Opět v nouzovém režimu. Problémy začaly včera navečer (předtím žádné problémy)- po obnově systému vše běželo jak má pár hodin, ale po přihlášení ráno byl PC opět nepoužitelný. Nyní funguje jen v nouzovém režimu.
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10-03-2015
Ran by Klara (administrator) on PC2 on 10-03-2015 20:02:16
Running from C:\Users\Klara\Desktop
Loaded Profiles: Klara (Available profiles: Klara & Administrator)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Čeština (Česká republika)
Internet Explorer Version 10 (Default browser: Opera)
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool:
http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ALTAP) C:\Program Files\Salamander\salamand.exe
(forum.viry.cz) C:\Users\Klara\Desktop\FRSTLauncher.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [997920 2011-06-15] (Microsoft Corporation)
HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
HKLM\...\Run: [USB3MON] => C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-08-15] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12017368 2013-10-24] (Realtek Semiconductor)
HKLM\...\Run: [SDActiveMonitor] => C:\Program Files\Max Spyware Detector\MaxSDTray.exe [1071144 2014-12-03] (Max Secure Software)
HKLM\...\Run: [SDAutoScan] => [X]
HKLM\...\Run: [MaxUSBProc] => C:\Program Files\Max Spyware Detector\MaxUSBProc.exe [450088 2014-12-03] (Max Secure Software)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-163411933-1303605079-18187683-1005\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-163411933-1303605079-18187683-1005\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-163411933-1303605079-18187683-1005\...\MountPoints2: {14066265-4eb4-11e4-a381-74d4351c0d60} - F:\AutoRun.exe
HKU\S-1-5-21-163411933-1303605079-18187683-1005\...\MountPoints2: {2252e51d-52df-11e4-a33b-74d4351c0d60} - F:\LG_PC_Programs.exe
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Registrace produktu.lnk
ShortcutTarget: Logitech . Registrace produktu.lnk -> C:\Program Files\Logitech\Ereg\eReg.exe (Leader Technologies/Logitech)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2014-01-23] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2014-03-12] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 192.168.99.1
FireFox:
========
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll [2013-06-26] (Adobe Systems, Inc.)
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2014-01-23] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin: @qq.com/npchrome -> C:\Program Files\Common Files\Tencent\Npchrome\npchrome.dll [2014-03-11] (Tencent)
FF Plugin: @qq.com/npqscall -> C:\Program Files\Common Files\Tencent\NPQSCALL\npqscall.dll [2014-03-11] (Tencent)
FF Plugin: @qq.com/TXSSO -> C:\Program Files\Common Files\Tencent\TXSSO\1.2.2.1\Bin\npSSOAxCtrlForPTLogin.dll [2013-04-08] (Tencent)
FF Plugin: @t.garena.com/garenatalk -> D:\Users\Klara\Apps\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> D:\Users\Klara\Apps\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-05-10] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-163411933-1303605079-18187683-1005: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Klara\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2014-01-23] (Microsoft Corporation)
Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\39.0.2171.71\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\39.0.2171.71\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\39.0.2171.71\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (WacomTabletPlugin) - C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll No File
CHR Profile: C:\Users\Klara\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Klara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-03]
CHR Extension: (Google Drive) - C:\Users\Klara\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-03]
CHR Extension: (YouTube) - C:\Users\Klara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-03]
CHR Extension: (Google Search) - C:\Users\Klara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-03]
CHR Extension: (Google Wallet) - C:\Users\Klara\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-02]
CHR Extension: (Gmail) - C:\Users\Klara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-03]
Opera:
=======
OPR Extension: (Adblock Plus) - C:\Users\Klara\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2014-09-13]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [406288 2014-06-23] (BlueStack Systems, Inc.)
S2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385808 2014-06-23] (BlueStack Systems, Inc.)
S2 BstHdUpdaterSvc; C:\Program Files\BlueStacks\HD-UpdaterService.exe [774928 2014-06-23] (BlueStack Systems, Inc.)
S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279024 2014-03-11] (Intel Corporation)
S3 EvoSvc; C:\Program Files\Echobit\Evolve\EvoSvc.exe [1579936 2014-09-25] (Echobit LLC)
S3 ICCS; C:\Program Files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [169752 2012-04-24] (Intel Corporation)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [250352 2014-03-11] (Intel Corporation)
S2 MaxMerger; C:\Program Files\Max Spyware Detector\MaxMerger.exe [307752 2014-12-03] (Max Secure Software)
S2 MaxWatchDogService; C:\Program Files\Max Spyware Detector\MaxWatchDogService.exe [660520 2014-12-03] (Max Secure Software)
S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [11736 2011-04-27] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [208944 2011-04-27] (Microsoft Corporation)
S2 PanService; C:\Program Files\PANDORA.TV\PanService\KMPService.exe [1922600 2013-07-08] (Pandora.TV)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [26032 2014-04-09] (Wondershare)
S2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [113424 2014-06-23] (BlueStack Systems)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-02-08] (DT Soft Ltd)
R3 EvolveVirtualAdapter; C:\Windows\System32\DRIVERS\evolve.sys [18584 2013-12-21] (Echobit, LLC)
S3 FLxHCIc; C:\Windows\System32\DRIVERS\FLxHCIc.sys [205552 2012-11-02] (Fresco Logic)
S3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [61168 2012-11-02] (Fresco Logic)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 hidkmdf; C:\Windows\System32\DRIVERS\hidkmdf.sys [11680 2012-10-12] (Windows (R) Win 7 DDK provider)
S3 Huawei; C:\Windows\System32\DRIVERS\ewdcsc.sys [23424 2009-12-15] (Huawei Tech. Co., Ltd.)
R0 iusb3hcs; C:\Windows\System32\DRIVERS\iusb3hcs.sys [16880 2013-08-15] (Intel Corporation)
R3 iusb3hub; C:\Windows\System32\DRIVERS\iusb3hub.sys [362480 2013-08-15] (Intel Corporation)
R3 iusb3xhc; C:\Windows\System32\DRIVERS\iusb3xhc.sys [798704 2013-08-15] (Intel Corporation)
R0 MaxMgr; C:\Windows\System32\drivers\MaxMgr.sys [75816 2014-12-03] (Max Secure Software)
S1 MaxProtector32; C:\Windows\System32\drivers\MaxProtector32.sys [86056 2014-12-03] (Max Secure Software)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [75480 2015-03-10] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-03-10] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [56432 2013-01-11] (Intel Corporation)
S1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [165648 2011-04-18] (Microsoft Corporation)
S3 MpNWMon; C:\Windows\System32\DRIVERS\MpNWMon.sys [43392 2011-04-18] (Microsoft Corporation)
S0 SDActMon; C:\Windows\System32\drivers\SDActMon.sys [127016 2014-12-03] (Max Secure Software)
S3 WacHidRouter; C:\Windows\System32\DRIVERS\wachidrouter.sys [69024 2012-10-12] (Wacom Technology)
S3 wacomrouterfilter; C:\Windows\System32\DRIVERS\wacomrouterfilter.sys [13728 2012-10-12] (Wacom Technology)
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [198656 2009-12-15] (Huawei Technologies Co., Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-10 20:02 - 2015-03-10 20:02 - 00013080 _____ () C:\Users\Klara\Desktop\FRST.txt
2015-03-10 20:02 - 2015-03-10 20:02 - 00000000 ____D () C:\FRST
2015-03-10 19:59 - 2015-03-10 19:59 - 01134592 _____ (Farbar) C:\Users\Klara\Desktop\FRST.exe
2015-03-10 19:59 - 2015-03-10 19:59 - 00112640 _____ (forum.viry.cz) C:\Users\Klara\Desktop\FRSTLauncher.exe
2015-03-10 19:51 - 2015-03-10 19:51 - 00000000 _____ () C:\Users\Klara\AppData\Local\{5EC253FF-98FD-4F11-B1E3-2F08439D05E5}
2015-03-10 19:14 - 2015-03-10 19:17 - 00000000 ____D () C:\Users\Klara\Desktop\backups
2015-03-10 19:12 - 2015-03-10 19:17 - 00006673 _____ () C:\Users\Klara\Desktop\hijackthis.log
2015-03-10 19:11 - 2015-03-10 19:11 - 00388608 _____ (Trend Micro Inc.) C:\Users\Klara\Desktop\hijackthis.exe
2015-03-10 17:59 - 2015-03-10 18:08 - 00000000 ____D () C:\Program Files\Max Spyware Detector
2015-03-10 17:59 - 2015-03-10 17:59 - 00001900 _____ () C:\Users\Public\Desktop\Max Spyware Detector.lnk
2015-03-10 17:59 - 2015-03-10 17:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Max Spyware Detector
2015-03-10 17:59 - 2014-12-03 17:59 - 00127016 _____ (Max Secure Software) C:\Windows\system32\Drivers\SDActMon.sys
2015-03-10 17:59 - 2014-12-03 17:59 - 00086056 _____ (Max Secure Software) C:\Windows\system32\Drivers\MaxProtector32.sys
2015-03-10 17:59 - 2014-12-03 17:59 - 00078376 _____ (Max Secure Software) C:\Windows\system32\Drivers\SDActMon2K.sys
2015-03-10 17:59 - 2014-12-03 17:59 - 00077864 _____ (Max Secure Software) C:\Windows\system32\Drivers\MaxProtector64.sys
2015-03-10 17:59 - 2014-12-03 17:59 - 00075816 _____ (Max Secure Software) C:\Windows\system32\Drivers\MaxMgr.sys
2015-03-10 17:59 - 2014-12-03 17:59 - 00068648 _____ (Max Secure Software) C:\Windows\system32\Drivers\MaxProc64.sys
2015-03-10 17:59 - 2014-12-03 17:59 - 00023080 _____ (Max Secure Software) C:\Windows\system32\Drivers\MaxTdss.sys
2015-03-10 17:59 - 2014-12-03 17:59 - 00013352 _____ (Max Secure Software) C:\Windows\system32\Drivers\004.sys
2015-03-10 17:59 - 2014-12-02 13:29 - 00117248 _____ () C:\Windows\system32\MaxNative.exe
2015-03-10 17:59 - 2009-06-10 22:39 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.backup
2015-03-10 17:58 - 2015-03-10 17:59 - 00000000 ____D () C:\ProgramData\Max Secure
2015-03-10 17:58 - 2015-03-10 17:58 - 265044424 _____ (Max Secure Software ) C:\Users\Klara\Desktop\MaxSpywaredetectorR.exe
2015-03-10 17:45 - 2015-03-10 17:45 - 00000000 ____D () C:\Users\Klara\AppData\Local\Max Secure Software
2015-03-10 17:44 - 2015-03-10 17:45 - 00000000 ____D () C:\Users\Klara\AppData\Roaming\GetRightToGo
2015-03-10 17:44 - 2015-03-10 17:44 - 00368256 _____ (RegNow.com) C:\Users\Klara\Desktop\Download_MaxSDRDM.exe
2015-03-10 17:43 - 2015-03-10 17:43 - 00000000 __RSH () C:\MSDOS.SYS
2015-03-10 17:43 - 2015-03-10 17:43 - 00000000 __RSH () C:\IO.SYS
2015-03-10 17:39 - 2015-03-10 17:39 - 00141136 _____ () C:\Windows\Minidump\031015-19172-01.dmp
2015-03-10 17:37 - 2015-03-10 17:38 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Klara\Downloads\mbam-setup-2.0.4.1028 (1).exe
2015-03-10 08:57 - 2015-03-10 19:08 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-10 08:57 - 2015-03-10 18:20 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-10 08:57 - 2015-03-10 08:57 - 00001022 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-03-10 08:57 - 2015-03-10 08:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-03-10 08:57 - 2015-03-10 08:57 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-10 08:57 - 2015-03-10 08:57 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-03-10 08:57 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-10 08:57 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-10 08:56 - 2015-03-10 08:56 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Klara\Downloads\mbam-setup-2.0.4.1028.exe
2015-03-06 22:05 - 2015-03-06 22:54 - 00000000 ____D () C:\Users\Klara\AppData\Roaming\TS3Client
2015-02-28 15:32 - 2015-02-28 15:32 - 00008644 _____ () C:\Users\Klara\Desktop\Epic.xlsx
2015-02-27 22:55 - 2015-03-01 18:44 - 00010946 _____ () C:\Users\Klara\Desktop\Rare.xlsx
2015-02-27 20:56 - 2015-02-27 20:56 - 00000785 _____ () C:\Users\Public\Desktop\World of Tanks - Common Test.lnk
2015-02-27 20:56 - 2015-02-27 20:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks - Common Test
2015-02-27 20:54 - 2015-02-27 20:55 - 04691200 _____ (Wargaming.net ) C:\Users\Klara\Downloads\WoT_internet_install_ct.exe
2015-02-25 21:09 - 2015-03-07 16:24 - 00000000 ____D () C:\Users\Klara\AppData\Roaming\MMFApplications
2015-02-25 21:07 - 2015-02-25 21:07 - 00000938 _____ () C:\Users\Klara\Desktop\Five Nights at Freddy's.lnk
2015-02-25 21:07 - 2015-02-25 21:07 - 00000000 ____D () C:\Users\Klara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Five Nights at Freddy's
2015-02-22 14:14 - 2015-02-22 14:14 - 23137948 _____ () C:\Users\Klara\Downloads\Stealthic Heaventide (Hair).package
2015-02-20 19:07 - 2015-02-20 19:07 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2015-02-20 18:41 - 2015-02-20 18:41 - 00050490 _____ () C:\Users\Klara\Downloads\Annabelle(0000248062).srt
2015-02-19 21:03 - 2015-02-19 21:03 - 00086016 _____ () C:\Users\Klara\Downloads\Seznam literatury 2014-2015a.xls
2015-02-18 20:51 - 2015-02-18 20:51 - 00008074 _____ () C:\Users\Klara\Desktop\Blabla.odt
2015-02-18 16:45 - 2015-02-27 22:02 - 00014146 _____ () C:\Users\Klara\Desktop\Rare perfects collection.odt
2015-02-16 14:19 - 2015-03-08 16:26 - 00000000 ____D () C:\Users\Klara\Desktop\Nová složka
2015-02-12 16:44 - 2015-02-12 16:44 - 01586333 _____ () C:\Users\Klara\Downloads\20150212_1550_france-F68_AMX_Chasseur_de_char_46_39_crimea.wotreplay
2015-02-12 16:43 - 2015-02-12 16:43 - 01068669 _____ () C:\Users\Klara\Downloads\20150212_1621_germany-Hetzer_43_north_america.wotreplay
2015-02-12 16:43 - 2015-02-12 16:43 - 01031206 _____ () C:\Users\Klara\Downloads\20150202_1522_ussr-IS_08_ruinberg.wotreplay
2015-02-12 16:43 - 2015-02-12 16:43 - 00870045 _____ () C:\Users\Klara\Downloads\20150208_1758_germany-G_Panther_10_hills.wotreplay
2015-02-12 16:37 - 2015-02-12 16:37 - 00848765 _____ () C:\Users\Klara\Downloads\14237540519759_germany_Wespe_prohorovka.wotreplay
2015-02-12 16:34 - 2015-02-12 16:34 - 00000000 ____D () C:\Users\Klara\Downloads\Záloha 9.6
2015-02-12 16:33 - 2015-02-12 16:33 - 00071550 _____ () C:\Users\Klara\Downloads\Shtys [Blogtanker.ru] (1).zip
2015-02-12 16:29 - 2015-02-12 16:29 - 00943500 _____ () C:\Users\Klara\Downloads\Ingame_Clock_int_96.zip
2015-02-12 16:17 - 2015-02-12 16:17 - 00202173 _____ () C:\Users\Klara\Downloads\clock_datetime_94.zip
2015-02-12 16:14 - 2015-02-12 16:14 - 01671552 _____ () C:\Users\Klara\Downloads\[0.9.6.1]-YasenKrasen-statistiky-V1-[CZ].rar
2015-02-12 16:12 - 2015-02-12 16:12 - 00066409 _____ () C:\Users\Klara\Downloads\battle_assistant_0.9.6_1.2.5.zip
2015-02-12 16:11 - 2015-02-12 16:14 - 39313052 _____ (Aslain ) C:\Users\Klara\Downloads\Aslains_XVM_Mod_Installer_v.4.2.2_96.exe
2015-02-08 15:13 - 2015-02-08 15:13 - 00009930 _____ () C:\Users\Klara\Desktop\Invaders.odt
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-10 20:00 - 2012-01-15 11:16 - 00006492 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-10 19:55 - 2012-01-16 17:53 - 00000940 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-10 19:55 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-10 19:55 - 2009-07-14 05:39 - 00205031 _____ () C:\Windows\setupact.log
2015-03-10 19:49 - 2012-01-16 17:53 - 00000936 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-10 19:21 - 2012-01-15 11:06 - 01700666 _____ () C:\Windows\WindowsUpdate.log
2015-03-10 18:09 - 2009-07-14 05:33 - 00473128 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-10 18:08 - 2013-06-03 09:00 - 00120880 _____ () C:\Users\Klara\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-10 17:39 - 2012-01-16 00:03 - 289396561 _____ () C:\Windows\MEMORY.DMP
2015-03-10 17:39 - 2012-01-16 00:03 - 00000000 ____D () C:\Windows\Minidump
2015-03-10 09:03 - 2014-03-29 22:02 - 00000000 ____D () C:\Windows\PCHEALTH
2015-03-10 09:03 - 2012-01-15 11:08 - 00049224 _____ () C:\Windows\PFRO.log
2015-03-09 23:17 - 2015-01-29 20:34 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-09 23:11 - 2014-09-01 16:06 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-163411933-1303605079-18187683-1005UA.job
2015-03-09 23:01 - 2013-06-03 10:04 - 00000000 ____D () C:\Users\Klara\AppData\Roaming\Skype
2015-03-09 18:05 - 2009-07-14 05:34 - 00014208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-09 18:05 - 2009-07-14 05:34 - 00014208 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-09 17:59 - 2013-06-03 09:00 - 00000000 ____D () C:\Users\Klara
2015-03-09 17:58 - 2013-06-03 09:12 - 00000000 ____D () C:\Users\Klara\AppData\Roaming\IrfanView
2015-03-09 17:58 - 2012-01-20 07:53 - 00000000 ____D () C:\Users\Administrator
2015-03-09 17:58 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\wfp
2015-03-09 17:58 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration
2015-03-08 13:19 - 2014-10-26 13:49 - 00010547 _____ () C:\Users\Klara\Desktop\DC- Boosts.xlsx
2015-03-03 14:16 - 2012-01-15 11:43 - 00246920 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-03-02 19:56 - 2013-08-04 14:32 - 00000000 ____D () C:\Users\Klara\AppData\Roaming\uTorrent
2015-03-02 17:11 - 2014-09-01 16:06 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-163411933-1303605079-18187683-1005Core.job
2015-03-02 16:08 - 2014-05-18 20:54 - 00000000 ____D () C:\Users\Klara\AppData\Roaming\vlc
2015-02-28 00:03 - 2015-01-30 08:52 - 00000000 ____D () C:\Users\Klara\Desktop\Himiko
2015-02-27 20:56 - 2013-08-23 20:52 - 00000000 ____D () C:\Windows\system32\directx
2015-02-20 16:14 - 2014-06-12 16:54 - 00000000 ____D () C:\Users\Klara\.gimp-2.8
2015-02-18 18:56 - 2015-01-05 10:30 - 00000000 ____D () C:\Users\Klara\Desktop\Selling
==================== Files in the root of some directories =======
2013-06-03 09:03 - 2014-06-26 22:18 - 0000600 _____ () C:\Users\Klara\AppData\Roaming\winscp.rnd
2013-09-21 22:12 - 2015-02-07 14:26 - 0007168 _____ () C:\Users\Klara\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-06-22 19:36 - 2014-06-22 19:36 - 0002787 _____ () C:\Users\Klara\AppData\Local\recently-used.xbel
2013-09-08 21:53 - 2014-10-20 20:35 - 0007595 _____ () C:\Users\Klara\AppData\Local\Resmon.ResmonCfg
2015-03-10 19:51 - 2015-03-10 19:51 - 0000000 _____ () C:\Users\Klara\AppData\Local\{5EC253FF-98FD-4F11-B1E3-2F08439D05E5}
Some content of TEMP:
====================
C:\Users\Klara\AppData\Local\Temp\DataCard_Setup.exe
C:\Users\Klara\AppData\Local\Temp\KMP_3.9.1.131.exe
C:\Users\Klara\AppData\Local\Temp\ose00000.exe
C:\Users\Klara\AppData\Local\Temp\ResetDevice.exe
C:\Users\Klara\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Klara\AppData\Local\Temp\utils.dll
C:\Users\Klara\AppData\Local\Temp\_is1229.exe
C:\Users\Klara\AppData\Local\Temp\_is17B5.exe
C:\Users\Klara\AppData\Local\Temp\_is9A4C.exe
C:\Users\Klara\AppData\Local\Temp\_isC909.exe
C:\Users\Klara\AppData\Local\Temp\_isCB6A.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-08 12:40
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
Drive c: (SYSTEM) (Fixed) (Total:151.35 GB) (Free:106.89 GB) NTFS
Drive d: (DATA) (Fixed) (Total:780.07 GB) (Free:222.76 GB) NTFS
Drive n: () (Network) (Total:1832.31 GB) (Free:391.88 GB)
Available physical RAM: 2736.94 MB
Total physical RAM: 3286.06 MB
Percentage of memory in use: 16%
==================== MBR and Partition Table ==================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: BBCCAC35)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=151.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=780.1 GB) - (Type=07 NTFS)
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-163411933-1303605079-18187683-1005Core.job => C:\Users\Klara\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-163411933-1303605079-18187683-1005UA.job => C:\Users\Klara\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
AV: Microsoft Security Essentials (Enabled - Up to date) {108DAC43-C256-20B7-BB05-914135DA5160}
AS: Microsoft Security Essentials (Enabled - Up to date) {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\Klara\Desktop" je 1198 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000
==================== End Of Log ==============================