VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Positive add problém přetrvává

https://forum.viry.cz:443/viewtopic.php?t=142901

Stránka 1 z 1

Positive add problém přetrvává

Napsal: 09 úno 2015 12:40
od papperwing
Dobrý den,
před pár dny jsem řešil problém se šmejdem Positive add a reklamy na chvíli zmizely. Během těch dní jsem windows využíval méně a nenavštěvoval jsem žádné nebezpečné stránky a šmej se vrátil.

zde zasílám rsit:

Logfile of random's system information tool 1.10 (written by random/random)
Run by jakub_000 at 2015-02-09 12:36:56
Microsoft Windows 8 Pro
System drive C: has 44 GB (15%) free of 300 GB
Total RAM: 4030 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:38:03, on 9. 2. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v10.0 (10.00.9200.17183)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe
C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\plugin.exe
C:\Users\jakub_000\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\Unity\MonoDevelop\bin\MonoDevelop.exe
C:\Program Files (x86)\Unity\Editor\Unity.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\trend micro\jakub_000.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/1ewenusDefaultPack/UP97_FRPage
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Positive Finds - {30c85a3d-1d96-4589-b63f-91fb7ef45a41} - C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [EaseUS EPM tray] C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [EaseUS EPM Tray Agent] "C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [EADM] "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
O4 - HKCU\..\Run: [Google Update] "C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - Startup: Dropbox.lnk = jakub_000\AppData\Roaming\Dropbox\bin\Dropbox.exe
O4 - Startup: EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe
O8 - Extra context menu item: Clip bookmark - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0
O8 - Extra context menu item: Clip image - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4
O8 - Extra context menu item: Clip selection - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3
O8 - Extra context menu item: Clip this page - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1
O8 - Extra context menu item: New note - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html
O8 - Extra context menu item: Nová poznámka - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\NewNote.html
O8 - Extra context menu item: Oříznout tuto stránku - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=1
O8 - Extra context menu item: Vystřihnout obrázek - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=4
O8 - Extra context menu item: Vystřihnout URL - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0
O8 - Extra context menu item: Výběr oříznutí - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=3
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: *.clonewarsadventures.com
O15 - Trusted Zone: *.freerealms.com
O15 - Trusted Zone: *.soe.com
O15 - Trusted Zone: *.sony.com
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs:
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: AtherosSvc - Unknown owner - C:\windows\system32\AdminService.exe (file missing)
O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Origin Client Service - Electronic Arts - C:\Program Files (x86)\Origin\OriginClientService.exe
O23 - Service: Overwolf Updater Service (OverwolfUpdaterService) - Unknown owner - C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Service Mgr PositiveFinds - Unknown owner - C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 9 (TeamViewer9) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: Update Mgr PositiveFinds - Unknown owner - C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9904 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
"dwm.exe"
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\windows\system32\AdminService.exe
dashost.exe {67aab0f5-323c-4f26-8fa1b2c073d54f20}
C:\windows\SysWOW64\PnkBstrA.exe
C:\windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe"
"C:\Program Files\Windows Defender\MsMpEng.exe"
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalServicePeerNet
taskhostex.exe
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
C:\windows\Explorer.EXE
taskhost.exe USER
"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server
C:\windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe"
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe"
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe"

"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\8\plugin.exe" u
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\5\plugin.exe" u
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\plugin.exe"
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\plugin.exe"
"C:\Users\jakub_000\AppData\Roaming\Dropbox\bin\Dropbox.exe" /home
taskeng.exe {6654750C-96CC-4010-8141-CE85DC1A9044}
C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe /c
"C:\Program Files (x86)\Unity\MonoDevelop\bin\MonoDevelop.exe" --nologo "C:\Users\jakub_000\Documents\New Unity Project\New Unity Project.sln" "C:\Users\jakub_000\Documents\New Unity Project\Assets\Scripts\LevelScripts\LevelBuilder.cs;-1"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-4707637f-2662-4f27-8d49-d7580a7183c5 -SystemEventPortName:HostProcess-5adb53cb-c12e-4b90-99c7-8ca036b4712b -IoCancelEventPortName:HostProcess-93bd7c25-2efe-445c-a872-591844b2a4b0 -NonStateChangingEventPortName:HostProcess-d779b845-4e58-4f4d-b5b5-4857bb5cecfc -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:aec57c71-fed6-4071-8dcb-8ca79aa55a4b -DeviceGroupId:WudfDefaultDevicePool
"C:\Program Files (x86)\Unity\Editor\Unity.exe"
C:\windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
C:\windows\system32\wbem\wmiprvse.exe
taskeng.exe {9A5938CB-E469-4CDB-B6BE-282DEC5EB97E}
C:\windows\System32\svchost.exe -k WerSvcGroup
"C:\Users\jakub_000\Desktop\RSITx64.exe"

=========Mozilla firefox=========

ProfilePath - C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143

prefs.js - "browser.startup.homepage" - "about:home"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 16.0.0.305 Plugin
"Path"=C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=2.1.7]
"Description"=
"Path"=C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.21.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\SysWOW64\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.6]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.5]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 16.0.0.305 Plugin
"Path"=C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=11.31.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=11.31.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26 551848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26 212904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30c85a3d-1d96-4589-b63f-91fb7ef45a41}]
Positive Finds - C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll [2015-02-04 145656]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-04-20 462752]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{92EF2EAD-A7CE-4424-B0DB-499CF856608E}]
Evernote extension - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2014-08-26 626528]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-04-20 171424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2013-11-07 171992]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2013-11-07 399832]
"Persistence"=C:\windows\system32\igfxpers.exe [2013-11-07 442328]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-03-14 3672640]
"EADM"=C:\Program Files (x86)\Origin\Origin.exe [2014-12-26 3618648]
"Google Update"=C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe [2013-08-12 116648]
"Steam"=C:\Program Files (x86)\Steam\steam.exe [2015-01-23 1942720]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"EaseUS EPM tray"=C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe [2014-11-18 2089056]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-12-17 508800]
"EaseUS EPM Tray Agent"=C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe [2014-11-18 255072]

C:\Users\jakub_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Dropbox.lnk - C:\Users\jakub_000\AppData\Roaming\Dropbox\bin\Dropbox.exe
EvernoteClipper.lnk - C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2013-11-07 442880]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-02-05 11:41:42 ----SHD---- C:\$RECYCLE.BIN
2015-02-05 11:39:00 ----A---- C:\windows\zoek-delete.exe
2015-02-05 11:38:59 ----D---- C:\windows\Temp
2015-02-05 11:28:44 ----D---- C:\zoek_backup
2015-02-04 17:54:15 ----A---- C:\windows\SYSWOW64\EuEpmGdi.dll
2015-02-04 17:54:15 ----A---- C:\windows\SYSWOW64\BootMan.exe
2015-02-04 17:54:15 ----A---- C:\windows\system32\setupempdrvx64.exe
2015-02-04 17:54:15 ----A---- C:\windows\system32\EuGdiDrv.sys
2015-02-04 17:54:15 ----A---- C:\windows\system32\EuEpmGdi.dll
2015-02-04 17:54:15 ----A---- C:\windows\system32\BootMan.exe
2015-02-04 17:54:14 ----A---- C:\windows\SYSWOW64\setupempdrv03.exe
2015-02-04 17:54:14 ----A---- C:\windows\SYSWOW64\EuGdiDrv.sys
2015-02-04 17:54:14 ----A---- C:\windows\SYSWOW64\epmntdrv.sys
2015-02-04 17:54:14 ----A---- C:\windows\system32\epmntdrv.sys
2015-02-04 17:54:08 ----D---- C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
2015-02-04 17:54:05 ----D---- C:\Program Files (x86)\Positive Finds
2015-02-02 14:17:47 ----D---- C:\Users\jakub_000\AppData\Roaming\ShoeBox
2015-02-02 14:17:44 ----D---- C:\Program Files (x86)\ShoeBox
2015-01-27 08:11:58 ----D---- C:\Program Files (x86)\Mozilla Firefox
2015-01-26 10:52:54 ----A---- C:\windows\system32\WindowsAccessBridge-64.dll
2015-01-26 10:48:35 ----D---- C:\Program Files\Java
2015-01-25 17:40:35 ----D---- C:\Users\jakub_000\AppData\Roaming\Factorio
2015-01-21 19:25:42 ----D---- C:\Program Files (x86)\PlayDance
2015-01-21 18:35:35 ----D---- C:\Program Files (x86)\StepMania
2015-01-19 14:09:18 ----D---- C:\Program Files (x86)\OpenAL
2015-01-19 14:09:18 ----A---- C:\windows\SYSWOW64\wrap_oal.dll
2015-01-19 14:09:18 ----A---- C:\windows\SYSWOW64\OpenAL32.dll
2015-01-19 14:09:18 ----A---- C:\windows\system32\wrap_oal.dll
2015-01-19 14:09:18 ----A---- C:\windows\system32\OpenAL32.dll
2015-01-18 18:18:28 ----D---- C:\Users\jakub_000\AppData\Roaming\six-updater
2015-01-18 18:18:27 ----D---- C:\Users\jakub_000\AppData\Roaming\six-zsync
2015-01-18 17:54:21 ----D---- C:\Program Files (x86)\SIX Projects
2015-01-17 10:39:44 ----A---- C:\windows\SYSWOW64\aspnet_counters.dll
2015-01-17 10:38:23 ----A---- C:\windows\system32\aspnet_counters.dll
2015-01-14 11:54:18 ----A---- C:\windows\system32\vbscript.dll
2015-01-14 11:54:17 ----A---- C:\windows\SYSWOW64\vbscript.dll
2015-01-14 11:53:54 ----A---- C:\windows\system32\localspl.dll
2015-01-14 11:53:53 ----A---- C:\windows\system32\win32spl.dll
2015-01-14 11:53:53 ----A---- C:\windows\system32\services.exe
2015-01-14 11:53:51 ----A---- C:\windows\system32\drivers\vhdmp.sys
2015-01-14 11:53:01 ----A---- C:\windows\system32\wucltux.dll
2015-01-14 11:53:01 ----A---- C:\windows\system32\wuaueng.dll
2015-01-14 11:53:00 ----A---- C:\windows\SYSWOW64\wuapi.dll
2015-01-14 11:53:00 ----A---- C:\windows\system32\WUSettingsProvider.dll
2015-01-14 11:53:00 ----A---- C:\windows\system32\wuauclt.exe
2015-01-14 11:53:00 ----A---- C:\windows\system32\wuapi.dll
2015-01-14 11:52:59 ----A---- C:\windows\SYSWOW64\wuwebv.dll
2015-01-14 11:52:59 ----A---- C:\windows\SYSWOW64\wudriver.dll
2015-01-14 11:52:59 ----A---- C:\windows\system32\wuwebv.dll
2015-01-14 11:52:59 ----A---- C:\windows\system32\storewuauth.dll
2015-01-14 11:52:58 ----A---- C:\windows\SYSWOW64\wuapp.exe
2015-01-14 11:52:58 ----A---- C:\windows\system32\wudriver.dll
2015-01-14 11:52:58 ----A---- C:\windows\system32\wuapp.exe
2015-01-14 11:51:25 ----A---- C:\windows\system32\profsvc.dll
2015-01-14 11:51:07 ----A---- C:\windows\SYSWOW64\nlaapi.dll
2015-01-14 11:51:07 ----A---- C:\windows\system32\nlasvc.dll
2015-01-14 11:51:07 ----A---- C:\windows\system32\nlaapi.dll
2015-01-14 11:51:07 ----A---- C:\windows\system32\ncsi.dll
2015-01-14 11:51:06 ----A---- C:\windows\system32\wer.dll
2015-01-14 11:51:05 ----A---- C:\windows\SYSWOW64\wer.dll
2015-01-14 11:51:05 ----A---- C:\windows\SYSWOW64\Faultrep.dll
2015-01-14 11:51:05 ----A---- C:\windows\system32\WerFaultSecure.exe
2015-01-14 11:51:05 ----A---- C:\windows\system32\Faultrep.dll
2015-01-14 11:51:04 ----A---- C:\windows\SYSWOW64\WerFaultSecure.exe
2015-01-14 11:51:04 ----A---- C:\windows\system32\EncDump.dll
2015-01-14 11:51:04 ----A---- C:\windows\system32\audiosrv.dll
2015-01-14 11:51:03 ----A---- C:\windows\system32\TSWbPrxy.exe
2015-01-14 11:51:03 ----A---- C:\windows\system32\drivers\mrxdav.sys
2015-01-14 11:51:02 ----A---- C:\windows\system32\ntoskrnl.exe
2015-01-11 15:35:14 ----HD---- C:\ProgramData\CanonBJ
2015-01-11 15:34:33 ----A---- C:\windows\system32\CNMLMBA.DLL
2015-01-10 20:53:59 ----D---- C:\2-click run

======List of files/folders modified in the last 1 month======

2015-02-09 12:38:00 ----D---- C:\Program Files\trend micro
2015-02-09 12:36:45 ----D---- C:\windows\Prefetch
2015-02-09 12:08:14 ----D---- C:\windows\system32\config
2015-02-09 12:00:00 ----D---- C:\windows\system32\sru
2015-02-09 11:39:57 ----D---- C:\ProgramData\Unity
2015-02-09 10:24:27 ----RD---- C:\windows\System32
2015-02-09 10:24:27 ----D---- C:\windows\Inf
2015-02-09 10:24:27 ----A---- C:\windows\system32\PerfStringBackup.INI
2015-02-09 09:18:53 ----D---- C:\windows\CbsTemp
2015-02-09 09:16:35 ----D---- C:\Users\jakub_000\AppData\Roaming\Dropbox
2015-02-05 22:38:53 ----D---- C:\Users\jakub_000\AppData\Roaming\vlc
2015-02-05 21:37:28 ----D---- C:\Windows
2015-02-05 14:10:05 ----SHD---- C:\System Volume Information
2015-02-05 11:37:29 ----SHD---- C:\windows\Installer
2015-02-05 11:37:28 ----HD---- C:\ProgramData
2015-02-05 11:30:48 ----RD---- C:\Program Files (x86)
2015-02-05 11:30:48 ----RD---- C:\Program Files
2015-02-05 11:30:08 ----D---- C:\windows\system32\drivers\etc
2015-02-05 11:28:45 ----D---- C:\windows\SysWOW64
2015-02-05 11:04:41 ----D---- C:\windows\Tasks
2015-02-05 11:03:32 ----D---- C:\AdwCleaner
2015-02-05 10:29:06 ----D---- C:\windows\Microsoft.NET
2015-02-05 09:11:13 ----D---- C:\windows\system32\Tasks
2015-02-05 09:08:22 ----D---- C:\windows\debug
2015-02-04 17:54:09 ----D---- C:\Program Files (x86)\Common Files
2015-02-04 17:53:54 ----D---- C:\Program Files (x86)\EaseUS
2015-02-02 21:16:10 ----D---- C:\Users\jakub_000\AppData\Roaming\Skype
2015-02-02 21:12:27 ----D---- C:\Program Files (x86)\Steam
2015-02-02 19:29:59 ----D---- C:\windows\system32\catroot2
2015-02-02 14:17:31 ----D---- C:\Users\jakub_000\AppData\Roaming\Adobe
2015-02-02 14:17:31 ----D---- C:\ProgramData\Adobe
2015-02-02 14:17:12 ----D---- C:\Program Files (x86)\Adobe
2015-02-01 19:16:16 ----D---- C:\Users\jakub_000\AppData\Roaming\uTorrent
2015-01-30 00:39:24 ----D---- C:\Users\jakub_000\AppData\Roaming\Mozilla
2015-01-29 09:14:34 ----D---- C:\windows\WinSxS
2015-01-27 17:05:04 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-26 11:36:47 ----D---- C:\Program Files (x86)\Origin
2015-01-25 17:38:57 ----D---- C:\Program Files\Factorio
2015-01-24 21:20:14 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2015-01-19 14:08:25 ----RSD---- C:\windows\assembly
2015-01-17 10:41:39 ----SD---- C:\ProgramData\Microsoft
2015-01-17 10:36:45 ----D---- C:\windows\SoftwareDistribution
2015-01-16 17:55:32 ----D---- C:\windows\system32\MRT
2015-01-16 17:48:41 ----A---- C:\windows\system32\MRT.exe
2015-01-15 09:12:17 ----D---- C:\windows\rescache
2015-01-15 08:38:16 ----D---- C:\windows\system32\en-US
2015-01-15 08:37:59 ----D---- C:\windows\system32\Drivers
2015-01-15 08:37:57 ----D---- C:\windows\system32\DriverStore
2015-01-12 16:08:12 ----D---- C:\windows\AUInstallAgent
2015-01-12 13:42:02 ----D---- C:\ProgramData\Origin
2015-01-11 15:36:54 ----HD---- C:\Program Files\WindowsApps
2015-01-11 15:36:33 ----D---- C:\windows\system32\FxsTmp

