VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Malware" Schvost

https://forum.viry.cz:443/viewtopic.php?t=142617

Stránka 1 z 1

Malware" Schvost

Napsal: 24 led 2015 20:40
od vaciky
Ahoj, potřeboval bych prosím pomoci, pravděpodobně mám zavirovaný počítač. Přikládám log z RSITu:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Jirka at 2015-01-24 20:36:58
Microsoft Windows 7 Ultimate
System drive C: has 35 GB (36%) free of 97 GB
Total RAM: 4095 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:37:05, on 24.1.2015
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Windows\vsnp2uvc.exe
C:\Users\Jirka\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Jirka.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Users\Jirka\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ - {086C8477-4F71-4550-87FB-AF0AE8DF3E98} - C:\Users\Jirka\AppData\Roaming\ICQM\icq.exe (HKCU)
O9 - Extra 'Tools' menuitem: ICQ - {086C8477-4F71-4550-87FB-AF0AE8DF3E98} - C:\Users\Jirka\AppData\Roaming\ICQM\icq.exe (HKCU)
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginClientService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8910 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe" /service
"C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe" /service
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe"
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\wbem\wmiprvse.exe
"taskhost.exe"
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe" /starttray
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
ngservice.exe pipeserver
"C:\Windows\vsnp2uvc.exe"
"C:\Users\Jirka\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto -critical
"C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="4976.0.444492203\2108803109" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,18,39 --gpu-vendor-id=0x1002 --gpu-device-id=0x6758 --gpu-driver-vendor="Advanced Micro Devices, Inc." --gpu-driver-version=14.501.1003.0 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group1 pct:10a stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/MaterialDesignNTP/Default/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/PP_Ethersuggest_A7_Stable_R8/PasswordGeneration/Disabled/QUIC/Disabled/RememberCertificateErrorDecisions/Default/SPDY/Spdy31Enabled-default/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_66/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_15/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="4976.1.664550408\1027975138" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group1 pct:10a stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GoogleNow/Enable/MaterialDesignNTP/Default/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/PP_Ethersuggest_A7_Stable_R8/PasswordGeneration/Disabled/QUIC/Disabled/RememberCertificateErrorDecisions/Default/SPDY/Spdy31Enabled-default/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_66/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_15/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="4976.2.747639393\1542896190" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group1 pct:10a stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GCM/Enabled/GoogleNow/Enable/MaterialDesignNTP/Default/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/PP_Ethersuggest_A7_Stable_R8/PasswordGeneration/Disabled/QUIC/Disabled/RememberCertificateErrorDecisions/Default/SPDY/Spdy31Enabled-default/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_66/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_15/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="4976.3.956678098\691950246" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group1 pct:10a stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GCM/Enabled/GoogleNow/Enable/MaterialDesignNTP/Default/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/PP_Ethersuggest_A7_Stable_R8/PasswordGeneration/Disabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/QUIC/Disabled/RememberCertificateErrorDecisions/Default/SPDY/Spdy31Enabled-default/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_66/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_15/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="4976.8.690690132\895968414" /prefetch:673131151
"taskhost.exe"
"C:\Program Files\CCleaner\CCleaner.exe" /uac

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/ChromeSuggestions/Default/DomRel-Enable/enable/EmbeddedSearch/Group1 pct:10a stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnhancedBookmarks/Default/ExtensionContentVerification/Enforce/ExtensionInstallVerification/Enforce/GCM/Enabled/GoogleNow/Enable/MaterialDesignNTP/Default/NewProfileManagement/NewAvatarMenu/OmniboxBundledExperimentV1/PP_Ethersuggest_A7_Stable_R8/PasswordGeneration/Disabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/QUIC/Disabled/RememberCertificateErrorDecisions/Default/SPDY/Spdy31Enabled-default/SRTPromptFieldTrial/Default/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group3/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_66/UMA-Uniformity-Trial-10-Percent/group_04/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_15/UMA-Uniformity-Trial-50-Percent/default/VoiceTrigger/Install/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --enable-impl-side-painting --num-raster-threads=1 --channel="4976.25.646973191\1630332779" /prefetch:673131151
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe20_ Global\UsGthrCtrlFltPipeMssGthrPipe20 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 508 512 520 65536 516
"C:\Users\Jirka\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2014-12-31 705448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14 2117216]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-12-31 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-12-31 586968]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14 1709152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-12-31 172968]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"=C:\Users\Jirka\AppData\Roaming\uTorrent\uTorrent.exe [2015-01-21 1374032]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icq]
C:\Users\Jirka\AppData\Roaming\ICQM\icq.exe [2015-01-06 36705800]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Program Files (x86)\Steam\steam.exe [2015-01-19 1942720]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-10-07 507776]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19 1022152]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-01-09 5227112]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-01-24 20:36:58 ----D---- C:\rsit
2015-01-24 20:36:58 ----D---- C:\Program Files\trend micro
2015-01-20 16:23:53 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2015-01-20 16:22:04 ----A---- C:\Windows\system32\drivers\mwac.sys
2015-01-20 16:22:04 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2015-01-20 16:22:04 ----A---- C:\Windows\system32\drivers\mbam.sys
2015-01-20 16:22:03 ----D---- C:\ProgramData\Malwarebytes
2015-01-20 16:22:03 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-18 15:18:47 ----D---- C:\Program Files\CCleaner
2015-01-18 12:36:51 ----D---- C:\Program Files (x86)\Steam
2015-01-17 22:53:10 ----D---- C:\ProgramData\Solidshield
2015-01-17 22:50:07 ----D---- C:\Program Files (x86)\Polda6
2015-01-17 22:13:07 ----D---- C:\Users\Jirka\AppData\Roaming\Steam
2015-01-17 22:09:35 ----D---- C:\Program Files (x86)\Construction Simulator 2015
2015-01-17 13:52:29 ----D---- C:\Users\Jirka\AppData\Roaming\Macromedia
2015-01-17 07:30:59 ----HD---- C:\ProgramData\CanonIJEPPEX2
2015-01-17 07:30:59 ----HD---- C:\ProgramData\CanonEPP
2015-01-15 12:49:15 ----HD---- C:\ProgramData\CanonIJScan
2015-01-15 12:48:21 ----D---- C:\Users\Jirka\AppData\Roaming\Canon
2015-01-15 11:47:01 ----D---- C:\Program Files (x86)\Canon
2015-01-15 11:46:59 ----D---- C:\Program Files\Canon
2015-01-15 11:39:31 ----HD---- C:\Windows\system32\CanonIJ Uninstaller Information
2015-01-15 11:39:25 ----HD---- C:\ProgramData\CanonBJ
2015-01-15 11:39:00 ----A---- C:\Windows\system32\CNMLMAA.DLL
2015-01-15 11:38:56 ----A---- C:\Windows\SYSWOW64\CNHMCA.dll
2015-01-15 11:38:56 ----A---- C:\Windows\SYSWOW64\CNC280U.dll
2015-01-15 11:38:56 ----A---- C:\Windows\SYSWOW64\CNC280L.dll
2015-01-15 11:38:56 ----A---- C:\Windows\system32\CNHMCA6.dll
2015-01-15 11:38:56 ----A---- C:\Windows\system32\CNC280L.dll
2015-01-15 11:38:56 ----A---- C:\Windows\system32\CNC280I.dll
2015-01-15 11:38:56 ----A---- C:\Windows\system32\CNC280C.dll
2015-01-09 22:59:11 ----D---- C:\ProgramData\EA Core
2015-01-09 22:59:09 ----D---- C:\ProgramData\EA Logs
2015-01-09 22:13:20 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2015-01-09 20:59:29 ----D---- C:\Program Files (x86)\Origin Games
2015-01-09 20:52:11 ----D---- C:\Users\Jirka\AppData\Roaming\Origin
2015-01-09 20:50:14 ----D---- C:\ProgramData\Origin
2015-01-09 20:50:12 ----D---- C:\ProgramData\Electronic Arts
2015-01-09 20:49:53 ----D---- C:\Program Files (x86)\Origin
2015-01-07 11:16:05 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2015-01-07 11:16:04 ----D---- C:\Windows\SYSWOW64\Macromed
2015-01-07 11:16:03 ----D---- C:\Windows\system32\Macromed
2015-01-07 11:15:03 ----D---- C:\Users\Jirka\AppData\Roaming\Adobe
2015-01-06 12:45:45 ----D---- C:\Users\Jirka\AppData\Roaming\ICQ-Profile
2015-01-06 12:45:45 ----D---- C:\Users\Jirka\AppData\Roaming\ICQM
2015-01-02 09:06:34 ----D---- C:\Users\Jirka\AppData\Roaming\vlc
2015-01-01 19:18:57 ----D---- C:\Users\Jirka\AppData\Roaming\AMD
2015-01-01 19:18:26 ----D---- C:\Users\Jirka\AppData\Roaming\java
2015-01-01 15:31:59 ----D---- C:\Users\Jirka\AppData\Roaming\Wargaming.net
2014-12-31 22:03:25 ----D---- C:\Users\Jirka\AppData\Roaming\Skype
2014-12-31 22:03:18 ----RD---- C:\Program Files (x86)\Skype
2014-12-31 22:03:16 ----D---- C:\ProgramData\Skype
2014-12-31 18:24:54 ----D---- C:\Windows\Panther
2014-12-31 18:24:42 ----RASH---- C:\BOOTSECT.BAK
2014-12-31 18:24:40 ----SHD---- C:\Boot
2014-12-31 18:24:26 ----D---- C:\Windows\system32\OEM
2014-12-31 12:28:43 ----A---- C:\Windows\SYSWOW64\XAudio2_7.dll
2014-12-31 12:28:43 ----A---- C:\Windows\SYSWOW64\XAPOFX1_5.dll
2014-12-31 12:28:43 ----A---- C:\Windows\system32\XAudio2_7.dll
2014-12-31 12:28:43 ----A---- C:\Windows\system32\XAPOFX1_5.dll
2014-12-31 12:28:42 ----A---- C:\Windows\SYSWOW64\xactengine3_7.dll
2014-12-31 12:28:42 ----A---- C:\Windows\system32\xactengine3_7.dll
2014-12-31 12:28:41 ----A---- C:\Windows\SYSWOW64\D3DCompiler_43.dll
2014-12-31 12:28:41 ----A---- C:\Windows\system32\D3DCompiler_43.dll
2014-12-31 12:28:40 ----A---- C:\Windows\SYSWOW64\d3dcsx_43.dll
2014-12-31 12:28:40 ----A---- C:\Windows\system32\d3dcsx_43.dll
2014-12-31 12:28:39 ----A---- C:\Windows\SYSWOW64\d3dx11_43.dll
2014-12-31 12:28:39 ----A---- C:\Windows\system32\d3dx11_43.dll
2014-12-31 12:28:38 ----A---- C:\Windows\SYSWOW64\D3DX9_43.dll
2014-12-31 12:28:38 ----A---- C:\Windows\SYSWOW64\d3dx10_43.dll
2014-12-31 12:28:38 ----A---- C:\Windows\system32\D3DX9_43.dll
2014-12-31 12:28:38 ----A---- C:\Windows\system32\d3dx10_43.dll
2014-12-31 12:28:37 ----A---- C:\Windows\SYSWOW64\XAudio2_6.dll
2014-12-31 12:28:37 ----A---- C:\Windows\SYSWOW64\XAPOFX1_4.dll
2014-12-31 12:28:37 ----A---- C:\Windows\system32\XAudio2_6.dll
2014-12-31 12:28:37 ----A---- C:\Windows\system32\XAPOFX1_4.dll
2014-12-31 12:28:35 ----A---- C:\Windows\SYSWOW64\xactengine3_6.dll
2014-12-31 12:28:35 ----A---- C:\Windows\system32\xactengine3_6.dll
2014-12-31 12:28:34 ----A---- C:\Windows\SYSWOW64\X3DAudio1_7.dll
2014-12-31 12:28:34 ----A---- C:\Windows\system32\X3DAudio1_7.dll
2014-12-31 12:27:46 ----D---- C:\Windows\SYSWOW64\directx
2014-12-31 12:17:18 ----D---- C:\Windows\system32\MRT
2014-12-31 12:17:15 ----A---- C:\Windows\system32\MRT.exe
2014-12-31 12:15:59 ----A---- C:\Windows\SYSWOW64\poqexec.exe
2014-12-31 12:15:59 ----A---- C:\Windows\system32\poqexec.exe
2014-12-31 12:15:56 ----A---- C:\Windows\system32\ntoskrnl.exe
2014-12-31 12:15:55 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2014-12-31 12:15:55 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2014-12-31 12:11:01 ----A---- C:\Windows\system32\win32k.sys
2014-12-31 12:06:15 ----A---- C:\Windows\SYSWOW64\XAudio2_5.dll
2014-12-31 12:06:15 ----A---- C:\Windows\system32\XAudio2_5.dll
2014-12-31 12:06:14 ----A---- C:\Windows\SYSWOW64\xactengine3_5.dll
2014-12-31 12:06:14 ----A---- C:\Windows\system32\xactengine3_5.dll
2014-12-31 12:06:13 ----A---- C:\Windows\SYSWOW64\D3DCompiler_42.dll
2014-12-31 12:06:13 ----A---- C:\Windows\system32\D3DCompiler_42.dll
2014-12-31 12:06:12 ----A---- C:\Windows\SYSWOW64\d3dcsx_42.dll
2014-12-31 12:06:12 ----A---- C:\Windows\system32\d3dcsx_42.dll
2014-12-31 12:06:11 ----A---- C:\Windows\SYSWOW64\d3dx11_42.dll
2014-12-31 12:06:11 ----A---- C:\Windows\system32\d3dx11_42.dll
2014-12-31 12:06:10 ----A---- C:\Windows\SYSWOW64\d3dx10_42.dll
2014-12-31 12:06:10 ----A---- C:\Windows\system32\d3dx10_42.dll
2014-12-31 12:06:09 ----A---- C:\Windows\SYSWOW64\D3DX9_42.dll
2014-12-31 12:06:09 ----A---- C:\Windows\system32\D3DX9_42.dll
2014-12-31 12:06:08 ----A---- C:\Windows\SYSWOW64\d3dx10_41.dll
2014-12-31 12:06:08 ----A---- C:\Windows\SYSWOW64\D3DCompiler_41.dll
2014-12-31 12:06:08 ----A---- C:\Windows\system32\d3dx10_41.dll
2014-12-31 12:06:08 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2014-12-31 12:06:07 ----A---- C:\Windows\SYSWOW64\D3DX9_41.dll
2014-12-31 12:06:07 ----A---- C:\Windows\system32\D3DX9_41.dll
2014-12-31 12:06:06 ----A---- C:\Windows\SYSWOW64\XAudio2_4.dll
2014-12-31 12:06:06 ----A---- C:\Windows\SYSWOW64\XAPOFX1_3.dll
2014-12-31 12:06:06 ----A---- C:\Windows\system32\XAudio2_4.dll
2014-12-31 12:06:06 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2014-12-31 12:06:05 ----A---- C:\Windows\SYSWOW64\xactengine3_4.dll
2014-12-31 12:06:05 ----A---- C:\Windows\SYSWOW64\X3DAudio1_6.dll
2014-12-31 12:06:05 ----A---- C:\Windows\system32\xactengine3_4.dll
2014-12-31 12:06:05 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2014-12-31 12:06:04 ----A---- C:\Windows\SYSWOW64\D3DCompiler_40.dll
2014-12-31 12:06:04 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2014-12-31 12:06:03 ----A---- C:\Windows\SYSWOW64\d3dx10_40.dll
2014-12-31 12:06:03 ----A---- C:\Windows\system32\d3dx10_40.dll
2014-12-31 12:06:02 ----A---- C:\Windows\SYSWOW64\XAPOFX1_2.dll
2014-12-31 12:06:02 ----A---- C:\Windows\SYSWOW64\D3DX9_40.dll
2014-12-31 12:06:02 ----A---- C:\Windows\system32\XAPOFX1_2.dll
2014-12-31 12:06:02 ----A---- C:\Windows\system32\D3DX9_40.dll
2014-12-31 12:06:01 ----A---- C:\Windows\SYSWOW64\XAudio2_3.dll
2014-12-31 12:06:01 ----A---- C:\Windows\SYSWOW64\xactengine3_3.dll
2014-12-31 12:06:01 ----A---- C:\Windows\system32\XAudio2_3.dll
2014-12-31 12:06:01 ----A---- C:\Windows\system32\xactengine3_3.dll
2014-12-31 12:06:00 ----A---- C:\Windows\SYSWOW64\X3DAudio1_5.dll
2014-12-31 12:06:00 ----A---- C:\Windows\system32\X3DAudio1_5.dll
2014-12-31 12:05:59 ----A---- C:\Windows\SYSWOW64\XAudio2_2.dll
2014-12-31 12:05:59 ----A---- C:\Windows\SYSWOW64\XAPOFX1_1.dll
2014-12-31 12:05:59 ----A---- C:\Windows\system32\XAudio2_2.dll
2014-12-31 12:05:59 ----A---- C:\Windows\system32\XAPOFX1_1.dll
2014-12-31 12:05:58 ----A---- C:\Windows\SYSWOW64\xactengine3_2.dll
2014-12-31 12:05:58 ----A---- C:\Windows\SYSWOW64\D3DCompiler_39.dll
2014-12-31 12:05:58 ----A---- C:\Windows\system32\xactengine3_2.dll
2014-12-31 12:05:58 ----A---- C:\Windows\system32\D3DCompiler_39.dll
2014-12-31 12:05:57 ----A---- C:\Windows\SYSWOW64\d3dx10_39.dll
2014-12-31 12:05:57 ----A---- C:\Windows\system32\d3dx10_39.dll
2014-12-31 12:05:56 ----A---- C:\Windows\SYSWOW64\XAudio2_1.dll
2014-12-31 12:05:56 ----A---- C:\Windows\SYSWOW64\XAPOFX1_0.dll
2014-12-31 12:05:56 ----A---- C:\Windows\SYSWOW64\D3DX9_39.dll
2014-12-31 12:05:56 ----A---- C:\Windows\system32\XAudio2_1.dll
2014-12-31 12:05:56 ----A---- C:\Windows\system32\XAPOFX1_0.dll
2014-12-31 12:05:56 ----A---- C:\Windows\system32\D3DX9_39.dll
2014-12-31 12:05:55 ----A---- C:\Windows\SYSWOW64\xactengine3_1.dll
2014-12-31 12:05:55 ----A---- C:\Windows\system32\xactengine3_1.dll
2014-12-31 12:05:54 ----A---- C:\Windows\SYSWOW64\X3DAudio1_4.dll
2014-12-31 12:05:54 ----A---- C:\Windows\system32\X3DAudio1_4.dll
2014-12-31 12:05:53 ----A---- C:\Windows\SYSWOW64\d3dx10_38.dll
2014-12-31 12:05:53 ----A---- C:\Windows\SYSWOW64\D3DCompiler_38.dll
2014-12-31 12:05:53 ----A---- C:\Windows\system32\d3dx10_38.dll
2014-12-31 12:05:53 ----A---- C:\Windows\system32\D3DCompiler_38.dll
2014-12-31 12:05:52 ----A---- C:\Windows\SYSWOW64\D3DX9_38.dll
2014-12-31 12:05:52 ----A---- C:\Windows\system32\D3DX9_38.dll
2014-12-31 12:05:51 ----A---- C:\Windows\SYSWOW64\XAudio2_0.dll
2014-12-31 12:05:51 ----A---- C:\Windows\system32\XAudio2_0.dll
2014-12-31 12:05:50 ----A---- C:\Windows\SYSWOW64\xactengine3_0.dll
2014-12-31 12:05:50 ----A---- C:\Windows\SYSWOW64\X3DAudio1_3.dll
2014-12-31 12:05:50 ----A---- C:\Windows\system32\xactengine3_0.dll
2014-12-31 12:05:50 ----A---- C:\Windows\system32\X3DAudio1_3.dll
2014-12-31 12:05:49 ----A---- C:\Windows\SYSWOW64\d3dx10_37.dll
2014-12-31 12:05:49 ----A---- C:\Windows\SYSWOW64\D3DCompiler_37.dll
2014-12-31 12:05:49 ----A---- C:\Windows\system32\d3dx10_37.dll
2014-12-31 12:05:49 ----A---- C:\Windows\system32\D3DCompiler_37.dll
2014-12-31 12:05:48 ----A---- C:\Windows\SYSWOW64\D3DX9_37.dll
2014-12-31 12:05:48 ----A---- C:\Windows\system32\D3DX9_37.dll
2014-12-31 12:05:47 ----A---- C:\Windows\SYSWOW64\xactengine2_10.dll
2014-12-31 12:05:47 ----A---- C:\Windows\system32\xactengine2_10.dll
2014-12-31 12:05:44 ----A---- C:\Windows\SYSWOW64\d3dx10_36.dll
2014-12-31 12:05:44 ----A---- C:\Windows\SYSWOW64\D3DCompiler_36.dll
2014-12-31 12:05:44 ----A---- C:\Windows\system32\d3dx10_36.dll
2014-12-31 12:05:44 ----A---- C:\Windows\system32\D3DCompiler_36.dll
2014-12-31 12:05:43 ----A---- C:\Windows\SYSWOW64\d3dx9_36.dll
2014-12-31 12:05:43 ----A---- C:\Windows\system32\d3dx9_36.dll
2014-12-31 12:05:42 ----A---- C:\Windows\SYSWOW64\xactengine2_9.dll
2014-12-31 12:05:42 ----A---- C:\Windows\system32\xactengine2_9.dll
2014-12-31 12:05:41 ----A---- C:\Windows\SYSWOW64\d3dx10_35.dll
2014-12-31 12:05:41 ----A---- C:\Windows\SYSWOW64\D3DCompiler_35.dll
2014-12-31 12:05:41 ----A---- C:\Windows\system32\d3dx10_35.dll
2014-12-31 12:05:41 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2014-12-31 12:05:40 ----A---- C:\Windows\SYSWOW64\d3dx9_35.dll
2014-12-31 12:05:40 ----A---- C:\Windows\system32\d3dx9_35.dll
2014-12-31 12:05:39 ----A---- C:\Windows\SYSWOW64\xactengine2_8.dll
2014-12-31 12:05:39 ----A---- C:\Windows\SYSWOW64\X3DAudio1_2.dll
2014-12-31 12:05:39 ----A---- C:\Windows\system32\xactengine2_8.dll
2014-12-31 12:05:39 ----A---- C:\Windows\system32\X3DAudio1_2.dll
2014-12-31 12:05:38 ----A---- C:\Windows\SYSWOW64\d3dx10_34.dll
2014-12-31 12:05:38 ----A---- C:\Windows\SYSWOW64\D3DCompiler_34.dll
2014-12-31 12:05:38 ----A---- C:\Windows\system32\d3dx10_34.dll
2014-12-31 12:05:38 ----A---- C:\Windows\system32\D3DCompiler_34.dll
2014-12-31 12:05:37 ----A---- C:\Windows\SYSWOW64\d3dx9_34.dll
2014-12-31 12:05:37 ----A---- C:\Windows\system32\d3dx9_34.dll
2014-12-31 12:05:36 ----A---- C:\Windows\SYSWOW64\xinput1_3.dll
2014-12-31 12:05:36 ----A---- C:\Windows\system32\xinput1_3.dll
2014-12-31 12:05:35 ----A---- C:\Windows\SYSWOW64\xactengine2_7.dll
2014-12-31 12:05:35 ----A---- C:\Windows\system32\xactengine2_7.dll
2014-12-31 12:05:33 ----A---- C:\Windows\SYSWOW64\d3dx10_33.dll
2014-12-31 12:05:33 ----A---- C:\Windows\SYSWOW64\D3DCompiler_33.dll
2014-12-31 12:05:33 ----A---- C:\Windows\system32\d3dx10_33.dll
2014-12-31 12:05:33 ----A---- C:\Windows\system32\D3DCompiler_33.dll
2014-12-31 12:05:32 ----A---- C:\Windows\SYSWOW64\d3dx9_33.dll
2014-12-31 12:05:32 ----A---- C:\Windows\system32\d3dx9_33.dll
2014-12-31 12:05:31 ----A---- C:\Windows\SYSWOW64\xactengine2_6.dll
2014-12-31 12:05:31 ----A---- C:\Windows\system32\xactengine2_6.dll
2014-12-31 12:05:29 ----A---- C:\Windows\SYSWOW64\xactengine2_5.dll
2014-12-31 12:05:29 ----A---- C:\Windows\system32\xactengine2_5.dll
2014-12-31 12:05:28 ----A---- C:\Windows\SYSWOW64\d3dx10.dll
2014-12-31 12:05:28 ----A---- C:\Windows\system32\d3dx10.dll
2014-12-31 12:05:26 ----A---- C:\Windows\SYSWOW64\d3dx9_32.dll
2014-12-31 12:05:26 ----A---- C:\Windows\system32\d3dx9_32.dll
2014-12-31 12:05:25 ----A---- C:\Windows\SYSWOW64\xactengine2_4.dll
2014-12-31 12:05:25 ----A---- C:\Windows\SYSWOW64\x3daudio1_1.dll
2014-12-31 12:05:25 ----A---- C:\Windows\system32\xactengine2_4.dll
2014-12-31 12:05:25 ----A---- C:\Windows\system32\x3daudio1_1.dll
2014-12-31 12:05:24 ----A---- C:\Windows\SYSWOW64\d3dx9_31.dll
2014-12-31 12:05:24 ----A---- C:\Windows\system32\d3dx9_31.dll
2014-12-31 12:05:23 ----A---- C:\Windows\SYSWOW64\xactengine2_3.dll
2014-12-31 12:05:23 ----A---- C:\Windows\system32\xactengine2_3.dll
2014-12-31 12:05:22 ----A---- C:\Windows\SYSWOW64\xinput1_2.dll
2014-12-31 12:05:22 ----A---- C:\Windows\system32\xinput1_2.dll
2014-12-31 12:05:21 ----A---- C:\Windows\SYSWOW64\xactengine2_2.dll
2014-12-31 12:05:21 ----A---- C:\Windows\system32\xactengine2_2.dll
2014-12-31 12:05:20 ----A---- C:\Windows\system32\xinput1_1.dll
2014-12-31 12:04:57 ----A---- C:\Windows\system32\wups2.dll
2014-12-31 12:04:57 ----A---- C:\Windows\system32\wucltux.dll
2014-12-31 12:04:57 ----A---- C:\Windows\system32\wuaueng.dll
2014-12-31 12:04:57 ----A---- C:\Windows\system32\wuauclt.exe
2014-12-31 12:04:41 ----A---- C:\Windows\system32\wups.dll
2014-12-31 12:04:41 ----A---- C:\Windows\system32\wudriver.dll
2014-12-31 12:04:41 ----A---- C:\Windows\system32\wuapi.dll
2014-12-31 12:04:34 ----A---- C:\Windows\system32\wuwebv.dll
2014-12-31 12:04:34 ----A---- C:\Windows\system32\wuapp.exe
2014-12-31 12:03:39 ----A---- C:\Windows\SYSWOW64\xinput1_1.dll
2014-12-31 12:03:38 ----A---- C:\Windows\SYSWOW64\xactengine2_1.dll
2014-12-31 12:03:38 ----A---- C:\Windows\system32\xactengine2_1.dll
2014-12-31 12:03:34 ----A---- C:\Windows\SYSWOW64\d3dx9_30.dll
2014-12-31 12:03:34 ----A---- C:\Windows\system32\d3dx9_30.dll
2014-12-31 12:03:33 ----A---- C:\Windows\SYSWOW64\xactengine2_0.dll
2014-12-31 12:03:33 ----A---- C:\Windows\SYSWOW64\x3daudio1_0.dll
2014-12-31 12:03:33 ----A---- C:\Windows\system32\xactengine2_0.dll
2014-12-31 12:03:33 ----A---- C:\Windows\system32\x3daudio1_0.dll
2014-12-31 12:03:32 ----A---- C:\Windows\SYSWOW64\d3dx9_29.dll
2014-12-31 12:03:32 ----A---- C:\Windows\SYSWOW64\d3dx9_28.dll
2014-12-31 12:03:32 ----A---- C:\Windows\system32\d3dx9_29.dll
2014-12-31 12:03:32 ----A---- C:\Windows\system32\d3dx9_28.dll
2014-12-31 12:03:31 ----A---- C:\Windows\SYSWOW64\d3dx9_27.dll
2014-12-31 12:03:31 ----A---- C:\Windows\system32\d3dx9_27.dll
2014-12-31 12:03:30 ----A---- C:\Windows\SYSWOW64\d3dx9_26.dll
2014-12-31 12:03:30 ----A---- C:\Windows\system32\d3dx9_26.dll
2014-12-31 12:03:29 ----A---- C:\Windows\SYSWOW64\d3dx9_25.dll
2014-12-31 12:03:29 ----A---- C:\Windows\system32\d3dx9_25.dll
2014-12-31 12:03:28 ----A---- C:\Windows\SYSWOW64\d3dx9_24.dll
2014-12-31 12:03:28 ----A---- C:\Windows\system32\d3dx9_24.dll
2014-12-31 12:00:39 ----D---- C:\Users\Jirka\AppData\Roaming\WinRAR
2014-12-31 11:01:05 ----D---- C:\Users\Jirka\AppData\Roaming\Dropbox
2014-12-31 10:51:02 ----D---- C:\Users\Jirka\AppData\Roaming\AVAST Software
2014-12-31 10:48:29 ----D---- C:\Windows\SYSWOW64\vbox
2014-12-31 10:48:29 ----D---- C:\Windows\system32\vbox
2014-12-31 10:47:57 ----A---- C:\Windows\system32\drivers\aswStm.sys
2014-12-31 10:47:56 ----A---- C:\Windows\system32\drivers\aswVmm.sys
2014-12-31 10:47:56 ----A---- C:\Windows\system32\drivers\aswSP.sys
2014-12-31 10:47:56 ----A---- C:\Windows\system32\drivers\aswRvrt.sys
2014-12-31 10:47:56 ----A---- C:\Windows\system32\drivers\aswMonFlt.sys
2014-12-31 10:47:56 ----A---- C:\Windows\system32\drivers\aswHwid.sys
2014-12-31 10:47:55 ----A---- C:\Windows\system32\drivers\aswsnx.sys
2014-12-31 10:47:55 ----A---- C:\Windows\system32\drivers\aswRdr2.sys
2014-12-31 10:47:54 ----A---- C:\Windows\system32\aswBoot.exe
2014-12-31 10:47:51 ----A---- C:\Windows\avastSS.scr
2014-12-31 10:46:16 ----D---- C:\Program Files\AVAST Software
2014-12-31 10:45:08 ----D---- C:\ProgramData\AVAST Software
2014-12-31 10:16:57 ----D---- C:\Program Files (x86)\Microsoft Works
2014-12-31 10:16:43 ----D---- C:\Program Files (x86)\Microsoft Visual Studio
2014-12-31 10:16:34 ----D---- C:\Windows\PCHEALTH
2014-12-31 10:16:34 ----D---- C:\Program Files (x86)\Microsoft.NET
2014-12-31 10:15:14 ----D---- C:\Program Files\Microsoft Office
2014-12-31 10:15:11 ----D---- C:\Program Files (x86)\Microsoft Visual Studio 8
2014-12-31 10:14:50 ----D---- C:\ProgramData\Microsoft Help
2014-12-31 10:14:50 ----D---- C:\Program Files (x86)\Microsoft Office
2014-12-31 10:14:06 ----RHD---- C:\MSOCache
2014-12-31 10:11:38 ----D---- C:\Users\Jirka\AppData\Roaming\.minecraft
2014-12-31 10:08:32 ----D---- C:\Program Files (x86)\VideoLAN
2014-12-31 10:01:17 ----D---- C:\Program Files (x86)\SpeedFan
2014-12-31 09:59:03 ----D---- C:\Program Files (x86)\Adobe
2014-12-31 09:58:57 ----D---- C:\ProgramData\Adobe
2014-12-31 09:54:26 ----D---- C:\ProgramData\Sun
2014-12-31 09:54:20 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2014-12-31 09:54:10 ----D---- C:\ProgramData\Oracle
2014-12-31 09:54:06 ----D---- C:\Program Files (x86)\Java
2014-12-31 09:52:15 ----A---- C:\Windows\system32\drivers\dtsoftbus01.sys
2014-12-31 09:52:12 ----D---- C:\Users\Jirka\AppData\Roaming\DAEMON Tools Lite
2014-12-31 09:52:11 ----D---- C:\Program Files (x86)\DAEMON Tools Lite
2014-12-31 09:51:57 ----N---- C:\Windows\system32\MpSigStub.exe
2014-12-31 09:51:42 ----D---- C:\ProgramData\DAEMON Tools Lite
2014-12-31 09:50:47 ----D---- C:\Users\Jirka\AppData\Roaming\RHEng
2014-12-31 09:50:29 ----D---- C:\ProgramData\APN
2014-12-31 09:50:00 ----D---- C:\Users\Jirka\AppData\Roaming\uTorrent
2014-12-31 09:49:46 ----D---- C:\Program Files\WinRAR
2014-12-31 09:49:10 ----D---- C:\ProgramData\AMD
2014-12-31 09:49:09 ----D---- C:\Program Files (x86)\AMD AVT
2014-12-31 09:48:12 ----D---- C:\Program Files\Common Files\ATI Technologies
2014-12-31 09:47:39 ----D---- C:\ProgramData\Package Cache
2014-12-31 09:46:45 ----D---- C:\Program Files\AMD
2014-12-31 09:45:18 ----D---- C:\AMD
2014-12-31 09:42:00 ----SHD---- C:\Windows\Installer
2014-12-31 09:37:41 ----D---- C:\Program Files (x86)\Google
2014-12-31 09:34:40 ----D---- C:\Users\Jirka\AppData\Roaming\Identities
2014-12-31 09:34:24 ----SD---- C:\Users\Jirka\AppData\Roaming\Microsoft
2014-12-31 09:34:24 ----D---- C:\Users\Jirka\AppData\Roaming\Media Center Programs
2014-12-31 09:32:25 ----SHD---- C:\Recovery
2014-12-31 09:32:25 ----SHD---- C:\ProgramData\Šablony
2014-12-31 09:32:25 ----SHD---- C:\ProgramData\Plocha
2014-12-31 09:32:25 ----SHD---- C:\ProgramData\Oblíbené položky
2014-12-31 09:32:25 ----SHD---- C:\ProgramData\Nabídka Start
2014-12-31 09:32:25 ----SHD---- C:\ProgramData\Dokumenty
2014-12-31 09:32:25 ----SHD---- C:\ProgramData\Data aplikací
2014-12-31 09:28:45 ----D---- C:\Windows\SoftwareDistribution
2014-12-31 09:25:56 ----D---- C:\Windows\Prefetch
2014-12-31 09:25:56 ----ASH---- C:\pagefile.sys
2014-12-31 09:25:54 ----SHD---- C:\System Volume Information
2014-12-31 09:25:54 ----ASH---- C:\hiberfil.sys

======List of files/folders modified in the last 1 month======

2015-01-24 20:37:03 ----D---- C:\Windows\Temp
2015-01-24 20:36:58 ----RD---- C:\Program Files
2015-01-24 11:20:45 ----D---- C:\Windows\system32\config
2015-01-24 11:09:29 ----D---- C:\Windows\inf
2015-01-23 16:54:11 ----D---- C:\Windows\SysWOW64
2015-01-23 16:37:03 ----D---- C:\Windows
2015-01-20 17:24:24 ----D---- C:\Windows\system32\wdi
2015-01-20 17:22:06 ----D---- C:\Windows\system32\drivers
2015-01-20 17:22:06 ----D---- C:\Windows\IME
2015-01-20 17:21:08 ----HD---- C:\ProgramData
2015-01-20 16:22:03 ----RD---- C:\Program Files (x86)
2015-01-18 15:19:50 ----D---- C:\Windows\Logs
2015-01-18 15:19:50 ----D---- C:\Windows\debug
2015-01-18 15:18:51 ----D---- C:\Windows\system32\Tasks
2015-01-18 12:36:53 ----D---- C:\Program Files (x86)\Common Files
2015-01-18 09:46:52 ----D---- C:\Windows\System32
2015-01-18 09:46:52 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-01-17 21:32:13 ----D---- C:\Windows\system32\FxsTmp
2015-01-17 13:56:15 ----D---- C:\Windows\system32\NDF
2015-01-15 11:39:17 ----D---- C:\Windows\system32\catroot2
2015-01-15 11:39:17 ----D---- C:\Windows\system32\catroot
2015-01-15 11:39:14 ----D---- C:\Windows\system32\DriverStore
2015-01-15 11:39:09 ----RSD---- C:\Windows\Media
2015-01-15 11:39:04 ----D---- C:\Windows\twain_32
2015-01-09 22:14:23 ----D---- C:\Windows\winsxs
2015-01-09 22:11:59 ----RSD---- C:\Windows\assembly
2015-01-09 20:50:02 ----D---- C:\Program Files\Common Files\Microsoft Shared
2015-01-07 11:16:06 ----D---- C:\Windows\Tasks
2015-01-01 15:52:24 ----RSD---- C:\Windows\Fonts
2015-01-01 15:44:42 ----SD---- C:\ProgramData\Microsoft
2015-01-01 15:44:40 ----D---- C:\Windows\system32\drivers\UMDF
2014-12-31 17:15:16 ----D---- C:\Windows\rescache
2014-12-31 16:29:14 ----D---- C:\Windows\system32\LogFiles
2014-12-31 12:20:04 ----D---- C:\Windows\SYSWOW64\cs-CZ
2014-12-31 12:20:04 ----D---- C:\Windows\system32\sk-SK
2014-12-31 12:20:04 ----D---- C:\Windows\system32\en-US
2014-12-31 12:20:04 ----D---- C:\Windows\system32\cs-CZ
2014-12-31 12:20:04 ----D---- C:\Windows\AppPatch
2014-12-31 12:03:35 ----D---- C:\Windows\Microsoft.NET
2014-12-31 10:16:48 ----D---- C:\Program Files (x86)\MSBuild
2014-12-31 10:16:42 ----D---- C:\Windows\ShellNew
2014-12-31 10:15:02 ----A---- C:\Windows\win.ini
2014-12-31 09:48:12 ----D---- C:\Program Files\Common Files
2014-12-31 09:47:30 ----D---- C:\Windows\system32\restore
2014-12-31 09:44:04 ----D---- C:\Windows\system32\CodeIntegrity
2014-12-31 09:34:37 ----SHD---- C:\$Recycle.Bin
2014-12-31 09:34:24 ----RD---- C:\Users
2014-12-31 09:33:08 ----D---- C:\Windows\Setup
2014-12-31 09:32:25 ----D---- C:\Program Files\Windows NT
2014-12-31 09:29:22 ----D---- C:\Windows\system32\sysprep
2014-12-31 09:26:34 ----D---- C:\Windows\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2014-12-31 65776]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2014-12-31 267632]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2009-07-14 214096]
R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2012-12-29 28664]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2014-12-31 93568]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2014-12-31 1050432]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2014-12-31 436624]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2009-07-14 514048]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2014-12-31 283064]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2014-12-31 29208]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2014-12-31 83280]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2014-12-31 116728]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2014-11-21 18959360]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2014-11-21 589312]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2014-06-21 94720]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2014-11-21 25816]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2015-01-24 129752]
R3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2014-11-21 63704]
R3 RTL8167;Ovladač Realtek 8167 NT; C:\Windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2009-06-23 3531136]
S3 pciide;pciide; C:\Windows\system32\DRIVERS\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2009-07-14 165376]
S3 s3cap;s3cap; C:\Windows\system32\DRIVERS\vms3cap.sys [2009-07-14 6656]
S3 storvsc;storvsc; C:\Windows\system32\DRIVERS\storvsc.sys [2009-07-14 34896]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2009-07-14 41984]
S3 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\DRIVERS\vmbus.sys [2009-07-14 200272]
S3 VMBusHID;VMBusHID; C:\Windows\system32\DRIVERS\VMBusHID.sys [2009-07-14 21760]
S4 VBoxAswDrv;VBoxAsw Support Driver; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2014-12-31 271752]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-03 81088]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2014-11-21 244736]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-12-31 50344]
R2 c2cautoupdatesvc;Skype Click to Call Updater; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
R2 c2cpnrsvc;Skype Click to Call PNR Service; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2014-11-21 969016]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-11-21 1871160]
R3 AvastVBoxSvc;AvastVBox COM Service; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2014-12-31 4012248]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-31 107912]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2014-12-11 315496]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-23 267440]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-12-31 107912]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 Origin Client Service;Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2015-01-09 1903472]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2015-01-19 834752]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]

-----------------EOF-----------------

Re: Malware" Schvost

Napsal: 24 led 2015 20:44
od Rudy
Zdravím!
Jak je na tom váš oper. systém s legalitou?

Re: Malware" Schvost

Napsal: 24 led 2015 20:57
od vaciky
Dobrý večer, PC jsem zakoupil od známého tak netuším zda je vše ok.

Re: Malware" Schvost

Napsal: 24 led 2015 21:34
od Rudy
Zkusíme tento postup:

Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte na plochu.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce
Oznacte polozky (dejte tam zatrzitka) Pro všechny uživatele, Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
Do spodniho okna vlozte nasledujici text
CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
adp3132.sys
AGP440.sys
ahcix86.sys
ahcix86s.sys
atapi.sys
autochk.exe
cdrom.sys
cngaudit.dll
cryptsvc.dll
eNetHook.dll
eventlog.dll
explorer.exe
hal.dll
Changer.sys
iaStor.sys
iastorv.sys
IdeChnDr.sys
isapnp.sys
JakNDis.sys
KR10N.sys
logevent.dll
lsass.exe
mv61xx.sys
ndis.sys
netlogon.dll
ntelogon.dll
nvata.sys
nvatabus.sys
nvgts.sys
nvraid.sys
nvrd32.sys
nvstor.sys
nvstor32.sys
scecli.dll
sceclt.dll
smss.exe
svchost.exe
symmpi.sys
tcpip.sys
userinit.exe
vaxscsi.sys
viamraid.sys
viasraid.sys
ViPrt.sys
winlogon.exe
ws2_32.dll
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c

type c:\boot.ini >> test.txt /c
%SystemDrive%\PhysicalMBR.bin /md5

*crack* /s
*keygen* /s
*AntiWPA* /s
*loader* /s
*minodlogin* /s
*tnod* /s
*AutoKMS* /s
*activator* /s
*serial* /s
*w7lxe* /s

Kliknete na Prohledat. Dejte oba logy.

Re: Malware" Schvost

Napsal: 25 led 2015 08:29
od vaciky
Tady jsou OTL a Extras

Re: Malware" Schvost

Napsal: 25 led 2015 10:58
od Rudy
Znovu spustte OTL jako spravce
Do spodniho okna vlozte nasledujici text:
:OTL
PRC - [2014.10.07 15:39:30 | 001,241,472 | ---- | M] (Oracle Corporation) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
PRC - [2014.07.14 18:21:46 | 001,390,176 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
PRC - [2014.07.14 18:21:06 | 001,767,520 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
SRV - [2014.07.14 18:21:46 | 001,390,176 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe -- (c2cautoupdatesvc)
SRV - [2014.07.14 18:21:06 | 001,767,520 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe -- (c2cpnrsvc)
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
CHR - plugin: Error reading preferences file
CHR - Extension: No name found = C:\Users\Jirka\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.8_0\
CHR - Extension: No name found = C:\Users\Jirka\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.8_0\
CHR - Extension: No name found = C:\Users\Jirka\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.7_0\
CHR - Extension: No name found = C:\Users\Jirka\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: No name found = C:\Users\Jirka\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck\10.0.2502.149_0\
CHR - Extension: No name found = C:\Users\Jirka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\10.0.2502.149_0\
CHR - Extension: No name found = C:\Users\Jirka\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
O2 - BHO: (Skype Click to Call for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

:files
C:\Program Files (x86)\Skype\Toolbars
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
%windir%\system32\*.tmp.dll /s
%windir%\system32\SET*.tmp /s
%windir%\*.tmp

:commands
[EMPTYTEMP]
[EMPTYFLASH]
[RESETHOSTS]
[Purity]
[CreateRestorePoint]
Kliknete na Opravit a nechte program pracovat. Pri otazce na restart souhlaste.
Po restartu se objevi novy log, ten sem dejte.

Re: Malware" Schvost

Napsal: 25 led 2015 16:55
od vaciky
Zde je log po opravě.

Re: Malware" Schvost

Napsal: 25 led 2015 17:02
od Rudy
OK, smazáno. Nastala nějaká změna?

Re: Malware" Schvost

Napsal: 26 led 2015 11:42
od vaciky
Ano, už to hlásí pouze jeden v user-appdata-roaming-utorrent-utorrent.exe

Tak ok vše běží jak má děkuji za pomoc.

Re: Malware" Schvost

Napsal: 26 led 2015 18:13
od Rudy
To je problém torrentového klienta. K tomu podporu neposkytujeme, neboť torrenty jsou častým zdrojm zavirování. Udělejte ještě kompletní sken MBAM: http://www.malwarebytes.org/mbam.php dejte log. Předem nic nemažte.

Re: Malware" Schvost

Napsal: 29 led 2015 13:47
od vaciky
Log po scanu

Re: Malware" Schvost

Napsal: 29 led 2015 18:10
od Rudy
Nějaký divný. Z čeho je?

Re: Malware" Schvost

Napsal: 30 led 2015 11:28
od vaciky
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe"

Re: Malware" Schvost

Napsal: 30 led 2015 16:56
od Rudy
vaciky píše:"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe"
Ten vypadá asi takto: http://forum.viry.cz/viewtopic.php?f=13 ... D#p1376183 .
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz