VIRY.CZ

Dobry deň,

dúfam že mi niekto poradí. Problém sa začal tým, že sa mi do PC dostal "GoSave" ten sa mi úspešne podarilo odstrániť. Teda nemám ho ani v ProgramFiles ani v Programoch a súčastiach. Avšak, ešte pred tým ako som ho odstránila, tak som si sťahovala nejaké obrázky kvôli škole. Ale nestiahlo mi obrázok ale len nefunkčný súbor, ktorý sa nedá v ničom otvoriť, ani vymazať, premiestniť, nič proste. Vo vlastnostiach toho súboru v Typ súboru: Súbor(.GoSave)alebo niečo podobné už si nie som istá. Po tom ako som ten GoSave odstránila, zostalo tam len Súbor(.)

Screen erroru a súboru:

Na odstránenie GoSave som použila programy: Malwarebytes Anti-Malware, Hitman-Pro, MCShield Real-Time Monitor.

Ďakujem vopred za pomoc
Tereza.

Prikladám log:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Skyrdis at 2014-12-30 13:23:51
Microsoft Windows 8.1 Pro
System drive C: has 242 GB (53%) free of 456 GB
Total RAM: 3691 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:24:00, on 30.12.2014
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17239)
Boot mode: Normal

Running processes:
C:\Windows\SysWOW64\WTClient.exe
C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Users\Skyrdis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Users\Skyrdis\AppData\Local\Akamai\netsession_win.exe
C:\Program Files (x86)\MCShield\MCShieldRTM.exe
C:\Users\Skyrdis\AppData\Local\Akamai\netsession_win.exe
C:\GIGABYTE FORCE\GIGABYTE FORCE.exe
C:\Program Files (x86)\GameVox\GameVox.exe
C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org\win32\adb.exe
C:\Program Files\trend micro\Skyrdis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [GMouse] "C:\GIGABYTE FORCE\GIGABYTE FORCE.EXE" /hide
O4 - HKLM\..\Run: [mncoxtndoSrv] C:\Windows\system32\mncoxtndo.vbe
O4 - HKLM\..\Run: [ADSKAppManager] "C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe" -showminimized -checkautorun
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ADSK DLMSession] C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe
O4 - HKLM\..\Run: [WTClient] WTClient.exe
O4 - HKCU\..\Run: [Spotify Web Helper] "C:\Users\Skyrdis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Skyrdis\AppData\Local\Akamai\netsession_win.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [MCShield Monitor] C:\Program Files (x86)\MCShield\mcshieldrtm.exe
O4 - Startup: GameVox.lnk = C:\Program Files (x86)\GameVox\GameVox.exe
O4 - Startup: Send to OneNote.lnk = C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~1\Office15\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Autodesk Application Manager Service (AdAppMgrSvc) - Autodesk Inc. - C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: @oem3.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service (BcmBtRSupport) - Unknown owner - C:\Windows\system32\BtwRSupportService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Garmin Core Update Service - Garmin Ltd or its subsidiaries - C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: mental ray Satellite for Autodesk 3ds Max 2015 64-bit (mi-raysat_3dsmax2015_64) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2015\NVIDIA\Satellite\raysat_3dsmax2015_64server.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginClientService.exe
O23 - Service: Corel License Validation Service V2 x64, Powered by arvato (PSI_SVC_2_x64) - arvato digital services llc - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: WinTab Service (WinTabService) - Unknown owner - C:\Windows\System32\Drivers\WTSRV.EXE (file missing)
O23 - Service: Wise Boot Assistant (WiseBootAssistant) - WiseCleaner.com - C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10708 bytes

======Listing Processes======





wininit.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
dashost.exe {2c29b473-80c3-41e5-aa981d02bd7ec5b7}
"c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe"
C:\Windows\system32\svchost.exe -k imgsvc

"C:\Windows\System32\Drivers\WTSRV.EXE"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
taskeng.exe {35F39917-5BB6-4010-8C77-01D7CE0F293D}
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe"

C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\System32\WinLogon.exe -SpecialSession
"LogonUI.exe" /flags:0x0
-hiberboot
C:\Windows\system32\wbem\wmiprvse.exe


C:\Windows\System32\WinLogon.exe -SpecialSession
-hiberboot
atieclxx
taskeng.exe {7D2C07F8-D222-4E5A-901C-66A155780723}
taskhostex.exe
WTClient.exe
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe" -StartTray
/QuitInfo:0000000000000E74;0000000000000BB8;
/loadhooks /Parent:0000000000000044
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Users\Skyrdis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
"C:\Users\Skyrdis\AppData\Local\Akamai\netsession_win.exe"
"C:\Program Files (x86)\MCShield\MCShieldRTM.exe"
"C:/Users/Skyrdis/AppData/Local/Akamai/netsession_win.exe" --client
"C:\GIGABYTE FORCE\GIGABYTE FORCE.exe" /hide
"C:\Program Files (x86)\GameVox\GameVox.exe" -noupdate
"C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE" /tsr
"C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
taskeng.exe {40D00B96-EEBC-4D89-9C56-67ED52A9144D}
"C:\Program Files\Microsoft Office\Office15\MsoSync.exe"
"C:\Windows\system32\wuauclt.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
adb fork-server server
"C:\Program Files\Windows Defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey 6FBFCC9A-132A-5625-3383-8A2827D5AC4E -Reinvoke
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe85_ Global\UsGthrCtrlFltPipeMssGthrPipe85 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 560 564 572 65536 568
"C:\Users\Skyrdis\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\Wise Care 365.job - C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe -StartTray
C:\Windows\tasks\Wise Turbo Checker.job - C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "www.google.sk "

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.246 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/Lync,version=15.0]
"Description"=Microsoft Lync Plug-in for Firefox
"Path"=C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\adobe.com/AdobeAAMDetect]
"Description"=
"Path"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 15.0.0.246 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\adobe.com/AdobeAAMDetect]
"Description"=
"Path"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll


C:\Program Files (x86)\Mozilla Firefox\plugins\
npMeetingJoinPluginOC.dll
nppdf32.dll

C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\
adbhelper@mozilla.org

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01 205416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office15\URLREDIR.DLL [2012-10-01 877720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~1\MICROS~1\Office15\GROOVEEX.DLL [2012-10-01 2322576]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01 139368]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office15\URLREDIR.DLL [2012-10-01 704664]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL [2012-10-01 1720976]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-10-14 2837288]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20 444904]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"=C:\Users\Skyrdis\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [2014-12-13 1676344]
"Akamai NetSession Interface"=C:\Users\Skyrdis\AppData\Local\Akamai\netsession_win.exe [2014-10-29 4673432]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]
"MCShield Monitor"=C:\Program Files (x86)\MCShield\mcshieldrtm.exe [2014-04-11 650816]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [2014-07-04 766688]
"GMouse"=C:\GIGABYTE FORCE\GIGABYTE FORCE.EXE [2011-11-08 667648]
"mncoxtndoSrv"=C:\Windows\system32\mncoxtndo.vbe []
"ADSKAppManager"=C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe [2014-09-04 488328]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-11-20 1021128]
"ADSK DLMSession"=C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe [2014-02-05 1627032]
"WTClient"=C:\Windows\system32\WTClient.exe [2009-08-19 32768]

C:\Users\Skyrdis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
GameVox.lnk - C:\Program Files (x86)\GameVox\GameVox.exe
Send to OneNote.lnk - C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37CrusaderBoot]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=221

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2014-12-30 13:23:51 ----D---- C:\rsit
2014-12-30 13:23:51 ----D---- C:\Program Files\trend micro
2014-12-22 14:13:42 ----D---- C:\Users\Skyrdis\AppData\Roaming\Stronghold Crusader 2
2014-12-22 13:49:40 ----D---- C:\Program Files (x86)\R.G. Mechanics
2014-12-21 19:13:22 ----D---- C:\Program Files (x86)\GameVox
2014-12-19 11:54:05 ----D---- C:\Program Files (x86)\TABLET
2014-12-18 21:50:49 ----D---- C:\Users\Skyrdis\AppData\Roaming\com.adobe.DC3Module.AdobeADC
2014-12-17 23:01:42 ----A---- C:\Windows\Tablet8000x6000M.ini
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\WTClient.exe
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\ST~DBC0.tmp
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\ST~AB1C.tmp
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\ST~777.tmp
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\ST~372D.tmp
2014-12-15 17:10:17 ----A---- C:\Windows\SYSWOW64\ST~3430.tmp
2014-12-15 17:10:17 ----A---- C:\Windows\system32\WTClient.exe
2014-12-15 17:10:16 ----A---- C:\Windows\system32\WinTab32.dll
2014-12-15 17:10:16 ----A---- C:\Windows\system32\UCMfg.exe
2014-12-15 17:10:16 ----A---- C:\Windows\system32\ucinst32.dll
2014-12-15 17:10:15 ----A---- C:\Windows\SYSWOW64\tabcfg.exe
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\WTSrv.exe
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\UCTblHid.sys
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\TClass2k.sys
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\ST~D71C.tmp
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\ST~A6D5.tmp
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\ST~321B.tmp
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\ST~2F4D.tmp
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\ST~246.tmp
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\PTSimHid.sys
2014-12-15 17:10:14 ----A---- C:\Windows\system32\drivers\PTSimBus.sys
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\WinTab32.dll
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\ST~DC4E.tmp
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\ST~AB9A.tmp
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\ST~7F5.tmp
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\ST~37AB.tmp
2014-12-15 17:10:13 ----A---- C:\Windows\SYSWOW64\ST~34AE.tmp
2014-12-15 17:10:08 ----A---- C:\Windows\SetupX32.EXE
2014-12-15 17:10:07 ----A---- C:\Windows\SYSWOW64\lhtool.exe
2014-12-15 17:10:06 ----A---- C:\Windows\SYSWOW64\HCCall.exe
2014-12-15 17:10:05 ----D---- C:\download
2014-12-15 14:43:51 ----D---- C:\ProgramData\MCShield
2014-12-15 14:43:51 ----D---- C:\Program Files (x86)\MCShield
2014-12-15 12:46:22 ----A---- C:\Windows\system32\drivers\hitmanpro37.sys
2014-12-15 12:34:40 ----D---- C:\Program Files\HitmanPro
2014-12-15 12:34:24 ----D---- C:\ProgramData\HitmanPro
2014-12-15 11:57:15 ----D---- C:\AdwCleaner
2014-12-15 11:02:50 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-12-15 11:01:59 ----A---- C:\Windows\system32\drivers\mwac.sys
2014-12-15 11:01:59 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-12-15 11:01:58 ----D---- C:\ProgramData\Malwarebytes
2014-12-15 11:01:58 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-12-15 11:01:58 ----A---- C:\Windows\system32\drivers\mbam.sys
2014-12-09 16:52:17 ----D---- C:\Program Files (x86)\Mozilla Firefox
2014-12-02 14:58:15 ----D---- C:\ProgramData\Steam
2014-12-02 14:44:58 ----D---- C:\Program Files (x86)\Sid Meiers Civilization Beyond Earth
2014-12-01 14:28:57 ----D---- C:\Program Files (x86)\Electronic Arts

======List of files/folders modified in the last 1 month======

2014-12-30 13:23:51 ----RD---- C:\Program Files
2014-12-30 13:18:10 ----D---- C:\Windows\Temp
2014-12-30 13:05:45 ----D---- C:\Users\Skyrdis\AppData\Roaming\GameVox
2014-12-30 13:04:49 ----D---- C:\Windows\system32\sru
2014-12-29 23:14:48 ----D---- C:\Users\Skyrdis\AppData\Roaming\uTorrent
2014-12-29 13:08:55 ----D---- C:\Windows\Inf
2014-12-29 11:36:35 ----D---- C:\Windows\system32\DriverStore
2014-12-29 11:36:32 ----RD---- C:\Windows\System32
2014-12-29 11:36:29 ----D---- C:\Windows\SysWOW64
2014-12-29 11:36:28 ----D---- C:\Windows\system32\drivers
2014-12-29 11:36:24 ----D---- C:\Windows
2014-12-28 20:17:38 ----D---- C:\Windows\Microsoft.NET
2014-12-27 12:44:59 ----D---- C:\Users\Skyrdis\AppData\Roaming\Wise Care 365
2014-12-26 16:43:15 ----D---- C:\Windows\AppReadiness
2014-12-26 13:05:24 ----D---- C:\Windows\WinSxS
2014-12-26 13:03:42 ----D---- C:\Windows\system32\config
2014-12-22 22:25:53 ----D---- C:\Users\Skyrdis\AppData\Roaming\Spotify
2014-12-22 14:13:41 ----SHD---- C:\Windows\Installer
2014-12-22 14:11:35 ----SHD---- C:\System Volume Information
2014-12-22 14:10:32 ----D---- C:\Windows\Logs
2014-12-22 13:49:40 ----RD---- C:\Program Files (x86)
2014-12-21 19:13:30 ----D---- C:\ProgramData\Package Cache
2014-12-20 13:39:24 ----D---- C:\Users\Skyrdis\AppData\Roaming\vlc
2014-12-20 13:12:56 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-12-19 11:51:33 ----D---- C:\Windows\system32\catroot2
2014-12-18 21:50:33 ----D---- C:\Users\Skyrdis\AppData\Roaming\Adobe
2014-12-18 21:17:29 ----SD---- C:\Users\Skyrdis\AppData\Roaming\Microsoft
2014-12-18 14:24:57 ----D---- C:\ProgramData\Origin
2014-12-18 14:24:48 ----D---- C:\Program Files (x86)\Origin
2014-12-18 14:21:27 ----D---- C:\Windows\system32\Tasks
2014-12-18 13:22:24 ----RSD---- C:\Windows\assembly
2014-12-18 13:03:38 ----HD---- C:\Program Files\WindowsApps
2014-12-16 20:07:08 ----D---- C:\Users\Skyrdis\AppData\Roaming\Mumble
2014-12-15 14:43:51 ----HD---- C:\ProgramData
2014-12-15 14:36:35 ----D---- C:\Windows\SYSWOW64\config
2014-12-15 14:27:55 ----D---- C:\Windows\SoftwareDistribution
2014-12-15 14:27:40 ----D---- C:\Windows\debug
2014-12-15 13:50:52 ----D---- C:\Users\Skyrdis\AppData\Roaming\DAEMON Tools Lite
2014-12-15 11:49:53 ----D---- C:\Windows\DigitalLocker
2014-12-14 10:24:57 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-10 20:48:02 ----D---- C:\Program Files (x86)\Battle.net
2014-12-06 20:14:12 ----D---- C:\Program Files (x86)\Hearthstone
2014-12-06 14:12:16 ----D---- C:\Program Files\KMSpico
2014-12-01 14:28:57 ----D---- C:\Program Files (x86)\Common Files

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 dtsoftbus01;@oem5.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\Windows\System32\drivers\dtsoftbus01.sys [2014-08-09 283064]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\Windows\system32\DRIVERS\vwififlt.sys [2014-04-30 71680]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-06-27 88632]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2014-07-21 13209088]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2014-07-21 626688]
R3 bcbtums;@oem3.inf,%BCBTUMS.SvcDesc%;Bluetooth RAM Firmware Download USB Filter; C:\Windows\system32\drivers\bcbtums.sys [2013-09-04 170712]
R3 BCM43XX;@netbc64.inf,%BCM43XX_Service_DispName%;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl63a.sys [2013-07-01 8536752]
R3 BthEnum;@bth.inf,%BthEnum.SVCDESC%;Bluetooth Enumerator Service; C:\Windows\system32\DRIVERS\BthEnum.sys [2013-08-22 53248]
R3 BthLEEnum;@bthleenum.inf,%BthLEEnum.SVCDESC%;Bluetooth Low Energy Driver; C:\Windows\system32\DRIVERS\BthLEEnum.sys [2014-03-18 226304]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2013-08-22 118272]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2014-03-18 81920]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2014-11-21 25816]
R3 PTSimBus;@oem19.inf,%PTSimBus.SVCDESC%;PenTablet Bus Enumerator; C:\Windows\System32\drivers\PTSimBus.sys [2009-06-18 27304]
R3 PTSimHid;@oem18.inf,%PTSimHid.SVCDESC%;PenTablet Simulated HID MiniDriver; C:\Windows\System32\drivers\PTSimHid.sys [2009-06-18 17064]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2014-03-18 167424]
R3 RSPCIESTOR;@oem1.inf,%Rts5208%;Realtek PCIE CardReader Driver; C:\Windows\system32\DRIVERS\RtsPStor.sys [2012-03-29 342632]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\Windows\system32\DRIVERS\Rt630x64.sys [2013-06-18 591360]
R3 SynTP;@oem2.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-10-14 396848]
R3 TClass2k;@oem17.inf,%TClass2k.SvcDesc%;Tablet Class Driver; C:\Windows\system32\DRIVERS\TClass2k.sys [2009-06-18 27304]
R3 UCTblHid;@oem17.inf,%UCTblHid.SvcDesc%;HID Tablet Port Driver; C:\Windows\system32\DRIVERS\UCTblHid.sys [2009-06-18 22696]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2013-08-22 212224]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\Windows\system32\DRIVERS\vwifimp.sys [2014-04-30 38912]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2014-05-15 1200128]
S3 btwampfl;@oem3.inf,%btwampfl.ServiceName%;btwampfl; C:\Windows\system32\DRIVERS\btwampfl.sys [2013-09-04 166104]
S3 hitmanpro37;HitmanPro 3.7 Support Driver; \??\C:\Windows\system32\drivers\hitmanpro37.sys [2014-12-15 43664]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2014-12-15 129752]
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2014-11-21 64216]
S3 Tablet2k;Serial Tablet Port Driver; C:\Windows\System32\Drivers\Tablet2k.sys []
S3 usbscan;@sti.inf,%usbscan.SvcDesc%;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2013-08-22 44544]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdAppMgrSvc;Autodesk Application Manager Service; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [2014-09-04 597896]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-03 81088]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2014-07-21 239616]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2014-07-04 344064]
R2 PSI_SVC_2_x64;Corel License Validation Service V2 x64, Powered by arvato; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2013-09-13 337776]
S2 BcmBtRSupport;@oem3.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service; C:\Windows\system32\BtwRSupportService.exe [2013-09-04 2252504]
S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-03 107912]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2014-11-21 969016]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-09 267440]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-10-14 1357104]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2014-09-15 655624]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2013-08-22 43696]
S3 Garmin Core Update Service;Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2014-08-27 441176]
S3 gupdatem;Google Update Service (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-03 107912]
S3 mi-raysat_3dsmax2015_64;mental ray Satellite for Autodesk 3ds Max 2015 64-bit; C:\Program Files\Autodesk\3ds Max 2015\NVIDIA\Satellite\raysat_3dsmax2015_64server.exe [2011-09-15 86016]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-12-09 114800]
S3 Origin Client Service;Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2014-12-18 1903472]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2012-10-01 178824]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-08-13 833728]
S4 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-11-21 1871160]

-----------------EOF-----------------

Zdravím
Stáhněte AdwCleaner http://www.bleepingcomputer.com/download/adwcleaner/
-Uložte program na plochu a ukončete všechny spuštěné programy .
-spusťte AdwCleaner, klikněte na Scan a po dokončení skenu na Clean
- provede se oprava, restartuje se pc - (případně restartujte) a objeví se log C:\AdwCleaner\AdwCleaner.txt , obsah logu zkopírujte zde.

Zmazalo to niečo ale tých súborov sa to ani nedotklo
( a ďakujem za váš čas )

# AdwCleaner v4.106 - Report created 30/12/2014 at 16:47:30
# Updated 21/12/2014 by Xplode
# Database : 2014-12-28.1 [Live]
# Operating System : Windows 8.1 Pro (64 bits)
# Username : Skyrdis - TEREZA
# Running from : C:\Users\Skyrdis\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Skyrdis\Desktop\Tutorials

***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17239


-\\ Mozilla Firefox v34.0.5 (x86 sk)


-\\ Google Chrome v38.0.2125.111


-\\ Comodo Dragon v


*************************

AdwCleaner[R0].txt - [13395 octets] - [15/12/2014 11:57:17]
AdwCleaner[R1].txt - [968 octets] - [30/12/2014 16:42:37]
AdwCleaner[S0].txt - [13239 octets] - [15/12/2014 12:00:26]
AdwCleaner[S1].txt - [892 octets] - [30/12/2014 16:47:30]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [951 octets] ##########

Použijte ZOEK - návod od kolegy Vyoska

vyosek píše:

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
• Do okna vlozte skript nize

• Kód: Vybrat vše

  autoclean;
  resethosts;
  emptyclsid;
  IEdefaults;
  FFdefaults;
  CHRdefaults;
  emptyIEcache;
  emptyFFcache;
  emptyCHRcache;
  emptyalltemp;
  emptyflash;
  emptyjava;
  emptyrecycle.bin;
  

• Nasledne kliknete na Run Script
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

Zoek.exe v5.0.0.0 Updated 28-12-2014
Tool run by Skyrdis on st 31.12.2014 at 10:43:55,70.
Microsoft Windows 8.1 Pro 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Skyrdis\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

31.12.2014 10:46:58 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Empty Folders Check ======================

C:\PROGRA~3\ALM deleted successfully
C:\PROGRA~3\CorelDRAW Graphics Suite X7 x64 deleted successfully
C:\Users\Skyrdis\AppData\Local\DriverToolkit deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_CLASSES_ROOT\CLSID\{31264a33-a653-46c4-af49-1232c59a7da5} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-4212868944-649435043-1964981586-1001\Software\Microsoft\Internet Explorer\Approved Extensions\{31264a33-a653-46c4-af49-1232c59a7da5} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\prefs.js:
user_pref("browser.startup.homepage", "www.google.sk ");
user_pref("browser.search.useDBForOrder", true);

Added to C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\prefs.js:

ProfilePath: C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_31.12.2014_1110_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~3\CorelDRAW Graphics Suite X7 x64 not found
C:\Users\Skyrdis\.android deleted
C:\Users\Skyrdis\AppData\Roaming\Thinstall deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Skyrdis\AppData\Local\Thinstall deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\BS_Player_ControlBar_B deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\GPT.INI deleted
C:\Windows\Syswow64\GroupPolicy\gpt.ini deleted
C:\Windows\Syswow64\ST~3430.tmp deleted
C:\Windows\Syswow64\ST~34AE.tmp deleted
C:\Windows\Syswow64\ST~372D.tmp deleted
C:\Windows\Syswow64\ST~37AB.tmp deleted
C:\Windows\Syswow64\ST~777.tmp deleted
C:\Windows\Syswow64\ST~7F5.tmp deleted
C:\Windows\Syswow64\ST~AB1C.tmp deleted
C:\Windows\Syswow64\ST~AB9A.tmp deleted
C:\Windows\Syswow64\ST~DBC0.tmp deleted
C:\Windows\Syswow64\ST~DC4E.tmp deleted
C:\Windows\SysWow64\AI_RecycleBin deleted
"C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org\win32\adb.exe" deleted
"C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org\win32\AdbWinApi.dll" deleted
"C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org\win32\AdbWinUsbApi.dll" deleted
"C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org" deleted
"C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default\extensions\adbhelper@mozilla.org\win32" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Skyrdis\AppData\Roaming\Mozilla\Firefox\Profiles\vs2smeiw.default
9860727E477F17B88E39AF8B69B0407A - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll - Shockwave Flash
F59A3BE52327B91541CA61A783741595 - C:\Users\Skyrdis\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player


==== Fake Chromium Profiles Check ======================

Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Administrator\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Administrator\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Guest\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Guest\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Guest\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\HomeGroupUser$\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Skyrdis\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Skyrdis\AppData\Local\Comodo\Dragon deleted

==== Chromium Look ======================

Google Chrome Version: 38.0.2125.111 (Possible outdated, latest Stable version: 39.0.2171.95)



==== Chromium Startpages ======================

C:\Users\Skyrdis\AppData\Local\Google\Chrome\User Data\Default\Preferences
"startup_urls": [ "http://www.google.sk/" ],


==== Chromium Fix ======================

C:\Users\Skyrdis\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_websearch.searc-hall.info_0.localstorage deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"

==== Reset Google Chrome ======================

C:\Users\Skyrdis\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Skyrdis\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Skyrdis\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Skyrdis\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Skyrdis\AppData\Local\Mozilla\Firefox\Profiles\vs2smeiw.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Skyrdis\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=125 folders=129 95353803 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Skyrdis\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Skyrdis\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\MpCmdRun.log" not found

==== EOF on st 31.12.2014 at 11:24:17,56 ======================

Změnilo se něco?

no zbavilo to všetkých doplnkov prehliadače a to je všetko také čo som si všimla z vizuálnej stránky, ale súbory tam stale sú

Máte systém legální?


Otevřete poznámkový blok a vložte do něj:
-uložte jako fixlist.txt. vedle Frstu.
-otřevřete Frst a klikněte na Fix.


klikněte pravým myšítkem na disk C :, vlastnosti - vyberte kontrolu disku a nechte naplánovat. Po restartu proběhne kontrola disku.

No systém mam momentálne na skúšku nelegálny win 8.1. mohol by byť problém v tom?

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-12-2014
Ran by Skyrdis at 2015-01-01 11:29:17 Run:1
Running from C:\Users\Skyrdis\Desktop
Loaded Profile: Skyrdis (Available profiles: Skyrdis)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
O4 - HKLM\..\Run: [mncoxtndoSrv] C:\Windows\system32\mncoxtndo.vbe
C:\Windows\system32\mncoxtndo.vbe
*****************

O4 - HKLM\..\Run: [mncoxtndoSrv] C:\Windows\system32\mncoxtndo.vbe => Error: No automatic fix found for this entry.
"C:\Windows\system32\mncoxtndo.vbe" => File/Directory not found.

==== End of Fixlog 11:29:17 ====

Skyrdis píše:No systém mam momentálne na skúšku nelegálny win 8.1. mohol by byť problém v tom?

Tak co tu saskujeme?
Cital si pravidla fora a preco plytvas vzacnym casom nasej moderatorky?

Dle pravidel fora se zde nelegálními systémy nezabýváme.

2) Pokud stroj uživatele prokazatelně obsahuje nelegální hostitelský čí ochranný software
(operační systém, antivir, firewall, atd.), je nutné navést uživatele k nápravě, např. skrze neplacený software,
a začít řešit, až v době kdy je PC "v pořádku". V případě že uživatel nechce na pravidla přistoupit,
je nutné jej vyzvat ať fórum opustí, a vrátí se až je splní.

Aj tak dakujem za váš čas a aj z vašej strany za slušné "navedenie uživateľa k náprave"
prajem krásny nový rok

Skyrdis píše:2) Pokud stroj uživatele prokazatelně obsahuje nelegální hostitelský čí ochranný software
(operační systém, antivir, firewall, atd.), je nutné navést uživatele k nápravě, např. skrze neplacený software,
a začít řešit, až v době kdy je PC "v pořádku". V případě že uživatel nechce na pravidla přistoupit,
je nutné jej vyzvat ať fórum opustí, a vrátí se až je splní.

Aj tak dakujem za váš čas a aj z vašej strany za slušné "navedenie uživateľa k náprave"
prajem krásny nový rok

Ma nezaujima tvoj vyklad pravidiel. Aj ja mam napriklad na skusku W 10.
Legalne.

Krasny novy rok a prid, ked budes mat vsetko ako ma byt.
Slonik nas zamkne?

Až si zakoupíte legální operační systém, rádi Vám tu pomůžeme. Pro verzi si určitě kupovat kvůli škole nebudete.
Hezký Nový rok