VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Mozny vir.. prosim o kontrolu..

https://forum.viry.cz:443/viewtopic.php?t=140928

Stránka 1 z 2

Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 14:27
od bzuk
Zdravim
Pri kazdem spusteni Google Chrome mi Avast vyhazuje tyto chyby:

URL: hxxps://codegv.ru
Infekce: URL:Mal

URL: hxxp://arteta.ru/sync.html?r=0.2646231504622847
Infekce: URL:Mal

Logfile of random's system information tool 1.10 (written by random/random)
Microsoft Windows 8.1 Pro
System drive C: has 99 GB (66%) free of 149 GB
Total RAM: 8135 MB (81% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:21:27, on 25. 10. 2014
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17344)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Vilém.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O4 - HKLM\..\Run: [CLMLServer_For_P2G8] "C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe"
O4 - HKLM\..\Run: [CLVirtualDrive] "C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe" /R
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [Power2GoExpress8] NA
O4 - HKCU\..\Run: [AceStream] C:\Users\Vilém\AppData\Roaming\ACEStream\engine\ace_engine.exe
O4 - HKCU\..\Run: [Zoner Photo Studio Service 16] "D:\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXED:\Zoner\Photo Studio 16\Program32\ZPSService.exe"
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] "D:\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXE"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\WINDOWS\system32\nvvsvc.exe (file missing)
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nc) (pr2ah4nc) - Unknown owner - C:\WINDOWS\system32\pr2ah4nc.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: Spyware Terminator 2012 Realtime Shield Service (ST2012_Svc) - Crawler.com - C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9009 bytes

======Listing Processes======





wininit.exe

winlogon.exe

C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
"dwm.exe"
"C:\WINDOWS\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\WINDOWS\system32\nvvsvc.exe -session -first
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe" /service
"C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe" /service
dashost.exe {1ce80663-958a-477b-9c17500aad28450c}
"C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" nss c9b77044-2112-4a8b-8150-e54c544de9c0 1
"C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe"
\??\C:\WINDOWS\system32\conhost.exe 0x4
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" serviceapp
\??\C:\WINDOWS\system32\conhost.exe 0x4
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
taskhostex.exe
C:\WINDOWS\Explorer.EXE
"C:\Windows\System32\SettingSyncHost.exe" -Embedding
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
C:\Windows\System32\skydrive.exe -Embedding
"C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
C:\WINDOWS\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
taskeng.exe {002B4AE1-BD2C-467C-875F-BE898308D3F7}
C:\Windows\System32\RuntimeBroker.exe -Embedding
taskhost.exe $(Arg0)
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="3468.0.2063712982\2095273346" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,16,44 --gpu-vendor-id=0x10de --gpu-device-id=0x11c0 --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.4448 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutoReloadExperiment/Enabled/AutoReloadVisibleOnlyExperiment/Enabled/BrowserBlacklist/Enabled/DomRel-Enable/disable/EmbeddedSearch/Group6 pct:10f stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Enforce/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/SDCH/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_06/UMA-Uniformity-Trial-1-Percent/group_18/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --renderer-print-preview --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --enable-pinch --device-scale-factor=1 --enable-delegated-renderer --channel="3468.2.1932269808\2134735674" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutoReloadExperiment/Enabled/AutoReloadVisibleOnlyExperiment/Enabled/BrowserBlacklist/Enabled/DomRel-Enable/disable/EmbeddedSearch/Group6 pct:10f stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Enforce/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/SDCH/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_06/UMA-Uniformity-Trial-1-Percent/group_18/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --renderer-print-preview --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --enable-pinch --device-scale-factor=1 --enable-delegated-renderer --channel="3468.3.1345531280\1385376586" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutoReloadExperiment/Enabled/AutoReloadVisibleOnlyExperiment/Enabled/BrowserBlacklist/Enabled/DomRel-Enable/disable/EmbeddedSearch/Group6 pct:10f stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Enforce/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/PasswordGeneration/Disabled/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/SDCH/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_06/UMA-Uniformity-Trial-1-Percent/group_18/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --renderer-print-preview --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --enable-pinch --device-scale-factor=1 --enable-delegated-renderer --channel="3468.4.623130733\642472051" /prefetch:673131151

"C:\WINDOWS\system32\wwahost.exe" -ServerName:Microsoft.WindowsReadingList.wwa
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AutoReloadExperiment/Enabled/AutoReloadVisibleOnlyExperiment/Enabled/BrowserBlacklist/Enabled/DomRel-Enable/disable/EmbeddedSearch/Group6 pct:10f stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Enforce/GoogleNow/Enable/OmniboxBundledExperimentV1/StandardR4/PasswordGeneration/Disabled/PasswordManagerUI/Bubble/Prerender/PrerenderEnabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/SDCH/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_06/UMA-Uniformity-Trial-1-Percent/group_18/UMA-Uniformity-Trial-10-Percent/group_07/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_12/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/" --renderer-print-preview --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --enable-pinch --device-scale-factor=1 --enable-delegated-renderer --channel="3468.14.1214072171\814760508" /prefetch:673131151
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
"C:\Users\Vilém\Desktop\Download\RSITx64 (1).exe"

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-10-25 705448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14 2117216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-10-25 586968]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14 1709152]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2013-10-06 6548112]
"ShadowPlay"=C:\WINDOWS\system32\nvspcap64.dll [2014-10-04 2800296]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2014-10-04 2463552]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress8"=NA []
"AceStream"=C:\Users\Vilém\AppData\Roaming\ACEStream\engine\ace_engine.exe [2014-09-25 27904]
"Zoner Photo Studio Service 16"=D:\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXE [2014-06-16 833024]
"Zoner Photo Studio Autoupdate"=D:\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXE [2014-06-16 833024]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2014-09-26 6482200]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"CLMLServer_For_P2G8"=C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2012-06-08 111120]
"CLVirtualDrive"=C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [2012-08-14 491120]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-08-21 959176]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2014-10-25 5223016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"SoftwareSASGeneration"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.yuy2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"vidc.yvyu"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"vidc.uyvy"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-10-25 15:21:25 ----D---- C:\rsit
2014-10-25 15:21:25 ----D---- C:\Program Files\trend micro
2014-10-25 14:28:25 ----SHD---- C:\Config.Msi
2014-10-25 14:27:09 ----D---- C:\Users\Vilém\AppData\Roaming\AVAST Software
2014-10-25 14:24:21 ----A---- C:\WINDOWS\system32\drivers\aswVmm.sys
2014-10-25 14:24:21 ----A---- C:\WINDOWS\system32\drivers\aswStm.sys
2014-10-25 14:24:21 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2014-10-25 14:24:21 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2014-10-25 14:24:21 ----A---- C:\WINDOWS\system32\drivers\aswRvrt.sys
2014-10-25 14:24:21 ----A---- C:\WINDOWS\system32\drivers\aswRdr2.sys
2014-10-25 14:24:21 ----A---- C:\WINDOWS\system32\drivers\aswMonFlt.sys
2014-10-25 14:24:21 ----A---- C:\WINDOWS\system32\drivers\aswHwid.sys
2014-10-25 14:24:20 ----A---- C:\WINDOWS\system32\aswBoot.exe
2014-10-25 14:24:19 ----A---- C:\WINDOWS\avastSS.scr
2014-10-25 14:22:50 ----D---- C:\Program Files\AVAST Software
2014-10-25 14:20:28 ----D---- C:\ProgramData\AVAST Software
2014-10-25 14:17:57 ----D---- C:\ProgramData\CheckPoint
2014-10-23 12:15:35 ----A---- C:\WINDOWS\SYSWOW64\nvStreaming.exe
2014-10-23 12:14:53 ----D---- C:\WINDOWS\LastGood.Tmp
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\nvumdshim.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\nvopencl.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\nvoglv32.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\nvoglshim32.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\nvinit.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\NvIFROpenGL.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\NvIFR.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\NvFBC.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\nvEncodeAPI.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\nvcuvid.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\nvcuda.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\SYSWOW64\nvcompiler.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvopencl.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvoglv64.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvoglshim64.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvmcumd.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvinitx.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\NvIFROpenGL.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\NvIFR64.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\NvFBC64.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvEncodeAPI64.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvdispgenco6434448.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvdispco6434448.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvd3dumx.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\nvcuda.dll
2014-10-23 12:14:08 ----A---- C:\WINDOWS\system32\drivers\nvlddmkm.sys
2014-10-23 12:14:07 ----A---- C:\WINDOWS\SYSWOW64\nvapi.dll
2014-10-23 12:14:07 ----A---- C:\WINDOWS\system32\nvcompiler.dll
2014-10-20 20:01:50 ----D---- C:\Users\Vilém\AppData\Roaming\Spyware Terminator
2014-10-20 20:01:50 ----D---- C:\ProgramData\Spyware Terminator
2014-10-20 20:01:50 ----A---- C:\WINDOWS\system32\drivers\stflt.sys
2014-10-20 20:01:48 ----D---- C:\Program Files (x86)\Spyware Terminator
2014-10-18 18:28:01 ----A---- C:\WINDOWS\system32\win32k.sys
2014-10-18 18:27:28 ----A---- C:\WINDOWS\SYSWOW64\MrmCoreR.dll
2014-10-18 18:27:28 ----A---- C:\WINDOWS\system32\MrmCoreR.dll
2014-10-18 18:27:26 ----A---- C:\WINDOWS\system32\winbici.dll
2014-10-18 18:27:13 ----A---- C:\WINDOWS\system32\wuaueng.dll
2014-10-18 18:27:12 ----A---- C:\WINDOWS\SYSWOW64\wuapi.dll
2014-10-18 18:27:12 ----A---- C:\WINDOWS\system32\wups.dll
2014-10-18 18:27:12 ----A---- C:\WINDOWS\system32\wucltux.dll
2014-10-18 18:27:12 ----A---- C:\WINDOWS\system32\wuapi.dll
2014-10-18 18:27:11 ----A---- C:\WINDOWS\SYSWOW64\wuwebv.dll
2014-10-18 18:27:11 ----A---- C:\WINDOWS\SYSWOW64\wudriver.dll
2014-10-18 18:27:11 ----A---- C:\WINDOWS\system32\wuwebv.dll
2014-10-18 18:27:11 ----A---- C:\WINDOWS\system32\WUSettingsProvider.dll
2014-10-18 18:27:11 ----A---- C:\WINDOWS\system32\wups2.dll
2014-10-18 18:27:11 ----A---- C:\WINDOWS\system32\wudriver.dll
2014-10-18 18:27:11 ----A---- C:\WINDOWS\system32\wuauclt.exe
2014-10-18 18:27:11 ----A---- C:\WINDOWS\system32\wuapp.exe
2014-10-18 18:27:10 ----A---- C:\WINDOWS\SYSWOW64\wuapp.exe
2014-10-18 18:26:52 ----A---- C:\WINDOWS\system32\mshtml.dll
2014-10-18 18:26:51 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2014-10-18 18:26:47 ----A---- C:\WINDOWS\system32\jscript9.dll
2014-10-18 18:26:46 ----A---- C:\WINDOWS\system32\ieframe.dll
2014-10-18 18:26:45 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2014-10-18 18:26:45 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2014-10-18 18:26:44 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2014-10-18 18:26:44 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2014-10-18 18:26:44 ----A---- C:\WINDOWS\system32\wininet.dll
2014-10-18 18:26:44 ----A---- C:\WINDOWS\system32\urlmon.dll
2014-10-18 18:26:44 ----A---- C:\WINDOWS\system32\iertutil.dll
2014-10-18 18:26:43 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2014-10-18 18:26:43 ----A---- C:\WINDOWS\SYSWOW64\msfeeds.dll
2014-10-18 18:26:43 ----A---- C:\WINDOWS\SYSWOW64\iedkcs32.dll
2014-10-18 18:26:43 ----A---- C:\WINDOWS\system32\msfeeds.dll
2014-10-18 18:26:43 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2014-10-18 18:26:43 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2014-10-18 18:26:42 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2014-10-18 18:26:42 ----A---- C:\WINDOWS\SYSWOW64\mshtmled.dll
2014-10-18 18:26:42 ----A---- C:\WINDOWS\SYSWOW64\MshtmlDac.dll
2014-10-18 18:26:42 ----A---- C:\WINDOWS\SYSWOW64\ieapfltr.dll
2014-10-18 18:26:42 ----A---- C:\WINDOWS\SYSWOW64\dxtrans.dll
2014-10-18 18:26:42 ----A---- C:\WINDOWS\system32\vbscript.dll
2014-10-18 18:26:42 ----A---- C:\WINDOWS\system32\mshtmled.dll
2014-10-18 18:26:42 ----A---- C:\WINDOWS\system32\MshtmlDac.dll
2014-10-18 18:26:42 ----A---- C:\WINDOWS\system32\jscript9diag.dll
2014-10-18 18:26:42 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2014-10-18 18:26:42 ----A---- C:\WINDOWS\system32\dxtrans.dll
2014-10-18 18:26:22 ----A---- C:\WINDOWS\SYSWOW64\packager.dll
2014-10-18 18:26:22 ----A---- C:\WINDOWS\system32\packager.dll
2014-10-18 18:26:19 ----A---- C:\WINDOWS\SYSWOW64\rastls.dll
2014-10-18 18:26:19 ----A---- C:\WINDOWS\system32\rastls.dll
2014-10-18 18:26:15 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2014-10-18 18:26:15 ----A---- C:\WINDOWS\system32\Windows.UI.Search.dll
2014-10-18 18:26:15 ----A---- C:\WINDOWS\system32\shell32.dll
2014-10-18 18:26:14 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Search.dll
2014-10-18 18:26:14 ----A---- C:\WINDOWS\SYSWOW64\mstscax.dll
2014-10-18 18:26:14 ----A---- C:\WINDOWS\system32\SyncEngine.dll
2014-10-18 18:26:14 ----A---- C:\WINDOWS\system32\mstscax.dll
2014-10-18 18:26:14 ----A---- C:\WINDOWS\system32\drivers\tcpip.sys
2014-10-18 18:26:13 ----A---- C:\WINDOWS\SYSWOW64\WSShared.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\SYSWOW64\Wldap32.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\SYSWOW64\SearchFolder.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\SYSWOW64\propsys.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\SYSWOW64\ntdll.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\SYSWOW64\KernelBase.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\system32\WSShared.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\system32\Wldap32.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\system32\SearchFolder.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\system32\propsys.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\system32\ntdll.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\system32\KernelBase.dll
2014-10-18 18:26:13 ----A---- C:\WINDOWS\system32\iphlpsvc.dll
2014-10-18 18:26:12 ----A---- C:\WINDOWS\SYSWOW64\SkyDriveShell.dll
2014-10-18 18:26:12 ----A---- C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-10-18 18:26:12 ----A---- C:\WINDOWS\system32\SkyDriveShell.dll
2014-10-18 18:26:12 ----A---- C:\WINDOWS\system32\SkyDrive.exe
2014-10-18 18:26:12 ----A---- C:\WINDOWS\system32\pcsvDevice.dll
2014-10-18 18:26:12 ----A---- C:\WINDOWS\system32\httpprxm.dll
2014-10-18 18:26:12 ----A---- C:\WINDOWS\system32\drivers\FWPKCLNT.SYS
2014-10-18 18:26:12 ----A---- C:\WINDOWS\system32\bisrv.dll
2014-10-18 18:26:11 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-18 18:26:11 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-18 18:26:11 ----A---- C:\WINDOWS\system32\ProximityService.dll
2014-10-18 18:26:11 ----A---- C:\WINDOWS\system32\adhsvc.dll
2014-10-18 18:25:34 ----A---- C:\WINDOWS\SYSWOW64\msi.dll
2014-10-18 18:25:34 ----A---- C:\WINDOWS\SYSWOW64\authui.dll
2014-10-18 18:25:34 ----A---- C:\WINDOWS\system32\msi.dll
2014-10-18 18:25:34 ----A---- C:\WINDOWS\system32\generaltel.dll
2014-10-18 18:25:34 ----A---- C:\WINDOWS\system32\authui.dll
2014-10-18 18:25:34 ----A---- C:\WINDOWS\system32\appinfo.dll
2014-10-18 18:25:34 ----A---- C:\WINDOWS\system32\aepdu.dll
2014-10-18 18:25:34 ----A---- C:\WINDOWS\system32\aeinv.dll

======List of files/folders modified in the last 1 month======

2014-10-25 15:21:25 ----RD---- C:\Program Files
2014-10-25 15:20:49 ----D---- C:\WINDOWS\Prefetch
2014-10-25 15:04:01 ----SHD---- C:\WINDOWS\Installer
2014-10-25 15:04:01 ----D---- C:\WINDOWS\Temp
2014-10-25 15:02:02 ----RD---- C:\WINDOWS\System32
2014-10-25 15:02:02 ----D---- C:\WINDOWS\Inf
2014-10-25 15:02:02 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2014-10-25 15:01:26 ----RD---- C:\Program Files (x86)
2014-10-25 15:00:00 ----D---- C:\WINDOWS\system32\sru
2014-10-25 14:59:48 ----D---- C:\WINDOWS\Tasks
2014-10-25 14:57:16 ----A---- C:\WINDOWS\SYSWOW64\log.txt
2014-10-25 14:55:05 ----D---- C:\ProgramData\NVIDIA
2014-10-25 14:52:39 ----D---- C:\WINDOWS\system32\DriverStore
2014-10-25 14:52:39 ----D---- C:\WINDOWS\system32\drivers
2014-10-25 14:43:10 ----D---- C:\WINDOWS\system32\config
2014-10-25 14:32:15 ----D---- C:\WINDOWS\system32\wdi
2014-10-25 14:29:50 ----HD---- C:\ProgramData
2014-10-25 14:29:48 ----D---- C:\WINDOWS\SysWOW64
2014-10-25 14:29:48 ----D---- C:\Windows
2014-10-25 14:29:48 ----D---- C:\ProgramData\MFAData
2014-10-25 14:28:50 ----HD---- C:\WINDOWS\ELAMBKUP
2014-10-25 14:24:26 ----D---- C:\WINDOWS\system32\Tasks
2014-10-25 14:24:21 ----D---- C:\WINDOWS\WinSxS
2014-10-25 14:22:46 ----SHD---- C:\System Volume Information
2014-10-23 21:36:13 ----D---- C:\Users\Vilém\AppData\Roaming\uTorrent
2014-10-23 19:27:54 ----D---- C:\Users\Vilém\AppData\Roaming\.ACEStream
2014-10-23 12:21:56 ----D---- C:\WINDOWS\Microsoft.NET
2014-10-23 12:15:40 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2014-10-23 02:22:13 ----D---- C:\Users\Vilém\AppData\Roaming\vlc
2014-10-21 22:56:24 ----HD---- C:\Program Files\WindowsApps
2014-10-21 22:56:24 ----D---- C:\WINDOWS\AppReadiness
2014-10-21 18:42:19 ----D---- C:\WINDOWS\debug
2014-10-21 18:25:45 ----D---- C:\WINDOWS\SoftwareDistribution
2014-10-20 18:52:08 ----D---- C:\WINDOWS\system32\MRT
2014-10-20 18:50:05 ----A---- C:\WINDOWS\system32\MRT.exe
2014-10-19 12:36:01 ----D---- C:\WINDOWS\rescache
2014-10-19 12:26:58 ----RSD---- C:\WINDOWS\assembly
2014-10-18 20:27:29 ----RD---- C:\WINDOWS\ToastData
2014-10-18 20:27:29 ----D---- C:\WINDOWS\WinStore
2014-10-18 20:27:29 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2014-10-18 20:27:29 ----D---- C:\WINDOWS\system32\cs-CZ
2014-10-18 20:27:29 ----D---- C:\WINDOWS\MediaViewer
2014-10-18 20:27:29 ----D---- C:\WINDOWS\FileManager
2014-10-18 20:27:29 ----D---- C:\WINDOWS\Camera
2014-10-18 20:27:29 ----D---- C:\Program Files\Internet Explorer
2014-10-18 20:27:29 ----D---- C:\Program Files (x86)\Internet Explorer
2014-10-18 20:27:28 ----SD---- C:\WINDOWS\system32\CompatTel
2014-10-18 18:32:57 ----D---- C:\WINDOWS\CbsTemp
2014-10-18 18:25:18 ----D---- C:\WINDOWS\system32\catroot2
2014-10-16 18:54:03 ----A---- C:\WINDOWS\SYSWOW64\OpenCL.dll
2014-10-16 18:54:03 ----A---- C:\WINDOWS\SYSWOW64\nvwgf2um.dll
2014-10-16 18:54:03 ----A---- C:\WINDOWS\SYSWOW64\nvd3dum.dll
2014-10-16 18:54:03 ----A---- C:\WINDOWS\system32\OpenCL.dll
2014-10-16 18:54:03 ----A---- C:\WINDOWS\system32\nvwgf2umx.dll
2014-10-16 18:54:03 ----A---- C:\WINDOWS\system32\nvumdshimx.dll
2014-10-16 18:54:03 ----A---- C:\WINDOWS\system32\nvapi64.dll
2014-10-16 16:11:40 ----A---- C:\WINDOWS\system32\nvsvc64.dll
2014-10-16 16:11:40 ----A---- C:\WINDOWS\system32\nvcpl.dll
2014-10-16 16:11:36 ----A---- C:\WINDOWS\system32\nvvsvc.exe
2014-10-16 16:11:36 ----A---- C:\WINDOWS\system32\nvsvcr.dll
2014-10-16 16:11:36 ----A---- C:\WINDOWS\system32\nvshext.dll
2014-10-16 16:11:36 ----A---- C:\WINDOWS\system32\nvmctray.dll
2014-10-09 13:25:53 ----D---- C:\WINDOWS\Logs
2014-10-09 13:24:43 ----D---- C:\Program Files\CCleaner
2014-10-04 08:42:47 ----A---- C:\WINDOWS\SYSWOW64\nvspcap.dll
2014-10-04 08:42:47 ----A---- C:\WINDOWS\SYSWOW64\nvspbridge.dll
2014-10-04 08:41:43 ----A---- C:\WINDOWS\system32\nvspcap64.dll
2014-10-04 08:41:43 ----A---- C:\WINDOWS\system32\nvspbridge64.dll
2014-09-30 00:45:58 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\WINDOWS\system32\drivers\aswRvrt.sys [2014-10-25 65776]
R0 aswVmm;avast! VM Monitor; C:\WINDOWS\system32\drivers\aswVmm.sys [2014-10-25 267632]
R0 pe3ah4nc;DiRT Environment Driver (pe3ah4nc); C:\WINDOWS\system32\drivers\pe3ah4nc.sys [2007-05-18 72560]
R0 ps6ah4nc;DiRT Synchronization Driver (ps6ah4nc); C:\WINDOWS\system32\drivers\ps6ah4nc.sys [2007-05-18 77176]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [2014-10-25 93568]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2014-10-25 1049920]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2014-10-25 436624]
R1 CLVirtualDrive;CLVirtualDrive; C:\WINDOWS\system32\DRIVERS\CLVirtualDrive.sys [2012-06-25 92536]
R2 aswHwid;avast! HardwareID; C:\WINDOWS\system32\drivers\aswHwid.sys [2014-10-25 29208]
R2 aswMonFlt;aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [2014-10-25 82768]
R2 aswStm;aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [2014-10-25 116728]
R2 sp_rsdrv2;Spyware Terminator Driver Filter; C:\WINDOWS\system32\DRIVERS\stflt.sys [2014-10-20 51496]
R3 dtsoftbus01;@oem4.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\System32\drivers\dtsoftbus01.sys [2014-09-08 283064]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RTKVHD64.sys [2013-10-06 4060560]
R3 MEIx64;@oem9.inf,%HECI_SvcDesc%;Intel(R) Management Engine Interface ; C:\WINDOWS\System32\drivers\HECIx64.sys [2012-07-17 62784]
R3 NVHDA;@oem29.inf,%NVHDA.SvcDesc%;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda64v.sys [2014-09-17 197408]
R3 nvlddmkm;nvlddmkm; C:\WINDOWS\system32\DRIVERS\nvlddmkm.sys [2014-10-16 13190288]
R3 NvStreamKms;NvStreamKms; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2014-10-04 20288]
R3 nvvad_WaveExtensible;@oem25.inf,%nvvad_WaveExtensible.SvcDesc%;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\WINDOWS\system32\drivers\nvvad64v.sys [2014-09-04 38048]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\WINDOWS\system32\DRIVERS\Rt630x64.sys [2013-06-18 591360]
S3 iaStorA;iaStorA; C:\WINDOWS\System32\drivers\iaStorA.sys [2012-07-09 645952]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-09-12 64704]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-10-25 50344]
R2 c2cautoupdatesvc;Skype Click to Call Updater; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
R2 c2cpnrsvc;Skype Click to Call PNR Service; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
R2 GfExperienceService;NVIDIA GeForce Experience Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2014-10-04 1149760]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-04-20 635104]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-06-25 166720]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2012-07-17 277824]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-10-04 1796928]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-10-04 19440960]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvvsvc.exe [2014-10-16 933064]
R2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [2012-09-07 1148664]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-10-16 410952]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-07-17 365376]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-08 116648]
S2 HPSLPSVC;HP Network Devices Support; C:\WINDOWS\system32\svchost.exe [2013-08-22 37768]
S2 pr2ah4nc;DiRT Drivers Auto Removal (pr2ah4nc); C:\WINDOWS\system32\pr2ah4nc.exe [2007-05-18 754288]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2013-08-03 43696]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-11-08 116648]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-10-30 566696]

-----------------EOF-----------------

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 14:34
od vyosek
Zdravim :)

:arrow: Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe
  • Ulozte nejlepe na plochu
  • Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
  • Probehne vytvoreni zalohy a nasledne prohledavani
  • Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte
:arrow: Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
  • Ulozte nejlepe na plochu
  • Ukoncete vsechny programy
  • Kliknete na Scan a nasledne Clean
  • Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 14:48
od bzuk
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.21.2014:1)
OS: Windows 8.1 Pro x64
Ran by Vil‚m on so 25. 10. 2014 at 15:38:15,30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\updateSecretSauce_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\updateSecretSauce_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\updateSecretSauce_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\updateSecretSauce_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{5986189A-B9FA-4EE0-9CE7-07C3623B4D89}



~~~ Files

Successfully deleted: [File] "C:\WINDOWS\wininit.ini"



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Vil‚m\appdata\local\cre"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on so 25. 10. 2014 at 15:42:01,21
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 14:49
od bzuk
# AdwCleaner v4.001 - Report created 25/10/2014 at 15:46:08
# DB v2014-10-23.2
# Updated 20/10/2014 by Xplode
# Operating System : Windows 8.1 Pro (64 bits)
# Username : Vilém - BZUK
# Running from : C:\Users\Vilém\Desktop\Download\adwcleaner_4.001.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Key Deleted : HKCU\Software\Conduit

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v


-\\ Google Chrome v38.0.2125.104


*************************

AdwCleaner[R0].txt - [5005 octets] - [01/09/2014 12:32:45]
AdwCleaner[R1].txt - [1036 octets] - [25/10/2014 15:45:02]
AdwCleaner[S0].txt - [4627 octets] - [01/09/2014 12:33:52]
AdwCleaner[S1].txt - [915 octets] - [25/10/2014 15:46:08]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [974 octets] ##########

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 14:50
od vyosek
:arrow: Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu
  • Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
  • Do okna vlozte skript nize

  • Kód: Vybrat vše

    autoclean;
emptyclsid;
iedefaults;
FFdefaults;
CHRdefaults;
emptyalltemp;
resethosts;
  • Nasledne kliknete na Run Script
  • PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 15:21
od bzuk
Brani mi Avast ve stazeni..

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 15:22
od vyosek
Docasne vypnete Avast, zoek stahnete a spustte - jedna se o falesnou detekci

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 15:37
od bzuk
Zoek.exe v5.0.0.0 Updated 24-10-2014
Tool run by Vil‚m on so 25. 10. 2014 at 16:25:24,05.
Microsoft Windows 8.1 Pro 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\VILM~1\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

25. 10. 2014 16:26:20 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-1773587694-3756523165-477646967-1001\Software\Microsoft\Internet Explorer\Approved Extensions\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} deleted successfully
HKEY_USERS\S-1-5-21-1773587694-3756523165-477646967-1001\Software\Microsoft\Internet Explorer\Approved Extensions\{0f21b1e5-5afc-43c9-9c66-515046e92ec2} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\VILM~1\AppData\Roaming\Mozilla\Firefox\Profiles\4wx6obpg.default\prefs.js:

Added to C:\Users\VILM~1\AppData\Roaming\Mozilla\Firefox\Profiles\4wx6obpg.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

C:\PROGRA~2\SopCast deleted
C:\PROGRA~2\COMMON~1\DVDVideoSoft\bin deleted
C:\PROGRA~2\Wondershare deleted
C:\PROGRA~2\COMMON~1\Wondershare deleted
C:\PROGRA~3\InstallMate deleted
C:\Users\VILM~1\AppData\Local\Wondershare deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\WINDOWS\SysNative\config\systemprofile\Searches deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\gpt.ini deleted
C:\WINDOWS\Syswow64\SETC290.tmp deleted
C:\WINDOWS\Syswow64\SETC594.tmp deleted
C:\Users\VILM~1\AppData\Roaming\Mozilla\Firefox\Profiles\4wx6obpg.default\extensions\staged deleted
"C:\PROGRA~2\Windows Portable Devices" deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [25. 10. 2014 14:24]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"magicplayer@torrentstream.org"="C:\Users\Vil‚m\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org" [16. 09. 2014 20:25]

==== Firefox Extensions ======================

==== Firefox Plugins ======================


==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
cflheckfmhopnialghigdlggahiomebp - C:\Users\Vil‚m\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx[]
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[25. 10. 2014 14:24]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
cflheckfmhopnialghigdlggahiomebp - C:\Users\Vil‚m\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx[]
kpckgflgdapkpabemgkielbefdildaio - C:\Users\Vil‚m\AppData\Roaming\ACEStream\extensions\chrome_new\magicplayer.crx[07. 11. 2013 16:52]

Avast Online Security - VILM~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki
AS Magic Player - VILM~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim

==== Chromium Fix ======================

C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_youtube.conduitapps.com_0.localstorage deleted successfully
C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_toolbar.utorrent.com_0.localstorage deleted successfully
C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.lyricsmania.com_0.localstorage deleted successfully
C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.centoservices.cz_0.localstorage deleted successfully
C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_deals.ebay.com_0.localstorage deleted successfully
C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_globaldeals.ebay.com_0.localstorage deleted successfully
C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_bsplayer.en.softonic.com_0.localstorage deleted successfully
C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_bus-driver.cs.softonic.com_0.localstorage deleted successfully
C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_nascar-the-game-2013.en.softonic.com_0.localstorage deleted successfully
C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_nascar-the-game-2013.en.softonic.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"
{FC025196-075D-4040-AD13-8D6394F2E7E1} Seznam TV Program Url="http://tv.seznam.cz/hledej?w={searchTer ... arch_13415"

==== Reset Google Chrome ======================

C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C702BF46-0172-4E1D-ACF6-49501CE19DB0} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\cflheckfmhopnialghigdlggahiomebp deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\cflheckfmhopnialghigdlggahiomebp deleted successfully

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\VILM~1\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\VILM~1\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\VILM~1\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=195 folders=53 33881573 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\VILM~1\AppData\Local\Temp will be emptied at reboot
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\VILM~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted

==== EOF on so 25. 10. 2014 at 16:36:20,97 ======================

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 15:44
od vyosek
Poprosim o FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 16:00
od bzuk
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-10-2014
Ran by Vilém (administrator) on BZUK on 25-10-2014 16:56:24
Running from C:\Users\Vilém\Desktop
Loaded Profile: Vilém (Available profiles: Vilém)
Platform: Windows 8.1 Pro (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(forum.viry.cz) C:\Users\Vilém\Desktop\FRSTLauncher (1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2013-10-06] (Realtek Semiconductor)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2463552 2014-10-04] (NVIDIA Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-08-14] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5223016 2014-10-25] (AVAST Software)
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [AceStream] => C:\Users\Vilém\AppData\Roaming\ACEStream\engine\ace_engine.exe [27904 2014-09-25] ()
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [Zoner Photo Studio Service 16] => D:\Zoner\Photo Studio 16\Program32\ZPSService.exe [27648 2014-06-16] ()
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [Zoner Photo Studio Autoupdate] => D:\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXE [833024 2014-06-16] (ZONER software)
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6482200 2014-09-26] (Piriform Ltd)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKCU - DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {FC025196-075D-4040-AD13-8D6394F2E7E1} URL = http://tv.seznam.cz/hledej?w={searchTer ... arch_13415
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Vilém\AppData\Roaming\Mozilla\Firefox\Profiles\4wx6obpg.default
FF NewTab: hxxp://www.google.com/
FF DefaultSearchEngine: Google
FF DefaultSearchUrl: hxxp://www.google.com/search?btnG=Google+Search&q=
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1209149.dll (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @acestream.net/acestreamplugin,version=2.1.10.1 -> C:\Users\Vilém\AppData\Roaming\ACEStream\player\npace_plugin.dll (Innovative Digital Technologies)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Vilém\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-10-25]
FF HKCU\...\Firefox\Extensions: [magicplayer@torrentstream.org] - C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org
FF Extension: TS Magic Player - C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org [2014-01-12]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.seznam.cz/
CHR Profile: C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-25]
CHR Extension: (Dokumenty Google) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-25]
CHR Extension: (Disk Google) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-25]
CHR Extension: (YouTube) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-25]
CHR Extension: (Vyhledávání Google) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-25]
CHR Extension: (Tabulky Google) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-25]
CHR Extension: (Avast Online Security) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-10-25]
CHR Extension: (AS Magic Player) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim [2014-09-29]
CHR Extension: (Peněženka Google) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-08]
CHR Extension: (Gmail) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-25]
CHR HKCU\...\Chrome\Extension: [kpckgflgdapkpabemgkielbefdildaio] - C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\chrome_new\magicplayer.crx [2013-11-07]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-10-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-10-25] (AVAST Software)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-10-04] (NVIDIA Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-10-04] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-10-04] (NVIDIA Corporation)
S2 pr2ah4nc; C:\Windows\system32\pr2ah4nc.exe [754288 2007-05-18] (CODEMASTERS)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1148664 2012-09-07] (Crawler.com)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
S2 HPSLPSVC; C:\Users\VILM~1\AppData\Local\Temp\7zS540B\hpslpsvc64.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-10-25] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [82768 2014-10-25] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-10-25] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-10-25] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1049920 2014-10-25] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-10-25] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-10-25] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-10-25] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R3 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2014-09-08] (Disc Soft Ltd)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-10-04] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
R0 pe3ah4nc; C:\Windows\System32\drivers\pe3ah4nc.sys [72560 2007-05-18] (CODEMASTERS)
R0 ps6ah4nc; C:\Windows\System32\drivers\ps6ah4nc.sys [77176 2007-05-18] (CODEMASTERS)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-10-20] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-25 16:56 - 2014-10-25 16:56 - 00016091 _____ () C:\Users\Vilém\Desktop\FRST.txt
2014-10-25 16:55 - 2014-10-25 16:56 - 00000000 ____D () C:\FRST
2014-10-25 16:52 - 2014-10-25 16:52 - 00112640 _____ (forum.viry.cz) C:\Users\Vilém\Desktop\FRSTLauncher (1).exe
2014-10-25 16:50 - 2014-10-25 16:50 - 02112512 _____ (Farbar) C:\Users\Vilém\Desktop\FRST64.exe
2014-10-25 16:35 - 2014-10-25 16:25 - 00024064 _____ () C:\WINDOWS\zoek-delete.exe
2014-10-25 16:26 - 2014-10-25 16:36 - 00010072 _____ () C:\zoek-results.log
2014-10-25 16:25 - 2014-10-25 16:35 - 00000000 ____D () C:\zoek_backup
2014-10-25 16:24 - 2014-10-25 16:24 - 01290752 _____ () C:\Users\Vilém\Desktop\zoek.exe
2014-10-25 15:43 - 2014-10-25 15:44 - 01962496 _____ () C:\Users\Vilém\Desktop\adwcleaner_4.001.exe
2014-10-25 15:42 - 2014-10-25 15:42 - 00001369 _____ () C:\Users\Vilém\Desktop\JRT.txt
2014-10-25 15:38 - 2014-10-25 15:38 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-10-25 15:37 - 2014-10-25 15:38 - 01706144 _____ (Thisisu) C:\Users\Vilém\Desktop\JRT.exe
2014-10-25 15:21 - 2014-10-25 15:21 - 00000000 ____D () C:\rsit
2014-10-25 15:21 - 2014-10-25 15:21 - 00000000 ____D () C:\Program Files\trend micro
2014-10-25 15:17 - 2014-10-25 15:17 - 00000114 _____ () C:\Users\Vilém\Desktop\bncvbxcv.txt
2014-10-25 14:29 - 2014-10-25 16:35 - 00031430 _____ () C:\WINDOWS\PFRO.log
2014-10-25 14:27 - 2014-10-25 14:27 - 00000000 ____D () C:\Users\Vilém\AppData\Roaming\AVAST Software
2014-10-25 14:24 - 2014-10-25 14:27 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2014-10-25 14:24 - 2014-10-25 14:24 - 01049920 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2014-10-25 14:24 - 2014-10-25 14:24 - 00436624 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2014-10-25 14:24 - 2014-10-25 14:24 - 00364512 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2014-10-25 14:24 - 2014-10-25 14:24 - 00267632 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2014-10-25 14:24 - 2014-10-25 14:24 - 00116728 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2014-10-25 14:24 - 2014-10-25 14:24 - 00093568 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2014-10-25 14:24 - 2014-10-25 14:24 - 00082768 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2014-10-25 14:24 - 2014-10-25 14:24 - 00065776 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2014-10-25 14:24 - 2014-10-25 14:24 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-10-25 14:24 - 2014-10-25 14:24 - 00029208 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2014-10-25 14:24 - 2014-10-25 14:24 - 00001980 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2014-10-25 14:24 - 2014-10-25 14:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2014-10-25 14:22 - 2014-10-25 14:22 - 00000000 ____D () C:\Program Files\AVAST Software
2014-10-25 14:20 - 2014-10-25 14:22 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-10-25 14:17 - 2014-10-25 14:17 - 00000000 ____D () C:\ProgramData\CheckPoint
2014-10-23 12:15 - 2014-10-16 14:27 - 00614544 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvStreaming.exe
2014-10-23 12:14 - 2014-10-23 12:15 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp
2014-10-23 12:14 - 2014-10-16 18:54 - 31890064 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 24555840 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 20922696 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcompiler.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 19966856 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 17260864 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcompiler.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 14029400 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 13942368 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 13190288 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys
2014-10-23 12:14 - 2014-10-16 18:54 - 11395672 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 11333848 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 04289856 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 04009672 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 02849224 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 01876296 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6434448.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 01539272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6434448.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00962376 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00931984 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00921928 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00895176 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00870112 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvumdshim.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00833864 _____ () C:\WINDOWS\system32\nvmcumd.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00500880 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00418112 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00392008 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00352016 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00348488 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00303600 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00174856 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvinitx.dll
2014-10-23 12:14 - 2014-10-16 18:54 - 00156840 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvinit.dll
2014-10-23 12:13 - 2014-10-23 12:15 - 00000039 _____ () C:\WINDOWS\setupact.log
2014-10-23 12:13 - 2014-10-23 12:13 - 00000000 _____ () C:\WINDOWS\setuperr.log
2014-10-22 17:34 - 2014-10-22 17:34 - 00000000 ____D () C:\Users\Vilém\Documents\nas2
2014-10-22 17:31 - 2014-10-22 17:31 - 00000141 _____ () C:\Users\Vilém\Desktop\Bramborový koláč - Prima Fresh.url
2014-10-22 16:31 - 2014-10-22 16:31 - 00000000 ____D () C:\Users\Vilém\AppData\Local\SKIDROW
2014-10-22 16:26 - 2014-10-22 16:26 - 00001013 _____ () C:\Users\Vilém\Desktop\Play NASCAR The Game 2013.lnk
2014-10-21 18:25 - 2014-10-25 16:46 - 00262554 _____ () C:\WINDOWS\WindowsUpdate.log
2014-10-20 20:01 - 2014-10-24 18:31 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-10-20 20:01 - 2014-10-21 18:27 - 00000000 ____D () C:\Program Files (x86)\Spyware Terminator
2014-10-20 20:01 - 2014-10-20 20:01 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\Drivers\stflt.sys
2014-10-20 20:01 - 2014-10-20 20:01 - 00001050 _____ () C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
2014-10-20 20:01 - 2014-10-20 20:01 - 00000000 ____D () C:\Users\Vilém\AppData\Roaming\Spyware Terminator
2014-10-20 20:01 - 2014-10-20 20:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator 2012
2014-10-18 18:28 - 2014-09-28 00:25 - 04183040 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-10-18 18:27 - 2014-09-08 05:15 - 00054752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-10-18 18:27 - 2014-09-08 03:46 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2014-10-18 18:27 - 2014-09-08 03:46 - 00050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2014-10-18 18:27 - 2014-09-08 02:08 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2014-10-18 18:27 - 2014-09-08 02:07 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2014-10-18 18:27 - 2014-09-08 02:05 - 03448320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-10-18 18:27 - 2014-09-08 02:04 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2014-10-18 18:27 - 2014-09-08 02:04 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-10-18 18:27 - 2014-09-08 02:03 - 01702400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2014-10-18 18:27 - 2014-09-08 02:03 - 00839680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-10-18 18:27 - 2014-09-08 01:59 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2014-10-18 18:27 - 2014-09-08 01:59 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2014-10-18 18:27 - 2014-09-08 01:56 - 00672256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-10-18 18:27 - 2014-09-08 01:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-10-18 18:27 - 2014-09-04 02:10 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-10-18 18:27 - 2014-09-04 01:57 - 00921600 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-10-18 18:27 - 2014-09-04 01:49 - 00626688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-10-18 18:26 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-10-18 18:26 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-10-18 18:26 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-10-18 18:26 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-10-18 18:26 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-10-18 18:26 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-10-18 18:26 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-10-18 18:26 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-10-18 18:26 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-10-18 18:26 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-10-18 18:26 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-10-18 18:26 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-10-18 18:26 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-10-18 18:26 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-10-18 18:26 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-10-18 18:26 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-10-18 18:26 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-10-18 18:26 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-10-18 18:26 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-10-18 18:26 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-10-18 18:26 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-10-18 18:26 - 2014-09-19 02:42 - 00363008 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-10-18 18:26 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-10-18 18:26 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-10-18 18:26 - 2014-09-19 02:20 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-10-18 18:26 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-10-18 18:26 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-10-18 18:26 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-10-18 18:26 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-10-18 18:26 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-10-18 18:26 - 2014-09-13 08:29 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll
2014-10-18 18:26 - 2014-09-13 07:49 - 00068608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll
2014-10-18 18:26 - 2014-09-04 02:12 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2014-10-18 18:26 - 2014-09-04 02:01 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2014-10-18 18:26 - 2014-08-16 06:08 - 21195616 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-10-18 18:26 - 2014-08-16 06:08 - 01507648 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2014-10-18 18:26 - 2014-08-16 06:01 - 01710184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-10-18 18:26 - 2014-08-16 05:58 - 01112512 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-10-18 18:26 - 2014-08-16 05:57 - 02498880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-10-18 18:26 - 2014-08-16 05:57 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2014-10-18 18:26 - 2014-08-16 05:16 - 18722600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-10-18 18:26 - 2014-08-16 05:16 - 01205976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2014-10-18 18:26 - 2014-08-16 05:03 - 01467384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-10-18 18:26 - 2014-08-16 03:31 - 00838144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-10-18 18:26 - 2014-08-16 03:04 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll
2014-10-18 18:26 - 2014-08-16 02:58 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2014-10-18 18:26 - 2014-08-16 02:53 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2014-10-18 18:26 - 2014-08-16 02:46 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProximityService.dll
2014-10-18 18:26 - 2014-08-16 02:45 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2014-10-18 18:26 - 2014-08-16 02:43 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll
2014-10-18 18:26 - 2014-08-16 02:43 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2014-10-18 18:26 - 2014-08-16 02:31 - 00914432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2014-10-18 18:26 - 2014-08-16 02:31 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcsvDevice.dll
2014-10-18 18:26 - 2014-08-16 02:29 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-18 18:26 - 2014-08-16 02:23 - 01106432 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-10-18 18:26 - 2014-08-16 02:22 - 00717824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-10-18 18:26 - 2014-08-16 02:22 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveShell.dll
2014-10-18 18:26 - 2014-08-16 02:19 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-18 18:26 - 2014-08-16 02:18 - 04758528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-10-18 18:26 - 2014-08-16 02:17 - 08757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-10-18 18:26 - 2014-08-16 02:14 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SkyDriveShell.dll
2014-10-18 18:26 - 2014-08-16 02:13 - 06649344 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-10-18 18:26 - 2014-08-16 02:13 - 05902848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-10-18 18:26 - 2014-08-16 02:13 - 00840192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2014-10-18 18:26 - 2014-08-16 02:11 - 00920064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-10-18 18:26 - 2014-08-16 02:10 - 01120768 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-10-18 18:26 - 2014-08-16 02:08 - 05777408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-10-18 18:26 - 2014-08-16 02:07 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-10-18 18:26 - 2014-08-01 01:22 - 00388729 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-10-18 18:25 - 2014-10-10 00:16 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-10-18 18:25 - 2014-10-09 00:09 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2014-10-18 18:25 - 2014-09-19 03:24 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-10-18 18:25 - 2014-09-13 08:02 - 02779648 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2014-10-18 18:25 - 2014-09-13 07:30 - 03117568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2014-10-18 18:25 - 2014-08-29 03:58 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
2014-10-18 18:25 - 2014-08-29 01:56 - 02646016 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-10-18 18:25 - 2014-08-29 01:47 - 02321920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-10-09 13:26 - 2014-10-09 13:26 - 00012958 _____ () C:\Users\Vilém\Documents\cc_20141009_132614.reg

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-25 16:42 - 2013-10-21 20:36 - 01745984 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-10-25 16:42 - 2013-09-30 05:56 - 00738682 _____ () C:\WINDOWS\system32\perfh005.dat
2014-10-25 16:42 - 2013-09-30 05:56 - 00151404 _____ () C:\WINDOWS\system32\perfc005.dat
2014-10-25 16:36 - 2014-02-28 16:46 - 00000000 ____D () C:\Users\Vilém\SkyDrive
2014-10-25 16:36 - 2013-11-08 14:15 - 00000956 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-25 16:35 - 2013-10-21 20:25 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-25 16:35 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-10-25 16:33 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-10-25 16:24 - 2013-10-06 23:13 - 00000000 ____D () C:\Users\Vilém\Desktop\Download
2014-10-25 16:08 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-10-25 16:06 - 2013-10-06 14:57 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1773587694-3756523165-477646967-1001
2014-10-25 16:04 - 2013-11-08 14:15 - 00000960 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-25 15:46 - 2014-09-01 12:32 - 00000000 ____D () C:\AdwCleaner
2014-10-25 15:01 - 2013-11-08 14:16 - 00002275 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-25 14:59 - 2013-11-08 14:15 - 00003932 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-25 14:59 - 2013-11-08 14:15 - 00003696 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-25 14:54 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-10-25 14:29 - 2013-10-07 11:59 - 00000000 ____D () C:\ProgramData\MFAData
2014-10-25 14:28 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-10-25 14:09 - 2013-10-31 17:12 - 00003954 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{18B2686D-7705-41B8-AC13-31A5E485B90C}
2014-10-23 21:36 - 2013-10-12 07:36 - 00000000 ____D () C:\Users\Vilém\AppData\Roaming\uTorrent
2014-10-23 19:27 - 2014-01-12 18:47 - 00000000 ____D () C:\Users\Vilém\AppData\Roaming\.ACEStream
2014-10-23 12:15 - 2013-10-21 20:25 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-10-23 12:15 - 2013-10-06 22:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-10-23 02:22 - 2013-10-07 14:15 - 00000000 ____D () C:\Users\Vilém\AppData\Roaming\vlc
2014-10-22 19:51 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-10-21 22:56 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-10-20 18:52 - 2013-10-07 12:53 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-10-20 18:50 - 2013-10-07 12:53 - 103265616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-10-19 12:36 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-10-19 11:58 - 2013-08-22 16:44 - 00415512 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-10-18 20:27 - 2014-07-11 13:36 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-10-18 20:27 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-10-18 20:27 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-10-18 20:27 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\MediaViewer
2014-10-18 20:27 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\FileManager
2014-10-18 20:27 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\Camera
2014-10-18 18:32 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-10-16 18:54 - 2014-09-20 13:02 - 18499648 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvwgf2um.dll
2014-10-16 18:54 - 2013-10-21 18:52 - 20968040 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvwgf2umx.dll
2014-10-16 18:54 - 2013-10-21 18:52 - 16886168 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvd3dum.dll
2014-10-16 18:54 - 2013-10-21 18:52 - 03237528 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2014-10-16 18:54 - 2013-10-21 18:52 - 00987008 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvumdshimx.dll
2014-10-16 18:54 - 2013-10-21 18:52 - 00027024 _____ () C:\WINDOWS\system32\nvinfo.pb
2014-10-16 18:54 - 2013-10-06 15:06 - 00072904 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2014-10-16 18:54 - 2013-10-06 15:06 - 00060560 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2014-10-16 16:11 - 2013-10-21 20:25 - 06883136 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2014-10-16 16:11 - 2013-10-21 20:25 - 03533632 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2014-10-16 16:11 - 2013-10-21 20:25 - 02559808 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2014-10-16 16:11 - 2013-10-21 20:25 - 00933064 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
2014-10-16 16:11 - 2013-10-21 20:25 - 00384200 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2014-10-16 16:11 - 2013-10-21 20:25 - 00061640 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2014-10-15 02:48 - 2013-10-21 20:25 - 04047877 _____ () C:\WINDOWS\system32\nvcoproc.bin
2014-10-09 13:24 - 2013-11-20 18:15 - 00000834 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-09 13:24 - 2013-11-20 18:15 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-05 22:05 - 2013-10-07 14:15 - 00001082 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-10-04 08:42 - 2014-06-03 20:59 - 01291280 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspbridge.dll
2014-10-04 08:42 - 2013-10-28 19:44 - 02197680 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2014-10-04 08:41 - 2014-06-03 20:59 - 01715224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspbridge64.dll
2014-10-04 08:41 - 2013-10-28 19:44 - 02800296 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2014-09-30 00:45 - 2013-08-22 17:38 - 00706016 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-09-30 00:45 - 2013-08-22 17:38 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-25 16:08




===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================

Drive c: () (Fixed) (Total:145.97 GB) (Free:97.08 GB) NTFS
Drive d: () (Fixed) (Total:785.03 GB) (Free:603.68 GB) NTFS

Available physical RAM: 6673.22 MB
Total physical RAM: 8134.81 MB
Percentage of memory in use: 17%

==================== MBR and Partition Table ==================

Disk: 0 (Size: 931.5 GB) (Disk ID: 19F334CA)

==================== Scheduled Tasks (whitelisted) ==================

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Alternate Data Streams (whitelisted) ==================

AlternateDataStreams: C:\Users\Vilém\SkyDrive:ms-properties

==================== Security Center ==================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Vil�m\Desktop" je 6823 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 16:20
od bzuk
Jeste jsem nasel tady na foru tento odkaz:
https://forum.avast.com/index.php?topic=155793.15

Bohuzel ma anglictina neni tak dobra, abych si prelozil o co se presne jedna..

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 16:25
od vyosek
:arrow: Odinstalujte Spyware Terminator

:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
CloseProcesses:

HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-08-14] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [AceStream] => C:\Users\Vilém\AppData\Roaming\ACEStream\engine\ace_engine.exe [27904 2014-09-25] ()
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [Zoner Photo Studio Service 16] => D:\Zoner\Photo Studio 16\Program32\ZPSService.exe [27648 2014-06-16] ()
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [Zoner Photo Studio Autoupdate] => D:\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXE [833024 2014-06-16] (ZONER software)
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

FF HKCU\...\Firefox\Extensions: [magicplayer@torrentstream.org] - C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org
FF Extension: TS Magic Player - C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org [2014-01-12]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

CHR Extension: (AS Magic Player) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim [2014-09-29]
CHR HKCU\...\Chrome\Extension: [kpckgflgdapkpabemgkielbefdildaio] - C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\chrome_new\magicplayer.crx [2013-11-07]

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

C:\Program Files (x86)\Skype\Toolbars
2014-10-25 16:56 - 2014-10-25 16:56 - 00016091 _____ () C:\Users\Vilém\Desktop\FRST.txt
2014-10-25 16:52 - 2014-10-25 16:52 - 00112640 _____ (forum.viry.cz) C:\Users\Vilém\Desktop\FRSTLauncher (1).exe
2014-10-25 16:35 - 2014-10-25 16:25 - 00024064 _____ () C:\WINDOWS\zoek-delete.exe
2014-10-25 16:26 - 2014-10-25 16:36 - 00010072 _____ () C:\zoek-results.log
2014-10-25 16:25 - 2014-10-25 16:35 - 00000000 ____D () C:\zoek_backup
2014-10-25 16:24 - 2014-10-25 16:24 - 01290752 _____ () C:\Users\Vilém\Desktop\zoek.exe
2014-10-25 15:43 - 2014-10-25 15:44 - 01962496 _____ () C:\Users\Vilém\Desktop\adwcleaner_4.001.exe
2014-10-25 15:42 - 2014-10-25 15:42 - 00001369 _____ () C:\Users\Vilém\Desktop\JRT.txt
2014-10-25 15:38 - 2014-10-25 15:38 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-10-25 15:37 - 2014-10-25 15:38 - 01706144 _____ (Thisisu) C:\Users\Vilém\Desktop\JRT.exe
2014-10-25 15:21 - 2014-10-25 15:21 - 00000000 ____D () C:\rsit
2014-10-25 15:21 - 2014-10-25 15:21 - 00000000 ____D () C:\Program Files\trend micro
2014-10-25 15:17 - 2014-10-25 15:17 - 00000114 _____ () C:\Users\Vilém\Desktop\bncvbxcv.txt
2014-10-25 14:29 - 2014-10-25 16:35 - 00031430 _____ () C:\WINDOWS\PFRO.log

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Hosts:
EmptyTemp:
Reboot:
End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt

Re: Mozny vir.. prosim o kontrolu..

Napsal: 25 říj 2014 16:39
od bzuk
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-10-2014
Ran by Vilém at 2014-10-25 17:36:16 Run:1
Running from C:\Users\Vilém\Desktop
Loaded Profile: Vilém (Available profiles: Vilém)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:

HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-08-14] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [AceStream] => C:\Users\Vilém\AppData\Roaming\ACEStream\engine\ace_engine.exe [27904 2014-09-25] ()
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [Zoner Photo Studio Service 16] => D:\Zoner\Photo Studio 16\Program32\ZPSService.exe [27648 2014-06-16] ()
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [Zoner Photo Studio Autoupdate] => D:\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXE [833024 2014-06-16] (ZONER software)
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

FF HKCU\...\Firefox\Extensions: [magicplayer@torrentstream.org] - C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org
FF Extension: TS Magic Player - C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org [2014-01-12]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

CHR Extension: (AS Magic Player) - C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim [2014-09-29]
CHR HKCU\...\Chrome\Extension: [kpckgflgdapkpabemgkielbefdildaio] - C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\chrome_new\magicplayer.crx [2013-11-07]

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)

C:\Program Files (x86)\Skype\Toolbars
2014-10-25 16:56 - 2014-10-25 16:56 - 00016091 _____ () C:\Users\Vilém\Desktop\FRST.txt
2014-10-25 16:52 - 2014-10-25 16:52 - 00112640 _____ (forum.viry.cz) C:\Users\Vilém\Desktop\FRSTLauncher (1).exe
2014-10-25 16:35 - 2014-10-25 16:25 - 00024064 _____ () C:\WINDOWS\zoek-delete.exe
2014-10-25 16:26 - 2014-10-25 16:36 - 00010072 _____ () C:\zoek-results.log
2014-10-25 16:25 - 2014-10-25 16:35 - 00000000 ____D () C:\zoek_backup
2014-10-25 16:24 - 2014-10-25 16:24 - 01290752 _____ () C:\Users\Vilém\Desktop\zoek.exe
2014-10-25 15:43 - 2014-10-25 15:44 - 01962496 _____ () C:\Users\Vilém\Desktop\adwcleaner_4.001.exe
2014-10-25 15:42 - 2014-10-25 15:42 - 00001369 _____ () C:\Users\Vilém\Desktop\JRT.txt
2014-10-25 15:38 - 2014-10-25 15:38 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-10-25 15:37 - 2014-10-25 15:38 - 01706144 _____ (Thisisu) C:\Users\Vilém\Desktop\JRT.exe
2014-10-25 15:21 - 2014-10-25 15:21 - 00000000 ____D () C:\rsit
2014-10-25 15:21 - 2014-10-25 15:21 - 00000000 ____D () C:\Program Files\trend micro
2014-10-25 15:17 - 2014-10-25 15:17 - 00000114 _____ () C:\Users\Vilém\Desktop\bncvbxcv.txt
2014-10-25 14:29 - 2014-10-25 16:35 - 00031430 _____ () C:\WINDOWS\PFRO.log

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Hosts:
EmptyTemp:
Reboot:
End
*****************

Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\CLMLServer_For_P2G8 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\CLVirtualDrive => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe ARM => value deleted successfully.
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Power2GoExpress8 => value deleted successfully.
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\Software\Microsoft\Windows\CurrentVersion\Run\\AceStream => value deleted successfully.
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Zoner Photo Studio Service 16 => value deleted successfully.
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Zoner Photo Studio Autoupdate => value deleted successfully.
HKU\S-1-5-21-1773587694-3756523165-477646967-1001\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}" => Key deleted successfully.
"HKCR\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}" => Key deleted successfully.
"HKCR\PROTOCOLS\Handler\skypec2c" => Key deleted successfully.
"HKCR\CLSID\{91774881-D725-4E58-B298-07617B9B86A8}" => Key deleted successfully.
"HKCR\Wow6432Node\PROTOCOLS\Handler\skype4com" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}" => Key deleted successfully.
"HKCR\Wow6432Node\PROTOCOLS\Handler\skypec2c" => Key not found.
"HKCR\Wow6432Node\CLSID\{91774881-D725-4E58-B298-07617B9B86A8}" => Key deleted successfully.
HKCU\Software\Mozilla\Firefox\Extensions\\magicplayer@torrentstream.org => value deleted successfully.
C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org => Moved successfully.
C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} not found.
C:\Users\Vilém\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhnkgpdlogbknkhlgdjlejeljbhflim => Moved successfully.
"HKCU\SOFTWARE\Google\Chrome\Extensions\kpckgflgdapkpabemgkielbefdildaio" => Key deleted successfully.
C:\Users\Vilém\AppData\Roaming\ACEStream\extensions\chrome_new\magicplayer.crx => Moved successfully.
c2cautoupdatesvc => Service deleted successfully.
c2cpnrsvc => Service deleted successfully.
C:\Program Files (x86)\Skype\Toolbars => Moved successfully.
"C:\Users\Vilém\Desktop\FRST.txt" => File/Directory not found.
"C:\Users\Vilém\Desktop\FRSTLauncher (1).exe" => File/Directory not found.
C:\WINDOWS\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\Vilém\Desktop\zoek.exe => Moved successfully.
C:\Users\Vilém\Desktop\adwcleaner_4.001.exe => Moved successfully.
C:\Users\Vilém\Desktop\JRT.txt => Moved successfully.
C:\WINDOWS\ERUNT => Moved successfully.
C:\Users\Vilém\Desktop\JRT.exe => Moved successfully.
C:\rsit => Moved successfully.
C:\Program Files\trend micro => Moved successfully.
C:\Users\Vilém\Desktop\bncvbxcv.txt => Moved successfully.
C:\WINDOWS\PFRO.log => Moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 177.8 MB temporary data.


The system needed a reboot.

==== End of Fixlog ====

Re: Mozny vir.. prosim o kontrolu..

Napsal: 26 říj 2014 17:30
od vyosek
Tak jeste uklidime :James008:

:arrow: DelFix https://toolslib.net/downloads/finish/2/
  • Stahnete a spustte
  • Ponechte zatrzitkou pouze u volby Remote disinfection tools
  • Kliknete na Run
:arrow: Stahnete Ccleaner https://www.piriform.com/ccleaner/download/standard
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: A pokud nejsou problemy ci dotazy, je to z me strany vse :|

Re: Mozny vir.. prosim o kontrolu..

Napsal: 29 říj 2014 11:49
od bzuk
Problem je porad stejny, nic se nezmenilo..
Porad naskakuji infekce:
URL: hxxps://codegv.ru
Infekce: URL:Mal
a
URL: hxxp://codegv.ru/u.html
Infekce: URL:Mal
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz