Dobrý den, potřeboval bych pomoc s virama a malware DĚKUJI
Napsal: 17 říj 2016 13:48
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 16-10-2016
Ran by AspireG (administrator) on ASPIREG-PC (17-10-2016 14:34:31)
Running from C:\Users\AspireG\Desktop
Loaded Profiles: AspireG (Available Profiles: AspireG & Guest)
Platform: Windows 7 Home Premium (X64) Language: Čeština (Česká republika)
Internet Explorer Version 8 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.11.266\SSScheduler.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(forum.viry.cz) C:\Users\AspireG\Desktop\FRSTLauncher.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1758280 2016-06-16] (APN)
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-30] (Piriform Ltd)
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\Policies\system: [Shell] explorer.exe
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\MountPoints2: {03e12952-c3de-11df-a7ee-00262d8fe6e4} - F:\wubi.exe
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\MountPoints2: {5c2d4742-b21b-11e5-a7bc-00262d8fe6e4} - H:\LG_PC_Programs.exe
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\MountPoints2: {6f75db40-6081-11e4-b867-806e6f6e6963} - F:\setup.exe
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\MountPoints2: {6f75db41-6081-11e4-b867-806e6f6e6963} - G:\setup.exe
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\MountPoints2: {b3f73255-4bee-11e6-9bad-00262d8fe6e4} - F:\autorun.exe
ShellExecuteHooks-x32: - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - No File [ ]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-07-31]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.11.266\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{566A5067-95CE-4D3F-A64D-81CC6684E64E}: [DhcpNameServer] 10.0.0.138
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130886245434960301&GUID=00000000-0000-0000-0000-000000000000
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.amaizingsearches.info/?pid=1273&r=2014/04/01&hid=11780356437905707336&lg=EN&cc=CZ&unqvl=51
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hp&ts=14147 ... E3280E3280
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hp&ts=14147 ... E3280E3280
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130886245435116301&GUID=00000000-0000-0000-0000-000000000000
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2670199&CUI=UN31378477952583167
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hp&ts=14147 ... E3280E3280
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937
URLSearchHook: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 - QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\AspireG\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
URLSearchHook: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 - SearchHook Class - {D8278076-BC68-4484-9233-6E7F1628B56C} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\searchhook.dll (APN LLC.)
URLSearchHook: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=565&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2522220171634425&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} URL =
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={s ... lz=1I7ACAW
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=565&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2522220171634425&q={searchTerms}
SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
SearchScopes: HKLM-x32 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.amaizingsearches.info/?l=1&q={searchTerms}&pid=1273&r=2014/04/01&hid=11780356437905707336&lg=EN&cc=CZ&unqvl=51
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> DefaultScope {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} URL = hxxp://search.qip.ru/search?query={searchTerms}&from=IE
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://asksearch.ask.com/redirect?client=ie&src=crm&tb=ATU-SAT&o=APN10241&locale=en_EU&apn_uid=43DCA117-327B-432F-B6C2-66AC26C10B54&apn_ptnrs=^AF8&apn_dtid=^YYYYYY^YY^CZ&apn_dbr=cr_15.0.874.102&itbv=11.1.0.182&doi=2012-09-29&q={searchTerms}&
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={s ... AW_csCZ397
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {93DE1ECA-2B83-4711-90F6-DC57FC14E825} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2670199
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=565&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2522220171634425&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} URL = hxxp://search.qip.ru/search?query={searchTerms}&from=IE
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search/web?q={searchTerms}
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://www.google.com/search?sourceid=ie7&q={s ... AW_csCZ397
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.amaizingsearches.info/?l=1&q={searchTerms}&pid=1273&r=2014/04/01&hid=11780356437905707336&lg=EN&cc=CZ&unqvl=51
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {CD4FA6E1-8CDA-4ABC-BB13-F5F83F94D7B6} URL = hxxp://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {FCFDB4EB-F7B2-4D61-B99A-C2317531ACB3} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
BHO: Ask Shopping Toolbar -> {4154552D-5341-5400-76A7-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU-SAT\Passport_x64.dll [2016-06-16] (APN LLC.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2016-03-21] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2016-03-21] (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06] (Adobe Systems Incorporated)
BHO-x32: Ask Shopping Toolbar -> {4154552D-5341-5400-76A7-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU-SAT\Passport.dll [2016-06-16] (APN LLC.)
BHO-x32: No Name -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> No File
BHO-x32: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
BHO-x32: Pomocná služba pro přihlášení ke službě Windows Live ID -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: QIPBHO Class -> {95289393-33EA-4F8D-B952-483415B9C955} -> C:\Users\AspireG\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll [2012-11-26] (qip.ru)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-09-23] (Microsoft Corporation)
BHO-x32: No Name -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> No File
BHO-x32: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
Toolbar: HKLM - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKLM - Ask Shopping Toolbar - {4154552D-5341-5400-76A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU-SAT\Passport_x64.dll [2016-06-16] (APN LLC.)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKLM-x32 - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKLM-x32 - Ask Shopping Toolbar - {4154552D-5341-5400-76A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU-SAT\Passport.dll [2016-06-16] (APN LLC.)
Toolbar: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> Ask Shopping Toolbar - {4154552D-5341-5400-76A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU-SAT\Passport_x64.dll [2016-06-16] (APN LLC.)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - No File
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-04] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-04] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-04] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-04] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=14147 ... E3280E3280
FireFox:
========
FF ProfilePath: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default [2016-10-17]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\hf278yrv.default -> Ask.com
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\hf278yrv.default -> hxxp://websearch.amaizingsearches.info/?pid=1273&r=2014/04/01&hid=11780356437905707336&lg=EN&cc=CZ&unqvl=51&l=1&q=
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\hf278yrv.default -> WebSearch
FF SearchEngineOrder.1,S: Mozilla\Firefox\Profiles\hf278yrv.default -> WebSearch
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\hf278yrv.default -> Ask.com
FF SelectedSearchEngine,S: Mozilla\Firefox\Profiles\hf278yrv.default -> WebSearch
FF Homepage: Mozilla\Firefox\Profiles\hf278yrv.default -> hxxp://websearch.amaizingsearches.info/?pid=1273&r=2014/04/01&hid=11780356437905707336&lg=EN&cc=CZ&unqvl=51
FF NetworkProxy: Mozilla\Firefox\Profiles\hf278yrv.default -> type", 0
FF Extension: (hosts) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\05dd836e-2cbd-4204-9ff3-2f8a8665967d@a8876730-fb0c-4057-a2fc-f9c09d438e81.com [2013-07-04] [not signed]
FF Extension: (TotalPlusHD-3.1V31.10) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\6cfae8cc4676442fa78d9dcdf@bd4ea874e76d4af1994ba.com [2014-10-31] [not signed]
FF Extension: (DAEMON Tools Toolbar) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\DTToolbar@toolbarnet.com [2013-07-29] [not signed]
FF Extension: (Fast Start) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\faststartff@gmail.com [2014-10-31] [not signed]
FF Extension: (multifoxhultmann) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\multifox@hultmann [2014-11-04] [not signed]
FF Extension: (GamePlayLabs Plugin) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\plugin2@gameplaylabs.com [2011-04-08] [not signed]
FF Extension: (QipCounter) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\QipCounter@qip.ru.xpi [2012-08-24] [not signed]
FF Extension: (aTube Toolbar) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\toolbar@ask.com [2012-08-23] [not signed]
FF Extension: (Torntv 3) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\trtv3@trtv.com.xpi [2013-06-30] [not signed]
FF Extension: (Address Bar Search) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{4D6A6C8E-1EB2-46e1-8CAA-40DAFDE3ED93} [2014-10-31] [not signed]
FF Extension: (ICQ Toolbar) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2013-07-29] [not signed]
FF Extension: (Free Lunch Design TB ) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{a5ae8924-4036-420f-b7f6-a47e4b8f692e} [2013-07-29] [not signed]
FF Extension: (No Name) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{a5ae8924-4036-420f-b7f6-a47e4b8f692e}.oldbackup [2012-09-21] [not signed]
FF Extension: (DVDVideoSoft Menu) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011-08-24] [not signed]
FF Extension: (Seznam lištička) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2016-07-14]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\ask-search.xml [2012-09-29]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\askcom.xml [2015-11-22]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\babylon.xml [2013-07-04]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\daemon-search.xml [2010-09-19]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-1.xml [2013-08-06]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-2.xml [2010-10-29]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-3.xml [2010-12-12]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-4.xml [2011-03-28]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-5.xml [2011-04-08]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-6.xml [2011-05-23]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-7.xml [2011-05-29]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-8.xml [2011-07-10]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-9.xml [2011-11-21]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin.xml [2010-10-19]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\ividi.xml [2013-08-30]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\qip-search.xml [2013-07-17]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\Search_Results.xml [2013-01-19]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\Web Search.xml [2012-12-27]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\WebSearch.xml [2014-04-01]
FF HKLM-x32\...\Firefox\Extensions: [OKitSpace@OKitSpace.es] - C:\Windows\system32\config\systemprofile\AppData\Roaming\okitSpace\Firefox => not found
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\extensions\faststartff@gmail.com
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-31] ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2016-03-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2016-03-21] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-31] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2013-12-05] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [No File]
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [No File]
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll [No File]
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Reader 2\npnitromozilla.dll [No File]
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [No File]
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [No File]
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2011-06-06] (Adobe Systems Inc.)
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hp&ts=14147 ... E3280E3280
CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hp&ts=14147 ... E3280E3280"
CHR DefaultSearchURL: Default -> hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
CHR DefaultSearchKeyword: Default -> mystartsearch
CHR Profile: C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default [2016-07-31]
CHR Extension: (Torntv 3) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\bicnnkjibmphdeigoodpjlcklcnaobdj [2015-11-15]
CHR Extension: (filklcnjkojnfbkcfooccecbjbfgfpaf) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\filklcnjkojnfbkcfooccecbjbfgfpaf [2014-11-05]
CHR Extension: (Domain Error Assistant) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj [2015-11-15]
CHR Extension: (TotalPlusHD-3.1V31.10) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljefoakgfhcoeobgicjgejglnpfpemgb [2014-10-31]
CHR Extension: (Slick Savings) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk [2015-07-25] [UpdateUrl: hxxp://www.mybrowserbar.com/update/wt/gc/coupons/update.xml] <==== ATTENTION
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-26]
CHR Extension: (GamePlayLabs Plugin) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocphobfcfafpclibolpjdafgaffkaoci [2014-07-14]
CHR Extension: (No Name) - C:\Users\AspireG\AppData\Local\Form Cooking\Component [2015-11-26]
CHR Extension: (King Ninja) - C:\Users\AspireG\AppData\Local\King Ninja\Component [2015-12-31]
CHR HKLM-x32\...\Chrome\Extension: [bicnnkjibmphdeigoodpjlcklcnaobdj] - C:\Program Files (x86)\TornTV.com\torntv10.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - C:\Program Files (x86)\Common Files\Spigot\GC\ErrorAssistant_1.3.crx [2013-12-27]
CHR HKLM-x32\...\Chrome\Extension: [kiplfnciaokpcennlkldkdaeaaomamof] - C:\Users\AspireG\AppData\Local\Torch\Plugins\TorchPlugin.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [lbidgdoiglndbjlcnnifemecdhnpeabo] - C:\Users\AspireG\AppData\Roaming\okitSpace\Chrome\OKitSpace.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Program Files (x86)\Common Files\Spigot\GC\coupons_2.4.crx [2013-04-26]
CHR HKLM-x32\...\Chrome\Extension: [ocphobfcfafpclibolpjdafgaffkaoci] - C:\Users\AspireG\AppData\Local\GamePlayLabs Plugin\gplplugin.crx [2011-03-15]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [198216 2016-06-16] (APN LLC.)
S4 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2013-12-05] ()
S4 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S2 MBAMService; D:\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.11.266\McCHSvc.exe [235696 2015-12-02] (McAfee, Inc.)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
S4 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [229392 2012-09-13] (Nitro PDF Software)
S4 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [279848 2007-06-27] (Nero AG)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S4 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [X]
S4 NTIBackupSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [X]
S4 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2016-03-22] () [File not signed]
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2016-03-22] () [File not signed]
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64896 2016-03-10] (Malwarebytes Corporation)
S3 nmwcdcx64; C:\Windows\System32\drivers\ccdcmbox64.sys [27136 2012-11-16] (Nokia)
S3 nmwcdx64; C:\Windows\System32\drivers\ccdcmbx64.sys [19968 2012-11-16] (Nokia)
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-02] (Realtek Semiconductor Corp.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-10-31] (Duplex Secure Ltd.)
S0 TPkd; no ImagePath
S3 vkdszuhd; no ImagePath
U3 aby21jxo; no ImagePath
S3 ApfiltrService; system32\DRIVERS\Apfiltr.sys [X]
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwavdt; system32\drivers\btwavdt.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; system32\DRIVERS\btwrchid.sys [X]
R3 gkernel; \??\C:\Users\AspireG\AppData\Local\Temp\gkernel.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-10-17 14:34 - 2016-10-17 14:35 - 00031713 _____ C:\Users\AspireG\Desktop\FRST.txt
2016-10-17 14:34 - 2016-10-17 14:34 - 00000000 ____D C:\FRST
2016-10-17 14:32 - 2016-10-17 14:33 - 00112640 _____ (forum.viry.cz) C:\Users\AspireG\Desktop\FRSTLauncher.exe
2016-10-17 14:31 - 2016-10-17 14:31 - 02406912 _____ (Farbar) C:\Users\AspireG\Desktop\FRST64.exe
2016-10-17 14:21 - 2016-10-17 14:21 - 03343856 _____ (Blizzard Entertainment) C:\Users\AspireG\Desktop\Heroes-of-the-Storm-Setup.exe
2016-10-16 22:40 - 2016-10-16 22:40 - 00001439 _____ C:\Users\Public\Desktop\League of Legends.lnk
2016-10-16 22:40 - 2016-10-16 22:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2016-10-16 22:37 - 2016-10-16 22:37 - 31336304 _____ (Riot Games) C:\Users\AspireG\Desktop\LeagueofLegends_EUNE_Installer_2016_05_13.exe
2016-09-24 03:53 - 2016-09-24 21:51 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-09-19 16:29 - 2016-10-17 13:51 - 00003476 _____ C:\Windows\System32\Tasks\Garena+ Plugin Host Service
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-10-17 14:29 - 2009-07-14 06:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-10-17 14:29 - 2009-07-14 06:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-10-17 14:21 - 2016-07-31 12:23 - 00000000 ____D C:\Program Files (x86)\Battle.net
2016-10-17 14:10 - 2016-07-31 19:26 - 00000000 ____D C:\Users\AspireG\AppData\Local\Battle.net
2016-10-17 14:10 - 2014-03-03 11:39 - 00000000 ____D C:\Users\AspireG\AppData\Local\CrashDumps
2016-10-17 14:06 - 2016-07-31 12:23 - 00000000 ____D C:\Users\AspireG\AppData\Roaming\Battle.net
2016-10-16 22:42 - 2014-10-30 17:22 - 00000000 ____D C:\Users\AspireG\AppData\Roaming\Riot Games
2016-10-15 19:55 - 2016-04-05 15:42 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
==================== Files in the root of some directories =======
2009-10-29 06:21 - 2009-02-10 21:23 - 0192484 _____ () C:\Program Files (x86)\Common Files\Acer GameZone online.ico
2002-08-29 19:33 - 2002-08-29 19:33 - 0319488 ____R () C:\Users\AspireG\AppData\Roaming\MafiaSetup.exe
2016-07-31 19:03 - 2016-07-31 19:05 - 0032256 ___SH () C:\Users\AspireG\AppData\Roaming\Thumbs.db
2010-11-04 02:15 - 2010-11-04 02:15 - 0024940 _____ () C:\Users\AspireG\AppData\Roaming\UserTile.png
2011-04-24 14:59 - 2011-04-24 14:59 - 0000000 _____ () C:\Users\AspireG\AppData\Local\{788661F8-0C23-4FCE-BA1D-75295EEDAC53}
2010-03-02 16:50 - 2010-03-02 16:53 - 0007747 _____ () C:\ProgramData\ArcadeDeluxe3.log
2009-10-29 06:22 - 2009-07-18 03:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
2011-07-18 19:17 - 2014-04-11 15:45 - 0000012 _____ () C:\ProgramData\ReminderNextRun
2014-01-22 12:48 - 2014-02-13 00:42 - 0000040 _____ () C:\ProgramData\spds90.txt
Some files in TEMP:
====================
C:\Users\AspireG\AppData\Local\Temp\AppInstaller.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
ATTENTION: ==> Could not access BCD.
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
==================== MBR and Partition Table ==================
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Epson Printer Software Downloader.job => C:\Program Files (x86)\EPSON\EPAPDL\E_SAPDL2.EXE
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d13e7cf2fc0456.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d16275856e309a.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d1ab60265b93ff.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PC Optimizer Pro64 startups.job => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
Task: C:\Windows\Tasks\WinThruster_DEFAULT.job => C:\Program Files (x86)\WinThruster\WinThruster.exe <==== ATTENTION
Task: C:\Windows\Tasks\WinThruster_UPDATES.job => C:\Program Files (x86)\WinThruster\WinThruster.exe <==== ATTENTION
Task: C:\Windows\Tasks\WinZipDriverUpdater_UPDATES.job => C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\AspireG\Desktop" je 26107 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
==================== End Of Log ==============================
Ran by AspireG (administrator) on ASPIREG-PC (17-10-2016 14:34:31)
Running from C:\Users\AspireG\Desktop
Loaded Profiles: AspireG (Available Profiles: AspireG & Guest)
Platform: Windows 7 Home Premium (X64) Language: Čeština (Česká republika)
Internet Explorer Version 8 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.11.266\SSScheduler.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(forum.viry.cz) C:\Users\AspireG\Desktop\FRSTLauncher.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1758280 2016-06-16] (APN)
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-30] (Piriform Ltd)
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\Policies\system: [Shell] explorer.exe
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\MountPoints2: {03e12952-c3de-11df-a7ee-00262d8fe6e4} - F:\wubi.exe
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\MountPoints2: {5c2d4742-b21b-11e5-a7bc-00262d8fe6e4} - H:\LG_PC_Programs.exe
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\MountPoints2: {6f75db40-6081-11e4-b867-806e6f6e6963} - F:\setup.exe
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\MountPoints2: {6f75db41-6081-11e4-b867-806e6f6e6963} - G:\setup.exe
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\...\MountPoints2: {b3f73255-4bee-11e6-9bad-00262d8fe6e4} - F:\autorun.exe
ShellExecuteHooks-x32: - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - No File [ ]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-09-11] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-07-31]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.11.266\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{566A5067-95CE-4D3F-A64D-81CC6684E64E}: [DhcpNameServer] 10.0.0.138
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130886245434960301&GUID=00000000-0000-0000-0000-000000000000
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.amaizingsearches.info/?pid=1273&r=2014/04/01&hid=11780356437905707336&lg=EN&cc=CZ&unqvl=51
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hp&ts=14147 ... E3280E3280
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hp&ts=14147 ... E3280E3280
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130886245435116301&GUID=00000000-0000-0000-0000-000000000000
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2670199&CUI=UN31378477952583167
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.mystartsearch.com/?type=hp&ts=14147 ... E3280E3280
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm
HKU\S-1-5-21-4209140738-1266058932-301308101-1000\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=2937
URLSearchHook: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 - QIPBHO Class - {95289393-33EA-4F8D-B952-483415B9C955} - C:\Users\AspireG\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
URLSearchHook: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 - SearchHook Class - {D8278076-BC68-4484-9233-6E7F1628B56C} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\searchhook.dll (APN LLC.)
URLSearchHook: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=565&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2522220171634425&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} URL =
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={s ... lz=1I7ACAW
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=565&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2522220171634425&q={searchTerms}
SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
SearchScopes: HKLM-x32 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.amaizingsearches.info/?l=1&q={searchTerms}&pid=1273&r=2014/04/01&hid=11780356437905707336&lg=EN&cc=CZ&unqvl=51
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> DefaultScope {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} URL = hxxp://search.qip.ru/search?query={searchTerms}&from=IE
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://asksearch.ask.com/redirect?client=ie&src=crm&tb=ATU-SAT&o=APN10241&locale=en_EU&apn_uid=43DCA117-327B-432F-B6C2-66AC26C10B54&apn_ptnrs=^AF8&apn_dtid=^YYYYYY^YY^CZ&apn_dbr=cr_15.0.874.102&itbv=11.1.0.182&doi=2012-09-29&q={searchTerms}&
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={s ... AW_csCZ397
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {93DE1ECA-2B83-4711-90F6-DC57FC14E825} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2670199
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=565&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2522220171634425&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} URL = hxxp://search.qip.ru/search?query={searchTerms}&from=IE
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search/web?q={searchTerms}
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://www.google.com/search?sourceid=ie7&q={s ... AW_csCZ397
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.amaizingsearches.info/?l=1&q={searchTerms}&pid=1273&r=2014/04/01&hid=11780356437905707336&lg=EN&cc=CZ&unqvl=51
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {CD4FA6E1-8CDA-4ABC-BB13-F5F83F94D7B6} URL = hxxp://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
SearchScopes: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> {FCFDB4EB-F7B2-4D61-B99A-C2317531ACB3} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
BHO: Ask Shopping Toolbar -> {4154552D-5341-5400-76A7-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU-SAT\Passport_x64.dll [2016-06-16] (APN LLC.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2016-03-21] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2016-03-21] (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06] (Adobe Systems Incorporated)
BHO-x32: Ask Shopping Toolbar -> {4154552D-5341-5400-76A7-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU-SAT\Passport.dll [2016-06-16] (APN LLC.)
BHO-x32: No Name -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> No File
BHO-x32: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
BHO-x32: Pomocná služba pro přihlášení ke službě Windows Live ID -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: QIPBHO Class -> {95289393-33EA-4F8D-B952-483415B9C955} -> C:\Users\AspireG\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll [2012-11-26] (qip.ru)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-09-23] (Microsoft Corporation)
BHO-x32: No Name -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> No File
BHO-x32: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No File
Toolbar: HKLM - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKLM - Ask Shopping Toolbar - {4154552D-5341-5400-76A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU-SAT\Passport_x64.dll [2016-06-16] (APN LLC.)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKLM-x32 - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKLM-x32 - Ask Shopping Toolbar - {4154552D-5341-5400-76A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU-SAT\Passport.dll [2016-06-16] (APN LLC.)
Toolbar: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKU\S-1-5-21-4209140738-1266058932-301308101-1000 -> Ask Shopping Toolbar - {4154552D-5341-5400-76A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ATU-SAT\Passport_x64.dll [2016-06-16] (APN LLC.)
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - No File
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-04] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-04] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-04] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-04] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=14147 ... E3280E3280
FireFox:
========
FF ProfilePath: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default [2016-10-17]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\hf278yrv.default -> Ask.com
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\hf278yrv.default -> hxxp://websearch.amaizingsearches.info/?pid=1273&r=2014/04/01&hid=11780356437905707336&lg=EN&cc=CZ&unqvl=51&l=1&q=
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\hf278yrv.default -> WebSearch
FF SearchEngineOrder.1,S: Mozilla\Firefox\Profiles\hf278yrv.default -> WebSearch
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\hf278yrv.default -> Ask.com
FF SelectedSearchEngine,S: Mozilla\Firefox\Profiles\hf278yrv.default -> WebSearch
FF Homepage: Mozilla\Firefox\Profiles\hf278yrv.default -> hxxp://websearch.amaizingsearches.info/?pid=1273&r=2014/04/01&hid=11780356437905707336&lg=EN&cc=CZ&unqvl=51
FF NetworkProxy: Mozilla\Firefox\Profiles\hf278yrv.default -> type", 0
FF Extension: (hosts) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\05dd836e-2cbd-4204-9ff3-2f8a8665967d@a8876730-fb0c-4057-a2fc-f9c09d438e81.com [2013-07-04] [not signed]
FF Extension: (TotalPlusHD-3.1V31.10) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\6cfae8cc4676442fa78d9dcdf@bd4ea874e76d4af1994ba.com [2014-10-31] [not signed]
FF Extension: (DAEMON Tools Toolbar) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\DTToolbar@toolbarnet.com [2013-07-29] [not signed]
FF Extension: (Fast Start) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\faststartff@gmail.com [2014-10-31] [not signed]
FF Extension: (multifoxhultmann) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\multifox@hultmann [2014-11-04] [not signed]
FF Extension: (GamePlayLabs Plugin) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\plugin2@gameplaylabs.com [2011-04-08] [not signed]
FF Extension: (QipCounter) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\QipCounter@qip.ru.xpi [2012-08-24] [not signed]
FF Extension: (aTube Toolbar) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\toolbar@ask.com [2012-08-23] [not signed]
FF Extension: (Torntv 3) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\trtv3@trtv.com.xpi [2013-06-30] [not signed]
FF Extension: (Address Bar Search) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{4D6A6C8E-1EB2-46e1-8CAA-40DAFDE3ED93} [2014-10-31] [not signed]
FF Extension: (ICQ Toolbar) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2013-07-29] [not signed]
FF Extension: (Free Lunch Design TB ) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{a5ae8924-4036-420f-b7f6-a47e4b8f692e} [2013-07-29] [not signed]
FF Extension: (No Name) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{a5ae8924-4036-420f-b7f6-a47e4b8f692e}.oldbackup [2012-09-21] [not signed]
FF Extension: (DVDVideoSoft Menu) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011-08-24] [not signed]
FF Extension: (Seznam lištička) - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2016-07-14]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\ask-search.xml [2012-09-29]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\askcom.xml [2015-11-22]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\babylon.xml [2013-07-04]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\daemon-search.xml [2010-09-19]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-1.xml [2013-08-06]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-2.xml [2010-10-29]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-3.xml [2010-12-12]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-4.xml [2011-03-28]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-5.xml [2011-04-08]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-6.xml [2011-05-23]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-7.xml [2011-05-29]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-8.xml [2011-07-10]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin-9.xml [2011-11-21]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\icqplugin.xml [2010-10-19]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\ividi.xml [2013-08-30]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\qip-search.xml [2013-07-17]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\Search_Results.xml [2013-01-19]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\Web Search.xml [2012-12-27]
FF SearchPlugin: C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\searchplugins\WebSearch.xml [2014-04-01]
FF HKLM-x32\...\Firefox\Extensions: [OKitSpace@OKitSpace.es] - C:\Windows\system32\config\systemprofile\AppData\Roaming\okitSpace\Firefox => not found
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\AspireG\AppData\Roaming\Mozilla\Firefox\Profiles\hf278yrv.default\extensions\faststartff@gmail.com
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-31] ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2016-03-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2016-03-21] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-31] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2013-12-05] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [No File]
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [No File]
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll [No File]
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Reader 2\npnitromozilla.dll [No File]
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [No File]
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [No File]
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2011-06-06] (Adobe Systems Inc.)
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hp&ts=14147 ... E3280E3280
CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hp&ts=14147 ... E3280E3280"
CHR DefaultSearchURL: Default -> hxxp://www.mystartsearch.com/web/?type=ds&ts=1 ... earchTerms}
CHR DefaultSearchKeyword: Default -> mystartsearch
CHR Profile: C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default [2016-07-31]
CHR Extension: (Torntv 3) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\bicnnkjibmphdeigoodpjlcklcnaobdj [2015-11-15]
CHR Extension: (filklcnjkojnfbkcfooccecbjbfgfpaf) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\filklcnjkojnfbkcfooccecbjbfgfpaf [2014-11-05]
CHR Extension: (Domain Error Assistant) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj [2015-11-15]
CHR Extension: (TotalPlusHD-3.1V31.10) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\ljefoakgfhcoeobgicjgejglnpfpemgb [2014-10-31]
CHR Extension: (Slick Savings) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk [2015-07-25] [UpdateUrl: hxxp://www.mybrowserbar.com/update/wt/gc/coupons/update.xml] <==== ATTENTION
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-26]
CHR Extension: (GamePlayLabs Plugin) - C:\Users\AspireG\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocphobfcfafpclibolpjdafgaffkaoci [2014-07-14]
CHR Extension: (No Name) - C:\Users\AspireG\AppData\Local\Form Cooking\Component [2015-11-26]
CHR Extension: (King Ninja) - C:\Users\AspireG\AppData\Local\King Ninja\Component [2015-12-31]
CHR HKLM-x32\...\Chrome\Extension: [bicnnkjibmphdeigoodpjlcklcnaobdj] - C:\Program Files (x86)\TornTV.com\torntv10.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - C:\Program Files (x86)\Common Files\Spigot\GC\ErrorAssistant_1.3.crx [2013-12-27]
CHR HKLM-x32\...\Chrome\Extension: [kiplfnciaokpcennlkldkdaeaaomamof] - C:\Users\AspireG\AppData\Local\Torch\Plugins\TorchPlugin.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [lbidgdoiglndbjlcnnifemecdhnpeabo] - C:\Users\AspireG\AppData\Roaming\okitSpace\Chrome\OKitSpace.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Program Files (x86)\Common Files\Spigot\GC\coupons_2.4.crx [2013-04-26]
CHR HKLM-x32\...\Chrome\Extension: [ocphobfcfafpclibolpjdafgaffkaoci] - C:\Users\AspireG\AppData\Local\GamePlayLabs Plugin\gplplugin.crx [2011-03-15]
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [198216 2016-06-16] (APN LLC.)
S4 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2013-12-05] ()
S4 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S2 MBAMService; D:\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.11.266\McCHSvc.exe [235696 2015-12-02] (McAfee, Inc.)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
S4 NitroReaderDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [229392 2012-09-13] (Nitro PDF Software)
S4 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [279848 2007-06-27] (Nero AG)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S4 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [X]
S4 NTIBackupSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [X]
S4 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2016-03-22] () [File not signed]
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2016-03-22] () [File not signed]
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64896 2016-03-10] (Malwarebytes Corporation)
S3 nmwcdcx64; C:\Windows\System32\drivers\ccdcmbox64.sys [27136 2012-11-16] (Nokia)
S3 nmwcdx64; C:\Windows\System32\drivers\ccdcmbx64.sys [19968 2012-11-16] (Nokia)
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-02] (Realtek Semiconductor Corp.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-10-31] (Duplex Secure Ltd.)
S0 TPkd; no ImagePath
S3 vkdszuhd; no ImagePath
U3 aby21jxo; no ImagePath
S3 ApfiltrService; system32\DRIVERS\Apfiltr.sys [X]
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwavdt; system32\drivers\btwavdt.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; system32\DRIVERS\btwrchid.sys [X]
R3 gkernel; \??\C:\Users\AspireG\AppData\Local\Temp\gkernel.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-10-17 14:34 - 2016-10-17 14:35 - 00031713 _____ C:\Users\AspireG\Desktop\FRST.txt
2016-10-17 14:34 - 2016-10-17 14:34 - 00000000 ____D C:\FRST
2016-10-17 14:32 - 2016-10-17 14:33 - 00112640 _____ (forum.viry.cz) C:\Users\AspireG\Desktop\FRSTLauncher.exe
2016-10-17 14:31 - 2016-10-17 14:31 - 02406912 _____ (Farbar) C:\Users\AspireG\Desktop\FRST64.exe
2016-10-17 14:21 - 2016-10-17 14:21 - 03343856 _____ (Blizzard Entertainment) C:\Users\AspireG\Desktop\Heroes-of-the-Storm-Setup.exe
2016-10-16 22:40 - 2016-10-16 22:40 - 00001439 _____ C:\Users\Public\Desktop\League of Legends.lnk
2016-10-16 22:40 - 2016-10-16 22:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2016-10-16 22:37 - 2016-10-16 22:37 - 31336304 _____ (Riot Games) C:\Users\AspireG\Desktop\LeagueofLegends_EUNE_Installer_2016_05_13.exe
2016-09-24 03:53 - 2016-09-24 21:51 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-09-19 16:29 - 2016-10-17 13:51 - 00003476 _____ C:\Windows\System32\Tasks\Garena+ Plugin Host Service
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-10-17 14:29 - 2009-07-14 06:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-10-17 14:29 - 2009-07-14 06:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-10-17 14:21 - 2016-07-31 12:23 - 00000000 ____D C:\Program Files (x86)\Battle.net
2016-10-17 14:10 - 2016-07-31 19:26 - 00000000 ____D C:\Users\AspireG\AppData\Local\Battle.net
2016-10-17 14:10 - 2014-03-03 11:39 - 00000000 ____D C:\Users\AspireG\AppData\Local\CrashDumps
2016-10-17 14:06 - 2016-07-31 12:23 - 00000000 ____D C:\Users\AspireG\AppData\Roaming\Battle.net
2016-10-16 22:42 - 2014-10-30 17:22 - 00000000 ____D C:\Users\AspireG\AppData\Roaming\Riot Games
2016-10-15 19:55 - 2016-04-05 15:42 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
==================== Files in the root of some directories =======
2009-10-29 06:21 - 2009-02-10 21:23 - 0192484 _____ () C:\Program Files (x86)\Common Files\Acer GameZone online.ico
2002-08-29 19:33 - 2002-08-29 19:33 - 0319488 ____R () C:\Users\AspireG\AppData\Roaming\MafiaSetup.exe
2016-07-31 19:03 - 2016-07-31 19:05 - 0032256 ___SH () C:\Users\AspireG\AppData\Roaming\Thumbs.db
2010-11-04 02:15 - 2010-11-04 02:15 - 0024940 _____ () C:\Users\AspireG\AppData\Roaming\UserTile.png
2011-04-24 14:59 - 2011-04-24 14:59 - 0000000 _____ () C:\Users\AspireG\AppData\Local\{788661F8-0C23-4FCE-BA1D-75295EEDAC53}
2010-03-02 16:50 - 2010-03-02 16:53 - 0007747 _____ () C:\ProgramData\ArcadeDeluxe3.log
2009-10-29 06:22 - 2009-07-18 03:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
2011-07-18 19:17 - 2014-04-11 15:45 - 0000012 _____ () C:\ProgramData\ReminderNextRun
2014-01-22 12:48 - 2014-02-13 00:42 - 0000040 _____ () C:\ProgramData\spds90.txt
Some files in TEMP:
====================
C:\Users\AspireG\AppData\Local\Temp\AppInstaller.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
ATTENTION: ==> Could not access BCD.
===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===
==================== Drive and Memory info ===================
==================== MBR and Partition Table ==================
==================== Scheduled Tasks (whitelisted) ==================
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Epson Printer Software Downloader.job => C:\Program Files (x86)\EPSON\EPAPDL\E_SAPDL2.EXE
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d13e7cf2fc0456.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d16275856e309a.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d1ab60265b93ff.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PC Optimizer Pro64 startups.job => C:\Program Files\PC Optimizer Pro\StartApps.exe <==== ATTENTION
Task: C:\Windows\Tasks\WinThruster_DEFAULT.job => C:\Program Files (x86)\WinThruster\WinThruster.exe <==== ATTENTION
Task: C:\Windows\Tasks\WinThruster_UPDATES.job => C:\Program Files (x86)\WinThruster\WinThruster.exe <==== ATTENTION
Task: C:\Windows\Tasks\WinZipDriverUpdater_UPDATES.job => C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe
==================== Alternate Data Streams (whitelisted) ==================
==================== Security Center ==================
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)
***** Velikost "Plochy" *****
Velikost slozky "C:\Users\AspireG\Desktop" je 26107 MB.
***** Startup Programs *****
***** Firewall rules *****
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
***** System Restore *****
==================== End Of Log ==============================
Jinak k tomu problemů udělal jsem co jste napsal a napsalo mi to.. Program ochrana prostředků systemu windows nenašel žadné narušení integrity.