows\SYSWOW64\wincredprovider.dll
2014-05-17 22:12:51 ----A---- C:\Windows\system32\lsass.exe
2014-05-17 22:12:50 ----A---- C:\Windows\SYSWOW64\secur32.dll
2014-05-17 22:12:50 ----A---- C:\Windows\SYSWOW64\credssp.dll
2014-05-17 22:12:50 ----A---- C:\Windows\system32\sspisrv.dll
2014-05-17 22:12:50 ----A---- C:\Windows\system32\secur32.dll
2014-05-17 22:12:50 ----A---- C:\Windows\system32\credssp.dll
2014-05-17 22:12:48 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2014-05-09 06:54:49 ----D---- C:\Users\Florian\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2014-05-07 03:01:06 ----SD---- C:\Windows\system32\CompatTel

======List of files/folders modified in the last 1 month======

2014-05-28 16:10:45 ----D---- C:\Users\Florian\AppData\Roaming\Dropbox
2014-05-28 16:10:37 ----D---- C:\Windows\Prefetch
2014-05-28 16:10:36 ----D---- C:\Program Files\trend micro
2014-05-28 16:10:14 ----D---- C:\Windows\Temp
2014-05-28 16:09:38 ----D---- C:\Windows\system32\config
2014-05-28 16:08:00 ----D---- C:\Users\Florian\AppData\Roaming\uTorrent
2014-05-28 16:07:22 ----D---- C:\ProgramData\Origin
2014-05-28 16:02:18 ----D---- C:\Windows\System32
2014-05-28 16:02:18 ----D---- C:\Windows\inf
2014-05-28 16:02:18 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-05-28 16:01:25 ----D---- C:\Users\Florian\AppData\Roaming\Skype
2014-05-28 16:00:57 ----D---- C:\Program Files (x86)\Steam
2014-05-28 15:58:13 ----D---- C:\Program Files (x86)\Trillian
2014-05-28 15:56:38 ----D---- C:\Program Files (x86)\Origin
2014-05-28 15:55:16 ----D---- C:\ProgramData\NVIDIA
2014-05-21 22:50:31 ----D---- C:\Users\Florian\AppData\Roaming\vlc
2014-05-21 15:42:01 ----SHD---- C:\System Volume Information
2014-05-21 15:05:52 ----D---- C:\Users\Florian\AppData\Roaming\YouTube Downloader
2014-05-21 15:05:35 ----D---- C:\Program Files (x86)\YTD
2014-05-20 21:20:13 ----AD---- C:\ProgramData\TEMP
2014-05-20 21:18:35 ----RD---- C:\Program Files (x86)
2014-05-18 03:43:47 ----D---- C:\Windows\Microsoft.NET
2014-05-18 03:43:14 ----RSD---- C:\Windows\assembly
2014-05-18 03:34:28 ----D---- C:\Windows\winsxs
2014-05-18 03:31:04 ----D---- C:\Windows\SysWOW64
2014-05-18 03:31:02 ----D---- C:\Windows\system32\cs-CZ
2014-05-18 03:31:02 ----D---- C:\Windows\PolicyDefinitions
2014-05-18 03:31:01 ----D---- C:\Windows\system32\drivers
2014-05-18 03:15:16 ----SHD---- C:\Windows\Installer
2014-05-18 03:15:16 ----D---- C:\ProgramData\Microsoft Help
2014-05-18 03:13:41 ----D---- C:\Windows\system32\catroot2
2014-05-18 03:13:41 ----D---- C:\Windows\system32\catroot
2014-05-18 03:12:27 ----D---- C:\Program Files (x86)\Common Files
2014-05-18 03:10:58 ----D---- C:\Windows\system32\MRT
2014-05-18 03:05:15 ----A---- C:\Windows\system32\MRT.exe
2014-05-17 23:31:22 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2014-05-10 22:39:13 ----D---- C:\Windows\system32\NDF
2014-05-09 06:51:53 ----D---- C:\ProgramData\Adobe
2014-05-09 06:34:30 ----HD---- C:\GrandeDevice
2014-05-03 11:10:25 ----RSD---- C:\Windows\Fonts

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2014-01-25 268512]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 PxHlpa64;PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2012-04-13 560184]
R0 Tpkd;Tpkd; C:\Windows\system32\drivers\Tpkd.sys [2011-06-28 105592]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2014-03-11 133928]
R2 Sentinel64;Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [2007-04-27 142120]
R3 athr;Wireless PCI Adapter Driver Service; C:\Windows\system32\DRIVERS\athrx.sys [2011-04-11 1579520]
R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver; C:\Windows\System32\Drivers\EtronHub3.sys [2011-02-08 39936]
R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver; C:\Windows\System32\Drivers\EtronXHCI.sys [2011-02-08 64512]
R3 L6UX2;Service - Line 6 UX2; C:\Windows\System32\Drivers\L6UX264.sys [2011-06-23 768000]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2013-04-04 25928]
R3 MEIx64;Intel(R) Management Engine Interface; C:\Windows\system32\drivers\HECIx64.sys [2010-09-21 56344]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2011-05-10 174184]
R3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-12-24 412264]
R3 Sftfs;Sftfs; C:\Windows\system32\DRIVERS\Sftfslh.sys [2013-06-26 767144]
R3 Sftplay;Sftplay; C:\Windows\system32\DRIVERS\Sftplaylh.sys [2013-06-26 273576]
R3 Sftredir;Sftredir; C:\Windows\system32\DRIVERS\Sftredirlh.sys [2013-06-26 28840]
R3 Sftvol;Sftvol; C:\Windows\system32\DRIVERS\Sftvollh.sys [2013-06-26 23208]
R3 WSDPrintDevice;Podpora tisku WSD prostřednictvím funkce UMB; C:\Windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
S1 Aspi32;Aspi32; C:\Windows\system32\drivers\Aspi32.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 fssfltr;FssFltr; C:\Windows\system32\DRIVERS\fssfltr.sys [2009-08-05 61280]
S3 hitmanpro37;HitmanPro 3.7 Support Driver; \??\C:\Windows\system32\drivers\hitmanpro37.sys [2013-09-16 32512]
S3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2010-10-01 12157792]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
S3 NvStUSB;NVIDIA Stereoscopic 3D USB driver; C:\Windows\system32\drivers\nvstusb.sys [2011-07-22 277096]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-05-13 157672]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2010-11-11 136264]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2010-11-11 19016]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2010-11-11 172104]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-02-12 19968]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WinUsb;Sony so0101 ADB Interface; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 c2cautoupdatesvc;Skype Click to Call Updater; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-04-11 1390720]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 cvhsvc;Client Virtualization Handler; C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2013-04-22 822504]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2014-03-11 23808]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-01-18 884512]
R2 PaceLicenseDServices;PACE License Services; C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe [2011-07-09 2932224]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2013-08-17 76888]
R2 postgresql-x64-9.0;postgresql-x64-9.0 - PostgreSQL Server 9.0; C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N postgresql-x64-9.0 -D C:/Program Files/PostgreSQL/9.0/data -w []
R2 PSI_SVC_2;Protexis Licensing V2; c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [2010-03-10 189728]
R2 sftlist;Application Virtualization Client; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2013-06-26 523944]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
R2 TeamViewer8;TeamViewer 8; C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-10-01 5087584]
R2 XRNADB;XRcnStatutsDatabase; C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmdb.exe [2012-07-16 96768]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2014-03-11 347872]
R3 sftvsa;Application Virtualization Service Agent; C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2013-06-26 207528]
R3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S2 BBSvc;Bing Bar Update Service; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE []
S2 BBUpdate;BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE []
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2013-02-26 1260320]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-17 257712]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S3 fsssvc;Služba Windows Live Zabezpečení rodiny; C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-03-06 111616]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-06-07 543656]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-04-13 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Zdravím!
Zkusíme tento postup: http://forum.viry.cz/viewtopic.php?f=13&t=133100.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02
Ran by Florian (administrator) on FLORIAN-PC on 28-05-2014 21:25:04
Running from C:\Users\Florian\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Czech
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(PACE Anti-Piracy, Inc.) C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\pg_ctl.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\PostgreSQL\9.0\bin\postgres.exe
() C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmdb.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe.old
(Evaer Technology) C:\Program Files (x86)\Evaer\videochannel.exe
(BitTorrent Inc.) C:\Users\Florian\AppData\Roaming\uTorrent\uTorrent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Scendix Software-Vertriebsges. mbH) C:\Program Files (x86)\Pamela\Pamela.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Cerulean Studios) C:\Program Files (x86)\Trillian\trillian.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
() C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmw.exe
() C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmwj.exe
() C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmpl.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Apple Inc.) C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe
(Google Inc.) C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
(Google Inc.) C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
(Dropbox, Inc.) C:\Users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\System32\DeviceDisplayObjectProvider.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
(forum.viry.cz) C:\Users\Florian\Desktop\FRSTLauncher.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [74752 2011-12-09] (Nullsoft, Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-10-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Launcher6015N] => C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\Launcher\xrlaunch.exe [2571264 2011-05-19] (Xerox)
HKLM-x32\...\Run: [6015N RUN] => C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmRun.exe [355840 2012-07-16] ()
HKLM-x32\...\Run: [StatusAutoRun6015N] => C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmpl.exe [3984896 2012-07-16] ()
HKLM-x32\...\Run: [cgBXoIziJrRPgl] => C:\Users\Florian\AppData\Local\dREbbSq.exe
HKLM-x32\...\Run: [MSStp] => C:\Windows\SysWOW64\msstp.vbe [1419 2014-01-19] ()
HKLM-x32\...\Run: [mncdwffymSrv] => C:\Windows\inf\mncdwffym.vbe [1342 2014-01-19] ()
HKLM-x32\...\Run: [NeroFilterCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [Google Update] => C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-04-12] (Google Inc.)
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672384 2012-04-11] (DT Soft Ltd)
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1775808 2014-05-28] (Valve Corporation)
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [avichannel] => C:\Program Files (x86)\Evaer\videochannel.exe [1696816 2013-03-22] (Evaer Technology)
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3588952 2014-04-27] (Electronic Arts)
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [SystemProc] => C:\Users\Public\Other\run_shc.lnk
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [uTorrent] => C:\Users\Florian\AppData\Roaming\uTorrent\uTorrent.exe [1270352 2014-04-29] (BitTorrent Inc.)
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [pamela.exe] => C:\Program Files (x86)\Pamela\Pamela.exe [4244952 2014-03-04] (Scendix Software-Vertriebsges. mbH)
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\MountPoints2: {612748c0-8583-11e1-acf1-806e6f6e6963} - I:\setup.exe
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rebeat UploadProcess.lnk
ShortcutTarget: Rebeat UploadProcess.lnk -> C:\Program Files (x86)\Rebeat Digital GmbH Austria\Rebeat\RebeatV1.UploadProcess.exe (Noxum GmbH)
Startup: C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=UP97&ocid=UP97DHP&dt=072513
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nmd.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.tsbohemia.cz
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {EBB38BF5-A0A0-4389-BE45-93F42405CE74} URL =
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Pomocník pro přihlášení ke službě Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 10.10.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.4.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @raidcall.en/RCplugin - C:\Users\Florian\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
FF Plugin-x32: @raidcall.kr/RCplugin - C:\Users\Florian\AppData\Roaming\RCKR\plugins\nprcplugin.dll (Raidcall)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Florian\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Florian\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

Chrome:
=======
CHR HomePage: hxxp://www.facebook.com/home.php?ref=hp
CHR StartupUrls: "hxxp://www.msn.com/?pc=UP97&ocid=UP97DHP&dt=072513"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Florian\AppData\Local\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Florian\AppData\Local\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Florian\AppData\Local\Google\Chrome\Application\35.0.1916.114\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\Florian\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Awesome Screenshot: Capture & Annotate) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce [2012-09-21]
CHR Extension: (Disk Google) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-12-04]
CHR Extension: (YouTube) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-04-12]
CHR Extension: (Vyhledávání Google) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-04-12]
CHR Extension: (SteamGifts Plus) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\edpihgmmgpfccdhghfigoobmjakgpipb [2013-02-23]
CHR Extension: (Vimeo™ Download Videos) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\geeljcibkkackafmeepgadbfgmpjmdeg [2014-02-14]
CHR Extension: (PageArchiver) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihkkeoeinpbomhnpkmmkpggkaefincbn [2013-02-20]
CHR Extension: (SingleFile Core) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\jemlklgaibiijojffihnhieihhagocma [2012-09-21]
CHR Extension: (Webcam Toy) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfbgimoladefibpklnfmkpknadbklade [2014-01-14]
CHR Extension: (Kontrola e-mailu Google) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2012-04-18]
CHR Extension: (Peněženka Google) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-30]
CHR Extension: (Hover Zoom) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nonjdcjchghhkdoolnlbekcfllmednbl [2012-11-25]
CHR Extension: (Gmail) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-04-12]
CHR Extension: (Canvas Rider) - C:\Users\Florian\AppData\Local\Google\Chrome\User Data\Default\Extensions\poknhlcknimnnbfcombaooklofipaibk [2012-04-18]
CHR StartMenuInternet: Google Chrome - C:\Users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-08-17] ()
R2 XRNADB; C:\Program Files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmdb.exe [96768 2012-07-16] ()
S2 BBSvc; "C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE" [X]
S2 BBUpdate; "C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE" [X]
R2 postgresql-x64-9.0; C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N "postgresql-x64-9.0" -D "C:/Program Files/PostgreSQL/9.0/data" -w [X]

==================== Drivers (Whitelisted) ====================

S1 Aspi32; No ImagePath
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32512 2013-09-16] ()
R3 L6UX2; C:\Windows\System32\Drivers\L6UX264.sys [768000 2011-06-23] (Line 6)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [142120 2007-04-27] (SafeNet, Inc.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2012-04-13] (Duplex Secure Ltd.)
S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbx64.sys [51496 2013-04-04] (Yamaha Corporation)
U3 awf5w9p0; C:\Windows\System32\Drivers\awf5w9p0.sys [0 ] (Microsoft Corporation)
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-28 21:25 - 2014-05-28 21:25 - 00023728 _____ () C:\Users\Florian\Desktop\FRST.txt
2014-05-28 21:24 - 2014-05-28 21:25 - 00000000 ____D () C:\FRST
2014-05-28 21:22 - 2014-05-28 21:22 - 02066944 _____ (Farbar) C:\Users\Florian\Desktop\FRST64.exe
2014-05-28 21:20 - 2014-05-28 21:21 - 00112640 _____ (forum.viry.cz) C:\Users\Florian\Desktop\FRSTLauncher.exe
2014-05-28 20:55 - 2014-05-28 21:13 - 837670912 ____R () C:\Users\Florian\Downloads\Queen - Houston 1977.avi
2014-05-28 17:25 - 2014-05-28 17:39 - 00000000 ____D () C:\Users\Florian\Desktop\hruskova
2014-05-28 16:08 - 2014-05-28 16:09 - 01222144 _____ () C:\Users\Florian\Downloads\RSITx64.exe
2014-05-28 16:08 - 2014-05-28 16:08 - 01107968 _____ () C:\Users\Florian\Downloads\RSIT.exe
2014-05-21 15:22 - 2014-05-21 15:22 - 00036088 _____ () C:\Users\Florian\Downloads\V4A-maturity-3.xlsx
2014-05-20 22:44 - 2014-05-21 00:00 - 734025728 _____ () C:\Users\Florian\Desktop\Annie.Hallova.1977.DVDRip.XviD.CZ-SAGiTTARiO.avi
2014-05-20 21:57 - 2014-05-28 17:41 - 00000000 ____D () C:\Users\Florian\Downloads\Simpsonovi 1-23
2014-05-20 21:56 - 2014-05-20 21:56 - 00385024 ___SH () C:\Users\Florian\Documents\Thumbs.db
2014-05-20 21:55 - 2014-05-20 21:55 - 00285492 _____ () C:\Users\Florian\Downloads\[CzT]Simpsonovi_The_Simpsons_1_23_serie_TVRip_CZ_.torrent
2014-05-20 21:19 - 2014-05-23 14:09 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Recolored
2014-05-20 21:18 - 2014-05-20 21:18 - 00000953 _____ () C:\Users\Florian\Desktop\Recolored.lnk
2014-05-20 21:18 - 2014-05-20 21:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recolored
2014-05-20 21:18 - 2014-05-20 21:18 - 00000000 ____D () C:\Program Files (x86)\Recolored
2014-05-20 21:18 - 2010-05-11 13:36 - 00044136 _____ () C:\Users\Florian\Desktop\1264885703579.jpeg
2014-05-20 21:18 - 2010-05-11 13:26 - 09179017 _____ (Bertheussen IT ) C:\Users\Florian\Desktop\recolored110.exe
2014-05-20 21:18 - 2010-05-11 13:18 - 00000219 _____ () C:\Users\Florian\Desktop\Serial.txt
2014-05-20 21:16 - 2014-05-20 21:17 - 09217068 _____ () C:\Users\Florian\Downloads\Recolored_1.1.0-Full-wih-Serial.rar
2014-05-20 21:15 - 2014-05-20 21:15 - 00000000 ____D () C:\Users\Florian\Downloads\Recolored 1.1.0
2014-05-20 21:13 - 2014-05-20 21:14 - 20971520 _____ () C:\Users\Florian\Downloads\Recolored-1.1.0-(32bit)-Portable.exe
2014-05-20 12:40 - 2014-05-20 13:45 - 735869026 _____ () C:\Users\Florian\Downloads\pup_linda_sweet_sg071813_480p_2000.mp4
2014-05-20 12:39 - 2014-05-20 12:39 - 00014856 _____ () C:\Users\Florian\Downloads\[kickass.to]publicpickups.linda.sweet.she.tastes.like.strawberries.21.01.2014.sd.torrent
2014-05-20 09:46 - 2014-05-20 09:46 - 00000000 ____D () C:\Users\Florian\Desktop\Kostal
2014-05-20 09:29 - 2014-05-20 09:30 - 14074434 _____ () C:\Users\Florian\Downloads\pos.zip
2014-05-18 19:48 - 2014-05-18 20:13 - 00000000 ____D () C:\Users\Florian\Downloads\Jethro Tull - Discography 1968-2009 Mp3 320 kbps
2014-05-18 17:35 - 2014-05-18 19:51 - 03573174 _____ () C:\Users\Florian\Desktop\satanaSs.psd
2014-05-18 14:54 - 2014-05-18 15:35 - 03524635 _____ () C:\Users\Florian\Desktop\satanas.psd
2014-05-18 03:13 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-18 03:13 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-18 03:13 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-18 03:13 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-18 03:13 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-18 03:13 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-17 22:14 - 2014-05-18 00:07 - 1093920768 _____ () C:\Users\Florian\Desktop\Prani-smrti-1-czdabing-1974-ZDARMA-DC-Tracker.avi
2014-05-17 22:14 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-17 22:14 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-17 22:14 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-17 22:14 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-17 22:13 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-17 22:13 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-17 22:13 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-17 22:13 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-17 22:13 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-17 22:13 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-17 22:13 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-17 22:13 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-17 22:13 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-17 22:13 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-17 22:13 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-17 22:13 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-17 22:13 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-17 22:13 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-17 22:13 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-17 22:13 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-17 22:13 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-17 22:12 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-17 22:12 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-17 22:12 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-17 22:12 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-17 22:12 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-17 22:12 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-17 22:12 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-17 22:12 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-17 22:12 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-17 22:12 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-17 22:12 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-17 22:12 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-17 22:12 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-17 22:12 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-17 22:12 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-17 22:12 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-17 22:12 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-17 22:12 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-17 22:12 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-17 22:12 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-17 22:12 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-17 22:12 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-17 22:12 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-17 22:12 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-12 00:16 - 2014-05-12 00:36 - 952541184 _____ () C:\Users\Florian\Downloads\Limitless.2011.DVDRip.XviD.CZ-LEADERs.avi
2014-05-12 00:16 - 2014-05-12 00:16 - 00018744 _____ () C:\Users\Florian\Downloads\[CzT]Vsemocny_Limitless_2011_.torrent
2014-05-11 12:33 - 2014-05-11 12:33 - 00033421 _____ () C:\Users\Florian\Downloads\now.is.good.(2012).eng.1cd.(4766609).zip
2014-05-11 10:46 - 2014-05-11 10:46 - 00006624 _____ () C:\Users\Florian\Downloads\Jigoshop-zbozi-feed-master.zip
2014-05-11 02:19 - 2014-05-11 02:54 - 00000000 ____D () C:\Users\Florian\Desktop\zaloha
2014-05-11 02:05 - 2014-05-11 02:05 - 00006968 _____ () C:\Users\Florian\Downloads\Jigoshop-heureka-feed-master.zip
2014-05-11 02:05 - 2013-11-06 14:34 - 00000000 ____D () C:\Users\Florian\Desktop\Jigoshop-heureka-feed-master
2014-05-11 01:42 - 2014-05-11 02:01 - 898969600 _____ () C:\Users\Florian\Downloads\The.Secret.Life.of.Walter.Mitty.2013.BRRip.XviD.CZ.avi
2014-05-11 01:41 - 2014-05-11 01:41 - 00017845 _____ () C:\Users\Florian\Downloads\[CzT]Walter_Mitty_a_jeho_tajny_zivot_The_Secret_Life_of_Walter_Mitty_2013_CZ_.torrent
2014-05-11 01:40 - 2014-05-11 12:33 - 00000000 ____D () C:\Users\Florian\Downloads\Now.Is.Good.2012.DVDRip.XviD-NYDIC
2014-05-10 23:34 - 2014-05-10 23:34 - 00001723 _____ () C:\Users\Florian\Downloads\settings_2014-5-10_23.34.59.zip
2014-05-09 21:26 - 2014-05-09 21:28 - 00000000 ____D () C:\Users\Florian\Downloads\12 Years a Slave (2013) [1080p]
2014-05-09 21:25 - 2014-05-09 21:25 - 00000000 ____D () C:\Users\Florian\Downloads\prisonarchitect-alpha20-pc
2014-05-09 20:05 - 2014-05-08 23:19 - 1438287312 _____ () C:\Users\Florian\Desktop\12-let-v-retezech.cz – kopie.avi
2014-05-09 08:37 - 2014-05-09 08:37 - 00000000 ____D () C:\Users\Florian\Desktop\yjamo
2014-05-09 06:54 - 2014-05-09 06:54 - 00000000 ____D () C:\Users\Public\Documents\Adobe
2014-05-09 06:54 - 2014-05-09 06:54 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2014-05-09 06:48 - 2014-05-09 06:48 - 00000000 ____D () C:\Users\Florian\Desktop\imposer
2014-05-09 06:47 - 2014-05-09 06:47 - 06714538 _____ () C:\Users\Florian\Downloads\idimposer902.zip
2014-05-09 03:49 - 2014-05-09 09:19 - 00532480 _____ () C:\Users\Florian\Desktop\Bez názvu-1.indd
2014-05-08 22:32 - 2014-05-08 22:38 - 00000575 _____ () C:\Users\Florian\Desktop\britsk.txt
2014-05-08 20:39 - 2014-05-09 20:11 - 00000212 _____ () C:\Users\Florian\Desktop\12-let-v-retezech.cz.avi
2014-05-07 03:01 - 2014-05-18 03:31 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-04 10:34 - 2014-05-04 10:58 - 117676208 _____ () C:\Users\Florian\Downloads\prisonarchitect-alpha20-pc.zip
2014-05-03 11:18 - 2014-05-03 11:20 - 00575680 _____ () C:\Users\Florian\Desktop\marx.psd
2014-05-03 11:10 - 2009-04-18 13:37 - 00033092 _____ () C:\Users\Florian\Desktop\coahce.ttf
2014-05-03 11:09 - 2014-05-03 11:09 - 00049489 _____ () C:\Users\Florian\Downloads\chronicles_of_a_her.zip

==================== One Month Modified Files and Folders =======

2014-05-28 21:25 - 2014-05-28 21:25 - 00023728 _____ () C:\Users\Florian\Desktop\FRST.txt
2014-05-28 21:25 - 2014-05-28 21:24 - 00000000 ____D () C:\FRST
2014-05-28 21:23 - 2012-04-19 18:25 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\uTorrent
2014-05-28 21:22 - 2014-05-28 21:22 - 02066944 _____ (Farbar) C:\Users\Florian\Desktop\FRST64.exe
2014-05-28 21:21 - 2014-05-28 21:20 - 00112640 _____ (forum.viry.cz) C:\Users\Florian\Desktop\FRSTLauncher.exe
2014-05-28 21:14 - 2012-04-12 21:40 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\vlc
2014-05-28 21:13 - 2014-05-28 20:55 - 837670912 ____R () C:\Users\Florian\Downloads\Queen - Houston 1977.avi
2014-05-28 20:40 - 2012-09-18 07:04 - 00000970 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002UA.job
2014-05-28 20:39 - 2012-04-12 14:56 - 01646594 _____ () C:\Windows\WindowsUpdate.log
2014-05-28 20:35 - 2012-09-28 11:14 - 00000000 ___RD () C:\Users\Florian\Dropbox
2014-05-28 20:34 - 2014-03-27 01:19 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\DropboxMaster
2014-05-28 20:34 - 2012-09-28 11:06 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Dropbox
2014-05-28 20:31 - 2012-04-12 15:06 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-28 18:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-28 17:41 - 2014-05-20 21:57 - 00000000 ____D () C:\Users\Florian\Downloads\Simpsonovi 1-23
2014-05-28 17:40 - 2012-09-18 07:04 - 00000918 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002Core.job
2014-05-28 17:39 - 2014-05-28 17:25 - 00000000 ____D () C:\Users\Florian\Desktop\hruskova
2014-05-28 17:12 - 2012-09-28 11:07 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-28 17:12 - 2012-04-12 15:02 - 00000000 ___RD () C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-28 16:45 - 2012-04-12 17:09 - 00000000 ____D () C:\Users\Florian\AppData\Local\Adobe
2014-05-28 16:16 - 2009-07-14 06:45 - 00021920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-28 16:16 - 2009-07-14 06:45 - 00021920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-28 16:10 - 2012-08-06 21:32 - 00000000 ____D () C:\Program Files\trend micro
2014-05-28 16:09 - 2014-05-28 16:08 - 01222144 _____ () C:\Users\Florian\Downloads\RSITx64.exe
2014-05-28 16:08 - 2014-05-28 16:08 - 01107968 _____ () C:\Users\Florian\Downloads\RSIT.exe
2014-05-28 16:07 - 2013-08-14 22:49 - 00000000 ____D () C:\ProgramData\Origin
2014-05-28 16:02 - 2010-11-21 11:27 - 00672588 _____ () C:\Windows\system32\perfh005.dat
2014-05-28 16:02 - 2010-11-21 11:27 - 00142926 _____ () C:\Windows\system32\perfc005.dat
2014-05-28 16:02 - 2009-07-14 07:13 - 01594702 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-28 16:01 - 2012-08-30 14:33 - 00000000 ____D () C:\Users\Florian\AppData\Local\CrashDumps
2014-05-28 16:01 - 2012-04-24 12:35 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Skype
2014-05-28 16:00 - 2014-04-25 09:25 - 00003162 _____ () C:\Users\Florian\rgmnr
2014-05-28 16:00 - 2013-03-26 20:31 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-05-28 15:58 - 2012-06-24 23:22 - 00000000 ____D () C:\Program Files (x86)\Trillian
2014-05-28 15:56 - 2013-08-14 22:49 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-05-28 15:55 - 2012-04-11 17:13 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-05-28 15:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-28 15:55 - 2009-07-14 06:51 - 00171785 _____ () C:\Windows\setupact.log
2014-05-23 14:09 - 2014-05-20 21:19 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\Recolored
2014-05-21 15:22 - 2014-05-21 15:22 - 00036088 _____ () C:\Users\Florian\Downloads\V4A-maturity-3.xlsx
2014-05-21 15:05 - 2012-05-08 12:51 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\YouTube Downloader
2014-05-21 15:05 - 2012-05-08 12:48 - 00000000 ____D () C:\Program Files (x86)\YTD
2014-05-21 00:00 - 2014-05-20 22:44 - 734025728 _____ () C:\Users\Florian\Desktop\Annie.Hallova.1977.DVDRip.XviD.CZ-SAGiTTARiO.avi
2014-05-20 21:56 - 2014-05-20 21:56 - 00385024 ___SH () C:\Users\Florian\Documents\Thumbs.db
2014-05-20 21:56 - 2012-09-12 22:46 - 00000000 ____D () C:\Users\Florian\Documents\valenta
2014-05-20 21:55 - 2014-05-20 21:55 - 00285492 _____ () C:\Users\Florian\Downloads\[CzT]Simpsonovi_The_Simpsons_1_23_serie_TVRip_CZ_.torrent
2014-05-20 21:55 - 2012-09-12 22:41 - 00000000 ____D () C:\Users\Florian\Documents\estranky
2014-05-20 21:18 - 2014-05-20 21:18 - 00000953 _____ () C:\Users\Florian\Desktop\Recolored.lnk
2014-05-20 21:18 - 2014-05-20 21:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recolored
2014-05-20 21:18 - 2014-05-20 21:18 - 00000000 ____D () C:\Program Files (x86)\Recolored
2014-05-20 21:17 - 2014-05-20 21:16 - 09217068 _____ () C:\Users\Florian\Downloads\Recolored_1.1.0-Full-wih-Serial.rar
2014-05-20 21:15 - 2014-05-20 21:15 - 00000000 ____D () C:\Users\Florian\Downloads\Recolored 1.1.0
2014-05-20 21:14 - 2014-05-20 21:13 - 20971520 _____ () C:\Users\Florian\Downloads\Recolored-1.1.0-(32bit)-Portable.exe
2014-05-20 13:45 - 2014-05-20 12:40 - 735869026 _____ () C:\Users\Florian\Downloads\pup_linda_sweet_sg071813_480p_2000.mp4
2014-05-20 12:39 - 2014-05-20 12:39 - 00014856 _____ () C:\Users\Florian\Downloads\[kickass.to]publicpickups.linda.sweet.she.tastes.like.strawberries.21.01.2014.sd.torrent
2014-05-20 09:46 - 2014-05-20 09:46 - 00000000 ____D () C:\Users\Florian\Desktop\Kostal
2014-05-20 09:30 - 2014-05-20 09:29 - 14074434 _____ () C:\Users\Florian\Downloads\pos.zip
2014-05-18 20:13 - 2014-05-18 19:48 - 00000000 ____D () C:\Users\Florian\Downloads\Jethro Tull - Discography 1968-2009 Mp3 320 kbps
2014-05-18 19:52 - 2012-04-24 19:37 - 00000132 _____ () C:\Users\Florian\AppData\Roaming\Adobe Formát PNG CS5 – předvolby
2014-05-18 19:51 - 2014-05-18 17:35 - 03573174 _____ () C:\Users\Florian\Desktop\satanaSs.psd
2014-05-18 15:35 - 2014-05-18 14:54 - 03524635 _____ () C:\Users\Florian\Desktop\satanas.psd
2014-05-18 14:22 - 2012-04-24 18:13 - 00001228 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5 (64 Bit).lnk
2014-05-18 13:55 - 2012-04-13 15:26 - 00000000 ____D () C:\Users\Florian\Documents\Cubase Projects
2014-05-18 08:20 - 2012-04-12 15:02 - 00000000 ___RD () C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-18 03:34 - 2009-07-14 07:08 - 00032544 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-18 03:32 - 2010-11-21 05:47 - 00235142 _____ () C:\Windows\PFRO.log
2014-05-18 03:31 - 2014-05-07 03:01 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-18 03:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-18 03:15 - 2012-04-18 06:31 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-18 03:10 - 2013-08-01 03:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-18 03:05 - 2013-06-29 03:04 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-18 00:07 - 2014-05-17 22:14 - 1093920768 _____ () C:\Users\Florian\Desktop\Prani-smrti-1-czdabing-1974-ZDARMA-DC-Tracker.avi
2014-05-17 23:31 - 2012-04-12 15:06 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-17 23:31 - 2012-04-12 15:06 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-17 23:31 - 2012-04-12 15:06 - 00003852 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-17 21:40 - 2009-07-14 06:45 - 05127432 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-05-12 00:36 - 2014-05-12 00:16 - 952541184 _____ () C:\Users\Florian\Downloads\Limitless.2011.DVDRip.XviD.CZ-LEADERs.avi
2014-05-12 00:16 - 2014-05-12 00:16 - 00018744 _____ () C:\Users\Florian\Downloads\[CzT]Vsemocny_Limitless_2011_.torrent
2014-05-11 12:33 - 2014-05-11 12:33 - 00033421 _____ () C:\Users\Florian\Downloads\now.is.good.(2012).eng.1cd.(4766609).zip
2014-05-11 12:33 - 2014-05-11 01:40 - 00000000 ____D () C:\Users\Florian\Downloads\Now.Is.Good.2012.DVDRip.XviD-NYDIC
2014-05-11 10:46 - 2014-05-11 10:46 - 00006624 _____ () C:\Users\Florian\Downloads\Jigoshop-zbozi-feed-master.zip
2014-05-11 02:54 - 2014-05-11 02:19 - 00000000 ____D () C:\Users\Florian\Desktop\zaloha
2014-05-11 02:05 - 2014-05-11 02:05 - 00006968 _____ () C:\Users\Florian\Downloads\Jigoshop-heureka-feed-master.zip
2014-05-11 02:01 - 2014-05-11 01:42 - 898969600 _____ () C:\Users\Florian\Downloads\The.Secret.Life.of.Walter.Mitty.2013.BRRip.XviD.CZ.avi
2014-05-11 01:41 - 2014-05-11 01:41 - 00017845 _____ () C:\Users\Florian\Downloads\[CzT]Walter_Mitty_a_jeho_tajny_zivot_The_Secret_Life_of_Walter_Mitty_2013_CZ_.torrent
2014-05-10 23:34 - 2014-05-10 23:34 - 00001723 _____ () C:\Users\Florian\Downloads\settings_2014-5-10_23.34.59.zip
2014-05-10 22:39 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-05-09 21:28 - 2014-05-09 21:26 - 00000000 ____D () C:\Users\Florian\Downloads\12 Years a Slave (2013) [1080p]
2014-05-09 21:25 - 2014-05-09 21:25 - 00000000 ____D () C:\Users\Florian\Downloads\prisonarchitect-alpha20-pc
2014-05-09 20:11 - 2014-05-08 20:39 - 00000212 _____ () C:\Users\Florian\Desktop\12-let-v-retezech.cz.avi
2014-05-09 09:19 - 2014-05-09 03:49 - 00532480 _____ () C:\Users\Florian\Desktop\Bez názvu-1.indd
2014-05-09 08:37 - 2014-05-09 08:37 - 00000000 ____D () C:\Users\Florian\Desktop\yjamo
2014-05-09 08:14 - 2014-05-17 22:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-17 22:14 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-09 06:54 - 2014-05-09 06:54 - 00000000 ____D () C:\Users\Public\Documents\Adobe
2014-05-09 06:54 - 2014-05-09 06:54 - 00000000 ____D () C:\Users\Florian\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2014-05-09 06:51 - 2011-06-09 16:52 - 00000000 ____D () C:\ProgramData\Adobe
2014-05-09 06:48 - 2014-05-09 06:48 - 00000000 ____D () C:\Users\Florian\Desktop\imposer
2014-05-09 06:47 - 2014-05-09 06:47 - 06714538 _____ () C:\Users\Florian\Downloads\idimposer902.zip
2014-05-09 06:34 - 2013-07-26 13:40 - 00000000 ___HD () C:\GrandeDevice
2014-05-08 23:19 - 2014-05-09 20:05 - 1438287312 _____ () C:\Users\Florian\Desktop\12-let-v-retezech.cz – kopie.avi
2014-05-08 22:38 - 2014-05-08 22:32 - 00000575 _____ () C:\Users\Florian\Desktop\britsk.txt
2014-05-07 17:35 - 2012-04-12 15:06 - 00003948 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002UA
2014-05-07 17:35 - 2012-04-12 15:06 - 00003552 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002Core
2014-05-06 06:40 - 2014-05-18 03:13 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-18 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-18 03:13 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-18 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-18 03:13 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-18 03:13 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-04 10:58 - 2014-05-04 10:34 - 117676208 _____ () C:\Users\Florian\Downloads\prisonarchitect-alpha20-pc.zip
2014-05-03 11:20 - 2014-05-03 11:18 - 00575680 _____ () C:\Users\Florian\Desktop\marx.psd
2014-05-03 11:19 - 2012-04-12 15:05 - 00141392 _____ () C:\Users\Florian\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-03 11:09 - 2014-05-03 11:09 - 00049489 _____ () C:\Users\Florian\Downloads\chronicles_of_a_her.zip

Files to move or delete:
====================
C:\ProgramData\jibkeqcpmhmbvyvighy.bat
C:\ProgramData\jibkeqcpmhmbvyvighy.reg
C:\Users\Public\d3dx10_41.dll
C:\Users\Public\d3dx10_42.dll
C:\Users\Public\d3dx10_43.dll
C:\Users\Public\d3dx11_42.dll
C:\Users\Public\d3dx11_43.dll
C:\Users\Public\D3DX9_41.dll
C:\Users\Public\D3DX9_42.dll
C:\Users\Public\D3DX9_43.dll
C:\Users\Public\Line 6 Podfarm 2.5 Platinum.exe
C:\Users\Public\WorkCentre_6015NI_Win8_CD_Package.exe


Some content of TEMP:
====================
C:\Users\Florian\AppData\Local\Temp\AskSLib.dll
C:\Users\Florian\AppData\Local\Temp\CheckSerial.dll
C:\Users\Florian\AppData\Local\Temp\Deldevice.dll
C:\Users\Florian\AppData\Local\Temp\DelVista.dll
C:\Users\Florian\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpvuyusj.dll
C:\Users\Florian\AppData\Local\Temp\gtapi_signed.dll
C:\Users\Florian\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Florian\AppData\Local\Temp\KMP_3.4.0.59.exe
C:\Users\Florian\AppData\Local\Temp\L6GPInst.dll
C:\Users\Florian\AppData\Local\Temp\SIInvoker.exe
C:\Users\Florian\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Florian\AppData\Local\Temp\sonarinst.exe
C:\Users\Florian\AppData\Local\Temp\utt7BE6.tmp.exe
C:\Users\Florian\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Florian\AppData\Local\Temp\vlc-2.0.4-win32.exe
C:\Users\Florian\AppData\Local\Temp\vlc-2.0.5-win32.exe
C:\Users\Florian\AppData\Local\Temp\vlc-2.0.6-win32.exe
C:\Users\Florian\AppData\Local\Temp\vlc-2.0.7-win32.exe
C:\Users\Florian\AppData\Local\Temp\vlc-2.0.8-win32.exe
C:\Users\Florian\AppData\Local\Temp\vlc-2.1.2-win32.exe
C:\Users\Florian\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Florian\AppData\Local\Temp\xrAnotherRegister.exe
C:\Users\Florian\AppData\Local\Temp\ytd-upgrade.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 02:35




===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================

Drive c: () (Fixed) (Total:1862.74 GB) (Free:222.83 GB) NTFS
Drive i: (NIKONTAKT510) (CDROM) (Total:0.77 GB) (Free:0 GB) CDFS

Available physical RAM: 4908.2 MB
Total physical RAM: 8175.12 MB
Percentage of memory in use: 39%

==================== MBR and Partition Table ==================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 2F171617)
Partition 1: (Active) - (Size=283 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=-198923255808) - (Type=07 NTFS)

==================== Scheduled Tasks (whitelisted) ==================

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002Core.job => C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002UA.job => C:\Users\Florian\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Alternate Data Streams (whitelisted) ==================

AlternateDataStreams: C:\ProgramData\Microsoft:6a5PItYFYlexpJUV3NaANsiggrN2
AlternateDataStreams: C:\ProgramData\Microsoft:6PyZgndwiyWz6e49oKimCCRQ
AlternateDataStreams: C:\ProgramData\Microsoft:awjUdlt4QEfQABeRf4uTj
AlternateDataStreams: C:\ProgramData\Microsoft:cKDa2WI6bgUuh2fptNlk6Bg
AlternateDataStreams: C:\ProgramData\Microsoft:epLfjKODwicc6IDRAx9KJZ1T
AlternateDataStreams: C:\ProgramData\Microsoft:tnxi7coKMOZ96Shj7NC2
AlternateDataStreams: C:\ProgramData\Microsoft:vIipsthrypGdI2lByjmzZq
AlternateDataStreams: C:\ProgramData\TEMP:5CB1E0D3
AlternateDataStreams: C:\ProgramData\TEMP:FB1B13D8
AlternateDataStreams: C:\Users\Florian\Local Settings:kVW9DZpMsh5k0JCMtFaaqU3u6
AlternateDataStreams: C:\Users\Florian\AppData\Local:kVW9DZpMsh5k0JCMtFaaqU3u6
AlternateDataStreams: C:\Users\Florian\AppData\Local\Data aplikací:kVW9DZpMsh5k0JCMtFaaqU3u6
AlternateDataStreams: C:\Users\Florian\AppData\Local\Temp:fbPRfpwkrMQvKwS8mfZUZvH0
AlternateDataStreams: C:\Users\Florian\AppData\Local\Temporary Internet Files:jWiLDqVTzsVs4xMwhWCbYC

==================== Security Center ==================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Florian\Desktop" je 4338 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files (x86)\\FlashGet Network\\FlashGet 3\\FlashGet3.exe"="C:\\Program Files (x86)\\FlashGet Network\\FlashGet 3\\FlashGet3.exe:*:Enabled:Flashget3"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================

Otevřte poznámkový blok a zkopírujte do něj:

Start
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [cgBXoIziJrRPgl] => C:\Users\Florian\AppData\Local\dREbbSq.exe
C:\Users\Florian\AppData\Local\dREbbSq.exe
C:\Windows\inf\mncdwffym.vbe
HKLM-x32\...\Run: [mncdwffymSrv] => C:\Windows\inf\mncdwffym.vbe [1342 2014-01-19] ()
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\MountPoints2: {612748c0-8583-11e1-acf1-806e6f6e6963} - I:\setup.exe
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
C:\Program Files (x86)\Skype\Toolbars
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002UA.job
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002Core.job
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002UA
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002Core
C:\ProgramData\jibkeqcpmhmbvyvighy.bat
C:\ProgramData\jibkeqcpmhmbvyvighy.reg
C:\Users\Public\d3dx10_41.dll
C:\Users\Public\d3dx10_42.dll
C:\Users\Public\d3dx10_43.dll
C:\Users\Public\d3dx11_42.dll
C:\Users\Public\d3dx11_43.dll
C:\Users\Public\D3DX9_41.dll
C:\Users\Public\D3DX9_42.dll
C:\Users\Public\D3DX9_43.dll
C:\Users\Public\Line 6 Podfarm 2.5 Platinum.exe
C:\Users\Public\WorkCentre_6015NI_Win8_CD_Package.exe
C:\Users\Florian\AppData\Local\Temp
AlternateDataStreams: C:\ProgramData\Microsoft:6a5PItYFYlexpJUV3NaANsiggrN2
AlternateDataStreams: C:\ProgramData\Microsoft:6PyZgndwiyWz6e49oKimCCRQ
AlternateDataStreams: C:\ProgramData\Microsoft:awjUdlt4QEfQABeRf4uTj
AlternateDataStreams: C:\ProgramData\Microsoft:cKDa2WI6bgUuh2fptNlk6Bg
AlternateDataStreams: C:\ProgramData\Microsoft:epLfjKODwicc6IDRAx9KJZ1T
AlternateDataStreams: C:\ProgramData\Microsoft:tnxi7coKMOZ96Shj7NC2
AlternateDataStreams: C:\ProgramData\Microsoft:vIipsthrypGdI2lByjmzZq
AlternateDataStreams: C:\ProgramData\TEMP:5CB1E0D3
AlternateDataStreams: C:\ProgramData\TEMP:FB1B13D8
AlternateDataStreams: C:\Users\Florian\Local Settings:kVW9DZpMsh5k0JCMtFaaqU3u6
AlternateDataStreams: C:\Users\Florian\AppData\Local:kVW9DZpMsh5k0JCMtFaaqU3u6
AlternateDataStreams: C:\Users\Florian\AppData\Local\Data aplikací:kVW9DZpMsh5k0JCMtFaaqU3u6
AlternateDataStreams: C:\Users\Florian\AppData\Local\Temp:fbPRfpwkrMQvKwS8mfZUZvH0
AlternateDataStreams: C:\Users\Florian\AppData\Local\Temporary Internet Files:jWiLDqVTzsVs4xMwhWCbYC
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Vypustil jsem z něj to Line 6 POD Farm, protože to je original software k mé externí zvukové kartě pro nahrávání a pak by mi to nejspíš nefungovalo

Po skončení mi to zahlásilo error. Akorát jsem ho odklikl a nezaznamenal

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-05-2014 02
Ran by Florian at 2014-05-29 00:32:44 Run:1
Running from C:\Users\Florian\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [cgBXoIziJrRPgl] => C:\Users\Florian\AppData\Local\dREbbSq.exe
C:\Users\Florian\AppData\Local\dREbbSq.exe
C:\Windows\inf\mncdwffym.vbe
HKLM-x32\...\Run: [mncdwffymSrv] => C:\Windows\inf\mncdwffym.vbe [1342 2014-01-19] ()
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\...\MountPoints2: {612748c0-8583-11e1-acf1-806e6f6e6963} - I:\setup.exe
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
C:\Program Files (x86)\Skype\Toolbars
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002UA.job
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002Core.job
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002UA
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002Core
C:\ProgramData\jibkeqcpmhmbvyvighy.bat
C:\ProgramData\jibkeqcpmhmbvyvighy.reg
C:\Users\Public\d3dx10_41.dll
C:\Users\Public\d3dx10_42.dll
C:\Users\Public\d3dx10_43.dll
C:\Users\Public\d3dx11_42.dll
C:\Users\Public\d3dx11_43.dll
C:\Users\Public\D3DX9_41.dll
C:\Users\Public\D3DX9_42.dll
C:\Users\Public\D3DX9_43.dll
C:\Users\Public\WorkCentre_6015NI_Win8_CD_Package.exe
C:\Users\Florian\AppData\Local\Temp
AlternateDataStreams: C:\ProgramData\Microsoft:6a5PItYFYlexpJUV3NaANsiggrN2
AlternateDataStreams: C:\ProgramData\Microsoft:6PyZgndwiyWz6e49oKimCCRQ
AlternateDataStreams: C:\ProgramData\Microsoft:awjUdlt4QEfQABeRf4uTj
AlternateDataStreams: C:\ProgramData\Microsoft:cKDa2WI6bgUuh2fptNlk6Bg
AlternateDataStreams: C:\ProgramData\Microsoft:epLfjKODwicc6IDRAx9KJZ1T
AlternateDataStreams: C:\ProgramData\Microsoft:tnxi7coKMOZ96Shj7NC2
AlternateDataStreams: C:\ProgramData\Microsoft:vIipsthrypGdI2lByjmzZq
AlternateDataStreams: C:\ProgramData\TEMP:5CB1E0D3
AlternateDataStreams: C:\ProgramData\TEMP:FB1B13D8
AlternateDataStreams: C:\Users\Florian\Local Settings:kVW9DZpMsh5k0JCMtFaaqU3u6
AlternateDataStreams: C:\Users\Florian\AppData\Local:kVW9DZpMsh5k0JCMtFaaqU3u6
AlternateDataStreams: C:\Users\Florian\AppData\Local\Data aplikací:kVW9DZpMsh5k0JCMtFaaqU3u6
AlternateDataStreams: C:\Users\Florian\AppData\Local\Temp:fbPRfpwkrMQvKwS8mfZUZvH0
AlternateDataStreams: C:\Users\Florian\AppData\Local\Temporary Internet Files:jWiLDqVTzsVs4xMwhWCbYC
End
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\cgBXoIziJrRPgl => Value deleted successfully.
"C:\Users\Florian\AppData\Local\dREbbSq.exe" => File/Directory not found.
C:\Windows\inf\mncdwffym.vbe => Moved successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\mncdwffymSrv => Value deleted successfully.
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge => Value deleted successfully.
HKU\S-1-5-21-27908995-1430856944-1559214145-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{612748c0-8583-11e1-acf1-806e6f6e6963} => Key deleted successfully.
HKCR\CLSID\{612748c0-8583-11e1-acf1-806e6f6e6963} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} => Key deleted successfully.
HKCR\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} => Key deleted successfully.
C:\Program Files (x86)\Skype\Toolbars => Moved successfully.
HKCR\Wow6432Node\PROTOCOLS\Handler\skype-ie-addon-data => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{91774881-D725-4E58-B298-07617B9B86A8} => Key deleted successfully.
HKLM\Software\MozillaPlugins\FF Plugin: @microsoft.com/GENUINE - disabled No File => Key not found.
"FF Plugin: @microsoft.com/GENUINE - disabled No File" => not found.
HKLM\Software\Wow6432Node\MozillaPlugins\FF Plugin-x32: @microsoft.com/GENUINE - disabled No File => Key not found.
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File not found.
c2cautoupdatesvc => Service stopped successfully.
c2cautoupdatesvc => Service deleted successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002UA.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002Core.job => Moved successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002UA => Moved successfully.
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-27908995-1430856944-1559214145-1002Core => Moved successfully.
C:\ProgramData\jibkeqcpmhmbvyvighy.bat => Moved successfully.
C:\ProgramData\jibkeqcpmhmbvyvighy.reg => Moved successfully.
C:\Users\Public\d3dx10_41.dll => Moved successfully.
C:\Users\Public\d3dx10_42.dll => Moved successfully.
C:\Users\Public\d3dx10_43.dll => Moved successfully.
C:\Users\Public\d3dx11_42.dll => Moved successfully.
C:\Users\Public\d3dx11_43.dll => Moved successfully.
C:\Users\Public\D3DX9_41.dll => Moved successfully.
C:\Users\Public\D3DX9_42.dll => Moved successfully.
C:\Users\Public\D3DX9_43.dll => Moved successfully.
C:\Users\Public\WorkCentre_6015NI_Win8_CD_Package.exe => Moved successfully.

"C:\Users\Florian\AppData\Local\Temp" directory move:

Smazáno. Nastala nějaká změna?

Je to pořád stejné Možná tedy asi bude lepší založit nový účet, co?

Zkusíme to ještě proskenovat ComboFixem:

Stahnete a ulozte nejlepe na plochu ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

pote spustte aplikaci pod uctem s administratorskym opravnenim

hned po startu se zobrazi obrazovka s licencnimi podminkami, pokracujte kliknutim na tlacitko Ano.

v klidu si postavte na kafe (cela akce trva cca. 5-10 minut, nekdy i dele - dle toho, o jak rychly stroj se

jedna a kolika soubory se skener bude muset prodirat), behem skenu se nepokousejte spoustet zadne jine

aplikace ani nic jineho

behem skenovani nepropadejte panice, vas stroj muze byt restartovan (predevsim pri prvni aplikaci skeneru)

upozorneni: pokud pouzivate antispyware s rezidentnim stitem, prepnete jeho rezidentni stit do Install Mode,

pripadne jej po dobu skenu uplne deaktivujte, protoze dochazi pri skenu a vymazu pripadneho malware k

nezadoucim kolizim s rezidentem antispyware.

ComboFix 14-06-12.01 - Florian 13.06.2014 9:50.1.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8175.6018 [GMT 2:00]
Spuštěný z: c:\users\Florian\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
C:\test.txt
c:\users\Florian\AppData\Local\MSGBOX.EXE
c:\users\Florian\AppData\Local\Plus500
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\BigLoading.gif
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_AutoYScaleDown.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_AutoYScaleUp.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_Cancel.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_cashier.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_CrosshairDown.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_CrosshairUp.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_DemoMode.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_downarrow_red.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_Help.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_ChartSettings.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_MoveDown.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_MoveUp.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_OK.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_RateAlerts.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_RealMode.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_Search.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_SetupIndicators.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_SwitchToCandleStick.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_SwitchToFun.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_SwitchToLine.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_SwitchToReal.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_ZoomIn.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_ZoomOut.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\but_ZoomReset.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_ABNAMRO.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_AboutWallpaper.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_ArrowDown.bmp
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_ArrowUp.bmp
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_Barclays.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_BuySellWallpaper.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_CashierMainWallpaper.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_CashierMainWallpaper1.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_CashierMainWallpaper1s.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_CashierMainWallpaper2.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_CashierMainWallpaper2s.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_CashierMainWallpaper3.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_CashierMainWallpaper3s.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_CommonwealthBank.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_Error.PNG
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_ChartToolbar.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_IBB.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_InstrumentScreenLeftWallpaper.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_InstrumentScreenRightWallpaper.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_LoginWallpaper.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_MainLobbyLeftWallpaper.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_MainLobbyRightWallpaper.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\img_RateUs.png
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\InvestSmallBtns.ssk
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\InvestSoft.ssk
c:\users\Florian\AppData\Local\Plus500\Languages\cs\Images\Loading.gif
c:\users\Florian\AppData\Local\Plus500\Main\configuration.xml
c:\users\Florian\AppData\Local\Plus500\Main\InstrumentsInfo.xml
c:\users\Florian\AppData\Local\Plus500\Main\InvestSoft.log
c:\users\Florian\AppData\Local\Plus500\Main\InvestSoft.log.1
c:\users\Florian\AppData\Local\Plus500\Main\InvestSoft.log.2
c:\users\Florian\AppData\Local\Plus500\Main\InvestSoft.log.3
c:\users\Florian\AppData\Local\Plus500\Main\InvestSoft.log.4
c:\users\Florian\AppData\Local\Plus500\Main\InvestSoftProject.exe
c:\users\Florian\AppData\Local\Plus500\Main\InvestSoftProject.jdbg
c:\users\Florian\AppData\Local\Plus500\Main\log4delphi.log
c:\users\Florian\AppData\Local\Plus500\Main\SIL\AboutGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\AboutGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\AlertsGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\AlertsGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\BuySellGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\BuySellGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierAddressVerificationGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierAddressVerificationGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierBonusAccountGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierBonusAccountGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierDepositGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierDepositGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierEmailVerificationGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierEmailVerificationGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierFullRegistration_FSA_GUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierFullRegistration_FSA_GUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierFullRegistrationGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierFullRegistrationGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierGUIbrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierHistoryGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierHistoryGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierChangePasswordGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierChangePasswordGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierMainGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierMainGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierPhoneVerificationGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierPhoneVerificationGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierQuestionnaireGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierQuestionnaireGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierReportsGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierReportsGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierUploadDocsGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierUploadDocsGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierWithdrawGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CashierWithdrawGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\ClosePositionGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\ClosePositionGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\Countries.xml
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CreateUserGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\CreateUserGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\DontShowAgainGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\DontShowAgainGUIbrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\FavoritesSetupGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\FavoritesSetupGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\ForgotPasswordGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\ForgotPasswordGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\ChartGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\ChartGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsADXGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsADXGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsAligatorGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsAligatorGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsBollingerGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsBollingerGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsEnvelopesGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsEnvelopesGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsMACDOsMAGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsMACDOsMAGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsMovingAverageGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsMovingAverageGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsParabolicSARGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsParabolicSARGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsPeriodGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsPeriodGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsStochasticGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IndicatorsStochasticGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\InstrumentScreenGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\InstrumentScreenGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\InvestSoft.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\InvestSoftBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IsRealGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\IsRealGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\LinkMessageDlgGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\LinkMessageDlgGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\LoginGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\LoginGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\MainLobbyGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\MainLobbyGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\ProcessingGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\ProcessingGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\ProcessingSmallGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\ProcessingSmallGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\RateAlertGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\RateAlertGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\RateAlertSetupGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\RateAlertSetupGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\RateUsGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\RateUsGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\SettingsGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\SettingsGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\UploadFileGUI.sil
c:\users\Florian\AppData\Local\Plus500\Main\SIL\UploadFileGUIBrand.sil
c:\users\Florian\AppData\Local\Plus500\Update\500w.exe
c:\users\Florian\AppData\Local\Plus500\Update\500z.exe
c:\users\Florian\AppData\Local\Plus500\Update\product.ico
c:\users\Florian\AppData\Local\Plus500\Update\ResourceChange.exe
c:\users\Florian\AppData\Local\Plus500\Update\uninstall.ico
c:\users\Florian\AppData\Roaming\poclbm
c:\users\Florian\AppData\Roaming\poclbm\poclbm.ini
c:\windows\SysWow64\delete.bat
c:\windows\SysWow64\msstp.vbe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-05-13 do 2014-06-13 )))))))))))))))))))))))))))))))
.
.
2014-06-13 07:58 . 2014-06-13 07:58 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2014-06-13 07:58 . 2014-06-13 07:58 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-06-13 07:58 . 2014-06-13 07:58 -------- d-----w- c:\users\tatka\AppData\Local\temp
2014-06-13 07:58 . 2014-06-13 07:58 -------- d-----w- c:\users\postgres\AppData\Local\temp
2014-06-13 07:58 . 2014-06-13 07:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-06-12 21:45 . 2014-05-02 13:16 1031560 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{204AE9E4-9915-42AC-97EE-E47976987DFA}\gapaengine.dll
2014-06-12 21:31 . 2014-04-30 23:20 10702536 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{30D6A61F-A23A-4D03-B88C-5C74876E8AA4}\mpengine.dll
2014-06-12 21:26 . 2014-06-12 21:26 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-06-11 21:36 . 2014-04-25 02:34 801280 ----a-w- c:\windows\system32\usp10.dll
2014-06-11 21:36 . 2014-04-25 02:06 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2014-06-11 21:36 . 2014-04-05 02:47 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2014-06-11 21:36 . 2014-04-05 02:47 288192 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2014-06-11 21:34 . 2014-06-08 09:13 506368 ----a-w- c:\windows\system32\aepdu.dll
2014-06-11 21:34 . 2014-06-08 09:08 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-06-11 06:29 . 2014-04-30 23:20 10702536 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-06-06 02:46 . 2014-05-02 13:16 1031560 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5B341481-3310-480F-9C5E-DDD83443E2C7}\gapaengine.dll
2014-05-30 13:58 . 2014-06-02 17:20 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2014-05-28 19:24 . 2014-05-28 22:34 -------- d-----w- C:\FRST
2014-05-20 19:19 . 2014-05-23 12:09 -------- d-----w- c:\users\Florian\AppData\Roaming\Recolored
2014-05-20 19:18 . 2014-05-20 19:18 -------- d-----w- c:\program files (x86)\Recolored
2014-05-17 20:14 . 2014-03-25 02:43 14175744 ----a-w- c:\windows\system32\shell32.dll
2014-05-17 20:12 . 2014-04-12 02:22 155072 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-12 01:05 . 2013-06-29 01:04 95414520 ----a-w- c:\windows\system32\MRT.exe
2014-05-17 21:31 . 2012-04-12 13:06 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-17 21:31 . 2012-04-12 13:06 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-05-02 13:16 . 2012-10-02 01:13 1031560 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-04-15 00:34 . 2014-04-15 00:34 1070232 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX
2013-09-28 07:06 . 2013-09-28 07:06 83505 ----a-w- c:\program files (x86)\Uninstal.exe
2006-05-03 10:06 163328 --sha-r- c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47 31232 --sha-r- c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30 216064 --sha-r- c:\windows\SysWOW64\nbDX.dll
2010-01-06 22:00 107520 --sha-r- c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2014-05-29 1754816]
"EADM"="c:\program files (x86)\Origin\Origin.exe" [2014-04-26 3588952]
"uTorrent"="c:\users\Florian\AppData\Roaming\uTorrent\uTorrent.exe" [2014-04-28 1270352]
"pamela.exe"="c:\program files (x86)\Pamela\Pamela.exe" [2014-03-04 4244952]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-05-08 21444224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-12-09 74752]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Launcher6015N"="c:\program files (x86)\Xerox Office Printing\WorkCentre SSW\Launcher\xrlaunch.exe" [2011-05-19 2571264]
"6015N RUN"="c:\program files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmRun.exe" [2012-07-16 355840]
"StatusAutoRun6015N"="c:\program files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmpl.exe" [2012-07-16 3984896]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
.
c:\users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-20 33322312]
Rebeat UploadProcess.lnk - c:\program files (x86)\Rebeat Digital GmbH Austria\Rebeat\RebeatV1.UploadProcess.exe [2013-1-8 110592]
Trillian.lnk - c:\program files (x86)\Trillian\trillian.exe [2012-7-27 2380752]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys;c:\windows\SYSNATIVE\drivers\hitmanpro37.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\drivers\nvstusb.sys;c:\windows\SYSNATIVE\drivers\nvstusb.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 YMIDUSBW;Yamaha USB-MIDI Driver (WDM);c:\windows\system32\drivers\ymidusbx64.sys;c:\windows\SYSNATIVE\drivers\ymidusbx64.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 PaceLicenseDServices;PACE License Services;c:\program files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe;c:\program files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe [x]
S2 postgresql-x64-9.0;postgresql-x64-9.0 - PostgreSQL Server 9.0;C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N postgresql-x64-9.0 -D C:/Program Files/PostgreSQL/9.0/data -w;C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N postgresql-x64-9.0 -D C:/Program Files/PostgreSQL/9.0/data -w [x]
S2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys;c:\windows\SYSNATIVE\Drivers\Sentinel64.sys [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 XRNADB;XRcnStatutsDatabase;c:\program files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmdb.exe;c:\program files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmdb.exe [x]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\System32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\System32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
S3 L6UX2;Service - Line 6 UX2;c:\windows\system32\Drivers\L6UX264.sys;c:\windows\SYSNATIVE\Drivers\L6UX264.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2014-06-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 21:31]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-10-06 166936]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-10-06 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-10-06 416792]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to &Teleport - c:\program files (x86)\Teleport Pro\teleport.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MIF5BA~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MIF5BA~1\Office14\ONBttnIE.dll/105
Trusted Zone: line6.net
TCP: DhcpNameServer = 10.10.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Wow6432Node-HKCU-Run-SystemProc - c:\users\Public\Other\run_shc.lnk
Wow6432Node-HKLM-Run-Wondershare Helper Compact.exe - c:\program files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
Wow6432Node-HKLM-Run-MSStp - c:\windows\system32\msstp.vbe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-Mafia Game - c:\windows\system32\MafiaSetup.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_moh.exe
AddRemove-Wondershare Video Converter Ultimate-Čeština 6.0.4 - c:\program files (x86)\Wondershare\Video Converter Ultimate\Languages\Uninstall.exe
AddRemove-{08A25478-C5DD-4EA7-B168-3D687CA987FF} - c:\program files\InstallShield Installation Information\{08A25478-C5DD-4EA7-B168-3D687CA987FF}\Sims3SP05Setup.exe
AddRemove-{117B6BF6-82C3-420C-B284-9247C8568E53} - c:\program files\InstallShield Installation Information\{117B6BF6-82C3-420C-B284-9247C8568E53}\setup.exe
AddRemove-{1C9B6173-6DC9-4EEE-9EFC-6BA115CFBE43} - c:\program files\InstallShield Installation Information\{1C9B6173-6DC9-4EEE-9EFC-6BA115CFBE43}\Sims3SP07Setup.exe
AddRemove-{3BBFD444-5FAB-49F6-98B1-A1954E831399} - c:\program files\InstallShield Installation Information\{3BBFD444-5FAB-49F6-98B1-A1954E831399}\Sims3EP06Setup.exe
AddRemove-{3DE92282-CB49-434F-81BF-94E5B380E889} - c:\program files\InstallShield Installation Information\{3DE92282-CB49-434F-81BF-94E5B380E889}\Sims3EP08Setup.exe
AddRemove-{45057FCE-5784-48BE-8176-D9D00AF56C3C} - c:\program files\InstallShield Installation Information\{45057FCE-5784-48BE-8176-D9D00AF56C3C}\setup.exe
AddRemove-{71828142-5A24-4BD0-97E7-976DA08CE6CF} - c:\program files\InstallShield Installation Information\{71828142-5A24-4BD0-97E7-976DA08CE6CF}\setup.exe
AddRemove-{7B11296A-F894-449C-8DF6-6AAAA7D4D118} - c:\program files\InstallShield Installation Information\{7B11296A-F894-449C-8DF6-6AAAA7D4D118}\Sims3SP04Setup.exe
AddRemove-{910F4A29-1134-49E0-AD8B-56E4A3152BD1} - c:\program files\InstallShield Installation Information\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}\setup.exe
AddRemove-{9B2506E3-9A3F-45B5-96BF-509CAD584650} - c:\program files\InstallShield Installation Information\{9B2506E3-9A3F-45B5-96BF-509CAD584650}\Sims3SP06Setup.exe
AddRemove-{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1} - c:\program files\InstallShield Installation Information\{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}\Sims3EP07Setup.exe
AddRemove-{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC} - c:\program files\InstallShield Installation Information\{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}\setup.exe
AddRemove-{C05D8CDB-417D-4335-A38C-A0659EDFD6B8} - c:\program files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\setup.exe
AddRemove-{C12631C6-804D-4B32-B0DD-8A496462F106} - c:\program files\InstallShield Installation Information\{C12631C6-804D-4B32-B0DD-8A496462F106}\Sims3EP05Setup.exe
AddRemove-{E1868CAE-E3B9-4099-8C18-AA8944D336FD} - c:\program files\InstallShield Installation Information\{E1868CAE-E3B9-4099-8C18-AA8944D336FD}\Sims3SP08Setup.exe
AddRemove-{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC} - c:\program files\InstallShield Installation Information\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}\Sims3EP04Setup.exe
AddRemove-{ED436EA8-4145-4703-AE5D-4D09DD24AF5A} - c:\program files\InstallShield Installation Information\{ED436EA8-4145-4703-AE5D-4D09DD24AF5A}\setup.exe
AddRemove-{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36} - c:\program files\InstallShield Installation Information\{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}\Sims3EP09Setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-x64-9.0]
"ImagePath"="C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N \"postgresql-x64-9.0\" -D \"C:/Program Files/PostgreSQL/9.0/data\" -w"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-x64-9.0]
"ImagePath"="C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N \"postgresql-x64-9.0\" -D \"C:/Program Files/PostgreSQL/9.0/data\" -w"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:41,2e,8f,b8,2d,d2,71,35,45,6b,06,7c,56,d0,19,5d,ba,ca,c0,a6,9b,
e0,52,01,42,76,7f,45,a1,63,fb,42,53,43,ec,6e,29,ec,a4,11,50,ae,16,2a,c4,3f,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.13"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:41,2e,8f,b8,2d,d2,71,35,45,6b,06,7c,56,d0,19,5d,ba,ca,c0,a6,9b,
e0,52,01,42,76,7f,45,a1,63,fb,42,53,43,ec,6e,29,ec,a4,11,50,ae,16,2a,c4,3f,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-06-13 10:01:55
ComboFix-quarantined-files.txt 2014-06-13 08:01
.
Před spuštěním: Volných bajtů: 220 212 916 224
Po spuštění: Volných bajtů: 225 587 400 704
.
- - End Of File - - F7471CDDAD84FA44473EBD8F153187DB
A36C5E4F47E84449FF07ED3517B43A31

Ještě dočistíme. Otevřte poznámkový blok a zkopírujte do něj:

KillAll::

Driver::
BBSvc
BBUpdate

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Regnull::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]

Reboot::

Uložte na plochu jako CFScript.txt. Pak jej myší přšetáhněte nad ikonu ComboFix a pusťte. CF se spustí a vykoná příkazy ze skriptu.

ComboFix 14-07-03.01 - Florian 04.07.2014 23:33:41.2.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1250.420.1029.18.8175.5798 [GMT 2:00]
Spuštěný z: c:\users\Florian\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Florian\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Java\jre7\bin\jp2ssv.dll
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_BBSvc
-------\Service_BBUpdate
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-06-04 do 2014-07-04 )))))))))))))))))))))))))))))))
.
.
2014-07-04 21:44 . 2014-07-04 21:44 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2014-07-04 21:44 . 2014-07-04 21:44 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-07-04 21:44 . 2014-07-04 21:44 -------- d-----w- c:\users\tatka\AppData\Local\temp
2014-07-04 21:44 . 2014-07-04 21:44 -------- d-----w- c:\users\postgres\AppData\Local\temp
2014-07-04 21:44 . 2014-07-04 21:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-07-04 20:14 . 2014-05-02 13:16 1031560 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{00491774-F62B-41A5-8F10-F69F6397D15A}\gapaengine.dll
2014-07-04 20:14 . 2014-06-05 10:54 10779000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0632EA9F-E3CA-479D-8C94-BDA6F906C563}\mpengine.dll
2014-07-04 18:51 . 2014-07-04 18:51 -------- d-----w- C:\ce1ed403a68f5c79272b07c63cfc2b
2014-06-22 00:03 . 2014-06-05 10:54 10779000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-06-12 21:26 . 2014-06-12 21:26 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-06-11 21:36 . 2014-04-25 02:34 801280 ----a-w- c:\windows\system32\usp10.dll
2014-06-11 21:36 . 2014-04-25 02:06 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2014-06-11 21:36 . 2014-04-05 02:47 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2014-06-11 21:36 . 2014-04-05 02:47 288192 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2014-06-11 21:34 . 2014-06-08 09:13 506368 ----a-w- c:\windows\system32\aepdu.dll
2014-06-11 21:34 . 2014-06-08 09:08 424448 ----a-w- c:\windows\system32\aeinv.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-21 17:21 . 2014-06-17 18:23 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2014-06-12 01:05 . 2013-06-29 01:04 95414520 ----a-w- c:\windows\system32\MRT.exe
2014-05-17 21:31 . 2012-04-12 13:06 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-17 21:31 . 2012-04-12 13:06 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-05-02 13:16 . 2012-10-02 01:13 1031560 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-04-15 00:34 . 2014-04-15 00:34 1070232 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX
2014-04-12 02:22 . 2014-05-17 20:12 155072 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2014-04-12 02:22 . 2014-05-17 20:12 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2014-04-12 02:19 . 2014-05-17 20:12 136192 ----a-w- c:\windows\system32\sspicli.dll
2014-04-12 02:19 . 2014-05-17 20:12 29184 ----a-w- c:\windows\system32\sspisrv.dll
2014-04-12 02:19 . 2014-05-17 20:12 28160 ----a-w- c:\windows\system32\secur32.dll
2014-04-12 02:19 . 2014-05-17 20:13 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-04-12 02:19 . 2014-05-17 20:12 31232 ----a-w- c:\windows\system32\lsass.exe
2014-04-12 02:12 . 2014-05-17 20:12 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-04-12 02:10 . 2014-05-17 20:12 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2013-09-28 07:06 . 2013-09-28 07:06 83505 ----a-w- c:\program files (x86)\Uninstal.exe
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2014-06-30 1753280]
"EADM"="c:\program files (x86)\Origin\Origin.exe" [2014-07-04 3595608]
"uTorrent"="c:\users\Florian\AppData\Roaming\uTorrent\uTorrent.exe" [2014-04-28 1270352]
"pamela.exe"="c:\program files (x86)\Pamela\Pamela.exe" [2014-03-04 4244952]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-05-08 21444224]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-12-09 74752]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Launcher6015N"="c:\program files (x86)\Xerox Office Printing\WorkCentre SSW\Launcher\xrlaunch.exe" [2011-05-19 2571264]
"6015N RUN"="c:\program files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmRun.exe" [2012-07-16 355840]
"StatusAutoRun6015N"="c:\program files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmpl.exe" [2012-07-16 3984896]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
.
c:\users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-20 33322312]
Rebeat UploadProcess.lnk - c:\program files (x86)\Rebeat Digital GmbH Austria\Rebeat\RebeatV1.UploadProcess.exe [2013-1-8 110592]
Trillian.lnk - c:\program files (x86)\Trillian\trillian.exe [2012-7-27 2380752]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 MpKsld2a4f5d2;MpKsld2a4f5d2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B1F72D3C-D91D-476F-95D0-8EBC7EF24E86}\MpKsld2a4f5d2.sys;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B1F72D3C-D91D-476F-95D0-8EBC7EF24E86}\MpKsld2a4f5d2.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys;c:\windows\SYSNATIVE\drivers\hitmanpro37.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola sítě Microsoft;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\drivers\nvstusb.sys;c:\windows\SYSNATIVE\drivers\nvstusb.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 YMIDUSBW;Yamaha USB-MIDI Driver (WDM);c:\windows\system32\drivers\ymidusbx64.sys;c:\windows\SYSNATIVE\drivers\ymidusbx64.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 PaceLicenseDServices;PACE License Services;c:\program files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe;c:\program files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe [x]
S2 postgresql-x64-9.0;postgresql-x64-9.0 - PostgreSQL Server 9.0;C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N postgresql-x64-9.0 -D C:/Program Files/PostgreSQL/9.0/data -w;C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N postgresql-x64-9.0 -D C:/Program Files/PostgreSQL/9.0/data -w [x]
S2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys;c:\windows\SYSNATIVE\Drivers\Sentinel64.sys [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 XRNADB;XRcnStatutsDatabase;c:\program files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmdb.exe;c:\program files (x86)\Xerox Office Printing\WorkCentre SSW\PrintingScout\xrksmdb.exe [x]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\System32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\System32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
S3 L6UX2;Service - Line 6 UX2;c:\windows\system32\Drivers\L6UX264.sys;c:\windows\SYSNATIVE\Drivers\L6UX264.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2014-07-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 21:31]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Florian\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-10-06 166936]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-10-06 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-10-06 416792]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to &Teleport - c:\program files (x86)\Teleport Pro\teleport.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MIF5BA~1\Office14\EXCEL.EXE/3000
IE: Od&eslat do aplikace OneNote - c:\progra~2\MIF5BA~1\Office14\ONBttnIE.dll/105
Trusted Zone: line6.net
TCP: DhcpNameServer = 10.10.1.1
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
AddRemove-Mafia Game - c:\windows\system32\MafiaSetup.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_moh.exe
AddRemove-Wondershare Video Converter Ultimate-Čeština 6.0.4 - c:\program files (x86)\Wondershare\Video Converter Ultimate\Languages\Uninstall.exe
AddRemove-{08A25478-C5DD-4EA7-B168-3D687CA987FF} - c:\program files\InstallShield Installation Information\{08A25478-C5DD-4EA7-B168-3D687CA987FF}\Sims3SP05Setup.exe
AddRemove-{117B6BF6-82C3-420C-B284-9247C8568E53} - c:\program files\InstallShield Installation Information\{117B6BF6-82C3-420C-B284-9247C8568E53}\setup.exe
AddRemove-{1C9B6173-6DC9-4EEE-9EFC-6BA115CFBE43} - c:\program files\InstallShield Installation Information\{1C9B6173-6DC9-4EEE-9EFC-6BA115CFBE43}\Sims3SP07Setup.exe
AddRemove-{3BBFD444-5FAB-49F6-98B1-A1954E831399} - c:\program files\InstallShield Installation Information\{3BBFD444-5FAB-49F6-98B1-A1954E831399}\Sims3EP06Setup.exe
AddRemove-{3DE92282-CB49-434F-81BF-94E5B380E889} - c:\program files\InstallShield Installation Information\{3DE92282-CB49-434F-81BF-94E5B380E889}\Sims3EP08Setup.exe
AddRemove-{45057FCE-5784-48BE-8176-D9D00AF56C3C} - c:\program files\InstallShield Installation Information\{45057FCE-5784-48BE-8176-D9D00AF56C3C}\setup.exe
AddRemove-{71828142-5A24-4BD0-97E7-976DA08CE6CF} - c:\program files\InstallShield Installation Information\{71828142-5A24-4BD0-97E7-976DA08CE6CF}\setup.exe
AddRemove-{7B11296A-F894-449C-8DF6-6AAAA7D4D118} - c:\program files\InstallShield Installation Information\{7B11296A-F894-449C-8DF6-6AAAA7D4D118}\Sims3SP04Setup.exe
AddRemove-{910F4A29-1134-49E0-AD8B-56E4A3152BD1} - c:\program files\InstallShield Installation Information\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}\setup.exe
AddRemove-{9B2506E3-9A3F-45B5-96BF-509CAD584650} - c:\program files\InstallShield Installation Information\{9B2506E3-9A3F-45B5-96BF-509CAD584650}\Sims3SP06Setup.exe
AddRemove-{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1} - c:\program files\InstallShield Installation Information\{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}\Sims3EP07Setup.exe
AddRemove-{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC} - c:\program files\InstallShield Installation Information\{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}\setup.exe
AddRemove-{C05D8CDB-417D-4335-A38C-A0659EDFD6B8} - c:\program files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\setup.exe
AddRemove-{C12631C6-804D-4B32-B0DD-8A496462F106} - c:\program files\InstallShield Installation Information\{C12631C6-804D-4B32-B0DD-8A496462F106}\Sims3EP05Setup.exe
AddRemove-{E1868CAE-E3B9-4099-8C18-AA8944D336FD} - c:\program files\InstallShield Installation Information\{E1868CAE-E3B9-4099-8C18-AA8944D336FD}\Sims3SP08Setup.exe
AddRemove-{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC} - c:\program files\InstallShield Installation Information\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}\Sims3EP04Setup.exe
AddRemove-{ED436EA8-4145-4703-AE5D-4D09DD24AF5A} - c:\program files\InstallShield Installation Information\{ED436EA8-4145-4703-AE5D-4D09DD24AF5A}\setup.exe
AddRemove-{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36} - c:\program files\InstallShield Installation Information\{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}\Sims3EP09Setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-x64-9.0]
"ImagePath"="C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N \"postgresql-x64-9.0\" -D \"C:/Program Files/PostgreSQL/9.0/data\" -w"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-x64-9.0]
"ImagePath"="C:/Program Files/PostgreSQL/9.0/bin/pg_ctl.exe runservice -N \"postgresql-x64-9.0\" -D \"C:/Program Files/PostgreSQL/9.0/data\" -w"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:41,2e,8f,b8,2d,d2,71,35,45,6b,06,7c,56,d0,19,5d,ba,ca,c0,a6,9b,
e0,52,01,42,76,7f,45,a1,63,fb,42,53,43,ec,6e,29,ec,a4,11,50,ae,16,2a,c4,3f,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:41,2e,8f,b8,2d,d2,71,35,45,6b,06,7c,56,d0,19,5d,ba,ca,c0,a6,9b,
e0,52,01,42,76,7f,45,a1,63,fb,42,53,43,ec,6e,29,ec,a4,11,50,ae,16,2a,c4,3f,\
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
c:\users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\Florian\AppData\Local\Google\Chrome\Application\chrome.exe
.
**************************************************************************
.
Celkový čas: 2014-07-04 23:59:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-07-04 21:59
ComboFix2.txt 2014-06-13 08:01
.
Před spuštěním: Volných bajtů: 215 847 972 864
Po spuštění: Volných bajtů: 220 327 895 040
.
- - End Of File - - ECB97E4216BE315E9C5C51846C673D34
A36C5E4F47E84449FF07ED3517B43A31

Smazáno. Nastala nějaká změna?