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 dtsoftbus01;@oem8.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\windows\System32\drivers\dtsoftbus01.sys [2013-05-01 283200]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\windows\system32\DRIVERS\vwififlt.sys [2012-07-26 64000]
R3 athr;@netathrx.inf,%ATHR.Service.DispName%;Qualcomm Atheros Extensible Wireless LAN device driver; C:\windows\system32\DRIVERS\athrx.sys [2012-06-02 2935808]
R3 BtFilter;BtFilter; C:\windows\system32\DRIVERS\btfilter.sys [2012-02-10 294000]
R3 BthEnum;@tdibth.inf,%BthEnum.DisplayName%;Bluetooth Enumerator Service; C:\windows\System32\drivers\BthEnum.sys [2013-01-09 51712]
R3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Bluetooth Device (Personal Area Network); C:\windows\system32\DRIVERS\bthpan.sys [2012-07-26 119808]
R3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Bluetooth Radio USB Driver; C:\windows\System32\Drivers\BTHUSB.sys [2013-01-09 74752]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2013-11-07 5363200]
R3 RFCOMM;@tdibth.inf,%RFCOMM.DisplayName%;Bluetooth Device (RFCOMM Protocol TDI); C:\windows\System32\drivers\rfcomm.sys [2013-03-01 156672]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\windows\system32\DRIVERS\Rt630x64.sys [2012-06-02 589824]
R3 SNP2UVC;@oem4.inf,%SERVICE_DISPLAY_NAME%;USB2.0 PC Camera (SNP2UVC); C:\windows\system32\DRIVERS\snp2uvc.sys [2012-11-28 1866080]
R3 SynTP;@oem11.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\windows\system32\DRIVERS\SynTP.sys [2013-10-30 549104]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\windows\system32\DRIVERS\vwifimp.sys [2012-07-26 17920]
R3 WinUsb;@wpdmtp.inf,%WinUsb.SvcDesc%;WinUsb; C:\windows\system32\DRIVERS\WinUsb.sys [2012-07-26 57344]
R3 WUDFSensorLP;@locationprovider.inf,%WudfLocationProviderDisplayName%;UMDF Reflector service for LocationProvider; C:\windows\system32\DRIVERS\WUDFRd.sys [2012-07-26 198656]
S3 amdkmdag;amdkmdag; C:\windows\system32\DRIVERS\atikmdag.sys [2012-07-25 11926528]
S3 amdkmdap;amdkmdap; C:\windows\system32\DRIVERS\atikmpag.sys [2012-06-29 360448]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Bluetooth Port Driver; C:\windows\System32\Drivers\BTHport.sys [2013-03-01 1175040]
S3 dg_ssudbus;@oem15.inf,%ssud.Service.DeviceDesc%;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\windows\system32\DRIVERS\ssudbus.sys [2014-01-22 108800]
S3 epmntdrv;epmntdrv; \??\C:\windows\syswow64\epmntdrv.sys [2014-11-18 14944]
S3 EuGdiDrv;EuGdiDrv; \??\C:\windows\syswow64\EuGdiDrv.sys [2014-11-18 10208]
S3 hamachi;LogMeIn Hamachi Virtual Miniport); C:\windows\system32\DRIVERS\Hamdrv.sys [2013-07-03 46136]
S3 MEIx64;@oem5.inf,%HECI_SvcDesc%;Intel(R) Management Engine Interface ; C:\windows\System32\drivers\HECIx64.sys [2010-10-19 56344]
S3 ssudmdm;@oem16.inf,%ssud.Service.Name%;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\windows\system32\DRIVERS\ssudmdm.sys [2014-01-22 206080]
S3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\windows\System32\Drivers\usbvideo.sys [2013-07-05 210560]
S3 WSDPrintDevice;@WSDPrint.Inf,%WSDPrintDevice.SVCDESC%;WSD Print Support; C:\windows\System32\drivers\WSDPrint.sys [2012-07-26 21504]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-19 81088]
R2 AtherosSvc;AtherosSvc; C:\windows\system32\AdminService.exe [2012-02-02 189440]
R2 PnkBstrA;PnkBstrA; C:\windows\syswow64\PnkBstrA.exe [2013-07-26 76888]
R2 Service Mgr PositiveFinds;Service Mgr PositiveFinds; C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe [2015-02-08 577272]
R2 TeamViewer9;TeamViewer 9; C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [2014-04-25 5024576]
R2 Update Mgr PositiveFinds;Update Mgr PositiveFinds; C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe [2015-02-08 384760]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04 267440]
S3 BEService;BattlEye Service; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [2015-02-01 448384]
S3 cphs;Intel(R) Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2013-11-07 279000]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2012-07-06 43616]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2015-01-27 114800]
S3 Origin Client Service;Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2014-12-26 1903472]
S3 OverwolfUpdaterService;Overwolf Updater Service; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe []
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2015-01-19 834752]

-----------------EOF-----------------

Re: Positive add problém přetrvává

Napsal: 09 úno 2015 18:39
od altrok
Zdravim :bye:

:arrow: Dejte mi jeste logy FRST.txt a prilozte i Addition.txt - http://forum.viry.cz/viewtopic.php?f=30&t=133101

Re: Positive add problém přetrvává

Napsal: 10 úno 2015 20:00
od papperwing
Zde zasílám scan z FRST:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-02-2015
Ran by jakub_000 (administrator) on PAPPERPOST on 10-02-2015 19:56:58
Running from C:\Users\jakub_000\Desktop
Loaded Profiles: jakub_000 (Available profiles: jakub_000)
Platform: Windows 8 Pro (X64) OS Language: English (United States)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Atheros Commnucations) C:\Windows\System32\AdminService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
() C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe
() C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe
() C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\8\Plugin.exe
() C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\Plugin.exe
() C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\5\Plugin.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\Plugin.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [EaseUS EPM tray] => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe [2089056 2014-11-18] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\Run: [EaseUS EPM Tray Agent] => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\TrayPopupE\TrayTipAgentE.exe [255072 2014-11-18] ()
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3618648 2014-12-26] (Electronic Arts)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [Google Update] => C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-08-12] (Google Inc.)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [1942720 2015-01-23] (Valve Corporation)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {0a5d8dad-b1c9-11e2-be6f-74de2b4cb138} - "H:\this_war_of_mine_drmfree.exe"
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {cdae1096-7caa-11e4-80ba-74de2b4cb138} - "I:\LaunchU3.exe" -a
Startup: C:\Users\jakub_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\jakub_000\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\jakub_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-164938143-4175652460-2459810496-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = http://g.msn.com/1ewenusDefaultPack/UP97_FRPage
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-164938143-4175652460-2459810496-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Positive Finds -> {30c85a3d-1d96-4589-b63f-91fb7ef45a41} -> C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll ()
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @esn/esnlaunch,version=2.1.7 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-164938143-4175652460-2459810496-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\jakub_000\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKU\S-1-5-21-164938143-4175652460-2459810496-1001: @talk.google.com/O1DPlugin -> C:\Users\jakub_000\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKU\S-1-5-21-164938143-4175652460-2459810496-1001: @tools.google.com/Google Update;version=3 -> C:\Users\jakub_000\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-164938143-4175652460-2459810496-1001: @tools.google.com/Google Update;version=9 -> C:\Users\jakub_000\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-164938143-4175652460-2459810496-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\jakub_000\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Users\jakub_000\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\jakub_000\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF Extension: Positive Finds - C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143\Extensions\{27b7c23c-50cd-4b3c-a6c1-8e45175b2442}.xpi [2015-02-05]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-01-27]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Windows\system32\AdminService.exe [189440 2012-02-02] (Atheros Commnucations)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2015-02-01] ()
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2014-12-26] (Electronic Arts)
R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [76888 2013-07-26] ()
R2 Service Mgr PositiveFinds; C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe [577272 2015-02-10] ()
R2 Update Mgr PositiveFinds; C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe [384760 2015-02-10] ()
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16032 2014-09-22] (Microsoft Corporation)
S3 OverwolfUpdaterService; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283200 2013-05-01] (DT Soft Ltd)
S3 epmntdrv; C:\windows\system32\epmntdrv.sys [18528 2014-11-18] ()
S3 epmntdrv; C:\windows\SysWOW64\epmntdrv.sys [14944 2014-11-18] ()
S3 EuGdiDrv; C:\windows\system32\EuGdiDrv.sys [10848 2014-11-18] ()
S3 EuGdiDrv; C:\windows\SysWOW64\EuGdiDrv.sys [10208 2014-11-18] ()
S3 hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [46136 2013-07-03] (LogMeIn Inc.)
S3 Secdrv; C:\windows\SysWOW64\drivers\SECDRV.SYS [14368 1968-04-08] () [File not signed]
R3 SNP2UVC; C:\Windows\system32\DRIVERS\snp2uvc.sys [1866080 2012-11-28] ()

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 19:56 - 2015-02-10 19:57 - 00011773 _____ () C:\Users\jakub_000\Desktop\FRST.txt
2015-02-10 19:56 - 2015-02-10 19:57 - 00000000 ____D () C:\FRST
2015-02-10 19:55 - 2015-02-10 19:55 - 02132992 _____ (Farbar) C:\Users\jakub_000\Desktop\FRST64.exe
2015-02-09 14:30 - 2015-02-09 14:30 - 00002277 _____ () C:\Users\jakub_000\Downloads\releasekeystore.keystore
2015-02-05 21:37 - 2015-02-05 21:37 - 00000000 _____ () C:\windows\setuperr.log
2015-02-05 21:37 - 2015-02-05 21:37 - 00000000 _____ () C:\windows\setupact.log
2015-02-05 11:44 - 2015-02-09 11:27 - 00000000 ____D () C:\Users\jakub_000\.android
2015-02-05 11:39 - 2015-02-05 11:28 - 00024064 _____ () C:\windows\zoek-delete.exe
2015-02-05 11:30 - 2015-02-05 11:41 - 00007973 _____ () C:\zoek-results.log
2015-02-05 11:28 - 2015-02-05 11:37 - 00000000 ____D () C:\zoek_backup
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Downloads\zoek.exe
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Desktop\zoek.exe
2015-02-05 11:04 - 2015-02-10 19:47 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-05 11:04 - 2015-02-05 11:40 - 00000640 _____ () C:\windows\PFRO.log
2015-02-05 10:47 - 2015-02-05 10:47 - 00000937 _____ () C:\Users\jakub_000\Desktop\JRT.txt
2015-02-05 10:44 - 2015-02-05 10:44 - 02194432 _____ () C:\Users\jakub_000\Downloads\AdwCleaner.exe
2015-02-05 10:43 - 2015-02-05 10:43 - 01388274 _____ (Thisisu) C:\Users\jakub_000\Downloads\JRT.exe
2015-02-05 10:01 - 2015-02-05 10:01 - 01222144 _____ () C:\Users\jakub_000\Desktop\RSITx64.exe
2015-02-05 09:54 - 2015-02-05 09:54 - 00000000 ____D () C:\Users\jakub_000\Desktop\Old Firefox Data
2015-02-04 21:35 - 2015-02-04 21:53 - 170714072 _____ () C:\Users\jakub_000\Downloads\Doctor.Who.2005.S08E11.Dark.Water.720p.WEB-DL.2CH.x265.HEVC-PSA.mkv.part
2015-02-04 20:46 - 2015-02-04 21:05 - 334955953 _____ () C:\Users\jakub_000\Downloads\Doctor.Who.2005.S08E10.In.The.Forest.Of.The.Night.720p.WEB-DL.2CH.x265.HEVC-PSA.mkv.part
2015-02-04 17:54 - 2015-02-10 19:48 - 00000000 ____D () C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
2015-02-04 17:54 - 2015-02-04 17:54 - 00001384 _____ () C:\Users\Public\Desktop\EaseUS Partition Master 10.2.lnk
2015-02-04 17:54 - 2015-02-04 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EaseUS Partition Master 10.2
2015-02-04 17:54 - 2015-02-04 17:54 - 00000000 ____D () C:\Program Files (x86)\Positive Finds
2015-02-04 17:54 - 2014-11-18 14:46 - 03384928 _____ () C:\windows\system32\BootMan.exe
2015-02-04 17:54 - 2014-11-18 14:46 - 02502240 _____ () C:\windows\SysWOW64\BootMan.exe
2015-02-04 17:54 - 2014-11-18 14:46 - 00021088 _____ () C:\windows\SysWOW64\EuEpmGdi.dll
2015-02-04 17:54 - 2014-11-18 14:46 - 00017504 _____ () C:\windows\system32\EuEpmGdi.dll
2015-02-04 17:54 - 2014-11-18 14:39 - 00018528 _____ () C:\windows\system32\epmntdrv.sys
2015-02-04 17:54 - 2014-11-18 14:39 - 00014944 _____ () C:\windows\SysWOW64\epmntdrv.sys
2015-02-04 17:54 - 2014-11-18 14:39 - 00010848 _____ () C:\windows\system32\EuGdiDrv.sys
2015-02-04 17:54 - 2014-11-18 14:39 - 00010208 _____ () C:\windows\SysWOW64\EuGdiDrv.sys
2015-02-04 17:54 - 2014-11-18 14:38 - 00101984 _____ () C:\windows\system32\setupempdrvx64.exe
2015-02-04 17:54 - 2014-11-18 14:38 - 00088160 _____ () C:\windows\SysWOW64\setupempdrv03.exe
2015-02-03 20:34 - 2015-02-03 20:35 - 24743106 _____ () C:\Users\jakub_000\Downloads\vlc-2.1.5-win32.exe
2015-02-03 20:29 - 2015-02-03 20:42 - 220085196 _____ () C:\Users\jakub_000\Downloads\Doctor.Who.2005.S08E09.Flatline.720p.WEB-DL.2CH.x265.HEVC-PSA.mkv.part
2015-02-03 17:40 - 2015-02-03 17:40 - 30603720 _____ (EaseUS ) C:\Users\jakub_000\Downloads\epm.exe
2015-02-02 14:17 - 2015-02-02 14:17 - 00000869 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShoeBox.lnk
2015-02-02 14:17 - 2015-02-02 14:17 - 00000857 _____ () C:\Users\Public\Desktop\ShoeBox.lnk
2015-02-02 14:17 - 2015-02-02 14:17 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\ShoeBox
2015-02-02 14:17 - 2015-02-02 14:17 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-02-02 14:17 - 2015-02-02 14:17 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-02-02 14:17 - 2015-02-02 14:17 - 00000000 ____D () C:\Program Files (x86)\ShoeBox
2015-02-02 14:11 - 2015-02-02 14:14 - 17709352 _____ (Adobe Systems Inc.) C:\Users\jakub_000\Downloads\AdobeAIRInstaller.exe
2015-02-02 14:09 - 2015-02-02 14:10 - 02683059 _____ () C:\Users\jakub_000\Downloads\ShoeBox_3.5.4_public.air
2015-02-01 20:58 - 2015-02-01 21:07 - 00000000 ____D () C:\Users\jakub_000\Documents\DayZ
2015-02-01 18:54 - 2015-02-01 19:24 - 533045877 _____ () C:\Users\jakub_000\Downloads\Friends.S03E09.mHD.BluRay.DD5.1.x264-EPiK.mkv.part
2015-02-01 14:18 - 2015-02-01 14:18 - 00000840 _____ () C:\Users\jakub_000\AppData\Local\recently-used.xbel
2015-01-27 08:11 - 2015-01-27 08:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-26 10:52 - 2015-01-26 10:52 - 00111016 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2015-01-26 10:49 - 2015-01-26 10:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2015-01-26 10:49 - 2015-01-26 10:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-26 10:48 - 2015-01-26 10:51 - 00000000 ____D () C:\Program Files\Java
2015-01-25 17:40 - 2015-01-29 21:20 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Factorio
2015-01-25 17:38 - 2015-01-25 17:38 - 00001880 _____ () C:\Users\Public\Desktop\Factorio.lnk
2015-01-25 17:38 - 2015-01-25 17:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Factorio
2015-01-22 18:44 - 2015-01-22 18:44 - 00001091 _____ () C:\Users\jakub_000\Desktop\ADT-1 - Shortcut.lnk
2015-01-22 16:30 - 2015-02-01 14:18 - 00022717 _____ () C:\Users\jakub_000\Documents\Výkaz za leden.ods
2015-01-22 16:16 - 2015-01-22 16:16 - 01321595 _____ () C:\Users\jakub_000\Downloads\Harmonogram_Bukovjan_Jiri.xlsx
2015-01-21 19:26 - 2015-01-21 19:26 - 00001019 _____ () C:\Users\Public\Desktop\PlayDance.lnk
2015-01-21 19:26 - 2015-01-21 19:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayDance
2015-01-21 19:25 - 2015-01-21 19:26 - 00000000 ____D () C:\Program Files (x86)\PlayDance
2015-01-21 18:45 - 2015-01-21 18:45 - 00001141 _____ () C:\Users\jakub_000\Desktop\StepMania 3.9.lnk
2015-01-21 18:45 - 2015-01-21 18:45 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StepMania
2015-01-21 18:45 - 2015-01-21 18:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StepMania
2015-01-21 18:35 - 2015-01-21 19:31 - 00000000 ____D () C:\Program Files (x86)\StepMania
2015-01-20 19:36 - 2015-01-20 19:36 - 00000222 _____ () C:\Users\jakub_000\Desktop\Insurgency.url
2015-01-19 14:09 - 2015-01-19 14:09 - 00466520 _____ (Creative Labs) C:\windows\system32\wrap_oal.dll
2015-01-19 14:09 - 2015-01-19 14:09 - 00445016 _____ (Creative Labs) C:\windows\SysWOW64\wrap_oal.dll
2015-01-19 14:09 - 2015-01-19 14:09 - 00123480 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\windows\system32\OpenAL32.dll
2015-01-19 14:09 - 2015-01-19 14:09 - 00109144 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\windows\SysWOW64\OpenAL32.dll
2015-01-19 14:09 - 2015-01-19 14:09 - 00000000 ____D () C:\Program Files (x86)\OpenAL
2015-01-19 13:55 - 2015-01-19 13:55 - 00000221 _____ () C:\Users\jakub_000\Desktop\Arma Cold War Assault.url
2015-01-19 12:46 - 2015-01-19 12:47 - 15486288 _____ (SIX Networks) C:\Users\jakub_000\Desktop\withSIX-Play.exe
2015-01-18 18:18 - 2015-01-18 18:18 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\six-zsync
2015-01-18 18:18 - 2015-01-18 18:18 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\six-updater
2015-01-18 17:54 - 2015-01-18 17:54 - 00000000 ____D () C:\Program Files (x86)\SIX Projects
2015-01-17 10:42 - 2015-01-17 11:48 - 00000000 ____D () C:\Users\jakub_000\Documents\Arma 3
2015-01-17 10:39 - 2013-08-14 13:41 - 00028776 _____ (Microsoft Corporation) C:\windows\SysWOW64\aspnet_counters.dll
2015-01-17 10:38 - 2013-08-14 13:40 - 00030312 _____ (Microsoft Corporation) C:\windows\system32\aspnet_counters.dll
2015-01-14 11:54 - 2014-11-27 03:40 - 00600576 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-01-14 11:54 - 2014-11-27 02:28 - 00523264 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-01-14 11:53 - 2014-11-15 07:06 - 00059392 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-01-14 11:53 - 2014-11-15 06:13 - 03286016 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-01-14 11:53 - 2014-11-15 06:13 - 01623552 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-01-14 11:53 - 2014-11-15 06:13 - 00775168 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-01-14 11:53 - 2014-11-15 06:13 - 00253440 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2015-01-14 11:53 - 2014-11-15 04:53 - 00630272 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-01-14 11:53 - 2014-11-05 07:40 - 00733184 _____ (Microsoft Corporation) C:\windows\system32\win32spl.dll
2015-01-14 11:53 - 2014-11-05 07:39 - 01024512 _____ (Microsoft Corporation) C:\windows\system32\localspl.dll
2015-01-14 11:53 - 2014-11-01 07:28 - 00417280 _____ (Microsoft Corporation) C:\windows\system32\services.exe
2015-01-14 11:53 - 2014-10-29 15:21 - 00499008 _____ (Microsoft Corporation) C:\windows\system32\Drivers\vhdmp.sys
2015-01-14 11:53 - 2014-10-27 23:10 - 00390841 _____ () C:\windows\system32\ApnDatabase.xml
2015-01-14 11:52 - 2014-11-15 06:13 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-01-14 11:52 - 2014-11-15 06:13 - 00100352 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-01-14 11:52 - 2014-11-15 06:13 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-01-14 11:52 - 2014-11-15 06:12 - 00176640 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2015-01-14 11:52 - 2014-11-15 04:54 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-01-14 11:52 - 2014-11-15 04:53 - 00128000 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-01-14 11:52 - 2014-11-15 04:53 - 00086528 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-01-14 11:51 - 2014-12-19 07:48 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-14 11:51 - 2014-12-19 05:35 - 00142336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-14 11:51 - 2014-12-11 08:35 - 06973248 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-14 11:51 - 2014-12-11 07:51 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-14 11:51 - 2014-12-06 08:53 - 00458240 _____ (Microsoft Corporation) C:\windows\system32\wer.dll
2015-01-14 11:51 - 2014-12-06 08:53 - 00026112 _____ (Microsoft Corporation) C:\windows\system32\WerFaultSecure.exe
2015-01-14 11:51 - 2014-12-06 08:52 - 00384000 _____ (Microsoft Corporation) C:\windows\system32\ncsi.dll
2015-01-14 11:51 - 2014-12-06 08:52 - 00357376 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-14 11:51 - 2014-12-06 08:52 - 00072192 _____ (Microsoft Corporation) C:\windows\system32\nlaapi.dll
2015-01-14 11:51 - 2014-12-06 08:51 - 00370688 _____ (Microsoft Corporation) C:\windows\system32\Faultrep.dll
2015-01-14 11:51 - 2014-12-06 08:51 - 00267264 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2015-01-14 11:51 - 2014-12-06 08:50 - 00783872 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2015-01-14 11:51 - 2014-12-06 07:10 - 00355840 _____ (Microsoft Corporation) C:\windows\SysWOW64\wer.dll
2015-01-14 11:51 - 2014-12-06 07:10 - 00023552 _____ (Microsoft Corporation) C:\windows\SysWOW64\WerFaultSecure.exe
2015-01-14 11:51 - 2014-12-06 07:09 - 00332800 _____ (Microsoft Corporation) C:\windows\SysWOW64\Faultrep.dll
2015-01-14 11:51 - 2014-12-06 07:09 - 00055296 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-11 15:35 - 2015-01-11 15:35 - 00000000 ___HD () C:\ProgramData\CanonBJ
2015-01-11 15:34 - 2012-04-16 05:00 - 00389120 _____ (CANON INC.) C:\windows\system32\CNMLMBA.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-10 19:57 - 2013-04-20 09:49 - 00003596 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-164938143-4175652460-2459810496-1001
2015-02-09 16:03 - 2013-06-02 17:38 - 01113777 _____ () C:\windows\WindowsUpdate.log
2015-02-09 16:03 - 2012-07-26 06:26 - 00786432 ___SH () C:\windows\system32\config\BBI
2015-02-09 16:01 - 2014-12-17 09:52 - 00000000 ____D () C:\Users\jakub_000\Documents\New Unity Project
2015-02-09 15:02 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\system32\sru
2015-02-09 14:26 - 2013-04-21 23:03 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\vlc
2015-02-09 12:38 - 2013-06-02 12:04 - 00000000 ____D () C:\Program Files\trend micro
2015-02-09 11:39 - 2014-10-02 09:59 - 00000000 ____D () C:\ProgramData\Unity
2015-02-09 10:24 - 2012-07-26 08:28 - 00848230 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-09 09:18 - 2012-07-26 08:59 - 00000000 ____D () C:\windows\CbsTemp
2015-02-09 09:16 - 2014-10-21 10:24 - 00000000 ___RD () C:\Users\jakub_000\Dropbox
2015-02-09 09:16 - 2014-10-21 10:20 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Dropbox
2015-02-05 11:44 - 2013-04-20 09:39 - 00000000 ____D () C:\Users\jakub_000
2015-02-05 11:38 - 2013-05-17 21:57 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Google
2015-02-05 11:18 - 2014-12-19 13:41 - 00097792 ___SH () C:\Users\jakub_000\Documents\Thumbs.db
2015-02-05 11:03 - 2014-07-20 16:53 - 00000000 ____D () C:\AdwCleaner
2015-02-04 20:36 - 2013-04-21 00:09 - 00003718 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-02-04 17:53 - 2014-07-18 11:30 - 00000000 ____D () C:\Program Files (x86)\EaseUS
2015-02-04 09:39 - 2013-08-12 19:52 - 00003954 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-164938143-4175652460-2459810496-1001UA
2015-02-04 09:39 - 2013-08-12 19:52 - 00003574 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-164938143-4175652460-2459810496-1001Core
2015-02-03 20:39 - 2013-06-04 21:26 - 00001066 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2015-02-03 20:39 - 2013-06-04 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-02-03 20:29 - 2014-10-18 19:24 - 00714184 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-03 20:29 - 2014-10-18 19:24 - 00106440 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-02 21:16 - 2013-04-20 09:45 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Skype
2015-02-02 21:12 - 2013-08-27 20:54 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-02-02 14:17 - 2014-11-25 11:43 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-02-02 14:17 - 2014-10-23 08:29 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Adobe
2015-02-02 14:17 - 2013-04-21 00:07 - 00000000 ____D () C:\ProgramData\Adobe
2015-02-02 14:17 - 2013-04-20 09:41 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Adobe
2015-02-01 21:02 - 2013-12-17 09:58 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\DayZ
2015-02-01 19:16 - 2013-04-27 00:31 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\uTorrent
2015-02-01 17:55 - 2013-12-16 22:59 - 00000222 _____ () C:\Users\jakub_000\Desktop\DayZ.url
2015-02-01 14:19 - 2014-12-24 14:33 - 00000000 ____D () C:\Users\jakub_000\.gimp-2.8
2015-01-30 00:39 - 2013-04-21 00:04 - 00000000 ____D () C:\Users\jakub_000\AppData\Roaming\Mozilla
2015-01-29 08:50 - 2014-10-03 12:00 - 00000000 ____D () C:\Users\jakub_000\Documents\Já
2015-01-29 08:50 - 2014-09-23 22:26 - 00564736 ___SH () C:\Users\jakub_000\Downloads\Thumbs.db
2015-01-27 17:05 - 2013-05-24 11:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-26 18:36 - 2013-10-10 21:08 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Arma 3
2015-01-26 11:36 - 2013-05-08 09:30 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-01-25 17:38 - 2013-08-06 14:32 - 00000000 ____D () C:\Program Files\Factorio
2015-01-20 19:05 - 2013-12-17 10:14 - 00212480 ___SH () C:\Users\jakub_000\Desktop\Thumbs.db
2015-01-19 22:52 - 2014-10-03 11:59 - 00000000 ____D () C:\Users\jakub_000\Documents\Škola
2015-01-19 12:49 - 2013-06-23 13:45 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Downloaded Installations
2015-01-18 17:54 - 2013-06-23 13:45 - 00002573 _____ () C:\Users\Public\Desktop\Six Updater.lnk
2015-01-18 17:54 - 2013-06-23 13:45 - 00002573 _____ () C:\Users\Public\Desktop\Six Launcher.lnk
2015-01-16 17:55 - 2013-08-14 11:24 - 00000000 ____D () C:\windows\system32\MRT
2015-01-16 17:48 - 2013-04-21 12:53 - 113365784 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-01-15 09:12 - 2013-12-13 21:23 - 00000000 ____D () C:\windows\rescache
2015-01-12 23:29 - 2015-01-10 20:54 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Game Dev Tycoon - Steam
2015-01-12 16:08 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\AUInstallAgent
2015-01-12 13:42 - 2013-05-08 09:30 - 00000000 ____D () C:\ProgramData\Origin
2015-01-11 15:37 - 2013-04-20 09:40 - 00000000 ____D () C:\Users\jakub_000\AppData\Local\Packages
2015-01-11 15:36 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\system32\FxsTmp

==================== Files in the root of some directories =======

2014-11-10 21:05 - 2014-12-26 22:07 - 0000600 _____ () C:\Users\jakub_000\AppData\Local\PUTTY.RND
2015-02-01 14:18 - 2015-02-01 14:18 - 0000840 _____ () C:\Users\jakub_000\AppData\Local\recently-used.xbel

Some content of TEMP:
====================
C:\Users\jakub_000\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppigusp.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-04 09:43

==================== End Of Log ============================

přikládám addition.txt

Re: Positive add problém přetrvává

Napsal: 10 úno 2015 20:55
od altrok
:arrow: Odinstalujte Skype Click to Call a starou verzi Javy Java 7 Update 21 - ponechte jen tu aktualni (Java 8U31)

  • Do Poznamkoveho bloku (Start -> spustit -> notepad) zkopirujte obsah bileho pole
  • ulozte na plochu jako fixlist (Typ souboru: Textovy dokument)
  • znovu spustte FRST a kliknete na Fix
  • po restartu na Vas vyskoci fixlog (pripadne bude ulozen na Plose), jehoz obsah mi vlozte do pristi odpovedi

    Kód: Vybrat vše

    Start
CloseProcesses:
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [Google Update] => C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-08-12] (Google Inc.)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {0a5d8dad-b1c9-11e2-be6f-74de2b4cb138} - "H:\this_war_of_mine_drmfree.exe"
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {cdae1096-7caa-11e4-80ba-74de2b4cb138} - "I:\LaunchU3.exe" -a

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Positive Finds -> {30c85a3d-1d96-4589-b63f-91fb7ef45a41} -> C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll ()
FF Extension: Positive Finds - C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143\Extensions\{27b7c23c-50cd-4b3c-a6c1-8e45175b2442}.xpi [2015-02-05]

R2 Service Mgr PositiveFinds; C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe [577272 2015-02-10] ()
R2 Update Mgr PositiveFinds; C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe [384760 2015-02-10] ()
C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602

2015-02-10 19:56 - 2015-02-10 19:57 - 00011773 _____ () C:\Users\jakub_000\Desktop\FRST.txt
2015-02-05 11:39 - 2015-02-05 11:28 - 00024064 _____ () C:\windows\zoek-delete.exe
2015-02-05 11:30 - 2015-02-05 11:41 - 00007973 _____ () C:\zoek-results.log
2015-02-05 11:28 - 2015-02-05 11:37 - 00000000 ____D () C:\zoek_backup
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Downloads\zoek.exe
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Desktop\zoek.exe
2015-02-05 10:47 - 2015-02-05 10:47 - 00000937 _____ () C:\Users\jakub_000\Desktop\JRT.txt
2015-02-05 10:44 - 2015-02-05 10:44 - 02194432 _____ () C:\Users\jakub_000\Downloads\AdwCleaner.exe
2015-02-05 10:43 - 2015-02-05 10:43 - 01388274 _____ (Thisisu) C:\Users\jakub_000\Downloads\JRT.exe
2015-02-05 10:01 - 2015-02-05 10:01 - 01222144 _____ () C:\Users\jakub_000\Desktop\RSITx64.exe
2015-02-04 17:54 - 2015-02-10 19:48 - 00000000 ____D () C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
2015-02-04 17:54 - 2015-02-04 17:54 - 00000000 ____D () C:\Program Files (x86)\Positive Finds
2015-02-05 11:03 - 2014-07-20 16:53 - 00000000 ____D () C:\AdwCleaner

Task: {04D80486-4E01-4E69-BBB0-47CD6652E183} - System32\Tasks\{02ABBAF8-1A38-4A9A-8227-317BF9DFE300} => pcalua.exe -a "C:\Users\jakub_000\Downloads\[PC] Mafia  [ENG]-[RIP] [dopeman]\Mafia\Game.exe" -d "C:\Users\jakub_000\Downloads\[PC] Mafia  [ENG]-[RIP] [dopeman]\Mafia"
Task: {191AB24B-EF31-4DCD-B6FC-8BE9902F0897} - System32\Tasks\{59A35D4D-D0BB-479F-94E9-5962E7029025} => pcalua.exe -a H:\MafiaSetup.exe -d H:\
Task: {4C2CF6B3-52E4-47C9-AED3-A64F8D9D4053} - System32\Tasks\{911DDACA-D000-4568-A8BD-0A99202F5C37} => pcalua.exe -a F:\Powerdrome.exe -d F:\
Task: {7C3AF094-0295-4EFB-BF02-5F5A5E8E8586} - System32\Tasks\{0E77C26D-9871-4077-B385-28303FCB630C} => pcalua.exe -a "C:\Users\jakub_000\Downloads\Age-of-Empires-II---PLNÁ-HRA!!-+-čeština\Age of Empires II - Conquerors\SETUPREG.EXE" -d "C:\Users\jakub_000\Downloads\Age-of-Empires-II---PLNÁ-HRA!!-+-čeština\Age of Empires II - Conquerors"
Task: {E027EFE1-91D8-4F24-A4B1-72D68D6814FE} - System32\Tasks\{AAF4BBEF-2237-4E08-8CD4-21FB80651298} => pcalua.exe -a H:\Detinst.exe -d H:\
Task: {F3C88C6F-E049-478E-9CCD-0F37494CA257} - System32\Tasks\{27DC3E27-6A9B-43FC-8717-845FAB0095A4} => pcalua.exe -a C:\Users\jakub_000\Downloads\Mortal-Kombat-4-(for-PC)\Setup.exe -d C:\Users\jakub_000\Downloads\Mortal-Kombat-4-(for-PC)
EmptyTemp:
End

Re: Positive add problém přetrvává

Napsal: 10 úno 2015 21:12
od papperwing
Ta odinstalace se provede těmi kroky s FRST nebo ten skype mám odinstalovat přes ovládací panely?

Re: Positive add problém přetrvává

Napsal: 10 úno 2015 21:18
od altrok
Pres ovladaci panely. Fixlist smaze positive find a podobnou havet, takze pak testujte vyskakovani reklam a podobne nestandardni chovani.

Re: Positive add problém přetrvává

Napsal: 10 úno 2015 22:33
od papperwing
zde je log:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-02-2015
Ran by jakub_000 at 2015-02-10 22:29:32 Run:1
Running from C:\Users\jakub_000\Desktop
Loaded Profiles: jakub_000 (Available profiles: jakub_000)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3672640 2013-03-14] (Disc Soft Ltd)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\Run: [Google Update] => C:\Users\jakub_000\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-08-12] (Google Inc.)
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {0a5d8dad-b1c9-11e2-be6f-74de2b4cb138} - "H:\this_war_of_mine_drmfree.exe"
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\...\MountPoints2: {cdae1096-7caa-11e4-80ba-74de2b4cb138} - "I:\LaunchU3.exe" -a

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Positive Finds -> {30c85a3d-1d96-4589-b63f-91fb7ef45a41} -> C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll ()
FF Extension: Positive Finds - C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143\Extensions\{27b7c23c-50cd-4b3c-a6c1-8e45175b2442}.xpi [2015-02-05]

R2 Service Mgr PositiveFinds; C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe [577272 2015-02-10] ()
R2 Update Mgr PositiveFinds; C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe [384760 2015-02-10] ()
C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602

2015-02-10 19:56 - 2015-02-10 19:57 - 00011773 _____ () C:\Users\jakub_000\Desktop\FRST.txt
2015-02-05 11:39 - 2015-02-05 11:28 - 00024064 _____ () C:\windows\zoek-delete.exe
2015-02-05 11:30 - 2015-02-05 11:41 - 00007973 _____ () C:\zoek-results.log
2015-02-05 11:28 - 2015-02-05 11:37 - 00000000 ____D () C:\zoek_backup
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Downloads\zoek.exe
2015-02-05 11:28 - 2015-02-05 11:28 - 01295360 _____ () C:\Users\jakub_000\Desktop\zoek.exe
2015-02-05 10:47 - 2015-02-05 10:47 - 00000937 _____ () C:\Users\jakub_000\Desktop\JRT.txt
2015-02-05 10:44 - 2015-02-05 10:44 - 02194432 _____ () C:\Users\jakub_000\Downloads\AdwCleaner.exe
2015-02-05 10:43 - 2015-02-05 10:43 - 01388274 _____ (Thisisu) C:\Users\jakub_000\Downloads\JRT.exe
2015-02-05 10:01 - 2015-02-05 10:01 - 01222144 _____ () C:\Users\jakub_000\Desktop\RSITx64.exe
2015-02-04 17:54 - 2015-02-10 19:48 - 00000000 ____D () C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
2015-02-04 17:54 - 2015-02-04 17:54 - 00000000 ____D () C:\Program Files (x86)\Positive Finds
2015-02-05 11:03 - 2014-07-20 16:53 - 00000000 ____D () C:\AdwCleaner

Task: {04D80486-4E01-4E69-BBB0-47CD6652E183} - System32\Tasks\{02ABBAF8-1A38-4A9A-8227-317BF9DFE300} => pcalua.exe -a "C:\Users\jakub_000\Downloads\[PC] Mafia [ENG]-[RIP] [dopeman]\Mafia\Game.exe" -d "C:\Users\jakub_000\Downloads\[PC] Mafia [ENG]-[RIP] [dopeman]\Mafia"
Task: {191AB24B-EF31-4DCD-B6FC-8BE9902F0897} - System32\Tasks\{59A35D4D-D0BB-479F-94E9-5962E7029025} => pcalua.exe -a H:\MafiaSetup.exe -d H:\
Task: {4C2CF6B3-52E4-47C9-AED3-A64F8D9D4053} - System32\Tasks\{911DDACA-D000-4568-A8BD-0A99202F5C37} => pcalua.exe -a F:\Powerdrome.exe -d F:\
Task: {7C3AF094-0295-4EFB-BF02-5F5A5E8E8586} - System32\Tasks\{0E77C26D-9871-4077-B385-28303FCB630C} => pcalua.exe -a "C:\Users\jakub_000\Downloads\Age-of-Empires-II---PLNÁ-HRA!!-+-čeština\Age of Empires II - Conquerors\SETUPREG.EXE" -d "C:\Users\jakub_000\Downloads\Age-of-Empires-II---PLNÁ-HRA!!-+-čeština\Age of Empires II - Conquerors"
Task: {E027EFE1-91D8-4F24-A4B1-72D68D6814FE} - System32\Tasks\{AAF4BBEF-2237-4E08-8CD4-21FB80651298} => pcalua.exe -a H:\Detinst.exe -d H:\
Task: {F3C88C6F-E049-478E-9CCD-0F37494CA257} - System32\Tasks\{27DC3E27-6A9B-43FC-8717-845FAB0095A4} => pcalua.exe -a C:\Users\jakub_000\Downloads\Mortal-Kombat-4-(for-PC)\Setup.exe -d C:\Users\jakub_000\Downloads\Mortal-Kombat-4-(for-PC)
EmptyTemp:
End
*****************

Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value not found.
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => value deleted successfully.
HKU\S-1-5-21-164938143-4175652460-2459810496-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Google Update => value deleted successfully.
"HKU\S-1-5-21-164938143-4175652460-2459810496-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0a5d8dad-b1c9-11e2-be6f-74de2b4cb138}" => Key deleted successfully.
HKCR\CLSID\{0a5d8dad-b1c9-11e2-be6f-74de2b4cb138} => Key not found.
"HKU\S-1-5-21-164938143-4175652460-2459810496-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cdae1096-7caa-11e4-80ba-74de2b4cb138}" => Key deleted successfully.
HKCR\CLSID\{cdae1096-7caa-11e4-80ba-74de2b4cb138} => Key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30c85a3d-1d96-4589-b63f-91fb7ef45a41}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{30c85a3d-1d96-4589-b63f-91fb7ef45a41}" => Key deleted successfully.
C:\Users\jakub_000\AppData\Roaming\Mozilla\Firefox\Profiles\0zrrz33f.default-1423126443143\Extensions\{27b7c23c-50cd-4b3c-a6c1-8e45175b2442}.xpi not found.
Service Mgr PositiveFinds => Service stopped successfully.
Service Mgr PositiveFinds => Service deleted successfully.
Update Mgr PositiveFinds => Service deleted successfully.
C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602 => Moved successfully.
C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602 => Moved successfully.
C:\Users\jakub_000\Desktop\FRST.txt => Moved successfully.
C:\windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\jakub_000\Downloads\zoek.exe => Moved successfully.
C:\Users\jakub_000\Desktop\zoek.exe => Moved successfully.
C:\Users\jakub_000\Desktop\JRT.txt => Moved successfully.
C:\Users\jakub_000\Downloads\AdwCleaner.exe => Moved successfully.
C:\Users\jakub_000\Downloads\JRT.exe => Moved successfully.
C:\Users\jakub_000\Desktop\RSITx64.exe => Moved successfully.
"C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602" => File/Directory not found.
C:\Program Files (x86)\Positive Finds => Moved successfully.
C:\AdwCleaner => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{04D80486-4E01-4E69-BBB0-47CD6652E183}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04D80486-4E01-4E69-BBB0-47CD6652E183}" => Key deleted successfully.
C:\Windows\System32\Tasks\{02ABBAF8-1A38-4A9A-8227-317BF9DFE300} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{02ABBAF8-1A38-4A9A-8227-317BF9DFE300}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{191AB24B-EF31-4DCD-B6FC-8BE9902F0897}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{191AB24B-EF31-4DCD-B6FC-8BE9902F0897}" => Key deleted successfully.
C:\Windows\System32\Tasks\{59A35D4D-D0BB-479F-94E9-5962E7029025} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{59A35D4D-D0BB-479F-94E9-5962E7029025}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4C2CF6B3-52E4-47C9-AED3-A64F8D9D4053}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4C2CF6B3-52E4-47C9-AED3-A64F8D9D4053}" => Key deleted successfully.
C:\Windows\System32\Tasks\{911DDACA-D000-4568-A8BD-0A99202F5C37} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{911DDACA-D000-4568-A8BD-0A99202F5C37}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7C3AF094-0295-4EFB-BF02-5F5A5E8E8586}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7C3AF094-0295-4EFB-BF02-5F5A5E8E8586}" => Key deleted successfully.
C:\Windows\System32\Tasks\{0E77C26D-9871-4077-B385-28303FCB630C} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0E77C26D-9871-4077-B385-28303FCB630C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E027EFE1-91D8-4F24-A4B1-72D68D6814FE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E027EFE1-91D8-4F24-A4B1-72D68D6814FE}" => Key deleted successfully.
C:\Windows\System32\Tasks\{AAF4BBEF-2237-4E08-8CD4-21FB80651298} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{AAF4BBEF-2237-4E08-8CD4-21FB80651298}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3C88C6F-E049-478E-9CCD-0F37494CA257}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3C88C6F-E049-478E-9CCD-0F37494CA257}" => Key deleted successfully.
C:\Windows\System32\Tasks\{27DC3E27-6A9B-43FC-8717-845FAB0095A4} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{27DC3E27-6A9B-43FC-8717-845FAB0095A4}" => Key deleted successfully.
EmptyTemp: => Removed 577.2 MB temporary data.


The system needed a reboot.

==== End of Fixlog 22:30:56 ====

Re: Positive add problém přetrvává

Napsal: 10 úno 2015 22:40
od altrok
OK, pozorujte chovani PC, vyskakovani reklam apod.

Pripadne uz jen uklidime.

Re: Positive add problém přetrvává

Napsal: 11 úno 2015 09:14
od papperwing
Zatím to vypadá dobře. Reklamy nevyskakují a v mozile už mi mezi addonama nevyskakuje.

Děkuji moc za pomoc.

Re: Positive add problém přetrvává

Napsal: 11 úno 2015 10:06
od altrok
Takze jeste uklidime.
A pokud nejsou dotazy ci jine problemy, je to ode mne vse.

Re: Positive add problém přetrvává

Napsal: 11 úno 2015 13:01
od papperwing
Děkuji moc, zde zasílám ještě log:
# DelFix v10.8 - Logfile created 11/02/2015 at 13:01:02
# Updated 29/07/2014 by Xplode
# Username : jakub_000 - PAPPERPOST
# Operating System : Windows 8 Pro (64 bits)

~ Removing disinfection tools ...

Deleted : C:\_OTM
Deleted : C:\RSIT
Deleted : C:\FRST
Deleted : C:\AdwCleaner[R1].txt
Deleted : C:\AdwCleaner[S1].txt
Deleted : C:\Users\jakub_000\Desktop\Addition.txt
Deleted : C:\Users\jakub_000\Desktop\adwcleaner_3.310.exe
Deleted : C:\Users\jakub_000\Desktop\Fixlog.txt
Deleted : C:\Users\jakub_000\Desktop\FRST64.exe
Deleted : C:\Users\jakub_000\Desktop\OTM.exe
Deleted : HKLM\SOFTWARE\OldTimer Tools
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis

########## - EOF - ##########

Re: Positive add problém přetrvává

Napsal: 11 úno 2015 19:47
od altrok
Tento soubor ( C:\delfix.txt ) muzete rucne smazat stejne jako pripadne zbytky po utilitach.

Nemate zac, rad jsem pomohl :worship:


Mejte se krasne a treba zase nekdy :bye:
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz