VIRY.CZ

Logfile of random's system information tool 1.10 (written by random/random)
Run by ZM at 2014-10-15 21:40:25
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 195 GB (70%) free of 278 GB
Total RAM: 4010 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:40:35, on 15.10.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17344)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe
C:\Program Files (x86)\Samsung\Easy Software Manager\SWMAgent.exe
C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe
C:\Program Files (x86)\Samsung\Easy Settings\SCCSpeedBoot.exe
C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe
C:\Program Files\Activ Software\ActivDriver\activmgr.exe
C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe
D:\ZM\Downloads\RSIT.exe
D:\ZM\Downloads\ZM.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1571869238-3936240484-2151935606-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1571869238-3936240484-2151935606-1000\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll C:\windows\SysWOW64\nvinit.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Bluetooth 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bluetooth Device Monitor - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel(R) Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: eBeam Device Service - Luidia, Inc. - C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Foxit Cloud Safe Update Service (FoxitCloudUpdateService) - Foxit Corporation - C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: SInstalátor (ssinstall) - PS Media s.r.o. - C:\windows\SysWOW64\ssins.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11687 bytes

======Scheduled tasks folder======

C:\windows\tasks\Adobe Flash Player Updater.job - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "https://www.seznam.cz/?clid=22668"
prefs.js - "keyword.URL" - "http://search.seznam.cz/?sourceid=quick ... earchTerms}&"

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF
"{ACAA314B-EEBA-48e4-AD47-84E31C44796C}"=C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.152 Plugin
"Path"=C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf]
"Description"=
"Path"=C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.67.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.67.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
xmlfiller@software602.cz

C:\Program Files (x86)\Mozilla Firefox\components\
nsIFillerPlugin.xpt

C:\Program Files (x86)\Mozilla Firefox\plugins\
npfiller.dll
NPOFFICE.DLL
nppdf32.dll
npwachk.dll

C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default\extensions\
{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default\searchplugins\
ask-search.xml
askcom.xml
bing-avast.xml
Google.xml
seznam-avast.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-25 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-07-04 457712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-25 171944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SSDMonitor"=C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [2011-12-12 103896]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-08-01 4085896]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-08-21 959176]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-07-25 256896]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll C:\windows\SysWOW64\nvinit.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\SysWOW64\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.siren"=sirenacm.dll
"vidc.tscc"=tsccvid.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-10-15 21:15:58 ----D---- C:\rsit
2014-10-15 20:55:48 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-15 20:54:47 ----A---- C:\windows\SysWOW64\ssinstall-uninstall.bat
2014-10-15 20:54:45 ----A---- C:\windows\SysWOW64\ssins.exe
2014-10-15 20:54:05 ----A---- C:\windows\SysWOW64\mscorier.dll
2014-10-15 20:54:05 ----A---- C:\windows\SysWOW64\dfshim.dll
2014-10-15 20:54:04 ----A---- C:\windows\SysWOW64\mscories.dll
2014-10-15 20:53:38 ----A---- C:\windows\SysWOW64\blackbox.dll
2014-10-15 20:53:35 ----A---- C:\windows\SysWOW64\drmv2clt.dll
2014-10-15 20:53:29 ----A---- C:\windows\SysWOW64\wmdrmsdk.dll
2014-10-15 20:53:27 ----A---- C:\windows\SysWOW64\wmp.dll
2014-10-15 20:53:17 ----A---- C:\windows\SysWOW64\mf.dll
2014-10-15 20:53:16 ----A---- C:\windows\SysWOW64\drmmgrtn.dll
2014-10-15 20:53:15 ----A---- C:\windows\SysWOW64\AUDIOKSE.dll
2014-10-15 20:53:12 ----A---- C:\windows\SysWOW64\AudioSes.dll
2014-10-15 20:53:06 ----A---- C:\windows\SysWOW64\ntkrnlpa.exe
2014-10-15 20:53:03 ----A---- C:\windows\SysWOW64\cryptsvc.dll
2014-10-15 20:53:02 ----A---- C:\windows\SysWOW64\wintrust.dll
2014-10-15 20:53:00 ----A---- C:\windows\SysWOW64\ntoskrnl.exe
2014-10-15 20:52:59 ----A---- C:\windows\SysWOW64\quartz.dll
2014-10-15 20:52:59 ----A---- C:\windows\SysWOW64\evr.dll
2014-10-15 20:52:58 ----A---- C:\windows\SysWOW64\cryptui.dll
2014-10-15 20:52:58 ----A---- C:\windows\SysWOW64\crypt32.dll
2014-10-15 20:52:57 ----A---- C:\windows\SysWOW64\mfplat.dll
2014-10-15 20:52:55 ----A---- C:\windows\SysWOW64\cryptsp.dll
2014-10-15 20:52:55 ----A---- C:\windows\SysWOW64\AudioEng.dll
2014-10-15 20:52:43 ----A---- C:\windows\SysWOW64\msscp.dll
2014-10-15 20:52:35 ----A---- C:\windows\SysWOW64\msnetobj.dll
2014-10-15 20:52:32 ----A---- C:\windows\SysWOW64\rrinstaller.exe
2014-10-15 20:52:30 ----A---- C:\windows\SysWOW64\mfps.dll
2014-10-15 20:52:29 ----A---- C:\windows\SysWOW64\srclient.dll
2014-10-15 20:52:29 ----A---- C:\windows\SysWOW64\mfpmp.exe
2014-10-15 20:52:29 ----A---- C:\windows\SysWOW64\appidapi.dll
2014-10-15 20:52:28 ----A---- C:\windows\SysWOW64\spwmp.dll
2014-10-15 20:52:28 ----A---- C:\windows\SysWOW64\mferror.dll
2014-10-15 20:52:28 ----A---- C:\windows\SysWOW64\dxmasf.dll
2014-10-15 20:52:26 ----A---- C:\windows\SysWOW64\wmploc.DLL
2014-10-15 20:51:53 ----A---- C:\windows\SysWOW64\iernonce.dll
2014-10-15 20:51:52 ----A---- C:\windows\SysWOW64\ieetwproxystub.dll
2014-10-15 20:51:47 ----A---- C:\windows\SysWOW64\urlmon.dll
2014-10-15 20:51:47 ----A---- C:\windows\SysWOW64\mshtmled.dll
2014-10-15 20:51:47 ----A---- C:\windows\SysWOW64\jscript9diag.dll
2014-10-15 20:51:47 ----A---- C:\windows\SysWOW64\iedkcs32.dll
2014-10-15 20:51:46 ----A---- C:\windows\SysWOW64\msfeeds.dll
2014-10-15 20:51:46 ----A---- C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-15 20:51:46 ----A---- C:\windows\SysWOW64\dxtmsft.dll
2014-10-15 20:51:45 ----A---- C:\windows\SysWOW64\mshtml.dll
2014-10-15 20:51:44 ----A---- C:\windows\SysWOW64\iesetup.dll
2014-10-15 20:51:42 ----A---- C:\windows\SysWOW64\iertutil.dll
2014-10-15 20:51:41 ----A---- C:\windows\SysWOW64\jsproxy.dll
2014-10-15 20:51:40 ----A---- C:\windows\SysWOW64\ieui.dll
2014-10-15 20:51:40 ----A---- C:\windows\SysWOW64\ieframe.dll
2014-10-15 20:51:40 ----A---- C:\windows\SysWOW64\dxtrans.dll
2014-10-15 20:51:34 ----A---- C:\windows\SysWOW64\mshtmlmedia.dll
2014-10-15 20:51:34 ----A---- C:\windows\SysWOW64\jscript9.dll
2014-10-15 20:51:34 ----A---- C:\windows\SysWOW64\ieUnatt.exe
2014-10-15 20:51:33 ----A---- C:\windows\SysWOW64\wininet.dll
2014-10-15 20:51:33 ----A---- C:\windows\SysWOW64\vbscript.dll
2014-10-15 20:51:33 ----A---- C:\windows\SysWOW64\ieapfltr.dll
2014-10-15 20:51:32 ----A---- C:\windows\SysWOW64\msrating.dll
2014-10-15 20:51:32 ----A---- C:\windows\SysWOW64\MshtmlDac.dll
2014-10-15 20:50:38 ----A---- C:\windows\SysWOW64\msi.dll
2014-10-15 20:50:15 ----A---- C:\windows\SysWOW64\rastls.dll
2014-10-15 20:50:01 ----A---- C:\windows\SysWOW64\mstscax.dll
2014-10-15 20:49:56 ----A---- C:\windows\SysWOW64\mstsc.exe
2014-10-15 20:49:55 ----A---- C:\windows\SysWOW64\winsta.dll
2014-10-15 20:49:53 ----A---- C:\windows\SysWOW64\aaclient.dll
2014-10-15 20:49:52 ----A---- C:\windows\SysWOW64\TSpkg.dll
2014-10-15 20:49:51 ----A---- C:\windows\SysWOW64\credssp.dll
2014-10-15 20:49:15 ----A---- C:\windows\SysWOW64\packager.dll
2014-10-02 19:19:53 ----A---- C:\autoexec.bat
2014-10-02 19:04:16 ----D---- C:\windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-10-02 19:04:11 ----D---- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2014-10-01 18:22:02 ----A---- C:\windows\SysWOW64\qdvd.dll
2014-09-28 20:52:55 ----D---- C:\Program Files (x86)\SearchProtect
2014-09-28 20:52:34 ----D---- C:\Users\ZM\AppData\Roaming\WebExtend
2014-09-25 06:21:07 ----D---- C:\Program Files (x86)\Mozilla Firefox
2014-09-24 14:09:59 ----A---- C:\windows\SysWOW64\tzres.dll
2014-09-22 20:07:02 ----D---- C:\ProgramData\APN
2014-09-22 20:04:57 ----D---- C:\Program Files (x86)\Common Files\Java
2014-09-22 20:04:52 ----A---- C:\windows\SysWOW64\javaws.exe
2014-09-22 20:04:44 ----A---- C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-09-22 20:04:44 ----A---- C:\windows\SysWOW64\javaw.exe
2014-09-22 20:04:44 ----A---- C:\windows\SysWOW64\java.exe
2014-09-17 15:33:07 ----D---- C:\Program Files (x86)\Common Files\SWF Studio
2014-09-17 14:56:26 ----D---- C:\Program Files (x86)\VESMAT4
2014-09-16 22:28:37 ----A---- C:\windows\SysWOW64\msmpeg2vdec.dll
2014-09-16 17:24:13 ----A---- C:\windows\SysWOW64\TSWorkspace.dll
2014-09-16 17:24:05 ----A---- C:\windows\SysWOW64\d3d10warp.dll
2014-09-16 17:20:18 ----A---- C:\windows\SysWOW64\kerberos.dll
2014-09-16 17:20:13 ----A---- C:\windows\SysWOW64\secur32.dll
2014-09-16 17:20:12 ----A---- C:\windows\SysWOW64\sspicli.dll

======List of files/folders modified in the last 1 month======

2014-10-15 21:40:36 ----RSD---- C:\windows\assembly
2014-10-15 21:36:43 ----D---- C:\windows\Temp
2014-10-15 21:35:18 ----A---- C:\windows\SysWOW64\log.txt
2014-10-15 21:35:08 ----D---- C:\windows\Microsoft.NET
2014-10-15 21:34:45 ----D---- C:\windows\winsxs
2014-10-15 21:29:49 ----D---- C:\windows\SysWOW64
2014-10-15 21:29:49 ----D---- C:\windows\System32
2014-10-15 21:29:45 ----D---- C:\windows\SysWOW64\Dism
2014-10-15 21:29:45 ----D---- C:\windows\SysWOW64\cs-CZ
2014-10-15 21:29:45 ----D---- C:\Program Files (x86)\Windows Media Player
2014-10-15 21:29:44 ----D---- C:\windows\SysWOW64\en-US
2014-10-15 21:29:43 ----D---- C:\Program Files (x86)\Internet Explorer
2014-10-15 21:28:50 ----SHD---- C:\windows\Installer
2014-10-15 21:24:11 ----D---- C:\ProgramData\Microsoft Help
2014-10-15 21:08:43 ----D---- C:\windows\debug
2014-10-15 21:08:20 ----SHD---- C:\System Volume Information
2014-10-15 20:55:48 ----D---- C:\Program Files (x86)
2014-10-15 20:49:31 ----SD---- C:\Users\ZM\AppData\Roaming\Microsoft
2014-10-15 20:37:03 ----D---- C:\Users\ZM\AppData\Roaming\Skype
2014-10-15 20:34:28 ----D---- C:\Windows
2014-10-15 20:27:34 ----D---- C:\windows\Tasks
2014-10-15 20:27:31 ----D---- C:\windows\inf
2014-10-15 20:27:31 ----D---- C:\Users\ZM\AppData\Roaming\Promethean
2014-10-15 20:27:28 ----D---- C:\ProgramData\WinClon
2014-10-15 20:27:23 ----D---- C:\windows\registration
2014-10-15 18:44:06 ----D---- C:\windows\Prefetch
2014-10-14 07:43:01 ----AD---- C:\ProgramData\Temp
2014-10-06 06:16:22 ----A---- C:\windows\SysWOW64\FlashPlayerApp.exe
2014-10-02 19:11:46 ----D---- C:\Users\ZM\AppData\Roaming\WildTangent
2014-10-02 19:11:46 ----D---- C:\ProgramData\WildTangent
2014-10-02 19:05:36 ----D---- C:\Program Files
2014-10-02 19:04:11 ----D---- C:\Program Files (x86)\Common Files
2014-10-02 06:19:39 ----D---- C:\Users\ZM\AppData\Roaming\Winamp
2014-09-28 20:53:08 ----D---- C:\windows\AppPatch
2014-09-25 14:03:53 ----D---- C:\windows\rescache
2014-09-24 13:56:59 ----HD---- C:\ProgramData
2014-09-22 20:05:07 ----D---- C:\ProgramData\Oracle
2014-09-22 20:04:42 ----D---- C:\Program Files (x86)\Java
2014-09-16 22:36:00 ----A---- C:\windows\SysWOW64\PerfStringBackup.INI
2014-09-16 17:00:50 ----D---- C:\windows\PolicyDefinitions
2014-09-16 17:00:46 ----D---- C:\windows\schemas
2014-09-16 17:00:20 ----D---- C:\windows\AppCompat
2014-09-16 17:00:14 ----D---- C:\Program Files (x86)\Common Files\microsoft shared

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswKbd;aswKbd; C:\windows\SysWOW64\drivers\aswKbd.sys []
R0 aswRvrt;avast! Revert; C:\windows\SysWOW64\drivers\aswRvrt.sys []
R0 aswVmm;avast! VM Monitor; C:\windows\SysWOW64\drivers\aswVmm.sys []
R0 iaStor;Intel AHCI Controller; C:\windows\system32\DRIVERS\iaStor.sys []
R0 nvpciflt;nvpciflt; C:\windows\system32\DRIVERS\nvpciflt.sys []
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys []
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr2.sys []
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys []
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys []
R1 SABI;SAMSUNG Kernel Driver For Windows 7; \??\C:\windows\system32\Drivers\SABI.sys []
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys []
R2 aswHwid;avast! HardwareID; C:\windows\system32\drivers\aswHwid.sys []
R2 aswMonFlt;aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys []
R2 aswStm;aswStm; C:\windows\system32\drivers\aswStm.sys []
R2 SGDrv;SGDrv; C:\windows\system32\DRIVERS\SGdrv64.sys []
R3 AMPPAL;Virtuální adaptér Intel(R) Centrino(R) Bluetooth 3.0 + High Speed; C:\windows\system32\DRIVERS\AMPPAL.sys []
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\windows\system32\drivers\BthEnum.sys []
R3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys []
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys []
R3 btmaux;Intel Bluetooth Auxiliary Service; C:\windows\system32\DRIVERS\btmaux.sys []
R3 btmhsf;btmhsf; C:\windows\system32\DRIVERS\btmhsf.sys []
R3 clwvd;CyberLink WebCam Virtual Driver; C:\windows\system32\DRIVERS\clwvd.sys []
R3 ETD;ELAN PS/2 Port Input Device; C:\windows\system32\DRIVERS\ETD.sys []
R3 iBtFltCoex;iBtFltCoex; C:\windows\system32\DRIVERS\iBtFltCoex.sys []
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys []
R3 IntcDAud;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys []
R3 MEIx64;Intel(R) Management Engine Interface; C:\windows\system32\DRIVERS\HECIx64.sys []
R3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit; C:\windows\system32\DRIVERS\NETwNs64.sys []
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\system32\DRIVERS\rfcomm.sys []
R3 RTL8167;Realtek 8167 NT Driver; C:\windows\system32\DRIVERS\Rt64win7.sys []
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys []
S3 AMPPALP;Protokol Intel(R) Centrino(R) Bluetooth 3.0 + High Speed; C:\windows\system32\DRIVERS\amppal.sys []
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys []
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys []
S3 rtport;rtport; \??\C:\windows\SysWOW64\drivers\rtport.sys [2011-09-19 15144]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\windows\system32\DRIVERS\ss_bus.sys []
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\windows\system32\DRIVERS\ss_mdfl.sys []
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\windows\system32\DRIVERS\ss_mdm.sys []
S3 TsUsbFlt;TsUsbFlt; C:\windows\system32\drivers\tsusbflt.sys []
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\windows\system32\drivers\TsUsbGD.sys []
S3 WinUsb;WinUsb; C:\windows\system32\DRIVERS\WinUsb.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2010-04-14 73728]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-09-12 64704]
R2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service; C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-04-21 1136640]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-07-04 50344]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-03-30 923984]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-03-30 1001808]
R2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service; C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-04-21 134928]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
R2 eBeam Device Service;eBeam Device Service; C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe [2009-09-17 180224]
R2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [2014-03-11 241728]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2011-05-05 326424]
R2 NVSvc;NVIDIA Driver Helper Service; C:\windows\system32\nvvsvc.exe []
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-06-05 1997416]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-12-12 793048]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [2009-12-01 244904]
R2 ssinstall;SInstalátor; C:\windows\SysWOW64\ssins.exe [2014-10-15 2324216]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-05-05 2656536]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 Bluetooth Media Service;Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-03-30 1321296]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-18 136176]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-06 267440]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-18 136176]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\windows\system32\IEEtwCollector.exe /V []
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-09-18 114288]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe []
S4 aspnet_state;Stavová služba ASP.NET; C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S4 NetMsmqActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------

Zdravim


Stahnete AdwCleaner https://toolslib.net/downloads/finish/1/ a ulozte ho na plochu.
Ukoncete vsechny programy, jinak to AdwCleaner udela za vas.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce.
Kliknete na Scan a pockejte, az kontrola dobehne.
Pak kliknete na Clean
Program zacne pracovat (muze dojit k restartu pc) a vyplivne log (pripadne bude zde C:\AdwCleaner\AdwCleaner [S?].txt ). Ten mi sem zkopirujte.


Mate 64bit system, takze potrebuji log z tohoto RSIT http://images.malwareremoval.com/random/RSITx64.exe

Nový log z RSIT
Logfile of random's system information tool 1.10 (written by random/random)
Run by ZM at 2014-10-16 16:29:56
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 192 GB (69%) free of 278 GB
Total RAM: 4010 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:30:01, on 16.10.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17344)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe
C:\Program Files (x86)\Samsung\Easy Software Manager\SWMAgent.exe
C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe
C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe
C:\Program Files\Activ Software\ActivDriver\activmgr.exe
C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe
C:\windows\SysWOW64\NOTEPAD.EXE
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
D:\ZM\Downloads\ZM.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ˙ţ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1571869238-3936240484-2151935606-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1571869238-3936240484-2151935606-1000\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll C:\windows\SysWOW64\nvinit.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Bluetooth 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bluetooth Device Monitor - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel(R) Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: eBeam Device Service - Luidia, Inc. - C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Foxit Cloud Safe Update Service (FoxitCloudUpdateService) - Foxit Corporation - C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: SInstalátor (ssinstall) - PS Media s.r.o. - C:\windows\SysWOW64\ssins.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11932 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\lsm.exe
winlogon.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\nvvsvc.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe"
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
"C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe"
C:\windows\system32\svchost.exe -k bthsvcs
"C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe"
"C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe"
"C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe"
"C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe"
"C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe"
C:\windows\SysWOW64\ssins.exe
C:\windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe"
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-05168049-61b6-4061-bccd-810e8fee109c -SystemEventPortName:HostProcess-9ceddefa-66cb-4fdc-a168-cf10d0922f3a -IoCancelEventPortName:HostProcess-befc06cf-da9e-473d-bf99-253163d2c4be -NonStateChangingEventPortName:HostProcess-cbba082f-964f-4144-9a2c-56e53a6e9675 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:0e02b859-396f-4b1b-bf87-5897159f2942 -DeviceGroupId:WpdFsGroup
C:\windows\system32\wbem\wmiprvse.exe
"C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe"
C:\windows\system32\nvvsvc.exe -session -first
"taskhost.exe"
taskeng.exe {23AC3115-B16A-49DD-9378-DA494240776F}
"C:\windows\system32\Dwm.exe"
C:\windows\Explorer.EXE
C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe -medIL
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Samsung\Easy Software Manager\SWMAgent.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"
taskeng.exe {E95B257B-830B-4AB7-A714-9D746BF663C1}
"C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe"
"C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe"
"C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"
"C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe"
"C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
"C:\Program Files\Elantech\ETDCtrl.exe"
"C:\Program Files\Activ Software\ActivDriver\ActivControl2x64.exe"
"C:\Program Files\Activ Software\ActivDriver\activmgr.exe"
"C:\Program Files\Elantech\ETDCtrlHelper.exe"
C:\windows\system32\igfxext.exe -Embedding
C:\windows\system32\igfxsrvc.exe -Embedding
"C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
"C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe"
C:\windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe" -Embedding
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\windows\System32\svchost.exe -k secsvcs
C:\windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe"
C:\windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 5352
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\windows\system32\svchost.exe -k SDRSVC
"C:\windows\system32\NOTEPAD.EXE" C:\rsit\log.txt
"C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
"C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe"
C:\windows\system32\hkcmd.exe
C:\windows\system32\igfxpers.exe
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" /e
"C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE"
C:\windows\splwow64.exe 8192
taskeng.exe {F0E8CFCA-4C4E-48BD-BEDE-0D96138D9BDE}

"C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe11_ Global\UsGthrCtrlFltPipeMssGthrPipe11 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"D:\ZM\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\windows\tasks\Adobe Flash Player Updater.job - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "https://www.seznam.cz/?clid=22668"
prefs.js - "keyword.URL" - "http://search.seznam.cz/?sourceid=quick ... earchTerms}&"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.152 Plugin
"Path"=C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf]
"Description"=
"Path"=C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.67.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.67.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.152 Plugin
"Path"=C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.60.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.60.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
xmlfiller@software602.cz

C:\Program Files (x86)\Mozilla Firefox\components\
nsIFillerPlugin.xpt

C:\Program Files (x86)\Mozilla Firefox\plugins\
npfiller.dll
NPOFFICE.DLL
nppdf32.dll
npwachk.dll

C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default\extensions\
{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default\searchplugins\
ask-search.xml
askcom.xml
bing-avast.xml
Google.xml
seznam-avast.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2014-06-22 553384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-07-04 612248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-06-22 211880]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-25 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-07-04 457712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-25 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -
{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-07-12 12558440]
"BTMTrayAgent"=C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [2011-03-30 10372368]
"ETDCtrl"=C:\Program Files\Elantech\ETDCtrl.exe [2011-06-17 2721576]
"ActivControl"=C:\Program Files\Activ Software\ActivDriver\ActivControl2x64.exe [2012-02-24 1241456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring]
C:\Program Files\CCleaner\CCleaner64.exe [2013-12-17 5973272]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-07-24 21650016]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SSDMonitor"=C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [2011-12-12 103896]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-08-01 4085896]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-08-21 959176]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-07-25 256896]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll C:\windows\system32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2010-12-16 384000]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-10-15 21:15:58 ----D---- C:\rsit
2014-10-15 20:55:48 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-15 20:54:47 ----A---- C:\windows\SYSWOW64\ssinstall-uninstall.bat
2014-10-15 20:54:45 ----A---- C:\windows\SYSWOW64\ssins.exe
2014-10-15 20:54:15 ----A---- C:\windows\system32\win32k.sys
2014-10-15 20:54:05 ----A---- C:\windows\SYSWOW64\mscorier.dll
2014-10-15 20:54:05 ----A---- C:\windows\SYSWOW64\dfshim.dll
2014-10-15 20:54:05 ----A---- C:\windows\system32\mscorier.dll
2014-10-15 20:54:05 ----A---- C:\windows\system32\dfshim.dll
2014-10-15 20:54:04 ----A---- C:\windows\SYSWOW64\mscories.dll
2014-10-15 20:54:04 ----A---- C:\windows\system32\mscories.dll
2014-10-15 20:53:38 ----A---- C:\windows\SYSWOW64\blackbox.dll
2014-10-15 20:53:38 ----A---- C:\windows\system32\drmv2clt.dll
2014-10-15 20:53:38 ----A---- C:\windows\system32\blackbox.dll
2014-10-15 20:53:35 ----A---- C:\windows\SYSWOW64\drmv2clt.dll
2014-10-15 20:53:32 ----A---- C:\windows\system32\wmp.dll
2014-10-15 20:53:29 ----A---- C:\windows\SYSWOW64\wmdrmsdk.dll
2014-10-15 20:53:29 ----A---- C:\windows\system32\wmdrmsdk.dll
2014-10-15 20:53:29 ----A---- C:\windows\system32\mf.dll
2014-10-15 20:53:27 ----A---- C:\windows\SYSWOW64\wmp.dll
2014-10-15 20:53:27 ----A---- C:\windows\system32\AUDIOKSE.dll
2014-10-15 20:53:25 ----A---- C:\windows\system32\drmmgrtn.dll
2014-10-15 20:53:17 ----A---- C:\windows\SYSWOW64\mf.dll
2014-10-15 20:53:16 ----A---- C:\windows\SYSWOW64\drmmgrtn.dll
2014-10-15 20:53:16 ----A---- C:\windows\system32\drivers\PEAuth.sys
2014-10-15 20:53:16 ----A---- C:\windows\system32\ci.dll
2014-10-15 20:53:15 ----A---- C:\windows\SYSWOW64\AUDIOKSE.dll
2014-10-15 20:53:14 ----A---- C:\windows\system32\quartz.dll
2014-10-15 20:53:14 ----A---- C:\windows\system32\AudioEng.dll
2014-10-15 20:53:13 ----A---- C:\windows\system32\winload.exe
2014-10-15 20:53:12 ----A---- C:\windows\SYSWOW64\AudioSes.dll
2014-10-15 20:53:12 ----A---- C:\windows\system32\wintrust.dll
2014-10-15 20:53:12 ----A---- C:\windows\system32\winresume.exe
2014-10-15 20:53:12 ----A---- C:\windows\system32\cryptsvc.dll
2014-10-15 20:53:11 ----A---- C:\windows\system32\ntoskrnl.exe
2014-10-15 20:53:10 ----A---- C:\windows\system32\evr.dll
2014-10-15 20:53:06 ----A---- C:\windows\SYSWOW64\ntkrnlpa.exe
2014-10-15 20:53:06 ----A---- C:\windows\system32\EncDump.dll
2014-10-15 20:53:05 ----A---- C:\windows\system32\crypt32.dll
2014-10-15 20:53:03 ----A---- C:\windows\SYSWOW64\cryptsvc.dll
2014-10-15 20:53:02 ----A---- C:\windows\SYSWOW64\wintrust.dll
2014-10-15 20:53:02 ----A---- C:\windows\system32\AudioSes.dll
2014-10-15 20:53:00 ----A---- C:\windows\SYSWOW64\ntoskrnl.exe
2014-10-15 20:53:00 ----A---- C:\windows\system32\cryptui.dll
2014-10-15 20:52:59 ----A---- C:\windows\SYSWOW64\quartz.dll
2014-10-15 20:52:59 ----A---- C:\windows\SYSWOW64\evr.dll
2014-10-15 20:52:59 ----A---- C:\windows\system32\mfplat.dll
2014-10-15 20:52:59 ----A---- C:\windows\system32\audiosrv.dll
2014-10-15 20:52:58 ----A---- C:\windows\SYSWOW64\cryptui.dll
2014-10-15 20:52:58 ----A---- C:\windows\SYSWOW64\crypt32.dll
2014-10-15 20:52:58 ----A---- C:\windows\system32\srcore.dll
2014-10-15 20:52:58 ----A---- C:\windows\system32\pcasvc.dll
2014-10-15 20:52:57 ----A---- C:\windows\SYSWOW64\mfplat.dll
2014-10-15 20:52:56 ----A---- C:\windows\system32\cryptsp.dll
2014-10-15 20:52:55 ----A---- C:\windows\SYSWOW64\cryptsp.dll
2014-10-15 20:52:55 ----A---- C:\windows\SYSWOW64\AudioEng.dll
2014-10-15 20:52:54 ----A---- C:\windows\system32\msscp.dll
2014-10-15 20:52:47 ----A---- C:\windows\system32\msnetobj.dll
2014-10-15 20:52:46 ----A---- C:\windows\system32\rstrui.exe
2014-10-15 20:52:46 ----A---- C:\windows\system32\appidsvc.dll
2014-10-15 20:52:43 ----A---- C:\windows\SYSWOW64\msscp.dll
2014-10-15 20:52:39 ----A---- C:\windows\system32\appidapi.dll
2014-10-15 20:52:38 ----A---- C:\windows\system32\audiodg.exe
2014-10-15 20:52:37 ----A---- C:\windows\system32\drivers\appid.sys
2014-10-15 20:52:35 ----A---- C:\windows\SYSWOW64\msnetobj.dll
2014-10-15 20:52:35 ----A---- C:\windows\system32\rrinstaller.exe
2014-10-15 20:52:32 ----A---- C:\windows\SYSWOW64\rrinstaller.exe
2014-10-15 20:52:30 ----A---- C:\windows\SYSWOW64\mfps.dll
2014-10-15 20:52:30 ----A---- C:\windows\system32\mfps.dll
2014-10-15 20:52:29 ----A---- C:\windows\SYSWOW64\srclient.dll
2014-10-15 20:52:29 ----A---- C:\windows\SYSWOW64\mfpmp.exe
2014-10-15 20:52:29 ----A---- C:\windows\SYSWOW64\appidapi.dll
2014-10-15 20:52:29 ----A---- C:\windows\system32\srclient.dll
2014-10-15 20:52:29 ----A---- C:\windows\system32\setbcdlocale.dll
2014-10-15 20:52:29 ----A---- C:\windows\system32\mfpmp.exe
2014-10-15 20:52:29 ----A---- C:\windows\system32\appidpolicyconverter.exe
2014-10-15 20:52:28 ----A---- C:\windows\SYSWOW64\spwmp.dll
2014-10-15 20:52:28 ----A---- C:\windows\SYSWOW64\mferror.dll
2014-10-15 20:52:28 ----A---- C:\windows\SYSWOW64\dxmasf.dll
2014-10-15 20:52:28 ----A---- C:\windows\system32\spwmp.dll
2014-10-15 20:52:28 ----A---- C:\windows\system32\dxmasf.dll
2014-10-15 20:52:28 ----A---- C:\windows\system32\appidcertstorecheck.exe
2014-10-15 20:52:27 ----A---- C:\windows\system32\mferror.dll
2014-10-15 20:52:26 ----A---- C:\windows\SYSWOW64\wmploc.DLL
2014-10-15 20:52:26 ----A---- C:\windows\system32\wmploc.DLL
2014-10-15 20:51:59 ----A---- C:\windows\system32\generaltel.dll
2014-10-15 20:51:59 ----A---- C:\windows\system32\aepdu.dll
2014-10-15 20:51:56 ----A---- C:\windows\system32\aeinv.dll
2014-10-15 20:51:53 ----A---- C:\windows\SYSWOW64\iernonce.dll
2014-10-15 20:51:52 ----A---- C:\windows\SYSWOW64\ieetwproxystub.dll
2014-10-15 20:51:47 ----A---- C:\windows\SYSWOW64\urlmon.dll
2014-10-15 20:51:47 ----A---- C:\windows\SYSWOW64\mshtmled.dll
2014-10-15 20:51:47 ----A---- C:\windows\SYSWOW64\jscript9diag.dll
2014-10-15 20:51:47 ----A---- C:\windows\SYSWOW64\iedkcs32.dll
2014-10-15 20:51:47 ----A---- C:\windows\system32\iernonce.dll
2014-10-15 20:51:47 ----A---- C:\windows\system32\ie4uinit.exe
2014-10-15 20:51:46 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2014-10-15 20:51:46 ----A---- C:\windows\SYSWOW64\JavaScriptCollectionAgent.dll
2014-10-15 20:51:46 ----A---- C:\windows\SYSWOW64\dxtmsft.dll
2014-10-15 20:51:46 ----A---- C:\windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 20:51:46 ----A---- C:\windows\system32\ieetwproxystub.dll
2014-10-15 20:51:45 ----A---- C:\windows\SYSWOW64\mshtml.dll
2014-10-15 20:51:44 ----A---- C:\windows\SYSWOW64\iesetup.dll
2014-10-15 20:51:43 ----A---- C:\windows\system32\urlmon.dll
2014-10-15 20:51:43 ----A---- C:\windows\system32\iedkcs32.dll
2014-10-15 20:51:42 ----A---- C:\windows\SYSWOW64\iertutil.dll
2014-10-15 20:51:41 ----A---- C:\windows\SYSWOW64\jsproxy.dll
2014-10-15 20:51:41 ----A---- C:\windows\system32\ieetwcollectorres.dll
2014-10-15 20:51:40 ----A---- C:\windows\SYSWOW64\ieui.dll
2014-10-15 20:51:40 ----A---- C:\windows\SYSWOW64\ieframe.dll
2014-10-15 20:51:40 ----A---- C:\windows\SYSWOW64\dxtrans.dll
2014-10-15 20:51:40 ----A---- C:\windows\system32\msfeeds.dll
2014-10-15 20:51:40 ----A---- C:\windows\system32\ieetwcollector.exe
2014-10-15 20:51:40 ----A---- C:\windows\system32\dxtmsft.dll
2014-10-15 20:51:39 ----A---- C:\windows\system32\iesetup.dll
2014-10-15 20:51:35 ----A---- C:\windows\system32\iertutil.dll
2014-10-15 20:51:34 ----A---- C:\windows\SYSWOW64\mshtmlmedia.dll
2014-10-15 20:51:34 ----A---- C:\windows\SYSWOW64\jscript9.dll
2014-10-15 20:51:34 ----A---- C:\windows\SYSWOW64\ieUnatt.exe
2014-10-15 20:51:33 ----A---- C:\windows\SYSWOW64\wininet.dll
2014-10-15 20:51:33 ----A---- C:\windows\SYSWOW64\vbscript.dll
2014-10-15 20:51:33 ----A---- C:\windows\SYSWOW64\ieapfltr.dll
2014-10-15 20:51:32 ----A---- C:\windows\SYSWOW64\msrating.dll
2014-10-15 20:51:32 ----A---- C:\windows\SYSWOW64\MshtmlDac.dll
2014-10-15 20:51:32 ----A---- C:\windows\system32\jsproxy.dll
2014-10-15 20:51:29 ----A---- C:\windows\system32\dxtrans.dll
2014-10-15 20:51:28 ----A---- C:\windows\system32\ieui.dll
2014-10-15 20:51:28 ----A---- C:\windows\system32\ieframe.dll
2014-10-15 20:51:25 ----A---- C:\windows\system32\mshtmlmedia.dll
2014-10-15 20:51:25 ----A---- C:\windows\system32\mshtmled.dll
2014-10-15 20:51:24 ----A---- C:\windows\system32\vbscript.dll
2014-10-15 20:51:24 ----A---- C:\windows\system32\jscript9diag.dll
2014-10-15 20:51:24 ----A---- C:\windows\system32\jscript9.dll
2014-10-15 20:51:24 ----A---- C:\windows\system32\ieUnatt.exe
2014-10-15 20:51:23 ----A---- C:\windows\system32\wininet.dll
2014-10-15 20:51:23 ----A---- C:\windows\system32\ieapfltr.dll
2014-10-15 20:51:21 ----A---- C:\windows\system32\msrating.dll
2014-10-15 20:51:21 ----A---- C:\windows\system32\MshtmlDac.dll
2014-10-15 20:51:18 ----A---- C:\windows\system32\MsSpellCheckingFacility.exe
2014-10-15 20:51:16 ----A---- C:\windows\system32\mshtml.dll
2014-10-15 20:50:39 ----A---- C:\windows\system32\msi.dll
2014-10-15 20:50:38 ----A---- C:\windows\SYSWOW64\msi.dll
2014-10-15 20:50:16 ----A---- C:\windows\system32\rastls.dll
2014-10-15 20:50:15 ----A---- C:\windows\SYSWOW64\rastls.dll
2014-10-15 20:50:01 ----A---- C:\windows\SYSWOW64\mstscax.dll
2014-10-15 20:50:00 ----A---- C:\windows\system32\mstscax.dll
2014-10-15 20:49:57 ----A---- C:\windows\system32\termsrv.dll
2014-10-15 20:49:57 ----A---- C:\windows\system32\mstsc.exe
2014-10-15 20:49:56 ----A---- C:\windows\SYSWOW64\mstsc.exe
2014-10-15 20:49:56 ----A---- C:\windows\system32\winsta.dll
2014-10-15 20:49:55 ----A---- C:\windows\SYSWOW64\winsta.dll
2014-10-15 20:49:55 ----A---- C:\windows\system32\drivers\rdpwd.sys
2014-10-15 20:49:54 ----A---- C:\windows\system32\winlogon.exe
2014-10-15 20:49:54 ----A---- C:\windows\system32\rdpcorekmts.dll
2014-10-15 20:49:53 ----A---- C:\windows\SYSWOW64\aaclient.dll
2014-10-15 20:49:52 ----A---- C:\windows\SYSWOW64\TSpkg.dll
2014-10-15 20:49:52 ----A---- C:\windows\system32\TSpkg.dll
2014-10-15 20:49:52 ----A---- C:\windows\system32\credssp.dll
2014-10-15 20:49:51 ----A---- C:\windows\SYSWOW64\credssp.dll
2014-10-15 20:49:51 ----A---- C:\windows\system32\drivers\tssecsrv.sys
2014-10-15 20:49:15 ----A---- C:\windows\SYSWOW64\packager.dll
2014-10-15 20:49:15 ----A---- C:\windows\system32\packager.dll
2014-10-02 19:19:53 ----A---- C:\autoexec.bat
2014-10-02 19:05:36 ----D---- C:\Program Files\Enigma Software Group
2014-10-02 19:04:16 ----D---- C:\windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-10-01 18:22:03 ----A---- C:\windows\system32\qdvd.dll
2014-10-01 18:22:02 ----A---- C:\windows\SYSWOW64\qdvd.dll
2014-09-28 20:52:55 ----D---- C:\Program Files (x86)\SearchProtect
2014-09-28 20:52:34 ----D---- C:\Users\ZM\AppData\Roaming\WebExtend
2014-09-25 06:21:07 ----D---- C:\Program Files (x86)\Mozilla Firefox
2014-09-24 14:09:59 ----A---- C:\windows\SYSWOW64\tzres.dll
2014-09-24 14:09:59 ----A---- C:\windows\system32\tzres.dll
2014-09-22 20:07:02 ----D---- C:\ProgramData\APN
2014-09-22 20:04:52 ----A---- C:\windows\SYSWOW64\javaws.exe
2014-09-22 20:04:44 ----A---- C:\windows\SYSWOW64\WindowsAccessBridge-32.dll
2014-09-22 20:04:44 ----A---- C:\windows\SYSWOW64\javaw.exe
2014-09-22 20:04:44 ----A---- C:\windows\SYSWOW64\java.exe
2014-09-17 14:56:26 ----D---- C:\Program Files (x86)\VESMAT4

======List of files/folders modified in the last 1 month======

2014-10-16 16:30:01 ----D---- C:\windows\Temp
2014-10-16 16:30:01 ----D---- C:\windows\Prefetch
2014-10-16 14:43:01 ----AD---- C:\ProgramData\Temp
2014-10-16 07:24:58 ----D---- C:\windows\system32\config
2014-10-16 07:01:43 ----D---- C:\windows\rescache
2014-10-16 06:32:12 ----D---- C:\windows\Microsoft.NET
2014-10-16 06:29:40 ----RSD---- C:\windows\assembly
2014-10-15 21:38:47 ----D---- C:\windows\system32\catroot2
2014-10-15 21:35:18 ----A---- C:\windows\SYSWOW64\log.txt
2014-10-15 21:34:45 ----D---- C:\windows\winsxs
2014-10-15 21:29:49 ----D---- C:\windows\SysWOW64
2014-10-15 21:29:49 ----D---- C:\windows\System32
2014-10-15 21:29:45 ----D---- C:\windows\SYSWOW64\Dism
2014-10-15 21:29:45 ----D---- C:\windows\SYSWOW64\cs-CZ
2014-10-15 21:29:45 ----D---- C:\windows\system32\drivers
2014-10-15 21:29:45 ----D---- C:\windows\system32\Dism
2014-10-15 21:29:45 ----D---- C:\Program Files\Windows Media Player
2014-10-15 21:29:45 ----D---- C:\Program Files (x86)\Windows Media Player
2014-10-15 21:29:44 ----SD---- C:\windows\system32\CompatTel
2014-10-15 21:29:44 ----D---- C:\windows\SYSWOW64\en-US
2014-10-15 21:29:44 ----D---- C:\windows\system32\en-US
2014-10-15 21:29:44 ----D---- C:\windows\system32\cs-CZ
2014-10-15 21:29:44 ----D---- C:\windows\system32\CodeIntegrity
2014-10-15 21:29:44 ----D---- C:\windows\system32\Boot
2014-10-15 21:29:44 ----D---- C:\Program Files\Internet Explorer
2014-10-15 21:29:43 ----D---- C:\Program Files (x86)\Internet Explorer
2014-10-15 21:28:50 ----SHD---- C:\windows\Installer
2014-10-15 21:24:11 ----D---- C:\ProgramData\Microsoft Help
2014-10-15 21:17:28 ----D---- C:\windows\system32\MRT
2014-10-15 21:08:43 ----D---- C:\windows\debug
2014-10-15 21:08:41 ----A---- C:\windows\system32\MRT.exe
2014-10-15 21:08:20 ----SHD---- C:\System Volume Information
2014-10-15 20:55:48 ----D---- C:\Program Files (x86)
2014-10-15 20:49:31 ----SD---- C:\Users\ZM\AppData\Roaming\Microsoft
2014-10-15 20:49:28 ----D---- C:\windows\system32\catroot
2014-10-15 20:37:03 ----D---- C:\Users\ZM\AppData\Roaming\Skype
2014-10-15 20:34:42 ----D---- C:\windows\system32\Tasks
2014-10-15 20:34:28 ----D---- C:\Windows
2014-10-15 20:28:23 ----D---- C:\windows\system32\wbem
2014-10-15 20:27:34 ----D---- C:\windows\Tasks
2014-10-15 20:27:34 ----D---- C:\windows\system32\wfp
2014-10-15 20:27:34 ----D---- C:\windows\system32\DriverStore
2014-10-15 20:27:31 ----D---- C:\windows\inf
2014-10-15 20:27:31 ----D---- C:\Users\ZM\AppData\Roaming\Promethean
2014-10-15 20:27:28 ----D---- C:\ProgramData\WinClon
2014-10-15 20:27:23 ----D---- C:\windows\registration
2014-10-13 21:39:46 ----A---- C:\windows\system32\PerfStringBackup.INI
2014-10-06 06:16:22 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2014-10-02 19:11:46 ----D---- C:\Users\ZM\AppData\Roaming\WildTangent
2014-10-02 19:11:46 ----D---- C:\ProgramData\WildTangent
2014-10-02 19:05:36 ----D---- C:\Program Files
2014-10-02 19:04:11 ----D---- C:\Program Files (x86)\Common Files
2014-10-02 06:19:39 ----D---- C:\Users\ZM\AppData\Roaming\Winamp
2014-09-28 20:53:08 ----D---- C:\windows\AppPatch
2014-09-24 13:56:59 ----HD---- C:\ProgramData
2014-09-22 20:05:07 ----D---- C:\ProgramData\Oracle
2014-09-22 20:04:42 ----D---- C:\Program Files (x86)\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswKbd;aswKbd; C:\windows\system32\drivers\aswKbd.sys [2013-03-07 22600]
R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2014-07-04 65776]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2014-07-04 224896]
R0 iaStor;Intel AHCI Controller; C:\windows\system32\DRIVERS\iaStor.sys [2011-02-18 439320]
R0 nvpciflt;nvpciflt; C:\windows\system32\DRIVERS\nvpciflt.sys [2011-06-05 25960]
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr2.sys [2014-07-04 93568]
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys [2014-07-04 1041168]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2014-07-04 427360]
R1 SABI;SAMSUNG Kernel Driver For Windows 7; \??\C:\windows\system32\Drivers\SABI.sys [2011-07-30 13824]
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2011-01-25 60416]
R2 aswHwid;avast! HardwareID; C:\windows\system32\drivers\aswHwid.sys [2014-07-04 29208]
R2 aswMonFlt;aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [2014-07-04 79184]
R2 aswStm;aswStm; C:\windows\system32\drivers\aswStm.sys [2014-07-04 92008]
R2 SGDrv;SGDrv; C:\windows\system32\DRIVERS\SGdrv64.sys [2011-04-11 7680]
R3 AMPPAL;Virtuální adaptér Intel(R) Centrino(R) Bluetooth 3.0 + High Speed; C:\windows\system32\DRIVERS\AMPPAL.sys [2011-04-21 294912]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btmaux;Intel Bluetooth Auxiliary Service; C:\windows\system32\DRIVERS\btmaux.sys [2011-03-08 51712]
R3 btmhsf;btmhsf; C:\windows\system32\DRIVERS\btmhsf.sys [2011-03-08 274944]
R3 clwvd;CyberLink WebCam Virtual Driver; C:\windows\system32\DRIVERS\clwvd.sys [2011-08-17 31216]
R3 ETD;ELAN PS/2 Port Input Device; C:\windows\system32\DRIVERS\ETD.sys [2011-06-17 186152]
R3 iBtFltCoex;iBtFltCoex; C:\windows\system32\DRIVERS\iBtFltCoex.sys [2011-03-22 59904]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2010-12-16 12256512]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2011-07-12 2917096]
R3 IntcDAud;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440]
R3 MEIx64;Intel(R) Management Engine Interface; C:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]
R3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit; C:\windows\system32\DRIVERS\NETwNs64.sys [2011-05-01 8593920]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RTL8167;Realtek 8167 NT Driver; C:\windows\system32\DRIVERS\Rt64win7.sys [2011-04-22 471144]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys [2011-01-25 18432]
S3 AMPPALP;Protokol Intel(R) Centrino(R) Bluetooth 3.0 + High Speed; C:\windows\system32\DRIVERS\amppal.sys [2011-04-21 294912]
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 rtport;rtport; \??\C:\windows\SysWOW64\drivers\rtport.sys [2011-09-19 15144]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\windows\system32\DRIVERS\ss_bus.sys [2009-09-21 127488]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\windows\system32\DRIVERS\ss_mdfl.sys [2009-09-21 18944]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\windows\system32\DRIVERS\ss_mdm.sys [2009-09-21 161280]
S3 TsUsbFlt;TsUsbFlt; C:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WinUsb;WinUsb; C:\windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2010-04-14 73728]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-09-12 64704]
R2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service; C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-04-21 1136640]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-07-04 50344]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-03-30 923984]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-03-30 1001808]
R2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service; C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-04-21 134928]
R2 eBeam Device Service;eBeam Device Service; C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe [2009-09-17 180224]
R2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [2014-03-11 241728]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2011-05-05 326424]
R2 NVSvc;NVIDIA Driver Helper Service; C:\windows\system32\nvvsvc.exe [2011-06-04 993896]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-06-05 1997416]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-12-12 793048]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [2009-12-01 244904]
R2 ssinstall;SInstalátor; C:\windows\SysWOW64\ssins.exe [2014-10-15 2324216]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-05-05 2656536]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
R3 Bluetooth Media Service;Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-03-30 1321296]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-18 136176]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-06 267440]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-04-18 136176]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\windows\system32\IEEtwCollector.exe [2014-09-19 111616]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-09-18 114288]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2012-04-19 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S4 NetMsmqActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------

Druhý log

# AdwCleaner v4.000 - Report created 16/10/2014 at 16:39:34
# DB v2014-10-15.7
# Updated 12/10/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : ZM - ZM-PC
# Running from : C:\Users\ZM\Desktop\adwcleaner_4.000.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\Users\ZM\AppData\Local\apn
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\Users\ZM\AppData\Local\Babylon
Folder Deleted : C:\Users\ZM\AppData\Roaming\Babylon
Folder Deleted : C:\Users\ZM\AppData\Roaming\dvdvideosoftiehelpers
Folder Deleted : C:\Users\ZM\AppData\Local\Mobogenie
Folder Deleted : D:\ZM\Documents\Mobogenie
Folder Deleted : C:\Users\ZM\AppData\Roaming\OpenCandy
Folder Deleted : C:\Program Files (x86)\SearchProtect
Folder Deleted : C:\Users\ZM\AppData\Local\SearchProtect
Folder Deleted : C:\Users\ZM\AppData\Roaming\WebExtend
Folder Deleted : C:\Program Files\Enigma Software Group
File Deleted : C:\Users\ZM\daemonprocess.txt
File Deleted : C:\END
File Deleted : C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default\searchplugins\Askcom.xml
File Deleted : C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default\searchplugins\ask-search.xml

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\PIP
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Freeze.com
Key Deleted : HKLM\SOFTWARE\PIP
Key Deleted : HKLM\SOFTWARE\SearchProtect
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00B2-0405-0000-0000000FF1CE}
Key Deleted : [x64] HKLM\SOFTWARE\Speedchecker Limited
Key Deleted : [x64] HKLM\SOFTWARE\EnigmaSoftwareGroup
Data Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll
Data Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v32.0.2 (x86 cs)


-\\ Google Chrome v37.0.2062.124


*************************

AdwCleaner[R0].txt - [4711 octets] - [16/10/2014 16:36:59]
AdwCleaner[S0].txt - [4150 octets] - [16/10/2014 16:39:34]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4210 octets] ##########

Udelejte kontrolu s MBAM. Test nastavte podle tohoto navodu http://forum.viry.cz/viewtopic.php?f=29&t=137928 a dejte sem vysledky. Predem nic nemazte, miva obcas falesne detekce

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 17.10.2014
Scan Time: 20:26:24
Logfile: log.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.10.17.07
Rootkit Database: v2014.10.17.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: ZM

Scan Type: Custom Scan
Result: Completed
Objects Scanned: 626915
Time Elapsed: 2 hr, 17 min, 56 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{8a4d5a43-c64a-45ab-bdf4-804fe18ceafd}, , [a32853c2d5a7e0561dc2c1cab94b53ad],
PUP.Optional.SearchProtect, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\INSTALLEDSDB\{cf2797aa-b7ec-e311-8ed9-005056c00008}, , [c2095eb71b61ef477b635a3116ee728e],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 7
PUP.Optional.Delta.A, C:\AdwCleaner\Quarantine\C\Users\ZM\AppData\Roaming\OpenCandy\608E924F91E3454DB21275445F97D1B8\DeltaTB.exe.vir, , [ccff37de7ffd25114cc4ee2ead54ed13],
PUP.Optional.SearchProtect.A, C:\Windows\AppPatch\AppPatch64\SPVCLdr64.dll, , [9e2d0f06314b7abc56d4c9d808f98a76],
PUP.Optional.ClientConnect, D:\ZM\Downloads\SMART_Notebook_TSA2OR7N0.exe, , [7952bc59d8a4de5858b5c6ee2dd414ec],
PUP.Optional.Spigot.A, D:\ZM\Downloads\YTDSetup.exe, , [d5f623f2b3c9ca6c2b8e2afc27d9827e],
Trojan.Downloader.Agent, D:\ZM\Downloads\free-youtube-download-lista-centrumcz.exe, , [7f4c8a8b8af2e353e3c5ddfd669abe42],
PUP.Optional.Softonic.A, D:\ZM\Music\ta\SoftonicDownloader_for_open-fitness.exe, , [f5d636dfde9eaa8c10adb480a9588e72],
PUP.Optional.SearchProtect, C:\Windows\AppPatch\Custom\Custom64\{cf2797aa-b7ec-e311-8ed9-005056c00008}.sdb, , [82493fd60e6e13234c961576bd4743bd],

Physical Sectors: 0
(No malicious items detected)


(end)

Vsechny nalezy hodte do karanteny. Po dalsim restartu pc test zopakujte, at vime, jestli se to nevraci. Napiste vysledek testu a podle nej zvolim dalsi postup

Dobrý den, zasílám log

Malwarebytes Anti-Malware
www.malwarebytes.org

Datum skenování: 18.10.2014
Čas skenování: 13:14:19
Protokol: log2.txt
Správce: Ano

Verze: 2.00.3.1025
Databáze malwaru: v2014.10.18.04
Databáze rootkitů: v2014.10.17.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Sebeobrany: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: ZM

Typ skenu: Vlastní sken
Výsledek: Dokončeno
Prohledaných objektů: 627565
Uplynulý čas: 2 hod, 13 min, 14 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Žádné zákerné zjištěny položek)

Moduly: 0
(Žádné zákerné zjištěny položek)

Klíče registru: 0
(Žádné zákerné zjištěny položek)

Hodnoty registru: 0
(Žádné zákerné zjištěny položek)

Data registru: 0
(Žádné zákerné zjištěny položek)

Složky: 0
(Žádné zákerné zjištěny položek)

Soubory: 0
(Žádné zákerné zjištěny položek)

Fyzické sektory: 0
(Žádné zákerné zjištěny položek)


(end)

Vyborne, MBAM odinstalujte.



Pokud nemate, zazalohujte si radeji dulezita data (fotky, dokumenty, atd.)

Nepouzivejte ComboFix bez predchozi domluvy! Je to poruseni pravidel fora a ztratite tim narok na pomoc!

Stahnete ComboFix http://download.bleepingcomputer.com/sUBs/ComboFix.exe a ulozte ho na plochu.
Vypnete antivir i dalsi pripadne zabezpeceni.
Kliknete na ComboFix pravym mysidlem a levym na Spustit jako spravce
Odsouhlaste licencni podminky a nechte program pracovat. Jestli vam nabidne instalaci Konzoly pro zotaveni, souhlaste.
Po dobu skenu nic nespoustejte, nikam neklikejte.
Po dokonceni skenovani (muze dojit i k restartu pc) by se mel vytvorit log, ktery bude umisteny zde C:\ComboFix.txt
Jeho obsah sem zkopirujte

Kdyby po restartu nenabehl windows, restartujte znovu, mackejte klavesu F8 a zvolte - Posledni znama funkcni konfigurace
Kdyz windows nabehne, ale pri spousteni ruznych programu bude hlasena chyba, staci restartovat pc a bude to v poradku

ComboFix 14-10-15.01 - ZM 18.10.2014 16:39:01.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4010.2261 [GMT 2:00]
Spuštěný z: c:\users\ZM\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\ZM\AppData\Local\._Revolution_
c:\windows\IsUn0405.exe
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-09-18 do 2014-10-18 )))))))))))))))))))))))))))))))
.
.
2014-10-18 14:48 . 2014-10-18 14:48 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-10-18 14:48 . 2014-10-18 14:48 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-10-18 14:44 . 2014-10-18 14:44 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{830449C0-734F-4BA1-B7D0-528D3CB34C20}\offreg.dll
2014-10-17 15:15 . 2014-09-09 02:05 11578928 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{830449C0-734F-4BA1-B7D0-528D3CB34C20}\mpengine.dll
2014-10-16 14:36 . 2014-10-16 14:39 -------- d-----w- C:\AdwCleaner
2014-10-15 19:15 . 2014-10-15 19:16 -------- d-----w- C:\rsit
2014-10-15 18:55 . 2014-10-15 18:59 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2014-10-15 18:54 . 2014-10-15 18:54 79 ----a-w- c:\windows\SysWow64\ssinstall-uninstall.bat
2014-10-15 18:54 . 2014-10-15 18:54 2324216 ----a-w- c:\windows\SysWow64\ssins.exe
2014-10-15 18:54 . 2014-09-29 00:58 3198976 ----a-w- c:\windows\system32\win32k.sys
2014-10-15 18:54 . 2014-06-18 22:23 1943696 ----a-w- c:\windows\system32\dfshim.dll
2014-10-15 18:54 . 2014-06-18 22:23 156312 ----a-w- c:\windows\system32\mscorier.dll
2014-10-15 18:54 . 2014-06-18 22:23 156824 ----a-w- c:\windows\SysWow64\mscorier.dll
2014-10-15 18:54 . 2014-06-18 22:23 1131664 ----a-w- c:\windows\SysWow64\dfshim.dll
2014-10-15 18:54 . 2014-06-18 22:23 73880 ----a-w- c:\windows\system32\mscories.dll
2014-10-15 18:54 . 2014-06-18 22:23 81560 ----a-w- c:\windows\SysWow64\mscories.dll
2014-10-15 18:52 . 2014-07-07 02:06 432128 ----a-w- c:\windows\system32\mfplat.dll
2014-10-15 18:51 . 2014-10-10 02:05 276480 ----a-w- c:\windows\system32\generaltel.dll
2014-10-15 18:50 . 2014-09-18 02:00 3241472 ----a-w- c:\windows\system32\msi.dll
2014-10-15 18:50 . 2014-09-18 01:32 2363904 ----a-w- c:\windows\SysWow64\msi.dll
2014-10-15 18:50 . 2014-09-04 05:23 424448 ----a-w- c:\windows\system32\rastls.dll
2014-10-15 18:50 . 2014-09-04 05:04 372736 ----a-w- c:\windows\SysWow64\rastls.dll
2014-10-15 18:50 . 2014-07-17 01:39 3221504 ----a-w- c:\windows\SysWow64\mstscax.dll
2014-10-15 18:50 . 2014-07-17 02:07 3722240 ----a-w- c:\windows\system32\mstscax.dll
2014-10-02 17:04 . 2014-10-02 17:24 -------- d-----w- c:\windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-10-02 17:04 . 2014-10-02 17:04 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2014-10-01 16:22 . 2014-09-25 02:08 371712 ----a-w- c:\windows\system32\qdvd.dll
2014-10-01 16:22 . 2014-09-25 01:40 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
2014-09-24 12:09 . 2014-09-09 22:11 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-24 12:09 . 2014-09-09 21:47 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-09-22 18:04 . 2014-09-22 18:04 -------- d-----w- c:\program files (x86)\Common Files\Java
2014-09-22 18:04 . 2014-07-25 10:55 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-15 19:08 . 2012-04-21 14:56 103265616 ----a-w- c:\windows\system32\MRT.exe
2014-10-06 04:16 . 2012-04-18 15:47 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-10-06 04:16 . 2012-04-18 15:47 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-15 07:06 . 2010-11-21 03:27 278152 ------w- c:\windows\system32\MpSigStub.exe
2014-09-02 09:37 . 2010-06-24 02:33 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-23 02:07 . 2014-08-28 18:09 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-23 01:45 . 2014-08-28 18:09 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-01 11:53 . 2014-09-16 15:24 1031168 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-08-01 11:35 . 2014-09-16 15:24 793600 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2014-07-25 13:25 . 2014-08-14 07:21 2774528 ----a-w- c:\windows\system32\iertutil(103).dll
2014-07-25 12:21 . 2014-08-14 07:21 2184704 ----a-w- c:\windows\SysWow64\iertutil(109).dll
2014-07-25 10:52 . 2014-08-14 07:21 2266624 ----a-w- c:\windows\system32\wininet(108).dll
2014-07-25 10:26 . 2014-08-14 07:21 1431040 ----a-w- c:\windows\system32\urlmon(106).dll
2014-07-25 10:05 . 2014-08-14 07:21 1792512 ----a-w- c:\windows\SysWow64\wininet(113).dll
2014-07-25 10:00 . 2014-08-14 07:21 1169920 ----a-w- c:\windows\SysWow64\urlmon(112).dll
2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 21:47 . 2014-07-24 21:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2003-03-21 12:45 . 2014-02-11 20:45 250544 ----a-w- c:\program files (x86)\Common Files\keyhelp.ocx
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2011-12-12 103896]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-08-01 4085896]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 ssinstall;SInstalátor;c:\windows\SysWOW64\ssins.exe;c:\windows\SysWOW64\ssins.exe [x]
R3 AMPPALP;Protokol Intel(R) Centrino(R) Bluetooth 3.0 + High Speed;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 aswKbd;aswKbd; [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]
S2 602XML Updater;602Updater;c:\program files (x86)\Common Files\soft602\602updsvc\602updsvc.exe;c:\program files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [x]
S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 eBeam Device Service;eBeam Device Service;c:\program files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe;c:\program files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe [x]
S2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [x]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [x]
S2 SGDrv;SGDrv;c:\windows\system32\DRIVERS\SGdrv64.sys;c:\windows\SYSNATIVE\DRIVERS\SGdrv64.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 AMPPAL;Virtuální adaptér Intel(R) Centrino(R) Bluetooth 3.0 + High Speed;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-10-16 16:48 1089352 ----a-w- c:\program files (x86)\Google\Chrome\Application\38.0.2125.104\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-10-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-18 04:16]
.
2014-10-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-10-16 16:47]
.
2014-10-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-10-16 16:47]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-07-04 19:12 634872 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-12 12558440]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-03-30 10372368]
"ActivControl"="c:\program files\Activ Software\ActivDriver\ActivControl2x64.exe" [2012-02-24 1241456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.seznam.cz/?clid=22668
mStart Page = https://www.seznam.cz/?clid=22668
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Bar = https://www.seznam.cz/?clid=22668
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
FF - prefs.js: browser.startup.homepage - hxxps://www.seznam.cz/?clid=22668
FF - prefs.js: keyword.URL - hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.150\SSScheduler.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
AddRemove-ssinstall - c:\windows\system32\ssinstall-uninstall.bat
AddRemove-Zimní Hrátky - c:\windows\IsUn0405.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2014-10-18 16:51:37
ComboFix-quarantined-files.txt 2014-10-18 14:51
.
Před spuštěním: Volných bajtů: 204 947 836 928
Po spuštění: Volných bajtů: 204 467 945 472
.
- - End Of File - - C62C199304E27C482AAB94FB038E321D

Vypnete trvale Windows Defender.



Otevrete si poznamkovy blok a zkopirujte do nej tento skript Vlevo nahore kliknete na napis Soubor
Kliknete na napis Ulozit jako...
Napiste spravne ten cerveny nazev CFScript a ulozte na plochu.
Vypnete antivir i dalsi pripadne zabezpeceni.
Pretahntete mysi tento vytvoreny textovy dokument nad ikonu ComboFix a pustte.
ComboFix by se mel spustit a vykonat prikazy.
Az skonci (muze dojit k restartu pc), mel by se objevit novy log, ten mi sem zase zkopirujte.

Kdyby po restartu nenabehl windows, restartujte znovu, mackejte klavesu F8 a zvolte - Posledni znama funkcni konfigurace
Kdyz windows nabehne, ale pri spousteni ruznych programu bude hlasena chyba, staci restartovat pc a bude to v poradku

ComboFix 14-10-15.01 - ZM 18.10.2014 18:10:55.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4010.2468 [GMT 2:00]
Spuštěný z: c:\users\ZM\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\ZM\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SkypeUpdate
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2014-09-18 do 2014-10-18 )))))))))))))))))))))))))))))))
.
.
2014-10-18 16:18 . 2014-10-18 16:18 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-10-16 14:36 . 2014-10-16 14:39 -------- d-----w- C:\AdwCleaner
2014-10-15 19:15 . 2014-10-15 19:16 -------- d-----w- C:\rsit
2014-10-15 18:55 . 2014-10-15 18:59 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2014-10-15 18:54 . 2014-10-15 18:54 79 ----a-w- c:\windows\SysWow64\ssinstall-uninstall.bat
2014-10-15 18:54 . 2014-10-15 18:54 2324216 ----a-w- c:\windows\SysWow64\ssins.exe
2014-10-15 18:54 . 2014-09-29 00:58 3198976 ----a-w- c:\windows\system32\win32k.sys
2014-10-15 18:54 . 2014-06-18 22:23 1943696 ----a-w- c:\windows\system32\dfshim.dll
2014-10-15 18:54 . 2014-06-18 22:23 156312 ----a-w- c:\windows\system32\mscorier.dll
2014-10-15 18:54 . 2014-06-18 22:23 156824 ----a-w- c:\windows\SysWow64\mscorier.dll
2014-10-15 18:54 . 2014-06-18 22:23 1131664 ----a-w- c:\windows\SysWow64\dfshim.dll
2014-10-15 18:54 . 2014-06-18 22:23 73880 ----a-w- c:\windows\system32\mscories.dll
2014-10-15 18:54 . 2014-06-18 22:23 81560 ----a-w- c:\windows\SysWow64\mscories.dll
2014-10-15 18:52 . 2014-07-07 02:06 432128 ----a-w- c:\windows\system32\mfplat.dll
2014-10-15 18:51 . 2014-10-10 02:05 276480 ----a-w- c:\windows\system32\generaltel.dll
2014-10-15 18:50 . 2014-09-18 02:00 3241472 ----a-w- c:\windows\system32\msi.dll
2014-10-15 18:50 . 2014-09-18 01:32 2363904 ----a-w- c:\windows\SysWow64\msi.dll
2014-10-15 18:50 . 2014-09-04 05:23 424448 ----a-w- c:\windows\system32\rastls.dll
2014-10-15 18:50 . 2014-09-04 05:04 372736 ----a-w- c:\windows\SysWow64\rastls.dll
2014-10-15 18:50 . 2014-07-17 01:39 3221504 ----a-w- c:\windows\SysWow64\mstscax.dll
2014-10-15 18:50 . 2014-07-17 02:07 3722240 ----a-w- c:\windows\system32\mstscax.dll
2014-10-02 17:04 . 2014-10-02 17:24 -------- d-----w- c:\windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-10-02 17:04 . 2014-10-02 17:04 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2014-10-01 16:22 . 2014-09-25 02:08 371712 ----a-w- c:\windows\system32\qdvd.dll
2014-10-01 16:22 . 2014-09-25 01:40 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
2014-09-24 12:09 . 2014-09-09 22:11 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-24 12:09 . 2014-09-09 21:47 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-09-22 18:04 . 2014-09-22 18:04 -------- d-----w- c:\program files (x86)\Common Files\Java
2014-09-22 18:04 . 2014-07-25 10:55 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-15 19:08 . 2012-04-21 14:56 103265616 ----a-w- c:\windows\system32\MRT.exe
2014-10-06 04:16 . 2012-04-18 15:47 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-10-06 04:16 . 2012-04-18 15:47 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-15 07:06 . 2010-11-21 03:27 278152 ------w- c:\windows\system32\MpSigStub.exe
2014-09-09 02:05 . 2014-10-17 15:15 11578928 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{830449C0-734F-4BA1-B7D0-528D3CB34C20}\mpengine.dll
2014-09-02 09:37 . 2010-06-24 02:33 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-23 02:07 . 2014-08-28 18:09 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-23 01:45 . 2014-08-28 18:09 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-01 11:53 . 2014-09-16 15:24 1031168 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-08-01 11:35 . 2014-09-16 15:24 793600 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2014-07-25 13:25 . 2014-08-14 07:21 2774528 ----a-w- c:\windows\system32\iertutil(103).dll
2014-07-25 12:21 . 2014-08-14 07:21 2184704 ----a-w- c:\windows\SysWow64\iertutil(109).dll
2014-07-25 10:52 . 2014-08-14 07:21 2266624 ----a-w- c:\windows\system32\wininet(108).dll
2014-07-25 10:26 . 2014-08-14 07:21 1431040 ----a-w- c:\windows\system32\urlmon(106).dll
2014-07-25 10:05 . 2014-08-14 07:21 1792512 ----a-w- c:\windows\SysWow64\wininet(113).dll
2014-07-25 10:00 . 2014-08-14 07:21 1169920 ----a-w- c:\windows\SysWow64\urlmon(112).dll
2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 21:47 . 2014-07-24 21:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2003-03-21 12:45 . 2014-02-11 20:45 250544 ----a-w- c:\program files (x86)\Common Files\keyhelp.ocx
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SSDMonitor"="c:\program files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2011-12-12 103896]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-08-01 4085896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AMPPALP;Protokol Intel(R) Centrino(R) Bluetooth 3.0 + High Speed;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 aswKbd;aswKbd; [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]
S2 602XML Updater;602Updater;c:\program files (x86)\Common Files\soft602\602updsvc\602updsvc.exe;c:\program files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [x]
S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 eBeam Device Service;eBeam Device Service;c:\program files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe;c:\program files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe [x]
S2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [x]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe;c:\program files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [x]
S2 SGDrv;SGDrv;c:\windows\system32\DRIVERS\SGdrv64.sys;c:\windows\SYSNATIVE\DRIVERS\SGdrv64.sys [x]
S2 ssinstall;SInstalátor;c:\windows\SysWOW64\ssins.exe;c:\windows\SysWOW64\ssins.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 AMPPAL;Virtuální adaptér Intel(R) Centrino(R) Bluetooth 3.0 + High Speed;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-10-16 16:48 1089352 ----a-w- c:\program files (x86)\Google\Chrome\Application\38.0.2125.104\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2014-10-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-18 04:16]
.
2014-10-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-10-16 16:47]
.
2014-10-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-10-16 16:47]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-07-04 19:12 634872 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-12 12558440]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-03-30 10372368]
"ETDCtrl"="c:\program files (x86)\Elantech\ETDCtrl.exe" [BU]
"ActivControl"="c:\program files\Activ Software\ActivDriver\ActivControl2x64.exe" [2012-02-24 1241456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.seznam.cz/?clid=22668
mStart Page = https://www.seznam.cz/?clid=22668
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Bar = https://www.seznam.cz/?clid=22668
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
FF - prefs.js: browser.startup.homepage - hxxps://www.seznam.cz/?clid=22668
FF - prefs.js: keyword.URL - hxxp://search.seznam.cz/?sourceid=quicksearch_22668&q={searchTerms}&
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
Toolbar-Locked - (no file)
AddRemove-ssinstall - c:\windows\system32\ssinstall-uninstall.bat
AddRemove-Zimní Hrátky - c:\windows\IsUn0405.exe
.
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe
c:\program files (x86)\CyberLink\Shared files\RichVideo.exe
c:\program files (x86)\Samsung\Easy Software Manager\SWMAgent.exe
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
c:\program files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
c:\program files (x86)\Samsung\Easy Settings\dmhkcore.exe
c:\program files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
c:\program files (x86)\Samsung\Easy Settings\SmartSetting.exe
c:\program files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
c:\program files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe
.
**************************************************************************
.
Celkový čas: 2014-10-18 18:33:08 - počítač byl restartován
ComboFix-quarantined-files.txt 2014-10-18 16:33
ComboFix2.txt 2014-10-18 14:51
.
Před spuštěním: Volných bajtů: 204 660 654 080
Po spuštění: Volných bajtů: 204 114 853 888
.
- - End Of File - - F922C234C9C2383C1EA0AB2FBF8CF70A

Dejte novy log z RSIT

Nový log

Logfile of random's system information tool 1.10 (written by random/random)
Run by ZM at 2014-10-18 19:33:30
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 195 GB (70%) free of 278 GB
Total RAM: 4010 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:33:33, on 18.10.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17344)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe
C:\Program Files (x86)\Samsung\Easy Software Manager\SWMAgent.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe
C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe
C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe
D:\ZM\Downloads\ZM.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/?clid=22668
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SSDMonitor] C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKUS\S-1-5-21-1571869238-3936240484-2151935606-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-1571869238-3936240484-2151935606-1000\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Bluetooth 3.0 + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bluetooth Device Monitor - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Intel Corporation - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service (BTHSSecurityMgr) - Intel(R) Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: eBeam Device Service - Luidia, Inc. - C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Foxit Cloud Safe Update Service (FoxitCloudUpdateService) - Foxit Corporation - C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: SInstalátor (ssinstall) - PS Media s.r.o. - C:\windows\SysWOW64\ssins.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10166 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\nvvsvc.exe
winlogon.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe"
C:\windows\system32\nvvsvc.exe -session -first
"C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe"
"taskhost.exe"
taskeng.exe {6E42622E-29A6-4F77-917E-E354CD9F94F3}
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\windows\system32\Dwm.exe"
"C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe"
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
"C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe"
C:\windows\system32\svchost.exe -k bthsvcs
"C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe"
"C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe"
"C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe"
C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceUI.exe -medIL
"C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe"
"C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe"
C:\windows\SysWOW64\ssins.exe
C:\windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe"
"C:\Program Files (x86)\Samsung\Easy Software Manager\SWMAgent.exe"
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-57bac0f7-2262-44a7-920d-3bd25fd8f04c -SystemEventPortName:HostProcess-27385e32-0798-4d2c-affb-5c85e0fbce15 -IoCancelEventPortName:HostProcess-6a39517b-0617-4748-bca9-b115fdf62315 -NonStateChangingEventPortName:HostProcess-43247a82-09b5-4cfd-a5fd-150069e97183 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:b349bfca-3de1-4875-abc6-23532e98c57d -DeviceGroupId:WpdFsGroup
taskeng.exe {7475B475-671B-4497-A6FD-F90911999984}
"C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"
"C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe"
"C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe"
"C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe"
"C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe"
C:\windows\system32\SearchIndexer.exe /Embedding
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\windows\system32\igfxext.exe -Embedding
C:\windows\system32\igfxsrvc.exe -Embedding
"C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe"
"C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
WLIDSvcM.exe 3788
C:\windows\system32\svchost.exe -k SDRSVC
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
C:\windows\explorer.exe
C:\windows\system32\wbem\wmiprvse.exe

"D:\ZM\Downloads\RSITx64.exe"
"C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524

======Scheduled tasks folder======

C:\windows\tasks\Adobe Flash Player Updater.job - C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default

prefs.js - "browser.search.suggest.enabled" - false
prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "https://www.seznam.cz/?clid=22668"
prefs.js - "keyword.URL" - "http://search.seznam.cz/?sourceid=quick ... earchTerms}&"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.152 Plugin
"Path"=C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf]
"Description"=
"Path"=C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.67.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.67.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.152 Plugin
"Path"=C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.60.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.60.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
xmlfiller@software602.cz

C:\Program Files (x86)\Mozilla Firefox\components\
nsIFillerPlugin.xpt

C:\Program Files (x86)\Mozilla Firefox\plugins\
npfiller.dll
NPOFFICE.DLL
nppdf32.dll
npwachk.dll

C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default\extensions\
{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

C:\Users\ZM\AppData\Roaming\Mozilla\Firefox\Profiles\v3ezqehg.default\searchplugins\
bing-avast.xml
Google.xml
seznam-avast.xml

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre7\bin\ssv.dll [2014-06-22 553384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-07-04 612248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-06-22 211880]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-25 462760]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-07-04 457712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-25 171944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -
{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2011-07-12 12558440]
"BTMTrayAgent"=C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [2011-03-30 10372368]
"ETDCtrl"=C:\Program Files\Elantech\ETDCtrl.exe [2011-06-17 2721576]
"ActivControl"=C:\Program Files\Activ Software\ActivDriver\ActivControl2x64.exe [2012-02-24 1241456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring]
C:\Program Files\CCleaner\CCleaner64.exe [2013-12-17 5973272]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-07-24 21650016]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SSDMonitor"=C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [2011-12-12 103896]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-08-01 4085896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\System32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2010-12-16 384000]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2014-10-18 18:33:09 ----A---- C:\ComboFix.txt
2014-10-18 18:25:59 ----D---- C:\$RECYCLE.BIN
2014-10-18 18:09:04 ----A---- C:\windows\NIRCMD.exe
2014-10-18 16:36:03 ----A---- C:\windows\zip.exe
2014-10-18 16:36:03 ----A---- C:\windows\SWSC.exe
2014-10-18 16:36:03 ----A---- C:\windows\SWREG.exe
2014-10-18 16:36:03 ----A---- C:\windows\sed.exe
2014-10-18 16:36:03 ----A---- C:\windows\PEV.exe
2014-10-18 16:36:03 ----A---- C:\windows\MBR.exe
2014-10-18 16:36:03 ----A---- C:\windows\grep.exe
2014-10-18 16:35:49 ----D---- C:\Qoobox
2014-10-18 16:35:21 ----D---- C:\windows\erdnt
2014-10-16 16:36:56 ----D---- C:\AdwCleaner
2014-10-15 21:15:58 ----D---- C:\rsit
2014-10-15 20:55:48 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-15 20:54:47 ----A---- C:\windows\SYSWOW64\ssinstall-uninstall.bat
2014-10-15 20:54:45 ----A---- C:\windows\SYSWOW64\ssins.exe
2014-10-15 20:54:15 ----A---- C:\windows\system32\win32k.sys
2014-10-15 20:54:05 ----A---- C:\windows\SYSWOW64\mscorier.dll
2014-10-15 20:54:05 ----A---- C:\windows\SYSWOW64\dfshim.dll
2014-10-15 20:54:05 ----A---- C:\windows\system32\mscorier.dll
2014-10-15 20:54:05 ----A---- C:\windows\system32\dfshim.dll
2014-10-15 20:54:04 ----A---- C:\windows\SYSWOW64\mscories.dll
2014-10-15 20:54:04 ----A---- C:\windows\system32\mscories.dll
2014-10-15 20:53:38 ----A---- C:\windows\SYSWOW64\blackbox.dll
2014-10-15 20:53:38 ----A---- C:\windows\system32\drmv2clt.dll
2014-10-15 20:53:38 ----A---- C:\windows\system32\blackbox.dll
2014-10-15 20:53:35 ----A---- C:\windows\SYSWOW64\drmv2clt.dll
2014-10-15 20:53:32 ----A---- C:\windows\system32\wmp.dll
2014-10-15 20:53:29 ----A---- C:\windows\SYSWOW64\wmdrmsdk.dll
2014-10-15 20:53:29 ----A---- C:\windows\system32\wmdrmsdk.dll
2014-10-15 20:53:29 ----A---- C:\windows\system32\mf.dll
2014-10-15 20:53:27 ----A---- C:\windows\SYSWOW64\wmp.dll
2014-10-15 20:53:27 ----A---- C:\windows\system32\AUDIOKSE.dll
2014-10-15 20:53:25 ----A---- C:\windows\system32\drmmgrtn.dll
2014-10-15 20:53:17 ----A---- C:\windows\SYSWOW64\mf.dll
2014-10-15 20:53:16 ----A---- C:\windows\SYSWOW64\drmmgrtn.dll
2014-10-15 20:53:16 ----A---- C:\windows\system32\drivers\PEAuth.sys
2014-10-15 20:53:16 ----A---- C:\windows\system32\ci.dll
2014-10-15 20:53:15 ----A---- C:\windows\SYSWOW64\AUDIOKSE.dll
2014-10-15 20:53:14 ----A---- C:\windows\system32\quartz.dll
2014-10-15 20:53:14 ----A---- C:\windows\system32\AudioEng.dll
2014-10-15 20:53:13 ----A---- C:\windows\system32\winload.exe
2014-10-15 20:53:12 ----A---- C:\windows\SYSWOW64\AudioSes.dll
2014-10-15 20:53:12 ----A---- C:\windows\system32\wintrust.dll
2014-10-15 20:53:12 ----A---- C:\windows\system32\winresume.exe
2014-10-15 20:53:12 ----A---- C:\windows\system32\cryptsvc.dll
2014-10-15 20:53:11 ----A---- C:\windows\system32\ntoskrnl.exe
2014-10-15 20:53:10 ----A---- C:\windows\system32\evr.dll
2014-10-15 20:53:06 ----A---- C:\windows\SYSWOW64\ntkrnlpa.exe
2014-10-15 20:53:06 ----A---- C:\windows\system32\EncDump.dll
2014-10-15 20:53:05 ----A---- C:\windows\system32\crypt32.dll
2014-10-15 20:53:03 ----A---- C:\windows\SYSWOW64\cryptsvc.dll
2014-10-15 20:53:02 ----A---- C:\windows\SYSWOW64\wintrust.dll
2014-10-15 20:53:02 ----A---- C:\windows\system32\AudioSes.dll
2014-10-15 20:53:00 ----A---- C:\windows\SYSWOW64\ntoskrnl.exe
2014-10-15 20:53:00 ----A---- C:\windows\system32\cryptui.dll
2014-10-15 20:52:59 ----A---- C:\windows\SYSWOW64\quartz.dll
2014-10-15 20:52:59 ----A---- C:\windows\SYSWOW64\evr.dll
2014-10-15 20:52:59 ----A---- C:\windows\system32\mfplat.dll
2014-10-15 20:52:59 ----A---- C:\windows\system32\audiosrv.dll
2014-10-15 20:52:58 ----A---- C:\windows\SYSWOW64\cryptui.dll
2014-10-15 20:52:58 ----A---- C:\windows\SYSWOW64\crypt32.dll
2014-10-15 20:52:58 ----A---- C:\windows\system32\srcore.dll
2014-10-15 20:52:58 ----A---- C:\windows\system32\pcasvc.dll
2014-10-15 20:52:57 ----A---- C:\windows\SYSWOW64\mfplat.dll
2014-10-15 20:52:56 ----A---- C:\windows\system32\cryptsp.dll
2014-10-15 20:52:55 ----A---- C:\windows\SYSWOW64\cryptsp.dll
2014-10-15 20:52:55 ----A---- C:\windows\SYSWOW64\AudioEng.dll
2014-10-15 20:52:54 ----A---- C:\windows\system32\msscp.dll
2014-10-15 20:52:47 ----A---- C:\windows\system32\msnetobj.dll
2014-10-15 20:52:46 ----A---- C:\windows\system32\rstrui.exe
2014-10-15 20:52:46 ----A---- C:\windows\system32\appidsvc.dll
2014-10-15 20:52:43 ----A---- C:\windows\SYSWOW64\msscp.dll
2014-10-15 20:52:39 ----A---- C:\windows\system32\appidapi.dll
2014-10-15 20:52:38 ----A---- C:\windows\system32\audiodg.exe
2014-10-15 20:52:37 ----A---- C:\windows\system32\drivers\appid.sys
2014-10-15 20:52:35 ----A---- C:\windows\SYSWOW64\msnetobj.dll
2014-10-15 20:52:35 ----A---- C:\windows\system32\rrinstaller.exe
2014-10-15 20:52:32 ----A---- C:\windows\SYSWOW64\rrinstaller.exe
2014-10-15 20:52:30 ----A---- C:\windows\SYSWOW64\mfps.dll
2014-10-15 20:52:30 ----A---- C:\windows\system32\mfps.dll
2014-10-15 20:52:29 ----A---- C:\windows\SYSWOW64\srclient.dll
2014-10-15 20:52:29 ----A---- C:\windows\SYSWOW64\mfpmp.exe
2014-10-15 20:52:29 ----A---- C:\windows\SYSWOW64\appidapi.dll
2014-10-15 20:52:29 ----A---- C:\windows\system32\srclient.dll
2014-10-15 20:52:29 ----A---- C:\windows\system32\setbcdlocale.dll
2014-10-15 20:52:29 ----A---- C:\windows\system32\mfpmp.exe
2014-10-15 20:52:29 ----A---- C:\windows\system32\appidpolicyconverter.exe
2014-10-15 20:52:28 ----A---- C:\windows\SYSWOW64\spwmp.dll
2014-10-15 20:52:28 ----A---- C:\windows\SYSWOW64\mferror.dll
2014-10-15 20:52:28 ----A---- C:\windows\SYSWOW64\dxmasf.dll
2014-10-15 20:52:28 ----A---- C:\windows\system32\spwmp.dll
2014-10-15 20:52:28 ----A---- C:\windows\system32\dxmasf.dll
2014-10-15 20:52:28 ----A---- C:\windows\system32\appidcertstorecheck.exe
2014-10-15 20:52:27 ----A---- C:\windows\system32\mferror.dll
2014-10-15 20:52:26 ----A---- C:\windows\SYSWOW64\wmploc.DLL
2014-10-15 20:52:26 ----A---- C:\windows\system32\wmploc.DLL
2014-10-15 20:51:59 ----A---- C:\windows\system32\generaltel.dll
2014-10-15 20:51:59 ----A---- C:\windows\system32\aepdu.dll
2014-10-15 20:51:56 ----A---- C:\windows\system32\aeinv.dll
2014-10-15 20:51:53 ----A---- C:\windows\SYSWOW64\iernonce.dll
2014-10-15 20:51:52 ----A---- C:\windows\SYSWOW64\ieetwproxystub.dll
2014-10-15 20:51:47 ----A---- C:\windows\SYSWOW64\urlmon.dll
2014-10-15 20:51:47 ----A---- C:\windows\SYSWOW64\mshtmled.dll
2014-10-15 20:51:47 ----A---- C:\windows\SYSWOW64\jscript9diag.dll
2014-10-15 20:51:47 ----A---- C:\windows\SYSWOW64\iedkcs32.dll
2014-10-15 20:51:47 ----A---- C:\windows\system32\iernonce.dll
2014-10-15 20:51:47 ----A---- C:\windows\system32\ie4uinit.exe
2014-10-15 20:51:46 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2014-10-15 20:51:46 ----A---- C:\windows\SYSWOW64\JavaScriptCollectionAgent.dll
2014-10-15 20:51:46 ----A---- C:\windows\SYSWOW64\dxtmsft.dll
2014-10-15 20:51:46 ----A---- C:\windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 20:51:46 ----A---- C:\windows\system32\ieetwproxystub.dll
2014-10-15 20:51:45 ----A---- C:\windows\SYSWOW64\mshtml.dll
2014-10-15 20:51:44 ----A---- C:\windows\SYSWOW64\iesetup.dll
2014-10-15 20:51:43 ----A---- C:\windows\system32\urlmon.dll
2014-10-15 20:51:43 ----A---- C:\windows\system32\iedkcs32.dll
2014-10-15 20:51:42 ----A---- C:\windows\SYSWOW64\iertutil.dll
2014-10-15 20:51:41 ----A---- C:\windows\SYSWOW64\jsproxy.dll
2014-10-15 20:51:41 ----A---- C:\windows\system32\ieetwcollectorres.dll
2014-10-15 20:51:40 ----A---- C:\windows\SYSWOW64\ieui.dll
2014-10-15 20:51:40 ----A---- C:\windows\SYSWOW64\ieframe.dll
2014-10-15 20:51:40 ----A---- C:\windows\SYSWOW64\dxtrans.dll
2014-10-15 20:51:40 ----A---- C:\windows\system32\msfeeds.dll
2014-10-15 20:51:40 ----A---- C:\windows\system32\ieetwcollector.exe
2014-10-15 20:51:40 ----A---- C:\windows\system32\dxtmsft.dll
2014-10-15 20:51:39 ----A---- C:\windows\system32\iesetup.dll
2014-10-15 20:51:35 ----A---- C:\windows\system32\iertutil.dll
2014-10-15 20:51:34 ----A---- C:\windows\SYSWOW64\mshtmlmedia.dll
2014-10-15 20:51:34 ----A---- C:\windows\SYSWOW64\jscript9.dll
2014-10-15 20:51:34 ----A---- C:\windows\SYSWOW64\ieUnatt.exe
2014-10-15 20:51:33 ----A---- C:\windows\SYSWOW64\wininet.dll
2014-10-15 20:51:33 ----A---- C:\windows\SYSWOW64\vbscript.dll
2014-10-15 20:51:33 ----A---- C:\windows\SYSWOW64\ieapfltr.dll
2014-10-15 20:51:32 ----A---- C:\windows\SYSWOW64\msrating.dll
2014-10-15 20:51:32 ----A---- C:\windows\SYSWOW64\MshtmlDac.dll
2014-10-15 20:51:32 ----A---- C:\windows\system32\jsproxy.dll
2014-10-15 20:51:29 ----A---- C:\windows\system32\dxtrans.dll
2014-10-15 20:51:28 ----A---- C:\windows\system32\ieui.dll
2014-10-15 20:51:28 ----A---- C:\windows\system32\ieframe.dll
2014-10-15 20:51:25 ----A---- C:\windows\system32\mshtmlmedia.dll
2014-10-15 20:51:25 ----A---- C:\windows\system32\mshtmled.dll
2014-10-15 20:51:24 ----A---- C:\windows\system32\vbscript.dll
2014-10-15 20:51:24 ----A---- C:\windows\system32\jscript9diag.dll
2014-10-15 20:51:24 ----A---- C:\windows\system32\jscript9.dll
2014-10-15 20:51:24 ----A---- C:\windows\system32\ieUnatt.exe
2014-10-15 20:51:23 ----A---- C:\windows\system32\wininet.dll
2014-10-15 20:51:23 ----A---- C:\windows\system32\ieapfltr.dll
2014-10-15 20:51:21 ----A---- C:\windows\system32\msrating.dll
2014-10-15 20:51:21 ----A---- C:\windows\system32\MshtmlDac.dll
2014-10-15 20:51:18 ----A---- C:\windows\system32\MsSpellCheckingFacility.exe
2014-10-15 20:51:16 ----A---- C:\windows\system32\mshtml.dll
2014-10-15 20:50:39 ----A---- C:\windows\system32\msi.dll
2014-10-15 20:50:38 ----A---- C:\windows\SYSWOW64\msi.dll
2014-10-15 20:50:16 ----A---- C:\windows\system32\rastls.dll
2014-10-15 20:50:15 ----A---- C:\windows\SYSWOW64\rastls.dll
2014-10-15 20:50:01 ----A---- C:\windows\SYSWOW64\mstscax.dll
2014-10-15 20:50:00 ----A---- C:\windows\system32\mstscax.dll
2014-10-15 20:49:57 ----A---- C:\windows\system32\termsrv.dll
2014-10-15 20:49:57 ----A---- C:\windows\system32\mstsc.exe
2014-10-15 20:49:56 ----A---- C:\windows\SYSWOW64\mstsc.exe
2014-10-15 20:49:56 ----A---- C:\windows\system32\winsta.dll
2014-10-15 20:49:55 ----A---- C:\windows\SYSWOW64\winsta.dll
2014-10-15 20:49:55 ----A---- C:\windows\system32\drivers\rdpwd.sys
2014-10-15 20:49:54 ----A---- C:\windows\system32\winlogon.exe
2014-10-15 20:49:54 ----A---- C:\windows\system32\rdpcorekmts.dll
2014-10-15 20:49:53 ----A---- C:\windows\SYSWOW64\aaclient.dll
2014-10-15 20:49:52 ----A---- C:\windows\SYSWOW64\TSpkg.dll
2014-10-15 20:49:52 ----A---- C:\windows\system32\TSpkg.dll
2014-10-15 20:49:52 ----A---- C:\windows\system32\credssp.dll
2014-10-15 20:49:51 ----A---- C:\windows\SYSWOW64\credssp.dll
2014-10-15 20:49:51 ----A---- C:\windows\system32\drivers\tssecsrv.sys
2014-10-15 20:49:15 ----A---- C:\windows\SYSWOW64\packager.dll
2014-10-15 20:49:15 ----A---- C:\windows\system32\packager.dll
2014-10-02 19:19:53 ----A---- C:\autoexec.bat
2014-10-02 19:04:16 ----D---- C:\windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-10-01 18:22:03 ----A---- C:\windows\system32\qdvd.dll
2014-10-01 18:22:02 ----A---- C:\windows\SYSWOW64\qdvd.dll
2014-09-25 06:21:07 ----D---- C:\Program Files (x86)\Mozilla Firefox
2014-09-24 14:09:59 ----A---- C:\windows\SYSWOW64\tzres.dll
2014-09-24 14:09:59 ----A---- C:\windows\system32\tzres.dll
2014-09-22 20:04:52 ----A---- C:\windows\SYSWOW64\javaws.exe
2014-09-22 20:04:44 ----A---- C:\windows\SYSWOW64\WindowsAccessBridge-32.dll
2014-09-22 20:04:44 ----A---- C:\windows\SYSWOW64\javaw.exe
2014-09-22 20:04:44 ----A---- C:\windows\SYSWOW64\java.exe

======List of files/folders modified in the last 1 month======

2014-10-18 19:33:33 ----D---- C:\windows\Prefetch
2014-10-18 18:36:13 ----D---- C:\windows\system32\config
2014-10-18 18:33:11 ----D---- C:\windows\system32\drivers
2014-10-18 18:33:10 ----D---- C:\windows\Temp
2014-10-18 18:27:50 ----A---- C:\windows\SYSWOW64\log.txt
2014-10-18 18:26:02 ----D---- C:\Windows
2014-10-18 18:26:02 ----A---- C:\windows\system.ini
2014-10-18 18:25:56 ----D---- C:\windows\system32\drivers\etc
2014-10-18 18:15:16 ----D---- C:\windows\SYSWOW64\drivers
2014-10-18 18:15:16 ----D---- C:\windows\SysWOW64
2014-10-18 18:15:16 ----D---- C:\windows\AppPatch
2014-10-18 18:15:14 ----D---- C:\Program Files (x86)\Common Files
2014-10-18 16:43:28 ----AD---- C:\ProgramData\Temp
2014-10-18 16:36:47 ----SHD---- C:\System Volume Information
2014-10-18 16:27:30 ----D---- C:\ProgramData
2014-10-18 16:27:29 ----D---- C:\Program Files (x86)
2014-10-18 07:54:14 ----D---- C:\windows\en-US
2014-10-17 06:10:17 ----D---- C:\windows\inf
2014-10-16 18:53:01 ----SHD---- C:\windows\Installer
2014-10-16 18:48:27 ----D---- C:\Program Files (x86)\Google
2014-10-16 18:48:01 ----D---- C:\windows\Tasks
2014-10-16 18:48:01 ----D---- C:\windows\system32\Tasks
2014-10-16 18:44:53 ----D---- C:\windows\debug
2014-10-16 16:39:35 ----D---- C:\Program Files
2014-10-16 07:01:43 ----D---- C:\windows\rescache
2014-10-16 06:32:12 ----D---- C:\windows\Microsoft.NET
2014-10-16 06:29:40 ----RSD---- C:\windows\assembly
2014-10-15 21:38:47 ----D---- C:\windows\system32\catroot2
2014-10-15 21:34:45 ----D---- C:\windows\winsxs
2014-10-15 21:29:49 ----D---- C:\windows\System32
2014-10-15 21:29:45 ----D---- C:\windows\SYSWOW64\Dism
2014-10-15 21:29:45 ----D---- C:\windows\SYSWOW64\cs-CZ
2014-10-15 21:29:45 ----D---- C:\windows\system32\Dism
2014-10-15 21:29:45 ----D---- C:\Program Files\Windows Media Player
2014-10-15 21:29:45 ----D---- C:\Program Files (x86)\Windows Media Player
2014-10-15 21:29:44 ----SD---- C:\windows\system32\CompatTel
2014-10-15 21:29:44 ----D---- C:\windows\SYSWOW64\en-US
2014-10-15 21:29:44 ----D---- C:\windows\system32\en-US
2014-10-15 21:29:44 ----D---- C:\windows\system32\cs-CZ
2014-10-15 21:29:44 ----D---- C:\windows\system32\CodeIntegrity
2014-10-15 21:29:44 ----D---- C:\windows\system32\Boot
2014-10-15 21:29:44 ----D---- C:\Program Files\Internet Explorer
2014-10-15 21:29:43 ----D---- C:\Program Files (x86)\Internet Explorer
2014-10-15 21:24:11 ----D---- C:\ProgramData\Microsoft Help
2014-10-15 21:17:28 ----D---- C:\windows\system32\MRT
2014-10-15 21:08:41 ----A---- C:\windows\system32\MRT.exe
2014-10-15 20:49:31 ----SD---- C:\Users\ZM\AppData\Roaming\Microsoft
2014-10-15 20:49:28 ----D---- C:\windows\system32\catroot
2014-10-15 20:37:03 ----D---- C:\Users\ZM\AppData\Roaming\Skype
2014-10-15 20:28:23 ----D---- C:\windows\system32\wbem
2014-10-15 20:27:34 ----D---- C:\windows\system32\wfp
2014-10-15 20:27:34 ----D---- C:\windows\system32\DriverStore
2014-10-15 20:27:31 ----D---- C:\Users\ZM\AppData\Roaming\Promethean
2014-10-15 20:27:28 ----D---- C:\ProgramData\WinClon
2014-10-15 20:27:23 ----D---- C:\windows\registration
2014-10-13 21:39:46 ----A---- C:\windows\system32\PerfStringBackup.INI
2014-10-06 06:16:22 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2014-10-02 19:11:46 ----D---- C:\Users\ZM\AppData\Roaming\WildTangent
2014-10-02 19:11:46 ----D---- C:\ProgramData\WildTangent
2014-10-02 06:19:39 ----D---- C:\Users\ZM\AppData\Roaming\Winamp
2014-09-22 20:05:07 ----D---- C:\ProgramData\Oracle
2014-09-22 20:04:42 ----D---- C:\Program Files (x86)\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswKbd;aswKbd; C:\windows\system32\drivers\aswKbd.sys [2013-03-07 22600]
R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2014-07-04 65776]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2014-07-04 224896]
R0 iaStor;Intel AHCI Controller; C:\windows\system32\DRIVERS\iaStor.sys [2011-02-18 439320]
R0 nvpciflt;nvpciflt; C:\windows\system32\DRIVERS\nvpciflt.sys [2011-06-05 25960]
R0 rdyboost;ReadyBoost; C:\windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr2.sys [2014-07-04 93568]
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys [2014-07-04 1041168]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2014-07-04 427360]
R1 SABI;SAMSUNG Kernel Driver For Windows 7; \??\C:\windows\system32\Drivers\SABI.sys [2011-07-30 13824]
R1 vwififlt;Virtual WiFi Filter Driver; C:\windows\system32\DRIVERS\vwififlt.sys [2011-01-25 60416]
R2 aswHwid;avast! HardwareID; C:\windows\system32\drivers\aswHwid.sys [2014-07-04 29208]
R2 aswMonFlt;aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [2014-07-04 79184]
R2 aswStm;aswStm; C:\windows\system32\drivers\aswStm.sys [2014-07-04 92008]
R2 SGDrv;SGDrv; C:\windows\system32\DRIVERS\SGdrv64.sys [2011-04-11 7680]
R3 AMPPAL;Virtuální adaptér Intel(R) Centrino(R) Bluetooth 3.0 + High Speed; C:\windows\system32\DRIVERS\AMPPAL.sys [2011-04-21 294912]
R3 BthEnum;Ovladač pro Bluetooth Request Block; C:\windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
R3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
R3 btmaux;Intel Bluetooth Auxiliary Service; C:\windows\system32\DRIVERS\btmaux.sys [2011-03-08 51712]
R3 btmhsf;btmhsf; C:\windows\system32\DRIVERS\btmhsf.sys [2011-03-08 274944]
R3 clwvd;CyberLink WebCam Virtual Driver; C:\windows\system32\DRIVERS\clwvd.sys [2011-08-17 31216]
R3 ETD;ELAN PS/2 Port Input Device; C:\windows\system32\DRIVERS\ETD.sys [2011-06-17 186152]
R3 iBtFltCoex;iBtFltCoex; C:\windows\system32\DRIVERS\iBtFltCoex.sys [2011-03-22 59904]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2010-12-16 12256512]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2011-07-12 2917096]
R3 IntcDAud;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-14 317440]
R3 MEIx64;Intel(R) Management Engine Interface; C:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]
R3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit; C:\windows\system32\DRIVERS\NETwNs64.sys [2011-05-01 8593920]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
R3 RTL8167;Realtek 8167 NT Driver; C:\windows\system32\DRIVERS\Rt64win7.sys [2011-04-22 471144]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\windows\system32\DRIVERS\vwifimp.sys [2011-01-25 18432]
S3 AMPPALP;Protokol Intel(R) Centrino(R) Bluetooth 3.0 + High Speed; C:\windows\system32\DRIVERS\amppal.sys [2011-04-21 294912]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTHPORT;Ovladač portu Bluetooth; C:\windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 pciide;pciide; C:\windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 rtport;rtport; \??\C:\windows\SysWOW64\drivers\rtport.sys [2011-09-19 15144]
S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\windows\system32\DRIVERS\ss_bus.sys [2009-09-21 127488]
S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\windows\system32\DRIVERS\ss_mdfl.sys [2009-09-21 18944]
S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\windows\system32\DRIVERS\ss_mdm.sys [2009-09-21 161280]
S3 TsUsbFlt;TsUsbFlt; C:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WinUsb;WinUsb; C:\windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2010-04-14 73728]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-09-12 64704]
R2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service; C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-04-21 1136640]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-07-04 50344]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-03-30 923984]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2011-03-30 1001808]
R2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service; C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-04-21 134928]
R2 eBeam Device Service;eBeam Device Service; C:\Program Files (x86)\Luidia\eBeam Device Service\eBeamDeviceServiceMain.exe [2009-09-17 180224]
R2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [2014-03-11 241728]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2011-05-05 326424]
R2 NVSvc;NVIDIA Driver Helper Service; C:\windows\system32\nvvsvc.exe [2011-06-04 993896]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-06-05 1997416]
R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [2011-12-12 793048]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [2009-12-01 244904]
R2 ssinstall;SInstalátor; C:\windows\SysWOW64\ssins.exe [2014-10-15 2324216]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-05-05 2656536]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2010-09-21 2286976]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-16 107912]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-06 267440]
S3 Bluetooth Media Service;Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2011-03-30 1321296]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-16 107912]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\windows\system32\IEEtwCollector.exe [2014-09-19 111616]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-09-18 114288]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\windows\system32\Wat\WatAdminSvc.exe [2012-04-19 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S4 NetMsmqActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------

Stahnete crystal disk info http://sourceforge.jp/projects/crystald ... 5_0_0.zip/
Spustte jako spravce. Za chvili se zobrazi vysledek.
Kliknete nahore na napis Úpravy a pak na napis Kopírovat. To co se zkopiruje (ulozi se to do pameti) mi sem vlozte (ctrl + V)



A posledni sken a budem mazat

Jestli bude Avast rvat, ze to chce otevrit v sandboxu, nedovolte to! Vyberte moznost Otevrit normalne
Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte na plochu.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce
Oznacte polozky (dejte tam zatrzitka) Pro všechny uživatele, Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
Do spodniho okna vlozte nasledujici text Kliknete na Prohledat
Po skenu se vytvori dva logy (OTL.Txt a Extras.txt), oba sem vlozte (kdyz budou dlouhe, rozdelte je do vice prispevku).