VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Data na flesce se prepisuji na .lnk

https://forum.viry.cz:443/viewtopic.php?t=143363

Stránka 1 z 2

Data na flesce se prepisuji na .lnk

Napsal: 04 bře 2015 22:02
od parmen20
Dobrý večer,
prosil bych o pomoc s jistým virem, který mi přepisuje data na flesce na .lnk. Problém začal dnes ráno, kdy jsme od kolegy dostal flesku, abych mu nakopiroval data. Poté jsme počítač proskenoval spyboot search and destroy, a po restartu jsem pak doma připojil další flesky a také externí disk, a ejhle žádná data se nepřepsala. Problém ovšem se znovu objevil večer kdy jsem připojil již testovanou flesku a nakopiroval soubory a už byli pouze .lnk. Když jsme si dal zobrazit skryté soubory, tak tma všechna data nalezena byla dokonce šla zkopírovat i upravovat, po opětovném připojení flesky byl problém stále stejný. Nepomohla ani formatovaní flesky z čehož usuzuji ze vir je v PC a pouze se spouští na flesce, protože data v počítači jsou v pořádku, na flesce se vždy objeví skrytý soubor adobe illustrator CC 17.0.0 multilanguage.vbs.
Prosil bych o nějakou pomoc jelikož mi jde o to, že externí disk používá i přítelkyně a máme tam dost důležitá data, o která bychom neradi přišli formatováním disku. Počítač bez problému přeinstaluji, ale to je jako krajní možnost. Ještě dodávám, že disk u přítelkyně funguje bez problému i potom co jsem ho měl připojený k mému nejspíš infikovanému PC. Dále jsem objevil že se mi po spuštění spouští wscript, který obsahuje již zmíněný adobe... a to i po zakázání spouštění, ovšem nemůžu jej odstranit.
Prosil bych tedy o pomoc s vyřešením tohoto problému. Log z FRST :

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by Lukas (administrator) on LUKAS-PC on 04-03-2015 22:18:05
Running from C:\WWW
Loaded Profiles: Lukas & UpdatusUser (Available profiles: Lukas & UpdatusUser)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Adobe Illustrator CC 17] => wscript.exe //B "C:\Users\Lukas\AppData\Local\Temp\Adobe Illustrator CC 17.0.0 Final Multilanguage.vbs" <===== ATTENTION
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707496 2014-08-15] (Cisco Systems, Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2384031562-724006598-4028863014-1000\...\Run: [EPSON SX125 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGGE.EXE [224768 2009-09-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2384031562-724006598-4028863014-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-2384031562-724006598-4028863014-1000\...\Run: [Adobe Illustrator CC 17] => wscript.exe //B "C:\Users\Lukas\AppData\Local\Temp\Adobe Illustrator CC 17.0.0 Final Multilanguage.vbs" <===== ATTENTION
Startup: C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Illustrator CC 17.0.0 Final Multilanguage.vbs ()
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-2384031562-724006598-4028863014-1000] => localhost:21320
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.seznam.cz/
CHR StartupUrls: Default -> "hxxp://www.seznam.cz/"
CHR Profile: C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-12]
CHR Extension: (Google Drive) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-12]
CHR Extension: (YouTube) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-12]
CHR Extension: (Google Search) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-12]
CHR Extension: (Google Wallet) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-12]
CHR Extension: (Gmail) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-12]
CHR Extension: (AVG PrivacyFix) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmejhjjecaldkllonlokhkglbdbkdcni [2015-02-25]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Corporate.11.0; C:\Program Files (x86)\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe [821840 2012-07-19] (ABBYY)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-08-12] (Disc Soft Ltd)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [9088 2007-07-11] (Hewlett-Packard Development Company, L.P.)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52592 2014-08-15] (Cisco Systems, Inc.)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-04 22:17 - 2015-03-04 22:18 - 00000000 ____D () C:\FRST
2015-03-04 21:42 - 2015-03-04 21:43 - 00000000 ____D () C:\rsit
2015-03-04 21:42 - 2015-03-04 21:43 - 00000000 ____D () C:\Program Files\trend micro
2015-03-04 19:28 - 2015-03-04 19:28 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-04 19:28 - 2015-03-04 19:28 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-03-04 19:28 - 2015-03-04 19:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-03-04 19:28 - 2015-03-04 19:28 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-04 19:28 - 2015-03-04 19:28 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-03-04 19:28 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-04 19:28 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-04 19:28 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-04 11:53 - 2015-03-04 11:52 - 00450771 ____R () C:\Windows\system32\Drivers\etc\hosts.20150304-115344.backup
2015-03-04 11:52 - 2015-03-04 11:50 - 00450771 ____R () C:\Windows\system32\Drivers\etc\hosts.20150304-115249.backup
2015-03-04 11:50 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20150304-115040.backup
2015-03-04 09:59 - 2015-03-04 09:59 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-03-04 09:57 - 2015-03-04 12:06 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-03-04 09:57 - 2015-03-04 10:01 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-03-04 09:57 - 2015-03-04 09:57 - 00001391 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-03-04 09:57 - 2015-03-04 09:57 - 00001379 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-03-04 09:57 - 2015-03-04 09:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-03-04 09:57 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-03-04 09:39 - 2015-03-04 09:39 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2015-02-28 14:00 - 2015-02-28 14:00 - 00001317 _____ () C:\Users\Public\Desktop\Ashampoo Burning Studio 6 FREE.lnk
2015-02-28 14:00 - 2015-02-28 14:00 - 00000000 ____D () C:\Users\Lukas\AppData\Roaming\Ashampoo
2015-02-28 14:00 - 2015-02-28 14:00 - 00000000 ____D () C:\Users\Lukas\AppData\Local\ashampoo
2015-02-28 14:00 - 2015-02-28 14:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2015-02-28 14:00 - 2015-02-28 14:00 - 00000000 ____D () C:\ProgramData\Ashampoo
2015-02-28 14:00 - 2015-02-28 14:00 - 00000000 ____D () C:\Program Files (x86)\Ashampoo
2015-02-28 13:54 - 2015-02-28 13:56 - 00000221 _____ () C:\Windows\ultimatecd.ini
2015-02-25 14:52 - 2015-02-25 14:52 - 00002617 _____ () C:\Users\Lukas\AppData\Local\recently-used.xbel
2015-02-25 14:37 - 2015-02-25 14:52 - 00000000 ____D () C:\Users\Lukas\AppData\Local\gtk-2.0
2015-02-25 14:37 - 2015-02-25 14:37 - 00000000 ____D () C:\Users\Lukas\.thumbnails
2015-02-25 14:34 - 2015-02-25 14:54 - 00000000 ____D () C:\Users\Lukas\.gimp-2.8
2015-02-25 14:34 - 2015-02-25 14:34 - 00000894 _____ () C:\Users\Lukas\Desktop\GIMP 2.lnk
2015-02-25 14:34 - 2015-02-25 14:34 - 00000000 ____D () C:\Users\Lukas\AppData\Local\gegl-0.2
2015-02-25 14:33 - 2015-02-25 14:33 - 00000894 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2015-02-25 14:32 - 2015-02-25 14:33 - 00000000 ____D () C:\Program Files\GIMP 2
2015-02-22 22:01 - 2015-02-22 22:01 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-22 21:24 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-02-22 21:24 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-02-22 21:24 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-02-22 21:24 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-02-22 21:24 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-02-22 21:24 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-02-22 21:24 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-02-22 21:24 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-02-22 21:24 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-02-22 21:24 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-22 20:45 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-22 20:45 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-22 20:43 - 2015-01-14 04:08 - 17878016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-22 20:43 - 2015-01-14 03:53 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-22 20:43 - 2015-01-14 03:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-22 20:43 - 2015-01-14 03:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-22 20:43 - 2015-01-14 03:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-22 20:43 - 2015-01-14 03:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-22 20:43 - 2015-01-14 03:45 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-22 20:43 - 2015-01-14 03:45 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-22 20:43 - 2015-01-14 03:44 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-22 20:43 - 2015-01-14 03:44 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-22 20:43 - 2015-01-14 03:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-22 20:43 - 2015-01-14 02:51 - 12371456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-22 20:43 - 2015-01-14 02:47 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-22 20:43 - 2015-01-14 02:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-22 20:43 - 2015-01-14 02:41 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-22 20:43 - 2015-01-14 02:41 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-22 20:43 - 2015-01-14 02:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-22 20:43 - 2015-01-14 02:40 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-22 20:43 - 2015-01-14 02:40 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-22 20:43 - 2015-01-14 02:40 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-22 20:43 - 2015-01-14 02:40 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-22 20:43 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-22 20:43 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-22 20:43 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-22 20:43 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-22 20:43 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-22 20:43 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-22 20:42 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-22 20:42 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-22 20:42 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-22 20:42 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-22 20:42 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-22 20:42 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-22 20:42 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-22 20:42 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-22 20:42 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-22 20:42 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-22 20:42 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-22 20:42 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-22 20:42 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-22 20:42 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-22 20:42 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-22 20:42 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-22 20:42 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-22 20:42 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-22 20:42 - 2015-01-14 03:59 - 10924032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-22 20:42 - 2015-01-14 03:59 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-22 20:42 - 2015-01-14 03:49 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-22 20:42 - 2015-01-14 03:47 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-22 20:42 - 2015-01-14 03:47 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-22 20:42 - 2015-01-14 03:46 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-22 20:42 - 2015-01-14 03:46 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-22 20:42 - 2015-01-14 03:45 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-22 20:42 - 2015-01-14 03:44 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-22 20:42 - 2015-01-14 03:44 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-02-22 20:42 - 2015-01-14 03:44 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-02-22 20:42 - 2015-01-14 02:49 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-02-22 20:42 - 2015-01-14 02:46 - 09742336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-22 20:42 - 2015-01-14 02:43 - 01139712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-22 20:42 - 2015-01-14 02:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-22 20:42 - 2015-01-14 02:41 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-22 20:42 - 2015-01-14 02:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-22 20:42 - 2015-01-14 02:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-02-22 20:42 - 2015-01-14 02:41 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-22 20:42 - 2015-01-14 02:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-22 20:42 - 2015-01-14 02:40 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-02-22 20:42 - 2015-01-14 02:40 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-02-22 20:42 - 2015-01-14 02:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-02-22 20:42 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-02-22 20:42 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-02-22 20:41 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-22 20:41 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-22 20:41 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-22 20:41 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-22 20:41 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-22 20:41 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-22 20:41 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-22 20:40 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-22 20:40 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-22 20:40 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-02-22 20:40 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-02-22 20:40 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-02-22 20:40 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-22 20:40 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-22 20:40 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-02-22 20:40 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-02-22 20:40 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-02-22 20:40 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-22 20:40 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-22 20:40 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-02-22 20:40 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2015-02-22 20:40 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2015-02-22 20:40 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2015-02-22 20:40 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2015-02-22 20:40 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2015-02-22 20:40 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2015-02-22 20:40 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2015-02-22 20:40 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2015-02-22 20:40 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2015-02-22 20:40 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2015-02-22 20:40 - 2014-09-05 03:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-22 20:40 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-02-22 20:40 - 2011-02-25 07:19 - 02871808 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2015-02-22 20:40 - 2011-02-25 06:30 - 02616320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2015-02-22 20:39 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-22 20:39 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2015-02-22 20:39 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2015-02-22 20:25 - 2012-02-11 07:36 - 00559104 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2015-02-22 20:25 - 2012-02-11 07:36 - 00067072 _____ (Microsoft Corporation) C:\Windows\splwow64.exe
2015-02-17 15:07 - 2015-02-17 15:07 - 00001621 _____ () C:\Users\Lukas\Desktop\RomeTW – zástupce.lnk
2015-02-17 14:39 - 2015-02-17 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rome - Total War
2015-02-17 14:39 - 2015-02-17 14:39 - 00000242 _____ () C:\Windows\RomeTW.ini
2015-02-17 14:32 - 2015-02-17 14:32 - 00000000 ____D () C:\Program Files\Activision
2015-02-17 13:57 - 2015-02-17 13:57 - 00002988 _____ () C:\Windows\System32\Tasks\{4E884584-EAE6-4838-808C-D0843831B37B}
2015-02-17 13:25 - 2015-02-17 14:39 - 00001623 _____ () C:\Users\UpdatusUser\Desktop\Rome - Total War.lnk
2015-02-17 13:25 - 2015-02-17 13:25 - 00000000 ____D () C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rome - Total War
2015-02-17 13:17 - 2015-02-17 14:32 - 00000000 ____D () C:\Program Files (x86)\Activision
2015-02-16 18:18 - 2015-02-16 18:18 - 00450560 _____ (RAD Game Tools, Inc.) C:\Windows\SysWOW64\mss32.dll
2015-02-16 18:17 - 2015-02-16 18:18 - 00000000 ____D () C:\ProgramData\TEMP
2015-02-16 18:17 - 2014-06-10 12:27 - 00019392 _____ (Dll-Files.com) C:\Windows\system32\roboot64.exe
2015-02-16 17:47 - 2015-02-16 17:48 - 00290208 _____ () C:\Windows\Minidump\021615-51027-01.dmp
2015-02-16 17:47 - 2015-02-16 17:47 - 247072547 _____ () C:\Windows\MEMORY.DMP
2015-02-16 16:32 - 2015-02-16 18:25 - 00002106 _____ () C:\Users\UpdatusUser\Desktop\BI-RTRPE.lnk
2015-02-16 16:32 - 2015-02-16 18:25 - 00002085 _____ () C:\Users\UpdatusUser\Desktop\RTRPE.lnk
2015-02-16 16:12 - 2015-02-16 16:16 - 00000000 ____D () C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-04 22:18 - 2014-08-12 11:20 - 00000000 ____D () C:\WWW
2015-03-04 22:17 - 2009-07-14 05:51 - 00109908 _____ () C:\Windows\setupact.log
2015-03-04 22:09 - 2014-08-13 10:44 - 00001834 _____ () C:\Users\Lukas\Desktop\Úkoly.txt
2015-03-04 21:41 - 2014-08-12 11:22 - 00000952 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-04 21:23 - 2009-07-14 05:45 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-04 21:23 - 2009-07-14 05:45 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-04 21:19 - 2014-08-12 10:58 - 01196994 _____ () C:\Windows\WindowsUpdate.log
2015-03-04 21:15 - 2014-08-12 13:57 - 00043772 _____ () C:\Windows\PFRO.log
2015-03-04 21:15 - 2014-08-12 11:22 - 00000948 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-04 21:15 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-04 20:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Resources
2015-03-04 20:11 - 2014-08-12 14:06 - 00000000 ____D () C:\ProgramData\MFAData
2015-03-04 19:02 - 2014-08-13 11:32 - 00000000 ____D () C:\Program Files\Nová složka
2015-03-04 18:30 - 2009-07-14 16:18 - 00668376 _____ () C:\Windows\system32\perfh005.dat
2015-03-04 18:30 - 2009-07-14 16:18 - 00141004 _____ () C:\Windows\system32\perfc005.dat
2015-03-04 18:30 - 2009-07-14 06:13 - 01582262 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-04 17:26 - 2014-08-13 10:57 - 00000000 ____D () C:\Videne filmy
2015-03-04 16:31 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-04 11:58 - 2014-12-01 14:49 - 00000000 ____D () C:\Users\Lukas\AppData\Roaming\Opera Software
2015-03-04 11:58 - 2014-12-01 14:49 - 00000000 ____D () C:\Users\Lukas\AppData\Local\Opera Software
2015-03-04 11:58 - 2014-12-01 14:48 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-04 11:53 - 2009-07-14 03:34 - 00450771 ____R () C:\Windows\system32\Drivers\etc\hosts.20150304-120047.backup
2015-03-01 08:01 - 2014-12-16 15:45 - 00000892 _____ () C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job
2015-02-28 13:56 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-02-25 14:37 - 2014-08-12 11:04 - 00000000 ____D () C:\Users\Lukas
2015-02-22 22:07 - 2009-07-14 05:45 - 00342288 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-22 22:01 - 2014-08-14 14:39 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-22 22:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-22 22:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2015-02-22 21:34 - 2014-11-30 12:27 - 01558096 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-02-22 21:32 - 2014-08-13 10:56 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-22 21:11 - 2014-08-12 12:31 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-20 08:48 - 2014-08-12 11:38 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-17 14:43 - 2014-10-29 12:31 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-16 17:47 - 2015-01-12 17:09 - 00000000 ____D () C:\Windows\Minidump
2015-02-16 13:30 - 2014-12-16 15:45 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-16 13:30 - 2014-12-16 15:45 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-16 13:30 - 2014-12-16 15:45 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2015-02-09 08:36 - 2014-08-12 11:22 - 00003948 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-09 08:36 - 2014-08-12 11:22 - 00003696 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-04 17:48 - 2014-10-21 12:14 - 00000000 ____D () C:\Users\Lukas\AppData\Local\Microsoft Games

==================== Files in the root of some directories =======

2015-02-25 14:52 - 2015-02-25 14:52 - 0002617 _____ () C:\Users\Lukas\AppData\Local\recently-used.xbel
2015-01-03 15:47 - 2015-01-03 15:47 - 0007597 _____ () C:\Users\Lukas\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-04 18:28

==================== End Of Log ============================

Re: Data na flesce se prepisuji na .lnk

Napsal: 05 bře 2015 07:29
od vyosek
Zdravim :)

:arrow: Jen se zeptam pouzivate legalni operacni system, nejvyssi licence (v hodnote nejake tisic) Ultimate zrovna neni bezna domaci verze :?:

Re: Data na flesce se prepisuji na .lnk

Napsal: 05 bře 2015 16:21
od parmen20
Dobré odpoledne,
používám legální, jelikož to je pod školní licencí všb, dokud budu student mám to legální :) A vzhledme k otmu, že studuji doktorské studium tak mám naštěstí přístup k některým licencím zdarma pod hlavičkou školy.

Re: Data na flesce se prepisuji na .lnk

Napsal: 05 bře 2015 20:40
od vyosek
:arrow: Plnne rozumim, krasny studenstky zivot a jeho vyhody :D :D

:arrow: Stahnete USBFix http://www.fosshub.com/download/UsbFix.exe/ a nechte udelat funkci Clean - log sem - vice info http://www.en.usbfix.net/2014/02/usbfix ... an-option/

Re: Data na flesce se prepisuji na .lnk

Napsal: 06 bře 2015 14:31
od parmen20
Odkaz na stažení mi hlásí chybu, že stránka je offline. A když stáhnu USBFix z druhého odkazu, ve kterém je popsáno info, tak mi AVG hlásí, že je to trojský kůň můžu to teda spustit jo?

Re: Data na flesce se prepisuji na .lnk

Napsal: 06 bře 2015 16:43
od vyosek
:arrow: AVG nevi co keca a je to falesny poplach, takze jej vypnete a stahnete

Re: Data na flesce se prepisuji na .lnk

Napsal: 06 bře 2015 16:57
od parmen20
Zasílám log z USbFix, myslím že to tu havěť zneškodnilo, ale posuďte sám. Externí HDD jsme nepřipojoval, jelikož na něm mám všechna důležitá data, ovšem jestli vyhodnotíte, že havěť v PC byla zneškodněna tak ho připojím a provedu znovu USBFix, ale říkám radši jsem ho nepřipojil ať nepříjdu o data, jelikož u přítelkyně HDD funguje bez problému, takže si myslím že infikovaný není.


############################## | UsbFix V 7.901 | [Clean]

User: Lukas (Administrator) # LUKAS-PC
Updated 25/02/2015 by El Desaparecido - SosVirus
Started at 16:40:24 | 06/03/2015

Website : http://www.en.usbfix.net/
Changelog : http://www.en.usbfix.net/changelog/
Support : http://www.sos-virus.net/
Live detection : http://how-to-remove.us/
Contact : http://www.en.usbfix.net/contact/

################## | System information |

MB: Wistron (360A)
CPU: AMD Athlon Dual-Core QL-60
RAM -> [Total : 1790 Mo | Free : 734 Mo]
Bios: Hewlett-Packard
Boot: Normal boot

OS: Microsoft™ Windows 7 Ultimate (6.1.7601 64-Bit) Service Pack 1
WB: Google Chrome : 40.0.2214.115

################## | Security Information |

AV: AVG AntiVirus Free Edition 2015 [(!) Disabled |Updated]
AS: Windows Defender [Enabled |Updated]
AS: Spybot - Search and Destroy [Enabled |Updated]
AS: AVG AntiVirus Free Edition 2015 [(!) Disabled |Updated]
AS: Malwarebytes Anti-Malware : 2.0.4.1028
FW: Windows Firewall [Enabled]
SC: Security Center [Enabled]
WU: Windows Update [Enabled]

################## | Disk Information |

C:\ (%SystemDrive%) -> Fixed disk # 142 Gb (28 Gb free - 20%) [] # NTFS
D:\ -> Fixed disk # 7 Gb (3 Gb free - 44%) [PRESARIO_RP] # NTFS
H:\ -> Removable disk # 7 Gb (7 Gb free - 100%) [] # FAT32
I:\ -> Removable disk # 2 Gb (2 Gb free - 100%) [LUKAS] # FAT32

################## | Generic Research |

Deleted! C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Illustrator CC 17.0.0 Final Multilanguage.vbs
Deleted! C:\Users\Lukas\AppData\Local\Temp\Adobe Illustrator CC 17.0.0 Final Multilanguage.vbs

(!) Temporary files deleted. (12.0784921646118 MB)

################## | Registry |

Deleted! HKU\S-1-5-21-2384031562-724006598-4028863014-1000\Software\Microsoft\Windows\CurrentVersion\Run|Adobe Illustrator CC 17
Deleted! [x64] HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Adobe Illustrator CC 17

################## | Regedit Run |

F2 - HKLM\..\Winlogon : [Shell] explorer.exe
F2 - [x64] HKLM\..\Winlogon : [Shell] explorer.exe
F2 - HKLM\..\Winlogon : [Userinit] userinit.exe,
F2 - [x64] HKLM\..\Winlogon : [Userinit] C:\Windows\system32\userinit.exe,
04 - HKCU\..\Run : [EPSON SX125 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGGE.EXE /FU "C:\Windows\TEMP\E_SA89D.tmp" /EF "HKCU"
04 - HKCU\..\Run : [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKLM\..\Run : [AVG_UI] "C:\Program Files (x86)\AVG\AVG2015\avgui.exe" /TRAYONLY
04 - HKLM\..\Run : [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\..\Run : [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
04 - HKLM\..\Run : [Cisco AnyConnect Secure Mobility Agent for Windows] "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
04 - HKU\S-1-5-19\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-20\..\Run : [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
04 - HKU\S-1-5-21-2384031562-724006598-4028863014-1000\..\Run : [EPSON SX125 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGGE.EXE /FU "C:\Windows\TEMP\E_SA89D.tmp" /EF "HKCU"
04 - HKU\S-1-5-21-2384031562-724006598-4028863014-1000\..\Run : [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKU\S-1-5-19\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe
04 - HKU\S-1-5-20\..\RunOnce : [mctadmin] C:\Windows\System32\mctadmin.exe

################## | UsbFix - Information |

Info : How to remove shortcut virus on flash disk (Video)
Info : Shortcut virus on flash disk, What is it ?
Live detection : http://how-to-remove.us/

################## | Hijack |


################## | C:\ %SystemDrive% - Fixed drive (NTFS) |

[21/02/2015 - 08:59:04 | A | 4 Ko] - C:\LOGFILE.TXT
[04/03/2015 - 21:15:13 | ASH | 1375044 Ko] - C:\hiberfil.sys
[04/03/2015 - 21:15:16 | ASH | 1833396 Ko] - C:\pagefile.sys
[12/08/2014 - 11:02:48 | N | 0 Ko] - C:\win7.ld
[12/08/2014 - 11:04:42 | SHD] - C:\$Recycle.Bin
[12/08/2014 - 11:54:12 | RASH | 8 Ko] - C:\BOOTSECT.BAK
[14/07/2009 - 06:08:56 | SHD] - C:\Documents and Settings
[20/11/2010 - 13:40:07 | RASH | 375 Ko] - C:\bootmgr
[12/08/2014 - 11:02:41 | SHD] - C:\Recovery
[12/08/2014 - 11:02:47 | N | 199 Ko] - C:\grldr
[12/08/2014 - 12:55:18 | RD] - C:\Users
[13/08/2014 - 10:53:59 | D] - C:\Škola
[13/08/2014 - 10:54:24 | RHD] - C:\MSOCache
[14/08/2014 - 15:12:43 | SHD] - C:\Boot
[14/11/2014 - 15:12:55 | D] - C:\$AVG
[04/03/2015 - 17:26:00 | D] - C:\Videne filmy
[04/03/2015 - 19:28:13 | RD] - C:\Program Files (x86)
[04/03/2015 - 19:28:13 | HD] - C:\ProgramData
[04/03/2015 - 21:42:35 | RD] - C:\Program Files
[04/03/2015 - 21:43:30 | D] - C:\rsit
[04/03/2015 - 22:22:04 | D] - C:\Windows
[04/03/2015 - 22:22:55 | D] - C:\FRST
[06/03/2015 - 16:37:41 | D] - C:\WWW
[06/03/2015 - 16:39:26 | D] - C:\UsbFix

################## | D:\ - Fixed drive (NTFS) |

[07/12/2011 - 20:14:22 | A | 98 Ko] - D:\cc_20111207_201400.reg
[06/04/2013 - 11:38:21 | A | 25 Ko] - D:\off_dib.bmp
[28/07/2010 - 18:55:46 | RA | 1 Ko] - D:\MediaID.bin
[12/08/2014 - 11:04:42 | SHD] - D:\$RECYCLE.BIN
[01/12/2013 - 19:07:18 | RD] - D:\LUKAS-PC
[22/10/2014 - 10:54:23 | D] - D:\$AVG

################## | H:\ - Removable drive (FAT32) |

[16/02/2015 - 12:54:14 | A | 239 Ko] - H:\preklad knihy semiconductor lasers.docx

################## | I:\ - Removable drive (FAT32) |

[16/02/2015 - 12:54:14 | A | 239 Ko] - I:\preklad knihy semiconductor rs.docx

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
H:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
I:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

################## | E.O.F | http://www.sosvirus.net/ | http://www.en.usbfix.net/ |

Re: Data na flesce se prepisuji na .lnk

Napsal: 07 bře 2015 08:18
od vyosek
:arrow: USBFix udelal co mel, ale jeste pockame se zavery

:arrow: S timto bude potreba neco udelat - ja bych dal do pryc AVG, Spybot i MBAM a nainstaloval Avast Free
AV: AVG AntiVirus Free Edition 2015 [(!) Disabled |Updated]
AS: Windows Defender [Enabled |Updated]
AS: Spybot - Search and Destroy [Enabled |Updated]
AS: AVG AntiVirus Free Edition 2015 [(!) Disabled |Updated]
AS: Malwarebytes Anti-Malware : 2.0.4.1028
:arrow: Udelejte novy log z FRST

Re: Data na flesce se prepisuji na .lnk

Napsal: 07 bře 2015 12:59
od parmen20
Zasílám log z FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by Lukas (administrator) on LUKAS-PC on 07-03-2015 12:53:03
Running from C:\WWW
Loaded Profiles: Lukas & UpdatusUser (Available profiles: Lukas & UpdatusUser)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Ghisler Software GmbH) C:\Program Files\totalcmd\TOTALCMD.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707496 2014-08-15] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5513424 2015-03-07] (Avast Software s.r.o.)
HKU\S-1-5-21-2384031562-724006598-4028863014-1000\...\Run: [EPSON SX125 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGGE.EXE [224768 2009-09-14] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2384031562-724006598-4028863014-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (Avast Software s.r.o.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-2384031562-724006598-4028863014-1000] => localhost:8080
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (Avast Software s.r.o.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (Avast Software s.r.o.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-03-07]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.seznam.cz/
CHR StartupUrls: Default -> "hxxp://www.seznam.cz/"
CHR Profile: C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-12]
CHR Extension: (Google Drive) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-12]
CHR Extension: (YouTube) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-12]
CHR Extension: (Google Search) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-12]
CHR Extension: (Avast Online Security) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-03-07]
CHR Extension: (Google Wallet) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-12]
CHR Extension: (Gmail) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-12]
CHR Extension: (AVG PrivacyFix) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmejhjjecaldkllonlokhkglbdbkdcni [2015-02-25]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-03-07]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Corporate.11.0; C:\Program Files (x86)\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe [821840 2012-07-19] (ABBYY)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-03-07] (Avast Software s.r.o.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-03-07] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-03-07] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-03-07] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-03-07] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-03-07] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [441728 2015-03-07] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-03-07] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [268640 2015-03-07] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-08-12] (Disc Soft Ltd)
R3 HpqRemHid; C:\Windows\System32\DRIVERS\HpqRemHid.sys [9088 2007-07-11] (Hewlett-Packard Development Company, L.P.)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52592 2014-08-15] (Cisco Systems, Inc.)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-07 12:20 - 2015-03-07 12:20 - 00000000 ____D () C:\Users\Lukas\AppData\Roaming\AVAST Software
2015-03-07 12:19 - 2015-03-07 12:19 - 00001922 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-03-07 12:19 - 2015-03-07 12:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-03-07 12:18 - 2015-03-07 12:18 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-03-07 12:17 - 2015-03-07 12:16 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-03-07 12:17 - 2015-03-07 12:16 - 00441728 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-03-07 12:17 - 2015-03-07 12:16 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-03-07 12:17 - 2015-03-07 12:16 - 00268640 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-03-07 12:17 - 2015-03-07 12:16 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-03-07 12:17 - 2015-03-07 12:16 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-03-07 12:17 - 2015-03-07 12:16 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-03-07 12:17 - 2015-03-07 12:16 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-03-07 12:17 - 2015-03-07 12:16 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-03-07 12:16 - 2015-03-07 12:16 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-03-07 12:15 - 2015-03-07 12:15 - 00000000 ____D () C:\Program Files\AVAST Software
2015-03-07 12:13 - 2015-03-07 12:13 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-03-07 12:12 - 2015-03-07 12:13 - 00000085 _____ () C:\Windows\wininit.ini
2015-03-06 16:39 - 2015-03-06 16:47 - 00000000 ____D () C:\UsbFix
2015-03-06 16:39 - 2015-03-06 16:39 - 00001448 _____ () C:\Users\Lukas\Desktop\UsbFix.lnk
2015-03-04 22:17 - 2015-03-07 12:53 - 00000000 ____D () C:\FRST
2015-03-04 21:42 - 2015-03-04 21:43 - 00000000 ____D () C:\Program Files\trend micro
2015-03-04 19:28 - 2015-03-04 19:28 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-04 11:53 - 2015-03-04 11:52 - 00450771 ____R () C:\Windows\system32\Drivers\etc\hosts.20150304-115344.backup
2015-03-04 11:52 - 2015-03-04 11:50 - 00450771 ____R () C:\Windows\system32\Drivers\etc\hosts.20150304-115249.backup
2015-03-04 11:50 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20150304-115040.backup
2015-03-04 09:59 - 2015-03-04 09:59 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-03-04 09:57 - 2015-03-07 12:42 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-03-04 09:57 - 2015-03-07 12:13 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-03-04 09:39 - 2015-03-04 09:39 - 00000000 ____D () C:\Users\Public\Documents\DAEMON Tools Images
2015-02-28 14:00 - 2015-02-28 14:00 - 00001317 _____ () C:\Users\Public\Desktop\Ashampoo Burning Studio 6 FREE.lnk
2015-02-28 14:00 - 2015-02-28 14:00 - 00000000 ____D () C:\Users\Lukas\AppData\Roaming\Ashampoo
2015-02-28 14:00 - 2015-02-28 14:00 - 00000000 ____D () C:\Users\Lukas\AppData\Local\ashampoo
2015-02-28 14:00 - 2015-02-28 14:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
2015-02-28 14:00 - 2015-02-28 14:00 - 00000000 ____D () C:\ProgramData\Ashampoo
2015-02-28 14:00 - 2015-02-28 14:00 - 00000000 ____D () C:\Program Files (x86)\Ashampoo
2015-02-28 13:54 - 2015-02-28 13:56 - 00000221 _____ () C:\Windows\ultimatecd.ini
2015-02-25 14:52 - 2015-02-25 14:52 - 00002617 _____ () C:\Users\Lukas\AppData\Local\recently-used.xbel
2015-02-25 14:37 - 2015-02-25 14:52 - 00000000 ____D () C:\Users\Lukas\AppData\Local\gtk-2.0
2015-02-25 14:37 - 2015-02-25 14:37 - 00000000 ____D () C:\Users\Lukas\.thumbnails
2015-02-25 14:34 - 2015-02-25 14:54 - 00000000 ____D () C:\Users\Lukas\.gimp-2.8
2015-02-25 14:34 - 2015-02-25 14:34 - 00000894 _____ () C:\Users\Lukas\Desktop\GIMP 2.lnk
2015-02-25 14:34 - 2015-02-25 14:34 - 00000000 ____D () C:\Users\Lukas\AppData\Local\gegl-0.2
2015-02-25 14:33 - 2015-02-25 14:33 - 00000894 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2015-02-25 14:32 - 2015-02-25 14:33 - 00000000 ____D () C:\Program Files\GIMP 2
2015-02-22 22:01 - 2015-02-22 22:01 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-22 21:24 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-02-22 21:24 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-02-22 21:24 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-02-22 21:24 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-02-22 21:24 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-02-22 21:24 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-02-22 21:24 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-02-22 21:24 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-02-22 21:24 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-02-22 21:24 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-22 20:45 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-22 20:45 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-22 20:45 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-22 20:43 - 2015-01-14 04:08 - 17878016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-22 20:43 - 2015-01-14 03:53 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-22 20:43 - 2015-01-14 03:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-22 20:43 - 2015-01-14 03:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-22 20:43 - 2015-01-14 03:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-22 20:43 - 2015-01-14 03:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-22 20:43 - 2015-01-14 03:45 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-22 20:43 - 2015-01-14 03:45 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-22 20:43 - 2015-01-14 03:44 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-22 20:43 - 2015-01-14 03:44 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-22 20:43 - 2015-01-14 03:44 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-22 20:43 - 2015-01-14 02:51 - 12371456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-22 20:43 - 2015-01-14 02:47 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-22 20:43 - 2015-01-14 02:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-22 20:43 - 2015-01-14 02:41 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-22 20:43 - 2015-01-14 02:41 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-22 20:43 - 2015-01-14 02:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-22 20:43 - 2015-01-14 02:40 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-22 20:43 - 2015-01-14 02:40 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-22 20:43 - 2015-01-14 02:40 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-22 20:43 - 2015-01-14 02:40 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-22 20:43 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-22 20:43 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-22 20:43 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-22 20:43 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-22 20:43 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-22 20:43 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-22 20:42 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-22 20:42 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-22 20:42 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-22 20:42 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-22 20:42 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-22 20:42 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-22 20:42 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-22 20:42 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-22 20:42 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-22 20:42 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-22 20:42 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-22 20:42 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-22 20:42 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-22 20:42 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-22 20:42 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-22 20:42 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-22 20:42 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-22 20:42 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-22 20:42 - 2015-01-14 03:59 - 10924032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-22 20:42 - 2015-01-14 03:59 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-22 20:42 - 2015-01-14 03:49 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-22 20:42 - 2015-01-14 03:47 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-22 20:42 - 2015-01-14 03:47 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-22 20:42 - 2015-01-14 03:46 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-22 20:42 - 2015-01-14 03:46 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-22 20:42 - 2015-01-14 03:45 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-22 20:42 - 2015-01-14 03:44 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-22 20:42 - 2015-01-14 03:44 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-02-22 20:42 - 2015-01-14 03:44 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-02-22 20:42 - 2015-01-14 02:49 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-02-22 20:42 - 2015-01-14 02:46 - 09742336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-22 20:42 - 2015-01-14 02:43 - 01139712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-22 20:42 - 2015-01-14 02:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-22 20:42 - 2015-01-14 02:41 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-22 20:42 - 2015-01-14 02:41 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-22 20:42 - 2015-01-14 02:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-02-22 20:42 - 2015-01-14 02:41 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-22 20:42 - 2015-01-14 02:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-22 20:42 - 2015-01-14 02:40 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-02-22 20:42 - 2015-01-14 02:40 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-02-22 20:42 - 2015-01-14 02:40 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-02-22 20:42 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-02-22 20:42 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2015-02-22 20:41 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-22 20:41 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-22 20:41 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-22 20:41 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-22 20:41 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-22 20:41 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-22 20:41 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-22 20:40 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-22 20:40 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-22 20:40 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-02-22 20:40 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-02-22 20:40 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-02-22 20:40 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-22 20:40 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-22 20:40 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-02-22 20:40 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-02-22 20:40 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-02-22 20:40 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-22 20:40 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-22 20:40 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-02-22 20:40 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2015-02-22 20:40 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2015-02-22 20:40 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2015-02-22 20:40 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2015-02-22 20:40 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2015-02-22 20:40 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2015-02-22 20:40 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2015-02-22 20:40 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2015-02-22 20:40 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2015-02-22 20:40 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2015-02-22 20:40 - 2014-09-05 03:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-22 20:40 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-02-22 20:40 - 2011-02-25 07:19 - 02871808 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2015-02-22 20:40 - 2011-02-25 06:30 - 02616320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2015-02-22 20:39 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-22 20:39 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2015-02-22 20:39 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2015-02-22 20:25 - 2012-02-11 07:36 - 00559104 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2015-02-22 20:25 - 2012-02-11 07:36 - 00067072 _____ (Microsoft Corporation) C:\Windows\splwow64.exe
2015-02-17 15:07 - 2015-02-17 15:07 - 00001621 _____ () C:\Users\Lukas\Desktop\RomeTW – zástupce.lnk
2015-02-17 14:39 - 2015-02-17 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rome - Total War
2015-02-17 14:39 - 2015-02-17 14:39 - 00000242 _____ () C:\Windows\RomeTW.ini
2015-02-17 14:32 - 2015-02-17 14:32 - 00000000 ____D () C:\Program Files\Activision
2015-02-17 13:57 - 2015-02-17 13:57 - 00002988 _____ () C:\Windows\System32\Tasks\{4E884584-EAE6-4838-808C-D0843831B37B}
2015-02-17 13:25 - 2015-02-17 14:39 - 00001623 _____ () C:\Users\UpdatusUser\Desktop\Rome - Total War.lnk
2015-02-17 13:25 - 2015-02-17 13:25 - 00000000 ____D () C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rome - Total War
2015-02-17 13:17 - 2015-02-17 14:32 - 00000000 ____D () C:\Program Files (x86)\Activision
2015-02-16 18:18 - 2015-02-16 18:18 - 00450560 _____ (RAD Game Tools, Inc.) C:\Windows\SysWOW64\mss32.dll
2015-02-16 18:17 - 2015-02-16 18:18 - 00000000 ____D () C:\ProgramData\TEMP
2015-02-16 18:17 - 2014-06-10 12:27 - 00019392 _____ (Dll-Files.com) C:\Windows\system32\roboot64.exe
2015-02-16 17:47 - 2015-02-16 17:48 - 00290208 _____ () C:\Windows\Minidump\021615-51027-01.dmp
2015-02-16 17:47 - 2015-02-16 17:47 - 247072547 _____ () C:\Windows\MEMORY.DMP
2015-02-16 16:32 - 2015-02-16 18:25 - 00002106 _____ () C:\Users\UpdatusUser\Desktop\BI-RTRPE.lnk
2015-02-16 16:32 - 2015-02-16 18:25 - 00002085 _____ () C:\Users\UpdatusUser\Desktop\RTRPE.lnk
2015-02-16 16:12 - 2015-02-16 16:16 - 00000000 ____D () C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-07 12:53 - 2014-08-12 11:20 - 00000000 ____D () C:\WWW
2015-03-07 12:52 - 2009-07-14 05:45 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-07 12:52 - 2009-07-14 05:45 - 00020480 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-07 12:51 - 2014-08-12 10:58 - 01207658 _____ () C:\Windows\WindowsUpdate.log
2015-03-07 12:43 - 2014-08-12 11:22 - 00000952 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-07 12:43 - 2014-08-12 11:22 - 00000948 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-07 12:43 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-07 12:42 - 2014-08-12 14:06 - 00000000 ____D () C:\ProgramData\MFAData
2015-03-07 12:42 - 2014-08-12 13:57 - 00063496 _____ () C:\Windows\PFRO.log
2015-03-07 12:42 - 2009-07-14 05:51 - 00111364 _____ () C:\Windows\setupact.log
2015-03-07 12:26 - 2014-12-16 15:45 - 00000892 _____ () C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job
2015-03-06 16:42 - 2009-07-14 16:18 - 00668376 _____ () C:\Windows\system32\perfh005.dat
2015-03-06 16:42 - 2009-07-14 16:18 - 00141004 _____ () C:\Windows\system32\perfc005.dat
2015-03-06 16:42 - 2009-07-14 06:13 - 01582262 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-05 16:18 - 2014-08-13 10:44 - 00001720 _____ () C:\Users\Lukas\Desktop\Úkoly.txt
2015-03-04 20:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Resources
2015-03-04 19:02 - 2014-08-13 11:32 - 00000000 ____D () C:\Program Files\Nová složka
2015-03-04 17:26 - 2014-08-13 10:57 - 00000000 ____D () C:\Videne filmy
2015-03-04 16:31 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-04 11:58 - 2014-12-01 14:49 - 00000000 ____D () C:\Users\Lukas\AppData\Roaming\Opera Software
2015-03-04 11:58 - 2014-12-01 14:49 - 00000000 ____D () C:\Users\Lukas\AppData\Local\Opera Software
2015-03-04 11:58 - 2014-12-01 14:48 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-04 11:53 - 2009-07-14 03:34 - 00450771 ____R () C:\Windows\system32\Drivers\etc\hosts.20150304-120047.backup
2015-02-28 13:56 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-02-25 14:37 - 2014-08-12 11:04 - 00000000 ____D () C:\Users\Lukas
2015-02-22 22:07 - 2009-07-14 05:45 - 00342288 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-22 22:01 - 2014-08-14 14:39 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-22 22:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-22 22:01 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2015-02-22 21:34 - 2014-11-30 12:27 - 01558096 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-02-22 21:32 - 2014-08-13 10:56 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-22 21:11 - 2014-08-12 12:31 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-20 08:48 - 2014-08-12 11:38 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-17 14:43 - 2014-10-29 12:31 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-16 17:47 - 2015-01-12 17:09 - 00000000 ____D () C:\Windows\Minidump
2015-02-16 13:30 - 2014-12-16 15:45 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-16 13:30 - 2014-12-16 15:45 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-16 13:30 - 2014-12-16 15:45 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2015-02-09 08:36 - 2014-08-12 11:22 - 00003948 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-09 08:36 - 2014-08-12 11:22 - 00003696 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

==================== Files in the root of some directories =======

2015-02-25 14:52 - 2015-02-25 14:52 - 0002617 _____ () C:\Users\Lukas\AppData\Local\recently-used.xbel
2015-01-03 15:47 - 2015-01-03 15:47 - 0007597 _____ () C:\Users\Lukas\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-06 15:00

==================== End Of Log ============================

Re: Data na flesce se prepisuji na .lnk

Napsal: 07 bře 2015 13:03
od vyosek
:arrow: Tvorba fixlistu pro FRST
  • Spustte poznamkovy blok (Start-spustit-notepad)
  • Zkopirujte skript nize

  • Kód: Vybrat vše

    Start
CloseProcesses:
CreateRestorePoint:

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKU\S-1-5-21-2384031562-724006598-4028863014-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
BootExecute: autocheck autochk * sdnclean64.exe

ProxyServer: [S-1-5-21-2384031562-724006598-4028863014-1000] => localhost:8080
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 

CHR Extension: (AVG PrivacyFix) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmejhjjecaldkllonlokhkglbdbkdcni [2015-02-25]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

2015-03-06 16:39 - 2015-03-06 16:47 - 00000000 ____D () C:\UsbFix
2015-03-06 16:39 - 2015-03-06 16:39 - 00001448 _____ () C:\Users\Lukas\Desktop\UsbFix.lnk
2015-03-04 11:53 - 2015-03-04 11:52 - 00450771 ____R () C:\Windows\system32\Drivers\etc\hosts.20150304-115344.backup
2015-03-04 11:52 - 2015-03-04 11:50 - 00450771 ____R () C:\Windows\system32\Drivers\etc\hosts.20150304-115249.backup
2015-03-04 11:50 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20150304-115040.backup
2015-03-04 09:59 - 2015-03-04 09:59 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-03-04 09:57 - 2015-03-07 12:42 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-03-04 09:57 - 2015-03-07 12:13 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

Hosts:
EmptyTemp:
Reboot:
End
  • Ulozte vytvoreny TXT jako fixlist.txt
  • Presunte vytvoreny fixlist vedle FRST
:arrow: Spustte znovu FRST.exe
  • Kliknete na Fix
  • Probehne oprava a vytvori log Fixlog.txt
:arrow: Restart PC a dejte mi sem fixlog.txt

Re: Data na flesce se prepisuji na .lnk

Napsal: 07 bře 2015 13:27
od parmen20
Log z fixlistu.txt:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-03-2015 01
Ran by Lukas at 2015-03-07 13:13:32 Run:1
Running from C:\WWW
Loaded Profiles: Lukas & UpdatusUser (Available profiles: Lukas & UpdatusUser)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
CreateRestorePoint:

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKU\S-1-5-21-2384031562-724006598-4028863014-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
BootExecute: autocheck autochk * sdnclean64.exe

ProxyServer: [S-1-5-21-2384031562-724006598-4028863014-1000] => localhost:8080
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =

CHR Extension: (AVG PrivacyFix) - C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmejhjjecaldkllonlokhkglbdbkdcni [2015-02-25]

S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

2015-03-06 16:39 - 2015-03-06 16:47 - 00000000 ____D () C:\UsbFix
2015-03-06 16:39 - 2015-03-06 16:39 - 00001448 _____ () C:\Users\Lukas\Desktop\UsbFix.lnk
2015-03-04 11:53 - 2015-03-04 11:52 - 00450771 ____R () C:\Windows\system32\Drivers\etc\hosts.20150304-115344.backup
2015-03-04 11:52 - 2015-03-04 11:50 - 00450771 ____R () C:\Windows\system32\Drivers\etc\hosts.20150304-115249.backup
2015-03-04 11:50 - 2009-06-10 22:00 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20150304-115040.backup
2015-03-04 09:59 - 2015-03-04 09:59 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2015-03-04 09:57 - 2015-03-07 12:42 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-03-04 09:57 - 2015-03-07 12:13 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

Hosts:
EmptyTemp:
Reboot:
End
*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value deleted successfully.
HKU\S-1-5-21-2384031562-724006598-4028863014-1000\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => value deleted successfully.
HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully.
HKU\S-1-5-21-2384031562-724006598-4028863014-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Local Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Local Page => Value was restored successfully.
C:\Users\Lukas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmejhjjecaldkllonlokhkglbdbkdcni => Moved successfully.
Synth3dVsc => Service deleted successfully.
tsusbhub => Service deleted successfully.
VGPU => Service deleted successfully.
C:\UsbFix => Moved successfully.
C:\Users\Lukas\Desktop\UsbFix.lnk => Moved successfully.
C:\Windows\system32\Drivers\etc\hosts.20150304-115344.backup => Moved successfully.
C:\Windows\system32\Drivers\etc\hosts.20150304-115249.backup => Moved successfully.
C:\Windows\system32\Drivers\etc\hosts.20150304-115040.backup => Moved successfully.
C:\Windows\System32\Tasks\Safer-Networking => Moved successfully.
C:\Program Files (x86)\Spybot - Search & Destroy 2 => Moved successfully.
C:\ProgramData\Spybot - Search & Destroy => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 353.9 MB temporary data.


The system needed a reboot.

==== End of Fixlog 13:15:02 ====

Re: Data na flesce se prepisuji na .lnk

Napsal: 07 bře 2015 13:41
od vyosek
Otestujte PC a dejte vedet, jak se chova...

Re: Data na flesce se prepisuji na .lnk

Napsal: 08 bře 2015 15:15
od parmen20
Vypadá to, že PC pracuje normálně, nezkoušel jsem teda ještě připojit externí HDD, ale ostatní funguje bez problému. Díky moc za rady a pomoc :)

Re: Data na flesce se prepisuji na .lnk

Napsal: 11 bře 2015 11:24
od vyosek
Tak jeste uklidime :James008:

:arrow: DelFix https://toolslib.net/downloads/finish/2/
  • Stahnete a spustte
  • Ponechte zatrzitkou pouze u volby Remote disinfection tools
  • Kliknete na Run
:arrow: Stahnete Ccleaner https://www.piriform.com/ccleaner/download/standard
Panel čistič
  • Vse nechte jak je, jen dejte Analyzovat a pote Spustit CCleaner
Panel registry
  • dejte Hledej problémy
  • nasledne Opravit problémy - zalohu registru doporucuji udelat, opravte vsechny problemy
  • postup opakujte dokud nebude bez problemu - vetsinou cca 3x
Panel nástroje
  • Zde muzete odinstalovat nepotrebne programy
CCleaner doporucuji pouzivat cca jednou za tyden

:arrow: A pokud nejsou problemy ci dotazy, je to z me strany vse :|

Re: Data na flesce se prepisuji na .lnk

Napsal: 11 bře 2015 14:20
od parmen20
Díky moc za pomoc:) problém odstraněn a PC funguje ještě líp jak předtím:)
Všechny časy jsou v UTC+01:00
Stránka 1 z 2

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz