VIRY.CZ

Dobrý den,

poslední dva dny mi stále vyskakují reklamy a různé banery. Nevím zda se nejedná o nějaký virus.

Proto prosím o preventivní kontrolu a předem děkuji za Váš čas.


zde je RSIT log..

Logfile of random's system information tool 1.10 (written by random/random)
Run by Methanol at 2015-04-17 13:06:07
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 20 GB (17%) free of 122 GB
Total RAM: 8146 MB (58% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:06:08, on 17.4.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17728)
Boot mode: Normal

Running processes:
C:\Windows\system32\IRMonitor.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe
C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe
C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
C:\Program Files (x86)\DynamicUSBTool\DynamicUSB.exe
C:\Program Files (x86)\Citrix\ICA Client\WFCRUN32.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
C:\Program Files\trend micro\Methanol.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: SalePlus - {285032df-c4b9-4998-b0b3-c3bab9a93d4d} - C:\Program Files (x86)\SalePlus\igbRQvPRSxpSI4.dll
O2 - BHO: bestadblocker - {6fde9cdd-fad4-4b48-bf39-0eff0b096b20} - C:\Program Files (x86)\bestadblocker\4vBdFIM8JG4toP.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [THX Audio Control Panel] "C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe" /r
O4 - HKLM\..\Run: [ControlCenterCount] C:\Program Files (x86)\MSI\ControlCenter\ControlCenterCount.exe
O4 - HKLM\..\Run: [Super-Charger] C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
O4 - HKLM\..\Run: [DynamicUSB] "C:\Program Files (x86)\DynamicUSBTool\DynamicUSB.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [NCUpdateHelper] C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [icq] C:\Users\Methanol\AppData\Roaming\ICQM\icq.exe -CU
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - Startup: Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.lnk = C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe
O4 - Startup: going-clear-scientology-and-the-prison-of-belief-cze-6117369.lnk = C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: ICQ - {086C8477-4F71-4550-87FB-AF0AE8DF3E98} - C:\Users\Methanol\AppData\Roaming\ICQM\icq.exe (HKCU)
O9 - Extra 'Tools' menuitem: ICQ - {086C8477-4F71-4550-87FB-AF0AE8DF3E98} - C:\Users\Methanol\AppData\Roaming\ICQM\icq.exe (HKCU)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~2\Citrix\ICACLI~1\RSHook.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Foxit Cloud Safe Update Service (FoxitCloudUpdateService) - Foxit Software Inc. - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MSI_SuperCharger - MSI - C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 14187 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
winlogon.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE"
"C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\LinkMonitor\LinkMonitor.dll",serv
"C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\LinkMonitor\LinkMonitor.dll",serv
"C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe" /service
"C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe" /service
"C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Citrix\ICA Client\ssonsvr.exe /HTC:296
"taskhost.exe"
taskeng.exe {2A4794C1-AD43-4858-A601-8D0D4682E5F4}
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\system32\IRMonitor.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
"C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
"C:\Program Files\Microsoft IntelliType Pro\itype.exe"
"C:\Program Files\Logitech\SetPointP\SetPoint.exe" /launchGaming
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe"
"C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe" --startup=1
"C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe" --startup=1
KHALMNPR.EXE /API
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe" /r
"C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe"
"C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe"
"C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
"C:\Program Files (x86)\DynamicUSBTool\DynamicUSB.exe"
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\Citrix\ICA Client\WFCRUN32.EXE" /HTC:296 -Embedding
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel=5284.268bace0.1068345213 "C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll" -greomni "C:\Program Files (x86)\Mozilla Firefox\omni.ja" -appomni "C:\Program Files (x86)\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files (x86)\Mozilla Firefox\browser" E7CF176E110C211B 5284 "\\.\pipe\gecko-crash-server-pipe.5284" plugin
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe" --proxy-stub-channel=Flash5864.6193BE28.7559 --host-broker-channel=Flash5864.6193BE28.27201 --host-pid=5864 --host-npapi-version=28 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll"
"C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe" --channel=5900.0022F70C.941958769 --proxy-stub-channel=Flash5864.6193BE28.7559 --plugin-path="C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll" --host-npapi-version=28 --type=renderer
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
taskhost.exe $(Arg0)
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe12_ Global\UsGthrCtrlFltPipeMssGthrPipe12 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 524 528 536 65536 532
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Methanol\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000Core.job - C:\Users\Methanol\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000UA.job - C:\Users\Methanol\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\Methanol\AppData\Roaming\Mozilla\Firefox\Profiles\apsa6ci0.default-1412009044122

prefs.js - "keyword.URL" - "http://www.bing.com/search?FORM=UP97DF&PC=UP97&q="

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 17.0.0.169 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Citrix.com/npican]
"Description"=Citrix ICA Client Plugin
"Path"=C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf]
"Description"=
"Path"=C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf]
"Description"=
"Path"=C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp]
"Description"=
"Path"=C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf]
"Description"=
"Path"=C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf]
"Description"=
"Path"=C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 17.0.0.169 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL


C:\Program Files (x86)\Mozilla Firefox\plugins\
np-mswmp.dll
nppdf32.dll
WMP Firefox Plugin License.rtf
WMP Firefox Plugin RelNotes.txt

C:\Users\Methanol\AppData\Roaming\Mozilla\Firefox\Profiles\apsa6ci0.default-1412009044122\extensions\
a7@EctBz.org
touD@QcDm.com

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{285032df-c4b9-4998-b0b3-c3bab9a93d4d}]
SalePlus - C:\Program Files (x86)\SalePlus\igbRQvPRSxpSI4.x64.dll [2015-04-15 912896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6fde9cdd-fad4-4b48-bf39-0eff0b096b20}]
bestadblocker - C:\Program Files (x86)\bestadblocker\4vBdFIM8JG4toP.x64.dll [2015-04-15 908800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14 2117216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF949550-9094-4807-95EC-D1C317803333}]
Logitech SetPoint - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2013-07-31 433944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{285032df-c4b9-4998-b0b3-c3bab9a93d4d}]
SalePlus - C:\Program Files (x86)\SalePlus\igbRQvPRSxpSI4.dll [2015-04-15 841728]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6fde9cdd-fad4-4b48-bf39-0eff0b096b20}]
bestadblocker - C:\Program Files (x86)\bestadblocker\4vBdFIM8JG4toP.dll [2015-04-15 840192]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14 1709152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF949550-9094-4807-95EC-D1C317803333}]
Logitech SetPoint - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2013-07-31 364824]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"THXCfg64"=C:\Windows\system32\THXCfg64.dll [2010-09-14 25600]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2012-06-12 6548112]
"itype"=C:\Program Files\Microsoft IntelliType Pro\itype.exe [2011-08-10 1873256]
"EvtMgr6"=C:\Program Files\Logitech\SetPointP\SetPoint.exe [2013-07-31 3091224]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2015-02-26 31344744]
"icq"=C:\Users\Methanol\AppData\Roaming\ICQM\icq.exe [2015-02-19 36705800]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2014-03-04 3696912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NCUpdateHelper]
C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe [2014-05-23 526240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TC UP]
C:\Program Files (x86)\TC UP\TC UP.exe [2011-11-21 616448]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Users\Methanol\AppData\Roaming\uTorrent\uTorrent.exe [2014-04-14 398760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Methanol^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^hamachi.lnk]
C:\PROGRA~2\Hamachi\hamachi.exe [2014-07-03 624416]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2012-03-27 291608]
"THX Audio Control Panel"=C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [2011-08-29 1517056]
"ControlCenterCount"=C:\Program Files (x86)\MSI\ControlCenter\ControlCenterCount.exe [2012-03-26 872448]
"Super-Charger"=C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe [2012-07-27 495616]
"ArcSoft Connection Service"=C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [2010-10-27 207424]
"ConnectionCenter"=C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [2014-01-08 383368]
"DynamicUSB"=C:\Program Files (x86)\DynamicUSBTool\DynamicUSB.exe [2007-03-02 94208]
"StartCCC"=C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [2014-11-20 767176]
"NCUpdateHelper"=C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe [2014-05-23 526240]

C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.lnk - C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe
going-clear-scientology-and-the-prison-of-belief-cze-6117369.lnk - C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2013-06-13 66328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - %SystemRoot%\SysWow64\CScript.exe "%1" %*
.vbs - open - %SystemRoot%\SysWow64\CScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-04-17 13:06:07 ----D---- C:\rsit
2015-04-15 11:55:19 ----SHD---- C:\Config.Msi
2015-04-15 10:56:46 ----D---- C:\Program Files (x86)\LinkMonitor
2015-04-15 10:55:43 ----D---- C:\Program Files (x86)\bestadblocker
2015-04-15 10:55:06 ----D---- C:\ProgramData\7044438373684523921
2015-04-15 10:55:06 ----D---- C:\Program Files (x86)\SalEPlUs
2015-04-15 10:54:51 ----D---- C:\ProgramData\anblmglnjdcgmpenbheeddcopcfpkldl
2015-04-15 10:53:47 ----D---- C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}
2015-04-15 08:31:35 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2015-04-15 08:31:35 ----A---- C:\Windows\SYSWOW64\wups.dll
2015-04-15 08:31:35 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2015-04-15 08:31:35 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2015-04-15 08:31:35 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2015-04-15 08:31:35 ----A---- C:\Windows\system32\wuwebv.dll
2015-04-15 08:31:35 ----A---- C:\Windows\system32\wups2.dll
2015-04-15 08:31:35 ----A---- C:\Windows\system32\wups.dll
2015-04-15 08:31:35 ----A---- C:\Windows\system32\wudriver.dll
2015-04-15 08:31:35 ----A---- C:\Windows\system32\wucltux.dll
2015-04-15 08:31:35 ----A---- C:\Windows\system32\wuaueng.dll
2015-04-15 08:31:35 ----A---- C:\Windows\system32\wuauclt.exe
2015-04-15 08:31:35 ----A---- C:\Windows\system32\wuapp.exe
2015-04-15 08:31:35 ----A---- C:\Windows\system32\wuapi.dll
2015-04-15 08:31:35 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 08:31:35 ----A---- C:\Windows\system32\WinSetupUI.dll
2015-04-15 08:31:25 ----A---- C:\Windows\system32\invagent.dll
2015-04-15 08:31:25 ----A---- C:\Windows\system32\generaltel.dll
2015-04-15 08:31:25 ----A---- C:\Windows\system32\devinv.dll
2015-04-15 08:31:25 ----A---- C:\Windows\system32\appraiser.dll
2015-04-15 08:31:25 ----A---- C:\Windows\system32\aepic.dll
2015-04-15 08:31:25 ----A---- C:\Windows\system32\aepdu.dll
2015-04-15 08:31:25 ----A---- C:\Windows\system32\aeinv.dll
2015-04-15 08:31:25 ----A---- C:\Windows\system32\acmigration.dll
2015-04-15 08:31:17 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2015-04-15 08:31:17 ----A---- C:\Windows\system32\gdi32.dll
2015-04-15 08:31:15 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2015-04-15 08:31:15 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2015-04-15 08:31:15 ----A---- C:\Windows\system32\msxml3r.dll
2015-04-15 08:31:15 ----A---- C:\Windows\system32\msxml3.dll
2015-04-15 08:31:14 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2015-04-15 08:31:14 ----A---- C:\Windows\system32\ntoskrnl.exe
2015-04-15 08:31:14 ----A---- C:\Windows\system32\ntdll.dll
2015-04-15 08:31:14 ----A---- C:\Windows\system32\KernelBase.dll
2015-04-15 08:31:14 ----A---- C:\Windows\system32\kernel32.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 08:31:13 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\wow32.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\user.exe
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\srclient.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\setup16.exe
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\instnm.exe
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2015-04-15 08:31:13 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\wow64win.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\wow64cpu.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\wow64.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\winsrv.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\wdigest.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\TSpkg.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\sspisrv.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\sspicli.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\srcore.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\srclient.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\smss.exe
2015-04-15 08:31:13 ----A---- C:\Windows\system32\schannel.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\secur32.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\rstrui.exe
2015-04-15 08:31:13 ----A---- C:\Windows\system32\ntvdm64.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\ncrypt.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\msv1_0.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\msobjs.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\msaudite.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\lsass.exe
2015-04-15 08:31:13 ----A---- C:\Windows\system32\lsasrv.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\kerberos.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-04-15 08:31:13 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-04-15 08:31:13 ----A---- C:\Windows\system32\csrsrv.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\credssp.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\conhost.exe
2015-04-15 08:31:13 ----A---- C:\Windows\system32\auditpol.exe
2015-04-15 08:31:13 ----A---- C:\Windows\system32\apisetschema.dll
2015-04-15 08:31:13 ----A---- C:\Windows\system32\adtschema.dll
2015-04-15 08:31:06 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-04-15 08:31:06 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-04-15 08:31:06 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-04-15 08:31:06 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-04-15 08:31:06 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-04-15 08:31:06 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-04-15 08:31:06 ----A---- C:\Windows\system32\drivers\http.sys
2015-04-15 08:31:05 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-04-15 08:31:05 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-04-15 08:31:05 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-04-15 08:31:05 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-04-15 08:31:05 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-04-15 08:31:05 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-04-15 08:31:05 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-15 08:31:05 ----A---- C:\Windows\system32\iernonce.dll
2015-04-15 08:31:05 ----A---- C:\Windows\system32\ie4uinit.exe
2015-04-15 08:31:04 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-04-15 08:31:04 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-04-15 08:31:04 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-04-15 08:31:04 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-04-15 08:31:04 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-04-15 08:31:04 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-04-15 08:31:04 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-04-15 08:31:04 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-04-15 08:31:04 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-04-15 08:31:04 ----A---- C:\Windows\system32\urlmon.dll
2015-04-15 08:31:04 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-15 08:31:04 ----A---- C:\Windows\system32\msfeeds.dll
2015-04-15 08:31:04 ----A---- C:\Windows\system32\iesetup.dll
2015-04-15 08:31:04 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-04-15 08:31:04 ----A---- C:\Windows\system32\iedkcs32.dll
2015-04-15 08:31:04 ----A---- C:\Windows\system32\dxtrans.dll
2015-04-15 08:31:03 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-04-15 08:31:03 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-04-15 08:31:03 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-04-15 08:31:03 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-04-15 08:31:03 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-04-15 08:31:03 ----A---- C:\Windows\system32\jsproxy.dll
2015-04-15 08:31:03 ----A---- C:\Windows\system32\ieUnatt.exe
2015-04-15 08:31:03 ----A---- C:\Windows\system32\iertutil.dll
2015-04-15 08:31:03 ----A---- C:\Windows\system32\ieapfltr.dll
2015-04-15 08:31:02 ----A---- C:\Windows\system32\vbscript.dll
2015-04-15 08:31:02 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-04-15 08:31:02 ----A---- C:\Windows\system32\mshtmled.dll
2015-04-15 08:31:02 ----A---- C:\Windows\system32\jscript9diag.dll
2015-04-15 08:31:02 ----A---- C:\Windows\system32\jscript9.dll
2015-04-15 08:31:02 ----A---- C:\Windows\system32\ieui.dll
2015-04-15 08:31:02 ----A---- C:\Windows\system32\ieframe.dll
2015-04-15 08:31:02 ----A---- C:\Windows\system32\dxtmsft.dll
2015-04-15 08:31:01 ----A---- C:\Windows\system32\wininet.dll
2015-04-15 08:31:01 ----A---- C:\Windows\system32\msrating.dll
2015-04-15 08:31:01 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-04-15 08:31:01 ----A---- C:\Windows\system32\mshtml.dll
2015-04-15 08:29:08 ----A---- C:\Windows\SYSWOW64\clfsw32.dll
2015-04-15 08:29:08 ----A---- C:\Windows\system32\clfsw32.dll
2015-04-15 08:29:08 ----A---- C:\Windows\system32\clfs.sys
2015-04-10 21:53:23 ----ASH---- C:\pagefile.sys
2015-04-05 12:46:41 ----D---- C:\Program Files (x86)\Mozilla Firefox
2015-04-04 09:19:16 ----SD---- C:\Windows\SYSWOW64\GWX
2015-04-04 09:19:16 ----SD---- C:\Windows\system32\GWX
2015-03-31 21:22:58 ----D---- C:\Users\Methanol\AppData\Roaming\Need for Speed Rivals
2015-03-31 18:19:14 ----D---- C:\Users\Methanol\AppData\Roaming\AMD
2015-03-31 16:06:41 ----D---- C:\Program Files (x86)\Ubisoft
2015-03-28 15:11:58 ----D---- C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}
2015-03-26 18:33:06 ----D---- C:\Windows\SYSWOW64\xlive
2015-03-19 16:38:49 ----D---- C:\L2
2015-03-19 16:36:17 ----A---- C:\Windows\SYSWOW64\npptNT2.sys
2015-03-19 16:33:49 ----D---- C:\Program Files (x86)\Lineage II

======List of files/folders modified in the last 1 month======

2015-04-17 13:06:08 ----D---- C:\Windows\Temp
2015-04-17 13:06:08 ----D---- C:\Program Files\trend micro
2015-04-17 13:00:42 ----D---- C:\Users\Methanol\AppData\Roaming\Skype
2015-04-17 11:56:36 ----D---- C:\Windows\system32\config
2015-04-17 11:55:44 ----D---- C:\Windows\inf
2015-04-17 11:55:44 ----AD---- C:\Windows\System32
2015-04-17 11:55:44 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-04-17 11:53:03 ----D---- C:\CitrixUSBStore
2015-04-17 09:02:34 ----A---- C:\Windows\SYSWOW64\log.txt
2015-04-17 09:00:47 ----D---- C:\Windows\system32\Tasks
2015-04-16 10:15:16 ----D---- C:\Windows\AppCompat
2015-04-16 09:15:59 ----D---- C:\Windows\Microsoft.NET
2015-04-16 09:15:43 ----RSD---- C:\Windows\assembly
2015-04-16 08:08:33 ----D---- C:\Users\Methanol\AppData\Roaming\Awesomium
2015-04-15 22:28:23 ----D---- C:\Windows\winsxs
2015-04-15 14:22:27 ----SD---- C:\Windows\system32\CompatTel
2015-04-15 14:22:27 ----D---- C:\Windows\SYSWOW64\en-US
2015-04-15 14:22:27 ----D---- C:\Windows\SYSWOW64\cs-CZ
2015-04-15 14:22:27 ----D---- C:\Windows\system32\en-US
2015-04-15 14:22:27 ----D---- C:\Windows\system32\cs-CZ
2015-04-15 14:22:27 ----D---- C:\Windows\system32\appraiser
2015-04-15 14:22:27 ----D---- C:\Windows\AppPatch
2015-04-15 14:22:27 ----D---- C:\Program Files\Internet Explorer
2015-04-15 14:22:27 ----D---- C:\Program Files (x86)\Internet Explorer
2015-04-15 14:22:27 ----AD---- C:\Windows\SysWOW64
2015-04-15 14:22:27 ----AD---- C:\Windows\system32\drivers
2015-04-15 14:12:19 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2015-04-15 11:56:01 ----SHD---- C:\Windows\Installer
2015-04-15 11:56:00 ----D---- C:\ProgramData\Microsoft Help
2015-04-15 11:55:35 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2015-04-15 11:53:52 ----D---- C:\Windows\system32\MRT
2015-04-15 11:49:22 ----A---- C:\Windows\system32\MRT.exe
2015-04-15 11:49:19 ----A---- C:\Windows\win.ini
2015-04-15 11:48:01 ----SHD---- C:\System Volume Information
2015-04-15 10:58:33 ----D---- C:\Users\Methanol\AppData\Roaming\XBMC
2015-04-15 10:56:46 ----RD---- C:\Program Files (x86)
2015-04-15 10:55:06 ----D---- C:\ProgramData
2015-04-15 08:24:43 ----D---- C:\Windows\system32\catroot2
2015-04-14 23:16:47 ----D---- C:\Users\Methanol\AppData\Roaming\uTorrent
2015-04-10 20:14:28 ----D---- C:\Users\Methanol\AppData\Roaming\TS3Client
2015-04-09 15:20:22 ----D---- C:\Users\Methanol\AppData\Roaming\Hamachi
2015-04-08 07:52:01 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-04 09:19:17 ----D---- C:\Windows\Logs
2015-04-03 08:20:07 ----RD---- C:\Program Files (x86)\Skype
2015-04-03 08:20:05 ----D---- C:\ProgramData\Skype
2015-03-26 18:33:49 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2015-03-26 18:32:10 ----D---- C:\Users\Methanol\AppData\Roaming\DAEMON Tools Lite
2015-03-25 23:12:15 ----D---- C:\Windows\system32\wbem

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2012-03-27 19224]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2011-03-18 29592]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2014-08-26 386680]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 ctxusbm;Citrix USB Monitor Driver; C:\Windows\system32\DRIVERS\ctxusbm.sys [2014-01-08 96872]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2014-08-26 283064]
R1 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2009-02-17 31400]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
R1 VD_FileDisk;VD_FileDisk; C:\Windows\system32\drivers\VD_FileDisk.sys [2011-01-26 30312]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [2014-08-26 314016]
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [2014-08-26 43680]
R3 Afc;PPdus ASPI Shell; C:\Windows\SysWOW64\drivers\Afc.sys [2006-11-14 22784]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2014-11-21 18959360]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2014-11-21 589312]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2014-06-21 94720]
R3 ElbyCDFL;ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [2007-02-16 40648]
R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2014-07-03 33344]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-06-12 4060560]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2012-03-27 356632]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2012-03-27 789272]
R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys [2013-05-23 76568]
R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys [2013-05-23 59160]
R3 MBfilt;MBfilt; C:\Windows\system32\drivers\MBfilt64.sys [2009-11-18 32344]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2011-11-09 60184]
R3 NTIOLib_1_0_3;NTIOLib_1_0_3; \??\C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [2010-01-18 14136]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2012-02-16 676968]
R3 tap0901;TAP-Win32 Adapter V9; C:\Windows\system32\DRIVERS\tap0901.sys [2011-07-01 31232]
R3 usbscan;Ovladač skeneru USB; C:\Windows\system32\drivers\usbscan.sys [2013-07-03 42496]
S3 7ByteIo;7ByteIo; C:\Windows\system32\drivers\7ByteIo.sys []
S3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2014-11-21 18959360]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 grmnusb;grmnusb; C:\Windows\system32\drivers\grmnusb.sys [2012-04-18 19304]
S3 IT9135BDA;IT9135 BDA Devices; C:\Windows\System32\Drivers\IT9135BDA.sys [2014-04-23 165504]
S3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [2010-05-10 33592]
S3 nmwcd;Nokia USB Phone Parent Driver; C:\Windows\system32\drivers\ccdcmbx64.sys [2012-01-09 19968]
S3 nmwcdc;Nokia USB Communication Driver; C:\Windows\system32\drivers\ccdcmbox64.sys [2012-01-09 27136]
S3 npkcusb;npkcusb; C:\Windows\system32\drivers\npkcusb.sys []
S3 NPPTNT2;NPPTNT2; \??\C:\Windows\syswow64\npptNT2.sys [2006-02-04 4682]
S3 NTIOLib_1_0_4;NTIOLib_1_0_4; \??\C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [2010-10-22 14136]
S3 NTIOLib_1_0_6;NTIOLib_1_0_6; \??\C:\Program Files (x86)\Setup Files\Ms7752v260\NTIOLib_X64.sys [2011-01-06 11888]
S3 PAC207;SoC PC-Camera; C:\Windows\system32\DRIVERS\PFC027.SYS [2006-12-05 572416]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2012-06-11 26112]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2015-01-31 20992]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 tap0801;TAP-Win32 Adapter V8; C:\Windows\system32\DRIVERS\tap0801.sys [2005-04-13 30720]
S3 tapoas;TAP-Win32 Adapter OAS; C:\Windows\system32\DRIVERS\tapoas.sys [2011-08-19 30720]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [2012-01-09 9216]
S3 usbser;USB Modem Driver; C:\Windows\system32\drivers\usbser.sys [2013-08-29 33280]
S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltjx64.sys [2012-01-09 9216]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2015-01-18 172344]
R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-05-08 65432]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2014-11-21 244736]
R2 c2cautoupdatesvc;Skype Click to Call Updater; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
R2 c2cpnrsvc;Skype Click to Call PNR Service; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
R2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service; C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe [2014-10-28 244448]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-03-07 629984]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-03-29 165144]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2012-03-29 277784]
R2 MSI_SuperCharger;MSI_SuperCharger; C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe [2012-06-29 136704]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-03-29 363800]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S2 7afe6f36;LinkMonitor; C:\Windows\syswow64\rundll32.exe [2009-07-14 44544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-28 107912]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-01-02 315488]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15 268464]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-28 107912]
S3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2011-08-30 160256]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-03-13 114688]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe [2013-06-13 357144]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2013-12-19 30814400]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2015-04-05 148080]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\syswow64\GameMon.des [2014-05-06 3071632]
S3 OpenVPNService;OpenVPN Service; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [2011-07-01 14848]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2012-06-11 724376]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-02-15 543144]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-06-30 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Zdravim


Bude to tou haveti

Odinstalujte

• Skype Click to Call - adware z instalace Skypu http://forum.viry.cz/viewtopic.php?p=1374439#p1374439

V ramci cisteni Vam budou vyprazdneny docasne adresare (vcetne Kose).

Ulozte na plochu AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/ (nebo http://www.bleepingcomputer.com/download/adwcleaner/ )

• ukoncete vsechny programy
• kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
• kliknete na Scan, pote na Cleaning
• po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\AdwCleaner [Sx].txt), jehoz obsah mi zkopirujte do pristi odpovedi

Horovo..zde je log.

# AdwCleaner v4.201 - Log vytvořen 17/04/2015 v 14:34:59
# Aktualizováno 08/04/2015 by Xplode
# Databáze : 2015-04-15.1 [Server]
# Operační system : Windows 7 Ultimate Service Pack 1 (x64)
# Uživatelské jméno : Methanol - METHANOL-PC
# Spuštěno z : C:\Users\Methanol\Desktop\adwcleaner_4.201.exe
# Nastavení : Čištění

***** [ Služby ] *****

[#] Služba Smazáno : 7afe6f36

***** [ Soubory / Složky ] *****

Složka Smazáno : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileViewPro
Složka Smazáno : C:\Program Files (x86)\DriverToolkit
Složka Smazáno : C:\Program Files (x86)\bestadblocker
Složka Smazáno : C:\Program Files (x86)\SalEPlUs
Složka Smazáno : C:\Program Files\FileViewPro
Složka Smazáno : C:\Users\Methanol\AppData\Local\FileViewPro
Složka Smazáno : C:\Users\Methanol\AppData\Local\DriverToolkit
Složka Smazáno : C:\Users\Methanol\AppData\Roaming\Mozilla\Firefox\Profiles\apsa6ci0.default-1412009044122\Extensions\a7@EctBz.org
Složka Smazáno : C:\Users\Methanol\AppData\Roaming\Mozilla\Firefox\Profiles\apsa6ci0.default-1412009044122\Extensions\touD@QcDm.com
Složka Smazáno : C:\Users\Methanol\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\cigiagpbkapepgklncnajbakkpkopmam
Složka Smazáno : C:\Users\Methanol\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\dfohdbmjdkfijghgklbickfnaepghgba

***** [ Naplánované úlohy ] *****


***** [ Zástupci ] *****


***** [ Registry ] *****

Klíč Smazáno : HKLM\SOFTWARE\Classes\P285032df_c4b9_4998_b0b3_c3bab9a93d4d_.P285032df_c4b9_4998_b0b3_c3bab9a93d4d_
Klíč Smazáno : HKLM\SOFTWARE\Classes\P285032df_c4b9_4998_b0b3_c3bab9a93d4d_.P285032df_c4b9_4998_b0b3_c3bab9a93d4d_.9
Klíč Smazáno : HKLM\SOFTWARE\Classes\P6fde9cdd_fad4_4b48_bf39_0eff0b096b20_.P6fde9cdd_fad4_4b48_bf39_0eff0b096b20_
Klíč Smazáno : HKLM\SOFTWARE\Classes\P6fde9cdd_fad4_4b48_bf39_0eff0b096b20_.P6fde9cdd_fad4_4b48_bf39_0eff0b096b20_.9
Klíč Smazáno : HKLM\SOFTWARE\5f57329b-feee-d078-1145-2a4ada0c428d
Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{7afe6f36}
Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{285032df-c4b9-4998-b0b3-c3bab9a93d4d}
Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{6fde9cdd-fad4-4b48-bf39-0eff0b096b20}
Klíč Smazáno : HKLM\SOFTWARE\Classes\TypeLib\{C1EC170E-C5ED-4100-9078-559C31AFDBF5}
Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{285032df-c4b9-4998-b0b3-c3bab9a93d4d}
Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6fde9cdd-fad4-4b48-bf39-0eff0b096b20}
Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{285032df-c4b9-4998-b0b3-c3bab9a93d4d}
Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6fde9cdd-fad4-4b48-bf39-0eff0b096b20}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\CLSID\{285032df-c4b9-4998-b0b3-c3bab9a93d4d}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Classes\CLSID\{6fde9cdd-fad4-4b48-bf39-0eff0b096b20}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{285032df-c4b9-4998-b0b3-c3bab9a93d4d}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6fde9cdd-fad4-4b48-bf39-0eff0b096b20}
Klíč Smazáno : HKCU\Software\DriverToolkit
Klíč Smazáno : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Klíč Smazáno : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Klíč Smazáno : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Klíč Smazáno : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Klíč Smazáno : HKU\.DEFAULT\Software\Goobzo
Klíč Smazáno : HKU\.DEFAULT\Software\ImInstaller
Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507}
Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}
Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B696F285-F54E-2524-58B1-E06A70ABE6BE}
Klíč Smazáno : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileViewPro_is1

***** [ Prohlížeče ] *****

-\\ Internet Explorer v11.0.9600.17728


-\\ Mozilla Firefox v37.0.1 (x86 cs)

[apsa6ci0.default-1412009044122\prefs.js] - Řádek Smazáno : user_pref("extensions.fDbe6UYdAeV5x4lC.scode", "(function(){try{if(window.self.location.href.indexOf(\"qdwFqjg8rHYHqTn8pdU4qdkGqY\")>-1){return;}}catch(e){}try{var d=[[\"trianglecash.com\",\"acebook\"[...]
[apsa6ci0.default-1412009044122\prefs.js] - Řádek Smazáno : user_pref("extensions.vTHRmD58pG1FJm0x.scode", "(function(){try{if(window.self.location.href.indexOf(\"qdwFqjg8rHYHqTn8pdU4qdkGqY\")>-1){return;}}catch(e){}try{var d=[[\"trianglecash.com\",\"acebook\"[...]

-\\ Google Chrome v42.0.2311.90


-\\ Comodo Dragon v


-\\ Chrome Canary v


*************************

AdwCleaner[R10].txt - [5566 bytů] - [17/04/2015 14:34:30]
AdwCleaner[R7].txt - [6763 bytů] - [08/01/2015 22:17:19]
AdwCleaner[R8].txt - [6823 bytů] - [09/01/2015 22:09:01]
AdwCleaner[R9].txt - [991 bytů] - [18/01/2015 14:57:53]
AdwCleaner[S5].txt - [6820 bytů] - [09/01/2015 22:09:38]
AdwCleaner[S6].txt - [1051 bytů] - [18/01/2015 14:59:45]
AdwCleaner[S7].txt - [5286 bytů] - [17/04/2015 14:34:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S7].txt - [5344 bytů] ##########

Dejte log FRST.txt, prilozte i Addition.txt - http://forum.viry.cz/viewtopic.php?f=30&t=133101

Zde je log z FRST..


Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-04-2015 04
Ran by Methanol (administrator) on METHANOL-PC on 17-04-2015 14:51:12
Running from C:\Users\Methanol\Downloads
Loaded Profiles: Methanol (Available profiles: Methanol & Lucinka)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Foxit Software Inc.) C:\Program Files (x86)\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(MSI) C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe
(ITE Tech. Inc.) C:\Windows\System32\IRMonitor.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
() C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe
() C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe
(MSI) C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Citrix Systems) C:\Program Files (x86)\DynamicUSBTool\DynamicUSB.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [THXCfg64] => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [itype] => C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [THX Audio Control Panel] => C:\Program Files (x86)\Creative\THX TruStudio Pro\THXAudioCP\THXAudio.exe [1517056 2011-08-29] (Creative Technology Ltd)
HKLM-x32\...\Run: [ControlCenterCount] => C:\Program Files (x86)\MSI\ControlCenter\ControlCenterCount.exe [872448 2012-03-26] (MSI CO.,LTD.)
HKLM-x32\...\Run: [Super-Charger] => C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe [495616 2012-07-27] (MSI)
HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [DynamicUSB] => C:\Program Files (x86)\DynamicUSBTool\DynamicUSB.exe [94208 2007-03-02] (Citrix Systems)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NCUpdateHelper] => C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe [526240 2014-05-23] (NCSOFT Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31344744 2015-02-26] (Skype Technologies S.A.)
HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\...\Run: [icq] => C:\Users\Methanol\AppData\Roaming\ICQM\icq.exe [36705800 2015-02-19] (ICQ)
HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
Startup: C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.lnk
ShortcutTarget: Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.lnk -> C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe ()
Startup: C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\going-clear-scientology-and-the-prison-of-belief-cze-6117369.lnk
ShortcutTarget: going-clear-scientology-and-the-prison-of-belief-cze-6117369.lnk -> C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/en-us/?pc=UP97&ocid=UP97DHP
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {008D53BB-0E84-430b-9B4A-A43C267C9C7F} URL = http://www.google.com/cse?cx=partner-pu ... earchTerms}
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {0BF888DB-6AA7-4AA2-A03E-54BEC6D679F4} URL = http://tv.seznam.cz/hledej?w={searchTer ... arch_13415
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {1EF993F7-8933-4946-B5B3-4A3E334DB1DA} URL = http://slovnik.seznam.cz/?q={searchTerm ... arch_13415
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {243A73EC-6BEC-454B-879A-0F70F87DD217} URL = http://slovnik.seznam.cz/?q={searchTerm ... arch_13415
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {3096F0A0-CEB6-4441-886C-15AECEA85365} URL = http://encyklopedie.seznam.cz/search?q= ... arch_13415
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {4E10AFAE-990F-46F6-8206-9AA8CF49865F} URL = http://www.mapy.cz/?query={searchTerms} ... arch_13415
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchT ... {startPage}
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {984DF530-066C-4BAF-95BC-0FDA95DBB8A0} URL = http://search.seznam.cz/?q={searchTerms ... arch_13415
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {A144453D-F0A9-48C5-880C-E3EDAD9F139C} URL = http://www.firmy.cz/?q={searchTerms}&so ... arch_13415
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {AE8CD03F-B869-483C-B597-91EEEBDD29D3} URL = http://www.novinky.cz/hledej?w={searchT ... arch_13415
SearchScopes: HKU\S-1-5-21-2973342720-1030308514-1458377291-1000 -> {C20F8244-C3B9-4FD7-9FD6-D9D9C7337CBB} URL = http://www.zbozi.cz/?q={searchTerms}&r= ... arch_13415
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2013-07-31] (Logitech, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2013-07-31] (Logitech, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Methanol\AppData\Roaming\Mozilla\Firefox\Profiles\apsa6ci0.default-1412009044122
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine:
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-10-20] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll [2014-11-18] (Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-07] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-05-08] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2013-10-05]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2015-04-05] <==== ATTENTION

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HomePage: Default -> hxxp://www.msn.com/en-us/?pc=UP97&ocid=UP97DHP
CHR StartupUrls: Default -> "hxxp://www.msn.com/en-us/?pc=UP97&ocid=UP97DHP"
CHR Profile: C:\Users\Methanol\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Methanol\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-18]
CHR Extension: (Google Search) - C:\Users\Methanol\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-18]
CHR Extension: (Bookmark Manager) - C:\Users\Methanol\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-15]
CHR Extension: (Google Wallet) - C:\Users\Methanol\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-26]
CHR Extension: (Gmail) - C:\Users\Methanol\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-18]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2015-01-18] (SUPERAntiSpyware.com)
R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 FoxitCloudUpdateService; C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\Foxit Cloud\FCUpdateService.exe [244448 2014-10-28] (Foxit Software Inc.)
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-03-29] (Intel Corporation)
R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe [136704 2012-06-29] (MSI) [File not signed]
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3071632 2014-05-06] (INCA Internet Co., Ltd.)
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [14848 2011-07-01] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 7ByteIo; No ImagePath
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-08-26] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-08-26] (Disc Soft Ltd)
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-16] (SlySoft, Inc.)
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [165504 2014-04-23] (ITE )
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-08-26] ()
S3 MSI_MSIBIOS_010507; C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [33592 2010-05-10] (Your Corporation)
S3 npkcusb; No ImagePath
S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2006-02-04] (INCA Internet Co., Ltd.) [File not signed]
R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [14136 2010-01-18] (MSI)
S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
S3 NTIOLib_1_0_6; C:\Program Files (x86)\Setup Files\Ms7752v260\NTIOLib_X64.sys [11888 2011-01-06] (MSI) [File not signed]
S3 PAC207; C:\Windows\System32\DRIVERS\PFC027.SYS [572416 2006-12-05] (PixArt Imaging Inc.)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-08-26] (Duplex Secure Ltd.)
S3 tap0801; C:\Windows\System32\DRIVERS\tap0801.sys [30720 2005-04-13] (The OpenVPN Project) [File not signed]
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2011-08-19] (The OpenVPN Project)
R1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [30312 2011-01-26] (CaptainFlint Software)
S3 X86BDA; C:\Windows\System32\DRIVERS\OEMDrv.sys [268416 2011-06-08] ( )
U3 amsf6ftn; C:\Windows\System32\Drivers\amsf6ftn.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero size file/folder)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-17 14:51 - 2015-04-17 14:51 - 00020083 _____ () C:\Users\Methanol\Downloads\FRST.txt
2015-04-17 14:50 - 2015-04-17 14:51 - 00000000 ____D () C:\FRST
2015-04-17 14:50 - 2015-04-17 14:50 - 02097664 _____ (Farbar) C:\Users\Methanol\Downloads\FRST64.exe
2015-04-17 14:24 - 2015-04-17 14:24 - 02217984 _____ () C:\Users\Methanol\Desktop\adwcleaner_4.201.exe
2015-04-17 13:06 - 2015-04-17 13:06 - 00000000 ____D () C:\rsit
2015-04-17 13:05 - 2015-04-17 13:05 - 01222144 _____ () C:\Users\Methanol\Downloads\RSITx64.exe
2015-04-15 10:57 - 2015-04-15 10:57 - 00081003 _____ () C:\Users\Methanol\Desktop\going-clear-scientology-and-the-prison-of-belief-cze-6117369.zip
2015-04-15 10:56 - 2015-04-15 10:56 - 00000000 ____D () C:\Program Files (x86)\LinkMonitor
2015-04-15 10:55 - 2015-04-15 10:55 - 00000000 ____D () C:\ProgramData\7044438373684523921
2015-04-15 10:54 - 2015-04-15 10:54 - 00000000 ____D () C:\ProgramData\anblmglnjdcgmpenbheeddcopcfpkldl
2015-04-15 10:53 - 2015-04-16 07:50 - 00000000 ____D () C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}
2015-04-15 10:53 - 2015-04-15 10:53 - 00374272 _____ () C:\Users\Methanol\Downloads\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe
2015-04-15 08:31 - 2015-04-02 02:17 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-15 08:31 - 2015-04-02 01:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-04-15 08:31 - 2015-03-25 05:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-15 08:31 - 2015-03-25 05:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-15 08:31 - 2015-03-25 05:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-15 08:31 - 2015-03-25 05:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-15 08:31 - 2015-03-25 05:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-15 08:31 - 2015-03-25 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-15 08:31 - 2015-03-25 05:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-15 08:31 - 2015-03-25 05:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-15 08:31 - 2015-03-25 05:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-15 08:31 - 2015-03-25 05:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-15 08:31 - 2015-03-25 05:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 08:31 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-15 08:31 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-15 08:31 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-15 08:31 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-15 08:31 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-15 08:31 - 2015-03-23 05:25 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-15 08:31 - 2015-03-23 05:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-15 08:31 - 2015-03-23 05:24 - 00957952 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-15 08:31 - 2015-03-23 05:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-15 08:31 - 2015-03-23 05:24 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-15 08:31 - 2015-03-23 05:24 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-15 08:31 - 2015-03-23 05:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-15 08:31 - 2015-03-23 05:17 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-15 08:31 - 2015-03-17 07:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-15 08:31 - 2015-03-17 07:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-15 08:31 - 2015-03-17 07:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-15 08:31 - 2015-03-17 07:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-15 08:31 - 2015-03-17 07:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-15 08:31 - 2015-03-17 07:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-15 08:31 - 2015-03-17 07:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-15 08:31 - 2015-03-17 07:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-15 08:31 - 2015-03-17 07:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-15 08:31 - 2015-03-17 07:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-15 08:31 - 2015-03-17 07:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-04-15 08:31 - 2015-03-17 07:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-15 08:31 - 2015-03-17 07:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-15 08:31 - 2015-03-17 07:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-15 08:31 - 2015-03-17 07:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 07:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-04-15 08:31 - 2015-03-17 07:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-04-15 08:31 - 2015-03-17 06:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-15 08:31 - 2015-03-17 06:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-15 08:31 - 2015-03-17 06:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-04-15 08:31 - 2015-03-17 06:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-15 08:31 - 2015-03-17 06:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-04-15 08:31 - 2015-03-17 06:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-04-15 08:31 - 2015-03-17 06:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-04-15 08:31 - 2015-03-17 06:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-04-15 08:31 - 2015-03-17 06:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-15 08:31 - 2015-03-17 06:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-15 08:31 - 2015-03-17 06:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-04-15 08:31 - 2015-03-17 06:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-04-15 08:31 - 2015-03-17 06:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-04-15 08:31 - 2015-03-17 06:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-04-15 08:31 - 2015-03-17 06:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-15 08:31 - 2015-03-17 06:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-04-15 08:31 - 2015-03-17 06:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-15 08:31 - 2015-03-17 06:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-15 08:31 - 2015-03-17 06:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 05:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-15 08:31 - 2015-03-17 05:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-15 08:31 - 2015-03-17 05:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 05:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 05:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 08:31 - 2015-03-17 05:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-15 08:31 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-15 08:31 - 2015-03-13 06:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-15 08:31 - 2015-03-13 06:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-15 08:31 - 2015-03-13 06:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-15 08:31 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-15 08:31 - 2015-03-13 06:08 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-15 08:31 - 2015-03-13 06:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-15 08:31 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-15 08:31 - 2015-03-13 06:06 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-15 08:31 - 2015-03-13 06:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-15 08:31 - 2015-03-13 05:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-15 08:31 - 2015-03-13 05:55 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-15 08:31 - 2015-03-13 05:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-15 08:31 - 2015-03-13 05:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-15 08:31 - 2015-03-13 05:53 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-15 08:31 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-15 08:31 - 2015-03-13 05:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-15 08:31 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-15 08:31 - 2015-03-13 05:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-04-15 08:31 - 2015-03-13 05:40 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-15 08:31 - 2015-03-13 05:32 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-15 08:31 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-15 08:31 - 2015-03-13 05:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-04-15 08:31 - 2015-03-13 05:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-04-15 08:31 - 2015-03-13 05:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-15 08:31 - 2015-03-13 05:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-04-15 08:31 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-15 08:31 - 2015-03-13 05:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-04-15 08:31 - 2015-03-13 05:23 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-15 08:31 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-04-15 08:31 - 2015-03-13 05:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-04-15 08:31 - 2015-03-13 05:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-04-15 08:31 - 2015-03-13 05:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-04-15 08:31 - 2015-03-13 05:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-04-15 08:31 - 2015-03-13 05:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-04-15 08:31 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-15 08:31 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-15 08:31 - 2015-03-13 05:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-04-15 08:31 - 2015-03-13 05:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-15 08:31 - 2015-03-13 05:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-15 08:31 - 2015-03-13 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-15 08:31 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-15 08:31 - 2015-03-13 04:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-04-15 08:31 - 2015-03-13 04:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-04-15 08:31 - 2015-03-13 04:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-04-15 08:31 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-15 08:31 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-15 08:31 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-15 08:31 - 2015-03-13 04:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-04-15 08:31 - 2015-03-13 04:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-04-15 08:31 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-15 08:31 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-15 08:31 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-15 08:31 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-15 08:31 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-15 08:31 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-04-15 08:31 - 2015-03-10 05:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 08:31 - 2015-03-10 05:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-15 08:31 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-15 08:31 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-15 08:31 - 2015-03-05 07:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 08:31 - 2015-03-05 06:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-15 08:31 - 2015-02-25 05:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-15 08:29 - 2015-03-04 06:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 08:29 - 2015-03-04 06:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 08:29 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-09 21:49 - 2015-04-09 21:49 - 00000000 ____D () C:\Users\Methanol\Desktop\BOLKA
2015-04-09 17:25 - 2015-04-09 17:25 - 07624781 _____ () C:\Users\Methanol\Downloads\FW__Mlad%c3%a1_Boleslav-star%c3%a9_fotky.zip
2015-04-09 15:46 - 2015-04-09 15:46 - 00465920 _____ () C:\Users\Methanol\Downloads\SPINTIRES_ Offroad Truck Simulator OTS PC CODEX.exe
2015-04-09 15:44 - 2015-04-09 15:45 - 01563152 _____ (Dummy, Ltd.) C:\Users\Methanol\Downloads\Off road drive skidrow torrent dragon torrents_10924_i50916045_il345.exe
2015-04-09 14:39 - 2015-04-09 14:40 - 17144378 _____ () C:\Users\Methanol\Downloads\l2mid_live_patch_v2.rar
2015-04-09 13:57 - 2015-04-09 13:57 - 00000786 _____ () C:\Users\Public\Desktop\Far Cry 4.lnk
2015-04-09 13:57 - 2015-04-09 13:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-04-05 12:46 - 2015-04-05 12:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-04 09:19 - 2015-04-04 09:19 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-04 09:19 - 2015-04-04 09:19 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-03 19:06 - 2015-04-09 14:39 - 00000000 ____D () C:\Users\Methanol\Desktop\l2-mid
2015-04-03 19:03 - 2015-04-03 19:04 - 16645637 _____ () C:\Users\Methanol\Downloads\l2mid_live_patch.rar
2015-04-03 08:32 - 2015-04-03 08:32 - 00000000 ____D () C:\Users\Methanol\Tracing
2015-03-31 21:23 - 2015-03-31 21:23 - 00000000 ____D () C:\Users\Methanol\Documents\Ghost Games
2015-03-31 21:22 - 2015-03-31 21:22 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\Need for Speed Rivals
2015-03-31 18:19 - 2015-03-31 18:19 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\AMD
2015-03-31 17:13 - 2015-03-31 17:13 - 00003178 _____ () C:\Windows\System32\Tasks\{C78E8831-B077-4CAD-9A4B-3544D4A08AB6}
2015-03-31 16:06 - 2015-03-31 16:28 - 00000000 ____D () C:\Users\Methanol\AppData\Local\Ubisoft Game Launcher
2015-03-31 16:06 - 2015-03-31 16:19 - 00000857 _____ () C:\Users\Methanol\Desktop\Uplay.lnk
2015-03-31 16:06 - 2015-03-31 16:06 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-03-31 16:06 - 2015-03-31 16:06 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2015-03-31 15:50 - 2015-03-31 15:50 - 00003082 _____ () C:\Windows\System32\Tasks\{868CC672-5182-4883-964B-45CEE9A0B790}
2015-03-31 15:50 - 2015-03-31 15:50 - 00000000 ____D () C:\Users\Methanol\AppData\Local\Ubisoft
2015-03-31 15:30 - 2015-03-31 15:30 - 00001298 _____ () C:\Users\Methanol\Desktop\SniperGhostWarrior2.exe – zástupce.lnk
2015-03-31 13:29 - 2015-03-31 13:29 - 00239272 _____ () C:\Users\Methanol\Downloads\Sniper-Ghost-Warrior-2.cestina.rar
2015-03-31 13:29 - 2015-03-31 13:29 - 00000000 ____D () C:\Users\Methanol\Downloads\Sniper-Ghost-Warrior-2.cestina
2015-03-31 13:27 - 2015-03-31 13:27 - 08043160 _____ () C:\Users\Methanol\Downloads\Sniper-Ghost-Warrior-2-Crack---100%-Funkčný-!-.rar
2015-03-30 18:03 - 2015-03-30 18:03 - 00000000 ____D () C:\Users\Methanol\Documents\TrialsFusion
2015-03-30 17:48 - 2015-03-30 17:48 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NFS Most Wanted
2015-03-30 17:48 - 2015-03-30 17:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NFS Most Wanted
2015-03-30 17:47 - 2015-03-30 17:47 - 00287363 _____ () C:\Users\Methanol\Downloads\nfsmw_cz.rar
2015-03-30 10:49 - 2015-04-17 13:34 - 00000000 ____D () C:\Users\Methanol\Desktop\2015-03-30 Krisštof x Davidová
2015-03-30 10:04 - 2015-03-30 10:04 - 00003072 _____ () C:\Windows\System32\Tasks\{00D6F48C-F9AC-41AC-A82B-90D4A57CD846}
2015-03-28 21:28 - 2015-03-28 21:28 - 00000000 ____D () C:\Users\Methanol\Documents\Criterion Games
2015-03-28 21:26 - 2015-03-28 21:27 - 02534153 _____ () C:\Users\Methanol\Downloads\cestiny_1555_cz_nfsmw_80.rar
2015-03-28 21:16 - 2015-03-28 21:16 - 00001088 _____ () C:\Users\Methanol\Desktop\Play Need For Speed Most Wanted 2012.lnk
2015-03-28 19:19 - 2015-03-28 19:19 - 00482816 _____ () C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition-BLUS31024.iso Torrent - KickassTorrents(1).exe
2015-03-28 19:19 - 2015-03-28 19:19 - 00480768 _____ () C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition-BLUS31024.iso Torrent - KickassTorrents.exe
2015-03-28 15:11 - 2015-03-29 10:00 - 00000000 ____D () C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}
2015-03-28 15:11 - 2015-03-28 15:11 - 00477696 _____ () C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe
2015-03-28 13:26 - 2015-03-28 13:27 - 00000000 ____D () C:\Users\Methanol\Documents\NFS Carbon
2015-03-28 13:25 - 2015-03-28 13:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts
2015-03-28 12:24 - 2015-03-28 12:25 - 00000748 _____ () C:\Users\Methanol\Desktop\golf.txt
2015-03-27 11:02 - 2015-03-27 11:02 - 00004608 _____ () C:\Users\Methanol\Downloads\OPLT JOSEF.p12
2015-03-26 18:37 - 2015-03-26 18:37 - 00000000 ____D () C:\Users\Methanol\AppData\Local\Fallout3
2015-03-26 18:33 - 2015-03-26 18:33 - 00000000 ____D () C:\Windows\SysWOW64\xlive
2015-03-24 17:38 - 2015-03-24 17:40 - 00000000 ____D () C:\Users\Methanol\Desktop\vinec
2015-03-24 10:59 - 2015-03-24 10:59 - 00012288 ___SH () C:\Users\Methanol\Documents\Thumbs.db
2015-03-20 10:15 - 2015-03-20 10:16 - 00000000 ____D () C:\Users\Methanol\Desktop\Chilli
2015-03-20 09:48 - 2015-03-20 09:48 - 00001104 _____ () C:\Users\Methanol\Desktop\l2.exe – zástupce (2).lnk
2015-03-19 16:38 - 2015-03-19 16:38 - 00000000 ____D () C:\L2
2015-03-19 16:36 - 2006-02-04 04:50 - 00005174 _____ () C:\Windows\SysWOW64\nppt9x.vxd
2015-03-19 16:36 - 2006-02-04 04:50 - 00004682 _____ (INCA Internet Co., Ltd.) C:\Windows\SysWOW64\npptNT2.sys
2015-03-19 16:33 - 2015-04-17 14:40 - 00000000 ____D () C:\Program Files (x86)\Lineage II
2015-03-19 15:47 - 2015-03-19 15:47 - 00003146 _____ () C:\Windows\System32\Tasks\{77BD7016-808B-46F3-96AA-A8821E6D3BA5}

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-17 14:43 - 2009-07-14 06:45 - 00023504 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-17 14:43 - 2009-07-14 06:45 - 00023504 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-17 14:41 - 2009-07-14 17:18 - 00668882 _____ () C:\Windows\system32\perfh005.dat
2015-04-17 14:41 - 2009-07-14 17:18 - 00141542 _____ () C:\Windows\system32\perfc005.dat
2015-04-17 14:41 - 2009-07-14 07:13 - 01584626 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-17 14:38 - 2015-01-18 14:55 - 01655891 _____ () C:\Windows\WindowsUpdate.log
2015-04-17 14:38 - 2012-07-01 17:10 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\Skype
2015-04-17 14:35 - 2015-01-29 16:06 - 00009900 _____ () C:\Windows\setupact.log
2015-04-17 14:35 - 2015-01-28 22:16 - 00000948 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-17 14:35 - 2015-01-08 22:16 - 00000000 ____D () C:\AdwCleaner
2015-04-17 14:35 - 2014-04-23 15:01 - 00000048 _____ () C:\monitor.log
2015-04-17 14:35 - 2012-11-01 23:14 - 00003034 _____ () C:\Windows\System32\Tasks\MSIAfterburner
2015-04-17 14:35 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-17 14:27 - 2015-01-28 22:16 - 00000952 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-17 14:25 - 2013-02-16 21:39 - 00000974 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000UA.job
2015-04-17 14:23 - 2012-12-24 12:19 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2015-04-17 14:22 - 2012-07-01 17:10 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-17 14:11 - 2012-06-30 11:31 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-17 13:43 - 2014-11-23 12:21 - 00000000 ____D () C:\Users\Methanol\Desktop\Já
2015-04-17 13:12 - 2014-11-01 18:42 - 00000000 ____D () C:\Program Files (x86)\Citrix
2015-04-17 13:10 - 2014-11-01 18:42 - 00000000 ____D () C:\CitrixUSBStore
2015-04-17 13:06 - 2012-07-27 11:37 - 00000000 ____D () C:\Program Files\trend micro
2015-04-17 11:24 - 2014-07-01 15:37 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-16 10:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2015-04-16 08:08 - 2013-11-10 13:21 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\Awesomium
2015-04-15 14:22 - 2014-12-11 00:56 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-15 14:22 - 2014-04-30 08:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-15 14:12 - 2013-12-11 10:11 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-15 14:12 - 2012-06-30 11:31 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-15 14:12 - 2012-06-30 11:31 - 00003852 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-15 13:34 - 2015-01-28 22:23 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-15 11:56 - 2012-08-15 09:13 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-15 11:55 - 2013-11-24 14:59 - 01559340 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-15 11:53 - 2013-08-15 15:53 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 11:49 - 2012-06-30 14:30 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-15 11:49 - 2009-07-14 04:34 - 00000521 _____ () C:\Windows\win.ini
2015-04-15 10:58 - 2012-08-27 21:07 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\XBMC
2015-04-14 23:16 - 2012-07-15 22:20 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\uTorrent
2015-04-14 19:25 - 2013-02-16 21:39 - 00000922 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000Core.job
2015-04-10 20:14 - 2012-07-01 10:34 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\TS3Client
2015-04-09 15:20 - 2014-07-03 22:33 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\Hamachi
2015-04-09 14:24 - 2013-03-07 20:26 - 00000000 ____D () C:\Users\Methanol\Desktop\Obrazky
2015-04-09 14:01 - 2012-11-30 15:39 - 00000000 ____D () C:\Users\Methanol\Documents\My Games
2015-04-08 07:52 - 2012-06-30 11:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-03 08:32 - 2012-06-30 10:58 - 00000000 ____D () C:\Users\Methanol
2015-04-03 08:20 - 2012-07-01 17:10 - 00000000 ____D () C:\ProgramData\Skype
2015-03-31 16:18 - 2015-01-29 19:05 - 00199390 _____ () C:\Windows\DirectX.log
2015-03-31 16:06 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-03-30 19:37 - 2012-07-03 16:07 - 00000000 ____D () C:\Windows\SysWOW64\directx
2015-03-28 13:25 - 2014-07-03 23:54 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-03-28 12:25 - 2015-02-19 12:23 - 00000792 _____ () C:\Users\Methanol\Desktop\Pražská.txt
2015-03-26 18:33 - 2012-06-30 11:05 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-26 18:32 - 2013-01-24 12:32 - 00000000 ____D () C:\Users\Methanol\AppData\Roaming\DAEMON Tools Lite
2015-03-25 11:30 - 2012-11-22 17:54 - 00000000 ____D () C:\Users\Methanol\AppData\Local\Adobe
2015-03-21 13:06 - 2015-03-03 20:11 - 00001026 _____ () C:\Users\Methanol\Desktop\Play L2Citadel.lnk
2015-03-21 13:06 - 2015-02-09 12:28 - 00001370 _____ () C:\Users\Methanol\Desktop\L2Citadel Updater.exe – zástupce.lnk
2015-03-20 09:36 - 2012-06-30 11:35 - 00110136 _____ () C:\Users\Methanol\AppData\Local\GDIPFONTCACHEV1.DAT
2015-03-20 09:36 - 2009-07-14 06:45 - 00415944 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-19 16:33 - 2015-01-03 17:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lineage II

==================== Files in the root of some directories =======

2013-07-05 23:07 - 2013-07-05 23:07 - 0000037 ___SH () C:\Users\Methanol\AppData\Local\1754111884ee9ab5277ca00.95260103
2014-06-07 11:21 - 2014-07-22 21:15 - 0005120 _____ () C:\Users\Methanol\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-11-19 15:27 - 2012-11-19 15:27 - 0003072 _____ () C:\Users\Methanol\AppData\Local\file__0.localstorage
2012-07-01 14:11 - 2012-11-13 18:36 - 0007597 _____ () C:\Users\Methanol\AppData\Local\Resmon.ResmonCfg
2014-07-22 18:47 - 2014-07-22 18:47 - 0000041 ___SH () C:\ProgramData\.zreglib

Some content of TEMP:
====================
C:\Users\Methanol\AppData\Local\Temp\3B30.exe
C:\Users\Methanol\AppData\Local\Temp\AutoRun.exe
C:\Users\Methanol\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Methanol\AppData\Local\Temp\C90.exe
C:\Users\Methanol\AppData\Local\Temp\DSETUP.dll
C:\Users\Methanol\AppData\Local\Temp\dsetup32.dll
C:\Users\Methanol\AppData\Local\Temp\DXSETUP.exe
C:\Users\Methanol\AppData\Local\Temp\EAInstall.dll
C:\Users\Methanol\AppData\Local\Temp\Quarantine.exe
C:\Users\Methanol\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Methanol\AppData\Local\Temp\sqlite3.dll
C:\Users\Methanol\AppData\Local\Temp\_isDBAE.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-14 13:26

==================== End Of Log ============================

A zde je log adition.txt


Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-04-2015 04
Ran by Methanol at 2015-04-17 14:51:29
Running from C:\Users\Methanol\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM-x32\...\uTorrent) (Version: 3.3.0.29625 - BitTorrent Inc.)
µTorrent (HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\...\uTorrent) (Version: 3.4.2.37754 - BitTorrent Inc.)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Czech (HKLM-x32\...\{AC76BA86-7AD7-1029-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.02.0000 - Ubisoft)
Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden
ArcSoft TotalMedia 3.5 (HKLM-x32\...\{29E44E9D-ACB2-4D2D-849F-5361C941B7E1}) (Version: 3.5.7.282 - ArcSoft)
Balíček ovladače systému Windows - Nokia Modem (02/25/2011 4.7) (HKLM\...\E0AC723A3DE3A04256288CADBBB011B112AED454) (Version: 02/25/2011 4.7 - Nokia)
Balíček ovladače systému Windows - Nokia Modem (02/25/2011 7.01.0.9) (HKLM\...\72A50F48CC5601190B9C4E74D81161693133E7F7) (Version: 02/25/2011 7.01.0.9 - Nokia)
Balíček ovladače systému Windows - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.0.0.0 - Electronic Arts)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.0.0.0 - Electronic Arts)
Borderlands 2 (HKLM-x32\...\Borderlands 2) (Version: 1.5.0 - 2K Games)
CCleaner (HKLM\...\CCleaner) (Version: 3.24 - Piriform)
CLICKBIOSII (HKLM-x32\...\{EBCB111F-4907-4B28-BD03-F5BD901106D2}_is1) (Version: 1.0.089 - MSI)
CloneCD (HKLM-x32\...\CloneCD) (Version: - SlySoft)
ControlCenter (HKLM-x32\...\{698B7D8B-0F43-4A19-8B9B-47F1EFEB858F}_is1) (Version: 2.2.097 - MSI)
CPUID CPU-Z 1.59 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Doom 3 BFG Edition version 5.1 (HKLM-x32\...\{B810D852-DFD6-DOM3BFG-89A5-CC4D47756DAF}_is1) (Version: 5.1 - Black_Box)
DynamicUSBTool (HKLM-x32\...\{85BC6E3A-E8D4-48B7-8EEE-13E46F65BA75}) (Version: 1.0.0 - <no manufacturer>)
EasyViewer (HKLM-x32\...\InstallShield_{EECD7B96-1416-4D3A-B12D-0D2512120C36}) (Version: 1.3.0.9 - MSI)
EasyViewer (x32 Version: 1.3.0.9 - MSI) Hidden
eMule (HKLM-x32\...\eMule) (Version: - )
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
EVEREST Ultimate Edition v5.50 (HKLM-x32\...\EVEREST Ultimate Edition_is1) (Version: 5.50 - Lavalys, Inc.)
Far Cry 3 v1.01 (HKLM-x32\...\Far Cry 3_is1) (Version: 1.01 - Ubisoft)
Far Cry 4 (HKLM-x32\...\Far Cry 4_is1) (Version: - )
Flash Drive Tester v1.14 (HKLM-x32\...\{272C8DEE-F54F-406C-9AA6-B4DE2985A47C}) (Version: 1.14 - Virtual Console)
FlashFXP v4.2 (HKLM-x32\...\{96E3AED5-3D0B-4BB0-84C2-1EDADB204487}) (Version: 4.2.4.1783 - OpenSight Software, LLC)
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 2.3.25.1124 - Foxit Software Inc.)
Foxit PhantomPDF Standard (HKLM-x32\...\{DF288875-5322-4210-A4A9-65E19626503C}) (Version: 7.0.6.1126 - Foxit Software Inc.)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.0.6.1126 - Foxit Software Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Chrome (HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Hamachi 1.0.2.5 (HKLM-x32\...\Hamachi) (Version: - )
honestech VHS to DVD 2.0 SE (HKLM-x32\...\{2856F5EA-E98A-40E4-BAD6-8C644A4A3F3C}) (Version: 2.0 - honestech)
Hot CPU Tester Pro 4.4.1 (HKLM-x32\...\{5A39D5C2-A28B-421D-925A-0390FD1E5529}_is1) (Version: 4.4 LE - 7Byte Computers)
ICQ 8.3 (verze 7317) (HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\...\ICQ) (Version: 8.3.7317.0 - ICQ)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.10.1464 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
Jpeg Resampler Vs 6+ (HKLM-x32\...\JpegResampler2010_is1) (Version: - Jpeg Resampler)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)
League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden
Lineage II (HKLM-x32\...\{076A6FD8-EE45-4A83-B3C9-C7C34E7CAFDD}) (Version: 90.7.2281 - NCSoft)
Lineage II (HKLM-x32\...\{21040472-F8DF-48A9-A093-2986C1495670}) (Version: 152.0.0 - NCsoft)
Lineage II (HKLM-x32\...\NCW-LINEAGE2) (Version: 1.0.0.2 - NC Interactive, LLC)
Live Update 5 (HKLM-x32\...\{009E5DF2-3F97-480B-89DA-F2D5E672E14A}_is1) (Version: 5.0.090 - MSI)
Logitech SetPoint 6.61 (HKLM\...\sp6) (Version: 6.61.15 - Logitech)
Malwarebytes Anti-Malware verze 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (čeština) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1029) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}) (Version: 1.2.0241 - Microsoft Corporation)
Microsoft IntelliType Pro 8.2 (HKLM\...\Microsoft IntelliType Pro 8.2) (Version: 8.20.469.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 cs) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 cs)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSI Afterburner 2.2.4 (HKLM-x32\...\Afterburner) (Version: 2.2.4 - MSI Co., LTD)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyGC (HKLM-x32\...\{9F978B29-E3F5-47A5-9319-07AC35C925E6}) (Version: 0.3.4.34 - MyGC)
NCSOFT Game Launcher (HKLM-x32\...\NCLauncher_NCWest) (Version: - NCSOFT)
NCsoft Launcher (HKLM-x32\...\{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}) (Version: 1.5.19002 - NCsoft)
Need for Speed Rivals (HKLM-x32\...\Need for Speed Rivals_R.G. Mechanics_is1) (Version: - R.G. Mechanics, spider91)
Need for Speed™ Carbon (HKLM-x32\...\{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}) (Version: - )
NFS: Most Wanted CZ (HKLM-x32\...\NFS: Most Wanted) (Version: CZ - Sub - Zero)
NirSoft MessenPass (HKLM-x32\...\MessenPass) (Version: - )
Nokia Connectivity Cable Driver (HKLM-x32\...\{A57025CC-5F2E-4D01-B387-06DB10500D43}) (Version: 7.1.78.0 - Nokia)
Nokia PC Suite (HKLM-x32\...\Nokia PC Suite) (Version: 7.1.180.94 - Nokia)
Nokia PC Suite (x32 Version: 7.1.180.94 - Nokia) Hidden
NVIDIA PhysX (HKLM-x32\...\{54194F60-988C-4D03-B922-C2B00EFDA39A}) (Version: 9.10.0222 - NVIDIA Corporation)
OpenVPN 2.2.1 (HKLM-x32\...\OpenVPN) (Version: 2.2.1 - )
PC Connectivity Solution (HKLM-x32\...\{644F4910-E812-49AD-93EC-86828CB81A0D}) (Version: 12.0.27.0 - Nokia)
PlayerLiteHJ 1.0.3.1.LHJ (HKLM-x32\...\{B435433C-110A-4853-843A-7BD1EE59624E}_is1) (Version: 1.0.3.1.LHJ - AVTECH)
Rage (HKLM-x32\...\Rage_is1) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.53.216.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Registry Life version 2.07 (HKLM-x32\...\Registry Life_is1) (Version: 2.07 - ChemTable Software)
Risen (HKLM-x32\...\{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}) (Version: 1.00.0000 - Deep Silver)
Sapphire TRIXX (HKLM-x32\...\Sapphire TRIXX) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Seznam Software (HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\...\SeznamInstall) (Version: - Seznam.cz)
Skype™ 7.2 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.2.103 - Skype Technologies S.A.)
Sleeping Dogs™ (HKLM-x32\...\Steam App 202170) (Version: - Square Enix)
SMPlayer 0.8.3 (x64) (HKLM\...\SMPlayer) (Version: 0.8.3 - Ricardo Villalba)
Soft Organizer version 3.51 (HKLM-x32\...\Soft Organizer_is1) (Version: 3.51 - ChemTable Software)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
Splashtop Connect for Firefox (HKLM-x32\...\{45D49CA7-D7D8-4659-B35A-EBD98C30AF28}) (Version: 1.1.8.4 - Splashtop Inc.)
Splashtop Connect IE (HKLM-x32\...\{3B983EFD-6E37-4AD9-9A7D-8C83E61674F7}) (Version: 1.1.13.0 - Splashtop Inc.)
SSDlife Free (HKLM-x32\...\{A0E7D69C-351B-43C2-80A1-4CA528BA29C0}) (Version: 2.1.29 - BinarySense Inc.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.6.1014 - SUPERAntiSpyware.com)
Super-Charger (HKLM-x32\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.012 - MSI)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
TechPowerUp GPU-Z (HKLM-x32\...\TechPowerUp GPU-Z) (Version: - )
The Elder Scrolls V: Skyrim v1.8.151.0 (HKLM-x32\...\The Elder Scrolls V: Skyrim_is1) (Version: 1.8.151.0 - Bethesda)
The KMPlayer (remove only) (HKLM-x32\...\The KMPlayer) (Version: 3.6.0.87 - KMP Media co., Ltd)
THX TruStudio Pro (HKLM-x32\...\{4FA6CB9A-2972-4AAF-A36E-3C40FCC22395}) (Version: 1.04.01 - Creative Technology Limited)
Total Commander Ultima Prime 5.6.0.0 (HKLM-x32\...\TC UP) (Version: 5.6.0.0 - Robert Łajka & Paweł Porwisz)
Trials Fusion (HKLM-x32\...\{E6B9277D-AC15-4E88-BA86-0047D69B4A8C}) (Version: 6.0 - Black Box)
Video Card Stability Test (HKLM-x32\...\Video Card Stability Test) (Version: v.1.0.0.3 - FreeStone Group)
VideoGenie (HKLM-x32\...\{FC54FD8D-789C-406D-BB88-F7C4421B7E83}_is1) (Version: 1.0.0.12 - MSI)
visionapp OneTimePass (HKLM-x32\...\{BFCF1FE9-C3B0-46EC-8DB5-F52447E7B665}) (Version: 7.0.0 - visionapp)
War Thunder Launcher 1.0.1.396 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version: - Gaijin Entertainment)
Win7codecs (HKLM-x32\...\{8C0CAA7A-3272-4991-A808-2C7559DE3409}) (Version: 4.1.2 - Shark007)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows Phone app for desktop (HKLM-x32\...\{CE9BDD0F-BAF3-474D-B6D8-15B84BDAB229}) (Version: 1.1.2726.0 - Microsoft Corporation)
Winki (HKLM-x32\...\{81CF5153-38CF-41e2-AC3C-3D477C987D96}_is1) (Version: 3.2.117 - MSI)
WinRAR 4.11 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)
XBMC (HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\...\XBMC) (Version: - Team XBMC)
XnView 1.99 (HKLM-x32\...\XnView_is1) (Version: 1.99 - Gougelet Pierre-e)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points =========================

10-04-2015 14:54:35 Windows Update
14-04-2015 23:24:01 Windows Update
15-04-2015 11:47:57 Windows Update
17-04-2015 14:22:29 Removed Skype Click to Call

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-07-01 22:56 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0392CE01-571D-4715-8614-E86D38EE52B4} - System32\Tasks\{5C99FD72-A216-4A30-9E4F-BC4BC9FEE784} => pcalua.exe -a G:\OriginInstaller.exe -d G:\
Task: {03A630AE-359C-45EB-A86A-D0630A30E856} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {0F51DDDC-584E-4529-9A6E-C6E2009F3ABC} - System32\Tasks\MSIAfterburner => C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe [2012-09-17] ()
Task: {19F4818B-3F8C-44D5-87A8-A59245F011A1} - System32\Tasks\irMonitor => C:\Windows\system32\IRMonitor.exe [2014-04-23] (ITE Tech. Inc.)
Task: {1A66A585-E99B-42AC-BB6D-F939C7D8414C} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-1 No Task File <==== ATTENTION
Task: {1DC86635-2CEE-4318-8F0E-3D05533F8FB6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000UA => C:\Users\Methanol\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {1DCC5085-452B-42F0-9B86-6A0FA884CA4F} - System32\Tasks\{557517D9-A3B9-41D3-BD74-8FEE2FEB9C93} => pcalua.exe -a C:\Users\Methanol\Downloads\VirtumundoBeGone.exe -d C:\Users\Methanol\Downloads
Task: {1E0A2D2E-8DE2-4079-8636-8D55DD928B60} - System32\Tasks\{77BD7016-808B-46F3-96AA-A8821E6D3BA5} => pcalua.exe -a "A:\GMSforINST\L2 Interlude\setup.exe" -d "A:\GMSforINST\L2 Interlude"
Task: {24295FC4-F819-4BFC-895D-C30D70F304FE} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {2692A003-5017-4DFD-B406-320FBD00D4AF} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-2 No Task File <==== ATTENTION
Task: {2E7FB113-3E8C-4C6C-9D9F-EADFD2B27580} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000Core => C:\Users\Methanol\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {30DF89BA-C5B0-4278-8974-4DBC30C3E4F8} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-5 No Task File <==== ATTENTION
Task: {348E4150-4ED2-4DEC-9765-624A87FFEBD6} - \99671b1f-6fed-4425-b716-7a85249607ed-1 No Task File <==== ATTENTION
Task: {39676B35-149F-46E3-A187-8AF434255EAE} - System32\Tasks\{7F0534E8-25D2-4BDB-8B0F-8E6676793945} => pcalua.exe -a "C:\Users\Methanol\Downloads\dxwebsetup (1).exe" -d C:\Users\Methanol\Downloads
Task: {3D949C1A-6F5B-444B-8904-89F8C986DD62} - \99671b1f-6fed-4425-b716-7a85249607ed-6 No Task File <==== ATTENTION
Task: {3E408FF9-987F-448E-BA5D-2963D8882B24} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {42A655CD-AB76-4316-87AC-898D8403DD67} - \99671b1f-6fed-4425-b716-7a85249607ed-2 No Task File <==== ATTENTION
Task: {43914F2C-F2D0-4A5C-9675-5840BA0A0F3A} - System32\Tasks\{25C6D5CE-C756-493E-99C5-5DCAD59C0228} => pcalua.exe -a C:\Users\Methanol\Downloads\dxwebsetup(1).exe -d C:\Users\Methanol\Downloads
Task: {4D17F167-A3D1-4F55-926A-FB637365DA37} - \SPBIW_UpdateTask_Time_333537303136383336352d3437415a556c2a3223346c41 No Task File <==== ATTENTION
Task: {52FEE585-1367-45E4-8153-84FE146811D0} - System32\Tasks\{308D64B8-BDBB-4AF7-859F-264AE48AA015} => pcalua.exe -a C:\Users\Methanol\Downloads\raidfight_v1.exe -d C:\Users\Methanol\Downloads
Task: {56D4829E-E43D-40EA-A892-35497A156651} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {61038C89-6C2E-4450-A263-713A3C22F096} - System32\Tasks\{6D946A09-849E-4F47-AEDA-00DC445B64E0} => pcalua.exe -a D:\setup.exe -d D:\
Task: {638D820C-EDF5-4413-835A-CE8C29855A24} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-5_user No Task File <==== ATTENTION
Task: {682AD900-2EA5-4D93-B77E-476680E2E0B3} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-11 No Task File <==== ATTENTION
Task: {794063A2-4396-4BFA-AC5C-4643B4A1A677} - System32\Tasks\{868CC672-5182-4883-964B-45CEE9A0B790} => pcalua.exe -a D:\Support\InsHelper.exe -d D:\Support
Task: {7CB1C4D9-4D71-405F-9DDB-C9C2A941D0B1} - \99671b1f-6fed-4425-b716-7a85249607ed-11 No Task File <==== ATTENTION
Task: {88B95CA2-33B0-40C7-A8E5-00B988463E9C} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => C:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-08-10] (Microsoft Corporation)
Task: {8A0F8B5D-26F8-454A-B221-71C8465E4DF9} - System32\Tasks\{4E28922A-62F5-4FDA-8BA8-BF224C5131F0} => pcalua.exe -a "C:\Program Files (x86)\ShopperPro\SPremove.exe" <==== ATTENTION
Task: {93A23672-B720-4F4F-B122-66C2F0958205} - \99671b1f-6fed-4425-b716-7a85249607ed-7 No Task File <==== ATTENTION
Task: {99A64AC2-15C3-4410-8CED-57797E6B015D} - System32\Tasks\{8104C66D-1F75-4FEA-AFED-1D9EC294F48A} => pcalua.exe -a H:\Razor1911_Installer.exe -d H:\
Task: {99B4196D-4B8C-47C1-9A0B-A51528B477CD} - System32\Tasks\{3CF5883E-AEF8-4043-BEF4-11785987AC38} => pcalua.exe -a "C:\Program Files (x86)\SavePass\Uninstall.exe" -c /fcp=1
Task: {9C923143-DC6F-4972-B7D9-A6CC2191712D} - System32\Tasks\{C061EE78-34E0-4005-87F3-D83B7D74FA3B} => pcalua.exe -a C:\Users\Methanol\Downloads\WindowsPhone(1).exe -d C:\Users\Methanol\Downloads
Task: {9FC1E097-9D19-4DF4-A0C6-F651691AE3D6} - System32\Tasks\{6DE259FF-AA7E-4F99-9F91-5AD6DBD15902} => pcalua.exe -a C:\Users\Methanol\AppData\Local\Temp\VARemove.exe -d C:\Users\Methanol\AppData\Local\Temp -c uninstall
Task: {A2A0EABB-E150-4654-B56E-EF0091405AB4} - System32\Tasks\{36439F61-3184-43A1-AD0C-65EC2990803D} => A:\Games\Risen\bin\Risen.exe [2010-03-08] (Piranha Bytes)
Task: {ADECD4C0-58A4-4787-95B3-B77F57051BDF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-28] (Google Inc.)
Task: {B1676CF1-56FA-4BC5-A5BE-8F89C00B8999} - System32\Tasks\{C78E8831-B077-4CAD-9A4B-3544D4A08AB6} => pcalua.exe -a "A:\Games\The Crew (Russian)\Support\InsHelper.exe" -c CallUplayProtocol Uninstall 507
Task: {BAB22D34-8BAC-4CCC-8F5E-9CD68A54102B} - \99671b1f-6fed-4425-b716-7a85249607ed-4 No Task File <==== ATTENTION
Task: {BC5A222C-00A1-4078-8CC8-4F600D9E20FE} - System32\Tasks\{22942021-5665-4701-8D57-4DC4D5DAD8CB} => pcalua.exe -a A:\STEAM\steam.exe -c steam://uninstall/202170
Task: {BDD41632-060E-4934-8897-1EB49DF4808B} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-4 No Task File <==== ATTENTION
Task: {C4E9A6AA-E00C-4A60-A5AC-6E5F8A160B83} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-6 No Task File <==== ATTENTION
Task: {C77B6CC7-2FE9-4DAE-A173-5F0FC0393AF2} - System32\Tasks\{C2BFDCC5-8927-4002-B96F-C22C57A60767} => pcalua.exe -a C:\Users\Methanol\Downloads\VirtumundoBeGone.exe -d C:\Users\Methanol\Downloads
Task: {C7E061A8-62DD-4292-A37A-41F0A4680B6F} - System32\Tasks\{6B4B8EA5-0865-46AD-A14F-65CB9AE172F4} => pcalua.exe -a C:\Users\Methanol\Downloads\wmp11-windowsxp-x86-CS-CZ.exe -d C:\Users\Methanol\Downloads
Task: {C8AD3519-DB26-4032-8A25-A129DE0D1942} - System32\Tasks\{97E39A22-293F-4B26-A419-83527550E5B4} => pcalua.exe -a C:\Users\Methanol\Downloads\OnLineRecovery.exe -d C:\Users\Methanol\Downloads
Task: {D34C5FBF-10A8-4A27-BA9F-3F02717E4AAD} - System32\Tasks\{00D6F48C-F9AC-41AC-A82B-90D4A57CD846} => Firefox.exe http://ui.skype.com/ui/0/7.2.0.103/cs/a ... age=tsBing
Task: {D7DC8EE7-419F-4AB0-9C36-A6D4DA019EA4} - System32\Tasks\{56195558-2991-4B08-ADCD-8D766344E733} => pcalua.exe -a "A:\GMSforINST\ANNO 1404 - Benátky\ANNO 1404 - Benátky\Patche\anno1404_1.2.exe" -d "A:\GMSforINST\ANNO 1404 - Benátky\ANNO 1404 - Benátky\Patche"
Task: {DA054C93-AB19-488D-8A2C-537694BBC726} - \99671b1f-6fed-4425-b716-7a85249607ed-5 No Task File <==== ATTENTION
Task: {E0F4E682-97DB-4AD6-B7B0-9CB337D44D65} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-7 No Task File <==== ATTENTION
Task: {E6C12F76-9B93-4C9E-86B7-C9CC03101B7A} - System32\Tasks\{E24332C1-2326-4270-8F0A-A21D78D13CC4} => pcalua.exe -a "C:\Program Files (x86)\iWebar\Uninstall.exe" -c /fcp=1
Task: {E78B8D12-B97F-4C71-B5E7-0638CEEBCD89} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-10-24] (Piriform Ltd)
Task: {E83D2D9B-0BA7-4190-B848-D7BF8AC70803} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-28] (Google Inc.)
Task: {EBCC44A0-45EB-4D33-A738-55CAC475185D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {F1BB571B-19D9-4FFE-9239-BBCB4B46EDD9} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {F599609E-CC88-4891-B3FF-44513ED2E8DA} - System32\Tasks\{14B9E7BC-BF1F-44BF-90C8-95E878CB3453} => pcalua.exe -a C:\Users\Methanol\AppData\Local\Temp\Rar$EXa0.384\TeamSpeak3-cestina-0.1.-beta2.exe -d "C:\Program Files\TeamSpeak 3 Client" -c -el -s2 "-dC:\Program Files\TeamSpeak 3 Client\" "-p" "-sp"
Task: {F6427C7D-7C6C-4D8B-8C77-D8B1E361CB41} - \99671b1f-6fed-4425-b716-7a85249607ed-5_user No Task File <==== ATTENTION
Task: {FF7B0C54-3B56-4D22-9DA8-C5A20B127982} - \SW-Booster-S-792098896 No Task File <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000Core.job => C:\Users\Methanol\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000UA.job => C:\Users\Methanol\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2012-07-30 15:40 - 2010-09-06 18:21 - 00538435 _____ () C:\Program Files (x86)\JpegResampler2010\JRcm64.dll
2012-07-01 13:14 - 2010-05-04 11:00 - 00237056 _____ () C:\Windows\SYSTEM32\APOMgr64.DLL
2014-03-28 15:12 - 2014-03-28 15:12 - 00477696 _____ () C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe
2015-04-15 10:53 - 2015-04-15 10:53 - 00374272 _____ () C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2015-04-15 14:12 - 2015-04-15 14:12 - 16863920 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll
2012-06-30 11:06 - 2012-03-29 13:18 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Windows:F40EA4D67EA11D06
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879
AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^Methanol^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^hamachi.lnk => C:\Windows\pss\hamachi.lnk.Startup
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: NCUpdateHelper => C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe
MSCONFIG\startupreg: TC UP => "C:\Program Files (x86)\TC UP\TC UP.exe" /wnd=max
MSCONFIG\startupreg: uTorrent => "C:\Users\Methanol\AppData\Roaming\uTorrent\uTorrent.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-2973342720-1030308514-1458377291-500 - Administrator - Disabled)
Guest (S-1-5-21-2973342720-1030308514-1458377291-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-2973342720-1030308514-1458377291-1004 - Limited - Enabled)
Lucinka (S-1-5-21-2973342720-1030308514-1458377291-1002 - Limited - Enabled) => C:\Users\Lucinka
Methanol (S-1-5-21-2973342720-1030308514-1458377291-1000 - Administrator - Enabled) => C:\Users\Methanol

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Adaptér tunelového režimu Microsoft Teredo
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/17/2015 02:23:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: l2.exe, verze: 0.0.0.0, časové razítko: 0x46dbe9ca
Název chybujícího modulu: unknown, verze: 0.0.0.0, časové razítko: 0x00000000
Kód výjimky: 0xc0000005
Posun chyby: 0x024f0c77
ID chybujícího procesu: 0x364
Čas spuštění chybující aplikace: 0xl2.exe0
Cesta k chybující aplikaci: l2.exe1
Cesta k chybujícímu modulu: l2.exe2
ID zprávy: l2.exe3

Error: (04/16/2015 10:15:06 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Generování kontextu aktivace pro Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1 se nezdařilo.
Závislé sestavení Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.

Error: (04/16/2015 10:14:58 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: Generování kontextu aktivace pro assemblyIdentity1 se nezdařilo. Chyba v souboru manifestu nebo zásady assemblyIdentity2 na řádku assemblyIdentity3.
Hodnota * atributu language v prvku assemblyIdentity je neplatná.

Error: (04/16/2015 08:42:31 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005

Error: (04/15/2015 00:55:01 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Generování kontextu aktivace pro assemblyIdentity1 se nezdařilo. Chyba v souboru manifestu nebo zásady assemblyIdentity2 na řádku assemblyIdentity3.
Hodnota * atributu language v prvku assemblyIdentity je neplatná.

Error: (04/15/2015 11:53:59 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005

Error: (04/15/2015 10:56:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: plugin-container.exe, verze: 37.0.1.5570, časové razítko: 0x551e23ee
Název chybujícího modulu: mozalloc.dll, verze: 37.0.1.5570, časové razítko: 0x551e1536
Kód výjimky: 0x80000003
Posun chyby: 0x00001aa1
ID chybujícího procesu: 0x11ec
Čas spuštění chybující aplikace: 0xplugin-container.exe0
Cesta k chybující aplikaci: plugin-container.exe1
Cesta k chybujícímu modulu: plugin-container.exe2
ID zprávy: plugin-container.exe3

Error: (04/15/2015 10:54:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: plugin-container.exe, verze: 37.0.1.5570, časové razítko: 0x551e23ee
Název chybujícího modulu: mozalloc.dll, verze: 37.0.1.5570, časové razítko: 0x551e1536
Kód výjimky: 0x80000003
Posun chyby: 0x00001aa1
ID chybujícího procesu: 0x1684
Čas spuštění chybující aplikace: 0xplugin-container.exe0
Cesta k chybující aplikaci: plugin-container.exe1
Cesta k chybujícímu modulu: plugin-container.exe2
ID zprávy: plugin-container.exe3

Error: (04/15/2015 10:19:07 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005

Error: (04/14/2015 04:38:32 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005


System errors:
=============
Error: (04/17/2015 02:35:32 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT AUTHORITY)
Description: Funkce řízení spotřeby pro výkon jsou u procesoru 3 skupiny 0 zakázány z důvodu potíží s firmwarem. Požádejte výrobce počítače o aktualizovaný firmware.

Error: (04/17/2015 02:35:32 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT AUTHORITY)
Description: Funkce řízení spotřeby pro výkon jsou u procesoru 2 skupiny 0 zakázány z důvodu potíží s firmwarem. Požádejte výrobce počítače o aktualizovaný firmware.

Error: (04/17/2015 02:35:32 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT AUTHORITY)
Description: Funkce řízení spotřeby pro výkon jsou u procesoru 1 skupiny 0 zakázány z důvodu potíží s firmwarem. Požádejte výrobce počítače o aktualizovaný firmware.

Error: (04/17/2015 02:35:32 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT AUTHORITY)
Description: Funkce řízení spotřeby pro výkon jsou u procesoru 0 skupiny 0 zakázány z důvodu potíží s firmwarem. Požádejte výrobce počítače o aktualizovaný firmware.

Error: (04/17/2015 02:34:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Windows Search byla nečekaně ukončena. Stalo se to 2 krát. Následující opravná akce bude spuštěna za 30000 milisekund: Restartovat službu.

Error: (04/17/2015 02:34:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Intel(R) Capability Licensing Service Interface byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 0 milisekund: Restartovat službu.

Error: (04/17/2015 02:34:59 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba Office Software Protection Platform byla neočekávaně ukončena. Tento stav nastal již 1krát.

Error: (04/17/2015 02:34:59 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba Intel(R) Management and Security Application User Notification Service byla neočekávaně ukončena. Tento stav nastal již 1krát.

Error: (04/17/2015 02:34:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Služba Windows Media Player Network Sharing byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 30000 milisekund: Restartovat službu.

Error: (04/17/2015 02:34:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Windows Search byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 30000 milisekund: Restartovat službu.


Microsoft Office Sessions:
=========================
Error: (04/17/2015 02:23:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: l2.exe0.0.0.046dbe9caunknown0.0.0.000000000c0000005024f0c7736401d07907912e5aa2C:\Program Files (x86)\Lineage II\system\l2.exeunknown7d09a5ff-e4fc-11e4-9127-8c89a5c1dfb4

Error: (04/16/2015 10:15:06 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"c:\program files (x86)\Nokia\nokia pc suite 7\TIS_Windows7PIM.dll

Error: (04/16/2015 10:14:58 AM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentitylanguage*c:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dllc:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dll8

Error: (04/16/2015 08:42:31 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005

Error: (04/15/2015 00:55:01 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentitylanguage*c:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dllc:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dll8

Error: (04/15/2015 11:53:59 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005

Error: (04/15/2015 10:56:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe37.0.1.5570551e23eemozalloc.dll37.0.1.5570551e15368000000300001aa111ec01d07759fde954a7C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll5158453d-e34d-11e4-b34d-8c89a5c1dfb4

Error: (04/15/2015 10:54:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe37.0.1.5570551e23eemozalloc.dll37.0.1.5570551e15368000000300001aa1168401d07743a731743cC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll0ae0e45e-e34d-11e4-b34d-8c89a5c1dfb4

Error: (04/15/2015 10:19:07 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005

Error: (04/14/2015 04:38:32 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005


CodeIntegrity Errors:
===================================
Date: 2015-02-27 16:08:46.426
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-02-20 17:11:41.861
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-02-07 14:51:48.129
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-02-07 14:51:35.371
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-02-07 09:05:48.196
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-01-29 13:17:36.242
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-01-29 13:14:02.331
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-01-29 11:41:11.807
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-01-29 06:55:39.001
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-01-28 23:19:47.160
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files\Common Files\ATI Technologies\Multimedia\AMDMFTDecoder_64.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz
Percentage of memory in use: 32%
Total physical RAM: 8145.56 MB
Available physical RAM: 5487.18 MB
Total Pagefile: 24143.75 MB
Available Pagefile: 21059.24 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive a: (2000) (Fixed) (Total:1863.01 GB) (Free:687.55 GB) NTFS
Drive c: () (Fixed) (Total:119.14 GB) (Free:21.05 GB) NTFS
Drive d: (Far Cry 4) (CDROM) (Total:26.71 GB) (Free:0 GB) CDFS
Drive e: (Místní disk) (Fixed) (Total:149.04 GB) (Free:122.3 GB) NTFS
Drive g: (FarCry3 D1) (CDROM) (Total:3.83 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 94464EAC)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: DDA7AAEA)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 149.1 GB) (Disk ID: 56DD56DD)
Partition 2: (Active) - (Size=149 GB) - (Type=05)

==================== End Of Log ============================

Typicke nachytavky na warezu... nevim jestli ma priste cenu Vam vubec pomahat... tolik warezu... mate vubec OS legalni?
Hint: C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe

Otestujte na virustotal.com C:\Program Files (x86)\JpegResampler2010\JRcm64.dll - pokud uz byl soubor otestovany, zvolte Reanalyze. Do pristiho prispevku dejte link (odkaz) s vysledky analyzy.

• Do Poznamkoveho bloku (Start -> spustit -> notepad) zkopirujte obsah bileho pole
• ulozte na plochu jako fixlist (Typ souboru: Textovy dokument)
• znovu spustte FRST a kliknete na Fix
• po restartu na Vas vyskoci fixlog (pripadne bude ulozen na Plose), jehoz obsah mi vlozte do pristi odpovedi

  Kód: Vybrat vše

  Start
  CloseProcesses:
  CreateRestorePoint:
  HKLM-x32\...\Run: [NCUpdateHelper] => C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe [526240 2014-05-23] (NCSOFT Corporation)
  HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
  Startup: C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.lnk
  ShortcutTarget: Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.lnk -> C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe ()
  Startup: C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\going-clear-scientology-and-the-prison-of-belief-cze-6117369.lnk
  ShortcutTarget: going-clear-scientology-and-the-prison-of-belief-cze-6117369.lnk -> C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe ()
  CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
  
  HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
  HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
  HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
  SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  FF SearchEngineOrder.3: Bing
  FF SelectedSearchEngine:
  FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
  FF Plugin: @microsoft.com/GENUINE -> disabled No File
  FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
  
  S3 7ByteIo; No ImagePath
  S3 npkcusb; No ImagePath
  
  2015-04-17 14:24 - 2015-04-17 14:24 - 02217984 _____ () C:\Users\Methanol\Desktop\adwcleaner_4.201.exe
  2015-04-17 13:06 - 2015-04-17 13:06 - 00000000 ____D () C:\rsit
  2015-04-17 13:05 - 2015-04-17 13:05 - 01222144 _____ () C:\Users\Methanol\Downloads\RSITx64.exe
  2015-04-15 10:57 - 2015-04-15 10:57 - 00081003 _____ () C:\Users\Methanol\Desktop\going-clear-scientology-and-the-prison-of-belief-cze-6117369.zip
  2015-04-15 10:55 - 2015-04-15 10:55 - 00000000 ____D () C:\ProgramData\7044438373684523921
  2015-04-15 10:54 - 2015-04-15 10:54 - 00000000 ____D () C:\ProgramData\anblmglnjdcgmpenbheeddcopcfpkldl
  2015-04-15 10:53 - 2015-04-16 07:50 - 00000000 ____D () C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}
  2015-04-15 10:53 - 2015-04-15 10:53 - 00374272 _____ () C:\Users\Methanol\Downloads\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe
  2015-04-15 10:56 - 2015-04-15 10:56 - 00000000 ____D () C:\Program Files (x86)\LinkMonitor
  2015-03-28 19:19 - 2015-03-28 19:19 - 00482816 _____ () C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition-BLUS31024.iso Torrent - KickassTorrents(1).exe
  2015-03-28 19:19 - 2015-03-28 19:19 - 00480768 _____ () C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition-BLUS31024.iso Torrent - KickassTorrents.exe
  2015-03-28 15:11 - 2015-03-28 15:11 - 00477696 _____ () C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe
  2015-04-17 14:35 - 2015-01-08 22:16 - 00000000 ____D () C:\AdwCleaner
  2015-04-17 13:06 - 2012-07-27 11:37 - 00000000 ____D () C:\Program Files\trend micro
  
  Task: {0392CE01-571D-4715-8614-E86D38EE52B4} - System32\Tasks\{5C99FD72-A216-4A30-9E4F-BC4BC9FEE784} => pcalua.exe -a G:\OriginInstaller.exe -d G:\
  Task: {1A66A585-E99B-42AC-BB6D-F939C7D8414C} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-1 No Task File <==== ATTENTION
  Task: {1DCC5085-452B-42F0-9B86-6A0FA884CA4F} - System32\Tasks\{557517D9-A3B9-41D3-BD74-8FEE2FEB9C93} => pcalua.exe -a C:\Users\Methanol\Downloads\VirtumundoBeGone.exe -d C:\Users\Methanol\Downloads
  Task: {1E0A2D2E-8DE2-4079-8636-8D55DD928B60} - System32\Tasks\{77BD7016-808B-46F3-96AA-A8821E6D3BA5} => pcalua.exe -a "A:\GMSforINST\L2 Interlude\setup.exe" -d "A:\GMSforINST\L2 Interlude"
  Task: {2692A003-5017-4DFD-B406-320FBD00D4AF} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-2 No Task File <==== ATTENTION
  Task: {30DF89BA-C5B0-4278-8974-4DBC30C3E4F8} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-5 No Task File <==== ATTENTION
  Task: {348E4150-4ED2-4DEC-9765-624A87FFEBD6} - \99671b1f-6fed-4425-b716-7a85249607ed-1 No Task File <==== ATTENTION
  Task: {39676B35-149F-46E3-A187-8AF434255EAE} - System32\Tasks\{7F0534E8-25D2-4BDB-8B0F-8E6676793945} => pcalua.exe -a "C:\Users\Methanol\Downloads\dxwebsetup (1).exe" -d C:\Users\Methanol\Downloads
  Task: {3D949C1A-6F5B-444B-8904-89F8C986DD62} - \99671b1f-6fed-4425-b716-7a85249607ed-6 No Task File <==== ATTENTION
  Task: {42A655CD-AB76-4316-87AC-898D8403DD67} - \99671b1f-6fed-4425-b716-7a85249607ed-2 No Task File <==== ATTENTION
  Task: {43914F2C-F2D0-4A5C-9675-5840BA0A0F3A} - System32\Tasks\{25C6D5CE-C756-493E-99C5-5DCAD59C0228} => pcalua.exe -a C:\Users\Methanol\Downloads\dxwebsetup(1).exe -d C:\Users\Methanol\Downloads
  Task: {4D17F167-A3D1-4F55-926A-FB637365DA37} - \SPBIW_UpdateTask_Time_333537303136383336352d3437415a556c2a3223346c41 No Task File <==== ATTENTION
  Task: {52FEE585-1367-45E4-8153-84FE146811D0} - System32\Tasks\{308D64B8-BDBB-4AF7-859F-264AE48AA015} => pcalua.exe -a C:\Users\Methanol\Downloads\raidfight_v1.exe -d C:\Users\Methanol\Downloads
  Task: {61038C89-6C2E-4450-A263-713A3C22F096} - System32\Tasks\{6D946A09-849E-4F47-AEDA-00DC445B64E0} => pcalua.exe -a D:\setup.exe -d D:\
  Task: {638D820C-EDF5-4413-835A-CE8C29855A24} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-5_user No Task File <==== ATTENTION
  Task: {682AD900-2EA5-4D93-B77E-476680E2E0B3} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-11 No Task File <==== ATTENTION
  Task: {794063A2-4396-4BFA-AC5C-4643B4A1A677} - System32\Tasks\{868CC672-5182-4883-964B-45CEE9A0B790} => pcalua.exe -a D:\Support\InsHelper.exe -d D:\Support
  Task: {7CB1C4D9-4D71-405F-9DDB-C9C2A941D0B1} - \99671b1f-6fed-4425-b716-7a85249607ed-11 No Task File <==== ATTENTION
  Task: {8A0F8B5D-26F8-454A-B221-71C8465E4DF9} - System32\Tasks\{4E28922A-62F5-4FDA-8BA8-BF224C5131F0} => pcalua.exe -a "C:\Program Files (x86)\ShopperPro\SPremove.exe" <==== ATTENTION
  Task: {93A23672-B720-4F4F-B122-66C2F0958205} - \99671b1f-6fed-4425-b716-7a85249607ed-7 No Task File <==== ATTENTION
  Task: {99A64AC2-15C3-4410-8CED-57797E6B015D} - System32\Tasks\{8104C66D-1F75-4FEA-AFED-1D9EC294F48A} => pcalua.exe -a H:\Razor1911_Installer.exe -d H:\
  Task: {99B4196D-4B8C-47C1-9A0B-A51528B477CD} - System32\Tasks\{3CF5883E-AEF8-4043-BEF4-11785987AC38} => pcalua.exe -a "C:\Program Files (x86)\SavePass\Uninstall.exe" -c /fcp=1
  Task: {9C923143-DC6F-4972-B7D9-A6CC2191712D} - System32\Tasks\{C061EE78-34E0-4005-87F3-D83B7D74FA3B} => pcalua.exe -a C:\Users\Methanol\Downloads\WindowsPhone(1).exe -d C:\Users\Methanol\Downloads
  Task: {9FC1E097-9D19-4DF4-A0C6-F651691AE3D6} - System32\Tasks\{6DE259FF-AA7E-4F99-9F91-5AD6DBD15902} => pcalua.exe -a C:\Users\Methanol\AppData\Local\Temp\VARemove.exe -d C:\Users\Methanol\AppData\Local\Temp -c uninstall
  Task: {A2A0EABB-E150-4654-B56E-EF0091405AB4} - System32\Tasks\{36439F61-3184-43A1-AD0C-65EC2990803D} => A:\Games\Risen\bin\Risen.exe [2010-03-08] (Piranha Bytes)
  Task: {B1676CF1-56FA-4BC5-A5BE-8F89C00B8999} - System32\Tasks\{C78E8831-B077-4CAD-9A4B-3544D4A08AB6} => pcalua.exe -a "A:\Games\The Crew (Russian)\Support\InsHelper.exe" -c CallUplayProtocol Uninstall 507
  Task: {BAB22D34-8BAC-4CCC-8F5E-9CD68A54102B} - \99671b1f-6fed-4425-b716-7a85249607ed-4 No Task File <==== ATTENTION
  Task: {BDD41632-060E-4934-8897-1EB49DF4808B} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-4 No Task File <==== ATTENTION
  Task: {C4E9A6AA-E00C-4A60-A5AC-6E5F8A160B83} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-6 No Task File <==== ATTENTION
  Task: {C77B6CC7-2FE9-4DAE-A173-5F0FC0393AF2} - System32\Tasks\{C2BFDCC5-8927-4002-B96F-C22C57A60767} => pcalua.exe -a C:\Users\Methanol\Downloads\VirtumundoBeGone.exe -d C:\Users\Methanol\Downloads
  Task: {C7E061A8-62DD-4292-A37A-41F0A4680B6F} - System32\Tasks\{6B4B8EA5-0865-46AD-A14F-65CB9AE172F4} => pcalua.exe -a C:\Users\Methanol\Downloads\wmp11-windowsxp-x86-CS-CZ.exe -d C:\Users\Methanol\Downloads
  Task: {D7DC8EE7-419F-4AB0-9C36-A6D4DA019EA4} - System32\Tasks\{56195558-2991-4B08-ADCD-8D766344E733} => pcalua.exe -a "A:\GMSforINST\ANNO 1404 - Benátky\ANNO 1404 - Benátky\Patche\anno1404_1.2.exe" -d "A:\GMSforINST\ANNO 1404 - Benátky\ANNO 1404 - Benátky\Patche"
  Task: {DA054C93-AB19-488D-8A2C-537694BBC726} - \99671b1f-6fed-4425-b716-7a85249607ed-5 No Task File <==== ATTENTION
  Task: {E0F4E682-97DB-4AD6-B7B0-9CB337D44D65} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-7 No Task File <==== ATTENTION
  Task: {E6C12F76-9B93-4C9E-86B7-C9CC03101B7A} - System32\Tasks\{E24332C1-2326-4270-8F0A-A21D78D13CC4} => pcalua.exe -a "C:\Program Files (x86)\iWebar\Uninstall.exe" -c /fcp=1
  Task: {F599609E-CC88-4891-B3FF-44513ED2E8DA} - System32\Tasks\{14B9E7BC-BF1F-44BF-90C8-95E878CB3453} => pcalua.exe -a C:\Users\Methanol\AppData\Local\Temp\Rar$EXa0.384\TeamSpeak3-cestina-0.1.-beta2.exe -d "C:\Program Files\TeamSpeak 3 Client" -c -el -s2 "-dC:\Program Files\TeamSpeak 3 Client\" "-p" "-sp"
  Task: {F6427C7D-7C6C-4D8B-8C77-D8B1E361CB41} - \99671b1f-6fed-4425-b716-7a85249607ed-5_user No Task File <==== ATTENTION
  Task: {FF7B0C54-3B56-4D22-9DA8-C5A20B127982} - \SW-Booster-S-792098896 No Task File <==== ATTENTION
  Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000Core.job => C:\Users\Methanol\AppData\Local\Google\Update\GoogleUpdate.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000UA.job => C:\Users\Methanol\AppData\Local\Google\Update\GoogleUpdate.exe
  
  C:\Program Files (x86)\SavePass
  C:\Program Files (x86)\ShopperPro
  C:\Program Files (x86)\iWebar
  C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}
  C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}
  
  AlternateDataStreams: C:\Windows:F40EA4D67EA11D06
  AlternateDataStreams: C:\ProgramData\TEMP:56E2E879
  AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
  Hosts:
  EmptyTemp:
  End
  

OS mám legální..jinak bych sem ani nepsal..

Zde je odkaz na ten soubor..je to trojan..

https://www.virustotal.com/cs/file/5c05 ... 429276796/

Nedaří se mi to fixnout..píše že nemůže najít fixlist.txt na ploše..přitom tam je..

Protoze jste nepostupoval podle navodu a FRST64.exe nemate na plose, ale v Presunte je obe do stejne slozky (v navodech je pro jednoduchost na plochu).

Omlouvám se..měl jste pravdu..měl jsem ho ve stažených souborech..promiňte..


zde je ten log..

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-04-2015 04
Ran by Methanol at 2015-04-17 15:34:24 Run:1
Running from C:\Users\Methanol\Desktop
Loaded Profiles: Methanol (Available profiles: Methanol & Lucinka)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
CreateRestorePoint:
HKLM-x32\...\Run: [NCUpdateHelper] => C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe [526240 2014-05-23] (NCSOFT Corporation)
HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
Startup: C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.lnk
ShortcutTarget: Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.lnk -> C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe ()
Startup: C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\going-clear-scientology-and-the-prison-of-belief-cze-6117369.lnk
ShortcutTarget: going-clear-scientology-and-the-prison-of-belief-cze-6117369.lnk -> C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine:
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

S3 7ByteIo; No ImagePath
S3 npkcusb; No ImagePath

2015-04-17 14:24 - 2015-04-17 14:24 - 02217984 _____ () C:\Users\Methanol\Desktop\adwcleaner_4.201.exe
2015-04-17 13:06 - 2015-04-17 13:06 - 00000000 ____D () C:\rsit
2015-04-17 13:05 - 2015-04-17 13:05 - 01222144 _____ () C:\Users\Methanol\Downloads\RSITx64.exe
2015-04-15 10:57 - 2015-04-15 10:57 - 00081003 _____ () C:\Users\Methanol\Desktop\going-clear-scientology-and-the-prison-of-belief-cze-6117369.zip
2015-04-15 10:55 - 2015-04-15 10:55 - 00000000 ____D () C:\ProgramData\7044438373684523921
2015-04-15 10:54 - 2015-04-15 10:54 - 00000000 ____D () C:\ProgramData\anblmglnjdcgmpenbheeddcopcfpkldl
2015-04-15 10:53 - 2015-04-16 07:50 - 00000000 ____D () C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}
2015-04-15 10:53 - 2015-04-15 10:53 - 00374272 _____ () C:\Users\Methanol\Downloads\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe
2015-04-15 10:56 - 2015-04-15 10:56 - 00000000 ____D () C:\Program Files (x86)\LinkMonitor
2015-03-28 19:19 - 2015-03-28 19:19 - 00482816 _____ () C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition-BLUS31024.iso Torrent - KickassTorrents(1).exe
2015-03-28 19:19 - 2015-03-28 19:19 - 00480768 _____ () C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition-BLUS31024.iso Torrent - KickassTorrents.exe
2015-03-28 15:11 - 2015-03-28 15:11 - 00477696 _____ () C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe
2015-04-17 14:35 - 2015-01-08 22:16 - 00000000 ____D () C:\AdwCleaner
2015-04-17 13:06 - 2012-07-27 11:37 - 00000000 ____D () C:\Program Files\trend micro

Task: {0392CE01-571D-4715-8614-E86D38EE52B4} - System32\Tasks\{5C99FD72-A216-4A30-9E4F-BC4BC9FEE784} => pcalua.exe -a G:\OriginInstaller.exe -d G:\
Task: {1A66A585-E99B-42AC-BB6D-F939C7D8414C} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-1 No Task File <==== ATTENTION
Task: {1DCC5085-452B-42F0-9B86-6A0FA884CA4F} - System32\Tasks\{557517D9-A3B9-41D3-BD74-8FEE2FEB9C93} => pcalua.exe -a C:\Users\Methanol\Downloads\VirtumundoBeGone.exe -d C:\Users\Methanol\Downloads
Task: {1E0A2D2E-8DE2-4079-8636-8D55DD928B60} - System32\Tasks\{77BD7016-808B-46F3-96AA-A8821E6D3BA5} => pcalua.exe -a "A:\GMSforINST\L2 Interlude\setup.exe" -d "A:\GMSforINST\L2 Interlude"
Task: {2692A003-5017-4DFD-B406-320FBD00D4AF} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-2 No Task File <==== ATTENTION
Task: {30DF89BA-C5B0-4278-8974-4DBC30C3E4F8} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-5 No Task File <==== ATTENTION
Task: {348E4150-4ED2-4DEC-9765-624A87FFEBD6} - \99671b1f-6fed-4425-b716-7a85249607ed-1 No Task File <==== ATTENTION
Task: {39676B35-149F-46E3-A187-8AF434255EAE} - System32\Tasks\{7F0534E8-25D2-4BDB-8B0F-8E6676793945} => pcalua.exe -a "C:\Users\Methanol\Downloads\dxwebsetup (1).exe" -d C:\Users\Methanol\Downloads
Task: {3D949C1A-6F5B-444B-8904-89F8C986DD62} - \99671b1f-6fed-4425-b716-7a85249607ed-6 No Task File <==== ATTENTION
Task: {42A655CD-AB76-4316-87AC-898D8403DD67} - \99671b1f-6fed-4425-b716-7a85249607ed-2 No Task File <==== ATTENTION
Task: {43914F2C-F2D0-4A5C-9675-5840BA0A0F3A} - System32\Tasks\{25C6D5CE-C756-493E-99C5-5DCAD59C0228} => pcalua.exe -a C:\Users\Methanol\Downloads\dxwebsetup(1).exe -d C:\Users\Methanol\Downloads
Task: {4D17F167-A3D1-4F55-926A-FB637365DA37} - \SPBIW_UpdateTask_Time_333537303136383336352d3437415a556c2a3223346c41 No Task File <==== ATTENTION
Task: {52FEE585-1367-45E4-8153-84FE146811D0} - System32\Tasks\{308D64B8-BDBB-4AF7-859F-264AE48AA015} => pcalua.exe -a C:\Users\Methanol\Downloads\raidfight_v1.exe -d C:\Users\Methanol\Downloads
Task: {61038C89-6C2E-4450-A263-713A3C22F096} - System32\Tasks\{6D946A09-849E-4F47-AEDA-00DC445B64E0} => pcalua.exe -a D:\setup.exe -d D:\
Task: {638D820C-EDF5-4413-835A-CE8C29855A24} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-5_user No Task File <==== ATTENTION
Task: {682AD900-2EA5-4D93-B77E-476680E2E0B3} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-11 No Task File <==== ATTENTION
Task: {794063A2-4396-4BFA-AC5C-4643B4A1A677} - System32\Tasks\{868CC672-5182-4883-964B-45CEE9A0B790} => pcalua.exe -a D:\Support\InsHelper.exe -d D:\Support
Task: {7CB1C4D9-4D71-405F-9DDB-C9C2A941D0B1} - \99671b1f-6fed-4425-b716-7a85249607ed-11 No Task File <==== ATTENTION
Task: {8A0F8B5D-26F8-454A-B221-71C8465E4DF9} - System32\Tasks\{4E28922A-62F5-4FDA-8BA8-BF224C5131F0} => pcalua.exe -a "C:\Program Files (x86)\ShopperPro\SPremove.exe" <==== ATTENTION
Task: {93A23672-B720-4F4F-B122-66C2F0958205} - \99671b1f-6fed-4425-b716-7a85249607ed-7 No Task File <==== ATTENTION
Task: {99A64AC2-15C3-4410-8CED-57797E6B015D} - System32\Tasks\{8104C66D-1F75-4FEA-AFED-1D9EC294F48A} => pcalua.exe -a H:\Razor1911_Installer.exe -d H:\
Task: {99B4196D-4B8C-47C1-9A0B-A51528B477CD} - System32\Tasks\{3CF5883E-AEF8-4043-BEF4-11785987AC38} => pcalua.exe -a "C:\Program Files (x86)\SavePass\Uninstall.exe" -c /fcp=1
Task: {9C923143-DC6F-4972-B7D9-A6CC2191712D} - System32\Tasks\{C061EE78-34E0-4005-87F3-D83B7D74FA3B} => pcalua.exe -a C:\Users\Methanol\Downloads\WindowsPhone(1).exe -d C:\Users\Methanol\Downloads
Task: {9FC1E097-9D19-4DF4-A0C6-F651691AE3D6} - System32\Tasks\{6DE259FF-AA7E-4F99-9F91-5AD6DBD15902} => pcalua.exe -a C:\Users\Methanol\AppData\Local\Temp\VARemove.exe -d C:\Users\Methanol\AppData\Local\Temp -c uninstall
Task: {A2A0EABB-E150-4654-B56E-EF0091405AB4} - System32\Tasks\{36439F61-3184-43A1-AD0C-65EC2990803D} => A:\Games\Risen\bin\Risen.exe [2010-03-08] (Piranha Bytes)
Task: {B1676CF1-56FA-4BC5-A5BE-8F89C00B8999} - System32\Tasks\{C78E8831-B077-4CAD-9A4B-3544D4A08AB6} => pcalua.exe -a "A:\Games\The Crew (Russian)\Support\InsHelper.exe" -c CallUplayProtocol Uninstall 507
Task: {BAB22D34-8BAC-4CCC-8F5E-9CD68A54102B} - \99671b1f-6fed-4425-b716-7a85249607ed-4 No Task File <==== ATTENTION
Task: {BDD41632-060E-4934-8897-1EB49DF4808B} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-4 No Task File <==== ATTENTION
Task: {C4E9A6AA-E00C-4A60-A5AC-6E5F8A160B83} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-6 No Task File <==== ATTENTION
Task: {C77B6CC7-2FE9-4DAE-A173-5F0FC0393AF2} - System32\Tasks\{C2BFDCC5-8927-4002-B96F-C22C57A60767} => pcalua.exe -a C:\Users\Methanol\Downloads\VirtumundoBeGone.exe -d C:\Users\Methanol\Downloads
Task: {C7E061A8-62DD-4292-A37A-41F0A4680B6F} - System32\Tasks\{6B4B8EA5-0865-46AD-A14F-65CB9AE172F4} => pcalua.exe -a C:\Users\Methanol\Downloads\wmp11-windowsxp-x86-CS-CZ.exe -d C:\Users\Methanol\Downloads
Task: {D7DC8EE7-419F-4AB0-9C36-A6D4DA019EA4} - System32\Tasks\{56195558-2991-4B08-ADCD-8D766344E733} => pcalua.exe -a "A:\GMSforINST\ANNO 1404 - Benátky\ANNO 1404 - Benátky\Patche\anno1404_1.2.exe" -d "A:\GMSforINST\ANNO 1404 - Benátky\ANNO 1404 - Benátky\Patche"
Task: {DA054C93-AB19-488D-8A2C-537694BBC726} - \99671b1f-6fed-4425-b716-7a85249607ed-5 No Task File <==== ATTENTION
Task: {E0F4E682-97DB-4AD6-B7B0-9CB337D44D65} - \f5ebbb8a-6dac-4502-a995-6bfebc6451c3-7 No Task File <==== ATTENTION
Task: {E6C12F76-9B93-4C9E-86B7-C9CC03101B7A} - System32\Tasks\{E24332C1-2326-4270-8F0A-A21D78D13CC4} => pcalua.exe -a "C:\Program Files (x86)\iWebar\Uninstall.exe" -c /fcp=1
Task: {F599609E-CC88-4891-B3FF-44513ED2E8DA} - System32\Tasks\{14B9E7BC-BF1F-44BF-90C8-95E878CB3453} => pcalua.exe -a C:\Users\Methanol\AppData\Local\Temp\Rar$EXa0.384\TeamSpeak3-cestina-0.1.-beta2.exe -d "C:\Program Files\TeamSpeak 3 Client" -c -el -s2 "-dC:\Program Files\TeamSpeak 3 Client\" "-p" "-sp"
Task: {F6427C7D-7C6C-4D8B-8C77-D8B1E361CB41} - \99671b1f-6fed-4425-b716-7a85249607ed-5_user No Task File <==== ATTENTION
Task: {FF7B0C54-3B56-4D22-9DA8-C5A20B127982} - \SW-Booster-S-792098896 No Task File <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000Core.job => C:\Users\Methanol\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000UA.job => C:\Users\Methanol\AppData\Local\Google\Update\GoogleUpdate.exe

C:\Program Files (x86)\SavePass
C:\Program Files (x86)\ShopperPro
C:\Program Files (x86)\iWebar
C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}
C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}

AlternateDataStreams: C:\Windows:F40EA4D67EA11D06
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879
AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
Hosts:
EmptyTemp:
End
*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\NCUpdateHelper => value deleted successfully.
HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => value deleted successfully.
C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.lnk => Moved successfully.
C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6}\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe => Moved successfully.
C:\Users\Methanol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\going-clear-scientology-and-the-prison-of-belief-cze-6117369.lnk => Moved successfully.
C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-2973342720-1030308514-1458377291-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key Deleted successfully.
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
Firefox SearchEngineOrder.3 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox Keyword.URL deleted successfully.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => Key deleted successfully.
7ByteIo => Service deleted successfully.
npkcusb => Service deleted successfully.
C:\Users\Methanol\Desktop\adwcleaner_4.201.exe => Moved successfully.
C:\rsit => Moved successfully.
C:\Users\Methanol\Downloads\RSITx64.exe => Moved successfully.
C:\Users\Methanol\Desktop\going-clear-scientology-and-the-prison-of-belief-cze-6117369.zip => Moved successfully.
C:\ProgramData\7044438373684523921 => Moved successfully.
C:\ProgramData\anblmglnjdcgmpenbheeddcopcfpkldl => Moved successfully.
C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa} => Moved successfully.
C:\Users\Methanol\Downloads\going-clear-scientology-and-the-prison-of-belief-cze-6117369.exe => Moved successfully.
C:\Program Files (x86)\LinkMonitor => Moved successfully.
C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition-BLUS31024.iso Torrent - KickassTorrents(1).exe => Moved successfully.
C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition-BLUS31024.iso Torrent - KickassTorrents.exe => Moved successfully.
C:\Users\Methanol\Downloads\Download Doom 3 BFG Edition (2012) PC _ Reapck By Fenixx Torrent - KickassTorrents.exe => Moved successfully.
C:\AdwCleaner => Moved successfully.
C:\Program Files\trend micro => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0392CE01-571D-4715-8614-E86D38EE52B4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0392CE01-571D-4715-8614-E86D38EE52B4}" => Key deleted successfully.
C:\Windows\System32\Tasks\{5C99FD72-A216-4A30-9E4F-BC4BC9FEE784} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{5C99FD72-A216-4A30-9E4F-BC4BC9FEE784}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1A66A585-E99B-42AC-BB6D-F939C7D8414C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1A66A585-E99B-42AC-BB6D-F939C7D8414C}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\f5ebbb8a-6dac-4502-a995-6bfebc6451c3-1" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1DCC5085-452B-42F0-9B86-6A0FA884CA4F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1DCC5085-452B-42F0-9B86-6A0FA884CA4F}" => Key deleted successfully.
C:\Windows\System32\Tasks\{557517D9-A3B9-41D3-BD74-8FEE2FEB9C93} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{557517D9-A3B9-41D3-BD74-8FEE2FEB9C93}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1E0A2D2E-8DE2-4079-8636-8D55DD928B60}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1E0A2D2E-8DE2-4079-8636-8D55DD928B60}" => Key deleted successfully.
C:\Windows\System32\Tasks\{77BD7016-808B-46F3-96AA-A8821E6D3BA5} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{77BD7016-808B-46F3-96AA-A8821E6D3BA5}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{2692A003-5017-4DFD-B406-320FBD00D4AF}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2692A003-5017-4DFD-B406-320FBD00D4AF}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\f5ebbb8a-6dac-4502-a995-6bfebc6451c3-2" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{30DF89BA-C5B0-4278-8974-4DBC30C3E4F8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{30DF89BA-C5B0-4278-8974-4DBC30C3E4F8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\f5ebbb8a-6dac-4502-a995-6bfebc6451c3-5" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{348E4150-4ED2-4DEC-9765-624A87FFEBD6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{348E4150-4ED2-4DEC-9765-624A87FFEBD6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\99671b1f-6fed-4425-b716-7a85249607ed-1" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{39676B35-149F-46E3-A187-8AF434255EAE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{39676B35-149F-46E3-A187-8AF434255EAE}" => Key deleted successfully.
C:\Windows\System32\Tasks\{7F0534E8-25D2-4BDB-8B0F-8E6676793945} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{7F0534E8-25D2-4BDB-8B0F-8E6676793945}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3D949C1A-6F5B-444B-8904-89F8C986DD62}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D949C1A-6F5B-444B-8904-89F8C986DD62}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\99671b1f-6fed-4425-b716-7a85249607ed-6" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{42A655CD-AB76-4316-87AC-898D8403DD67}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{42A655CD-AB76-4316-87AC-898D8403DD67}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\99671b1f-6fed-4425-b716-7a85249607ed-2" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{43914F2C-F2D0-4A5C-9675-5840BA0A0F3A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{43914F2C-F2D0-4A5C-9675-5840BA0A0F3A}" => Key deleted successfully.
C:\Windows\System32\Tasks\{25C6D5CE-C756-493E-99C5-5DCAD59C0228} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{25C6D5CE-C756-493E-99C5-5DCAD59C0228}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4D17F167-A3D1-4F55-926A-FB637365DA37}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D17F167-A3D1-4F55-926A-FB637365DA37}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SPBIW_UpdateTask_Time_333537303136383336352d3437415a556c2a3223346c41" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{52FEE585-1367-45E4-8153-84FE146811D0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{52FEE585-1367-45E4-8153-84FE146811D0}" => Key deleted successfully.
C:\Windows\System32\Tasks\{308D64B8-BDBB-4AF7-859F-264AE48AA015} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{308D64B8-BDBB-4AF7-859F-264AE48AA015}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{61038C89-6C2E-4450-A263-713A3C22F096}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{61038C89-6C2E-4450-A263-713A3C22F096}" => Key deleted successfully.
C:\Windows\System32\Tasks\{6D946A09-849E-4F47-AEDA-00DC445B64E0} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6D946A09-849E-4F47-AEDA-00DC445B64E0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{638D820C-EDF5-4413-835A-CE8C29855A24}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{638D820C-EDF5-4413-835A-CE8C29855A24}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\f5ebbb8a-6dac-4502-a995-6bfebc6451c3-5_user" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{682AD900-2EA5-4D93-B77E-476680E2E0B3}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{682AD900-2EA5-4D93-B77E-476680E2E0B3}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\f5ebbb8a-6dac-4502-a995-6bfebc6451c3-11" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{794063A2-4396-4BFA-AC5C-4643B4A1A677}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{794063A2-4396-4BFA-AC5C-4643B4A1A677}" => Key deleted successfully.
C:\Windows\System32\Tasks\{868CC672-5182-4883-964B-45CEE9A0B790} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{868CC672-5182-4883-964B-45CEE9A0B790}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7CB1C4D9-4D71-405F-9DDB-C9C2A941D0B1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7CB1C4D9-4D71-405F-9DDB-C9C2A941D0B1}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\99671b1f-6fed-4425-b716-7a85249607ed-11" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8A0F8B5D-26F8-454A-B221-71C8465E4DF9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8A0F8B5D-26F8-454A-B221-71C8465E4DF9}" => Key deleted successfully.
C:\Windows\System32\Tasks\{4E28922A-62F5-4FDA-8BA8-BF224C5131F0} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{4E28922A-62F5-4FDA-8BA8-BF224C5131F0}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{93A23672-B720-4F4F-B122-66C2F0958205}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{93A23672-B720-4F4F-B122-66C2F0958205}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\99671b1f-6fed-4425-b716-7a85249607ed-7" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{99A64AC2-15C3-4410-8CED-57797E6B015D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{99A64AC2-15C3-4410-8CED-57797E6B015D}" => Key deleted successfully.
C:\Windows\System32\Tasks\{8104C66D-1F75-4FEA-AFED-1D9EC294F48A} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{8104C66D-1F75-4FEA-AFED-1D9EC294F48A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{99B4196D-4B8C-47C1-9A0B-A51528B477CD}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{99B4196D-4B8C-47C1-9A0B-A51528B477CD}" => Key deleted successfully.
C:\Windows\System32\Tasks\{3CF5883E-AEF8-4043-BEF4-11785987AC38} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{3CF5883E-AEF8-4043-BEF4-11785987AC38}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9C923143-DC6F-4972-B7D9-A6CC2191712D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9C923143-DC6F-4972-B7D9-A6CC2191712D}" => Key deleted successfully.
C:\Windows\System32\Tasks\{C061EE78-34E0-4005-87F3-D83B7D74FA3B} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C061EE78-34E0-4005-87F3-D83B7D74FA3B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9FC1E097-9D19-4DF4-A0C6-F651691AE3D6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9FC1E097-9D19-4DF4-A0C6-F651691AE3D6}" => Key deleted successfully.
C:\Windows\System32\Tasks\{6DE259FF-AA7E-4F99-9F91-5AD6DBD15902} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6DE259FF-AA7E-4F99-9F91-5AD6DBD15902}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A2A0EABB-E150-4654-B56E-EF0091405AB4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A2A0EABB-E150-4654-B56E-EF0091405AB4}" => Key deleted successfully.
C:\Windows\System32\Tasks\{36439F61-3184-43A1-AD0C-65EC2990803D} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{36439F61-3184-43A1-AD0C-65EC2990803D}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B1676CF1-56FA-4BC5-A5BE-8F89C00B8999}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B1676CF1-56FA-4BC5-A5BE-8F89C00B8999}" => Key deleted successfully.
C:\Windows\System32\Tasks\{C78E8831-B077-4CAD-9A4B-3544D4A08AB6} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C78E8831-B077-4CAD-9A4B-3544D4A08AB6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{BAB22D34-8BAC-4CCC-8F5E-9CD68A54102B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BAB22D34-8BAC-4CCC-8F5E-9CD68A54102B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\99671b1f-6fed-4425-b716-7a85249607ed-4" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{BDD41632-060E-4934-8897-1EB49DF4808B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BDD41632-060E-4934-8897-1EB49DF4808B}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\f5ebbb8a-6dac-4502-a995-6bfebc6451c3-4" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{C4E9A6AA-E00C-4A60-A5AC-6E5F8A160B83}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C4E9A6AA-E00C-4A60-A5AC-6E5F8A160B83}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\f5ebbb8a-6dac-4502-a995-6bfebc6451c3-6" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C77B6CC7-2FE9-4DAE-A173-5F0FC0393AF2}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C77B6CC7-2FE9-4DAE-A173-5F0FC0393AF2}" => Key deleted successfully.
C:\Windows\System32\Tasks\{C2BFDCC5-8927-4002-B96F-C22C57A60767} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C2BFDCC5-8927-4002-B96F-C22C57A60767}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C7E061A8-62DD-4292-A37A-41F0A4680B6F}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C7E061A8-62DD-4292-A37A-41F0A4680B6F}" => Key deleted successfully.
C:\Windows\System32\Tasks\{6B4B8EA5-0865-46AD-A14F-65CB9AE172F4} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6B4B8EA5-0865-46AD-A14F-65CB9AE172F4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D7DC8EE7-419F-4AB0-9C36-A6D4DA019EA4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D7DC8EE7-419F-4AB0-9C36-A6D4DA019EA4}" => Key deleted successfully.
C:\Windows\System32\Tasks\{56195558-2991-4B08-ADCD-8D766344E733} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{56195558-2991-4B08-ADCD-8D766344E733}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DA054C93-AB19-488D-8A2C-537694BBC726}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DA054C93-AB19-488D-8A2C-537694BBC726}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\99671b1f-6fed-4425-b716-7a85249607ed-5" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E0F4E682-97DB-4AD6-B7B0-9CB337D44D65}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E0F4E682-97DB-4AD6-B7B0-9CB337D44D65}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\f5ebbb8a-6dac-4502-a995-6bfebc6451c3-7" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E6C12F76-9B93-4C9E-86B7-C9CC03101B7A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E6C12F76-9B93-4C9E-86B7-C9CC03101B7A}" => Key deleted successfully.
C:\Windows\System32\Tasks\{E24332C1-2326-4270-8F0A-A21D78D13CC4} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E24332C1-2326-4270-8F0A-A21D78D13CC4}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F599609E-CC88-4891-B3FF-44513ED2E8DA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F599609E-CC88-4891-B3FF-44513ED2E8DA}" => Key deleted successfully.
C:\Windows\System32\Tasks\{14B9E7BC-BF1F-44BF-90C8-95E878CB3453} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{14B9E7BC-BF1F-44BF-90C8-95E878CB3453}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F6427C7D-7C6C-4D8B-8C77-D8B1E361CB41}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F6427C7D-7C6C-4D8B-8C77-D8B1E361CB41}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\99671b1f-6fed-4425-b716-7a85249607ed-5_user" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{FF7B0C54-3B56-4D22-9DA8-C5A20B127982}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FF7B0C54-3B56-4D22-9DA8-C5A20B127982}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SW-Booster-S-792098896" => Key deleted successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000Core.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2973342720-1030308514-1458377291-1000UA.job => Moved successfully.
"C:\Program Files (x86)\SavePass" => File/Directory not found.
"C:\Program Files (x86)\ShopperPro" => File/Directory not found.
"C:\Program Files (x86)\iWebar" => File/Directory not found.
C:\ProgramData\{8013a6b9-90ea-8e6d-8013-3a6b990e9ae6} => Moved successfully.
"C:\ProgramData\{cde837ea-a7e3-38b7-cde8-837eaa7edfaa}" => File/Directory not found.
C:\Windows => ":F40EA4D67EA11D06" ADS removed successfully.
C:\ProgramData\TEMP => ":56E2E879" ADS removed successfully.
C:\ProgramData\TEMP => ":D1B5B4F1" ADS removed successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 630.1 MB temporary data.


The system needed a reboot.

==== End of Fixlog 15:34:36 ====

Nic se nedeje

Doporucuju soubor C:\Program Files (x86)\JpegResampler2010\JRcm64.dll zazipovat (archivovat) a puvodni smazat.

Takze jeste uklidime.

• Stahnete a spustte DelFix - https://toolslib.net/downloads/viewdownload/2-delfix/
• Oznacte jen moznost "Remove disinfection tools"
• kliknete na Run

A pokud nejsou dotazy ci jine problemy, je to ode mne vse.

Nedaří se mi ho "zazipovat" - přístup byl odepřen..stačí ho smazat?

Tady je log z delfixu..

# DelFix v10.9 - Logfile created 17/04/2015 at 15:46:57
# Updated 27/02/2015 by Xplode
# Username : Methanol - METHANOL-PC
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\Users\Methanol\Desktop\Fixlog.txt
Deleted : C:\Users\Methanol\Desktop\FRST64.exe
Deleted : C:\Users\Methanol\Desktop\TFC.exe
Deleted : C:\Users\Methanol\Downloads\Addition.txt
Deleted : C:\Users\Methanol\Downloads\FRST.txt
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\Swearware
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis

########## - EOF - ##########

Jako trojan ho oznacil jen jeden antivir, takze se muze jednat o false positive. Tak ho presunte do jine slozky.