Rising Antivirus Vyřešeno

Místo pro vaše HiJackThis logy a logy z dalších programů…

Moderátoři: Mods_senior, Security team

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43294
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod jaro3 » 30 srp 2015 09:27

Vypni rez. ochranu u antiviru a antispywaru,příp. firewall..

Otevři si Poznámkový blok (Start -> Spustit... a napiš do okna Notepad a dej Ok.
Zkopíruj do něj následující celý text označený zeleně:

Kód: Vybrat vše

FixCSet::




Zvol možnost Soubor -> Uložit jako... a nastav tyto parametry:
Název souboru: zde napiš: CFScript.txt
Uložit jako typ: tak tam vyber Všechny soubory
Ulož soubor na plochu.
Ukonči všechna aktivní okna.

Uchop myší vytvořený skript CFScript.txt, přemísti ho nad stažený program ComboFix.exe a když se oba soubory překryjí, skript upusť.
- Automaticky se spustí ComboFix
- Vlož sem log, který vyběhne v závěru čistícího procesu + nový log z HJT

Upozornění : Může se stát, že po aplikaci Combofixu a restartu počítače, Windows nenaběhnou , nebo nenajede plocha , budou problémy s připojením, pak znovu restartuj počítač, pokud to nepomůže , po restartu mačkej klávesu F8 a pak zvol poslední známou funkční konfiguraci. , či použij bod obnovy.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

Reklama
bobsch2
Level 1.5
Level 1.5
Příspěvky: 106
Registrován: prosinec 09
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod bobsch2 » 30 srp 2015 14:33

ComboFix 15-08-24.01 - Admin 30.08.2015 14:21:02.4.2 - x64
Microsoft Windows 7 Enterprise 6.1.7601.1.1250.420.1029.18.4095.3129 [GMT 2:00]
Spuštěný z: c:\users\Admin\Desktop\Sprßva PC\LiÜtýnÝ PC od havýti\ComboFix.exe
Použité ovládací přepínače :: c:\users\Admin\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-07-28 do 2015-08-30 )))))))))))))))))))))))))))))))
.
.
2015-08-30 12:29 . 2015-08-30 12:29 -------- d-----w- c:\users\Spravce\AppData\Local\temp
2015-08-30 12:29 . 2015-08-30 12:29 -------- d-----w- c:\users\Public\AppData\Local\temp
2015-08-30 12:29 . 2015-08-30 12:29 -------- d-----w- c:\users\OutputFolder\AppData\Local\temp
2015-08-30 12:29 . 2015-08-30 12:29 -------- d-----w- c:\users\HomeGroupUser$\AppData\Local\temp
2015-08-30 12:29 . 2015-08-30 12:29 -------- d-----w- c:\users\Guest\AppData\Local\temp
2015-08-30 12:29 . 2015-08-30 12:29 -------- d-----w- c:\users\Downloads\AppData\Local\temp
2015-08-30 12:29 . 2015-08-30 12:29 -------- d-----w- c:\users\Documents and Settings\AppData\Local\temp
2015-08-30 12:29 . 2015-08-30 12:29 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-08-30 12:29 . 2015-08-30 12:29 -------- d-----w- c:\users\Arnochtomag\AppData\Local\temp
2015-08-30 12:29 . 2015-08-30 12:29 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2015-08-30 09:06 . 2015-08-30 09:06 6429 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2015-08-30 09:06 . 2015-08-30 09:06 63115 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2015-08-30 09:06 . 2015-08-30 09:06 4599 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2015-08-29 07:14 . 2015-08-30 09:07 -------- d-----w- c:\programdata\ExtTag
2015-08-27 16:57 . 2015-08-27 16:57 -------- d-----w- c:\users\Admin\AppData\Local\bitComposer
2015-08-26 13:30 . 2015-08-26 13:08 24064 ----a-w- c:\windows\zoek-delete.exe
2015-08-26 13:30 . 2015-08-30 12:29 -------- d-----w- c:\users\Admin\AppData\Local\Temp
2015-08-25 13:00 . 2015-08-25 13:00 -------- d-----w- C:\Steam
2015-08-25 07:43 . 2015-08-25 09:41 -------- d-----w- c:\users\Admin\AppData\Roaming\DarkSoulsII
2015-08-25 07:25 . 2015-08-28 20:25 -------- d-----w- c:\program files (x86)\Dark Souls 2
2015-08-24 14:58 . 2015-08-24 15:03 -------- d-----w- c:\program files (x86)\1E007420-1440428285-1100-5FCD-001E8C545F1D
2015-08-24 14:57 . 2015-08-24 16:57 -------- d-----w- c:\program files\NixSrv
2015-08-24 14:54 . 2015-08-25 06:32 -------- d-----w- c:\programdata\update
2015-08-24 11:51 . 2015-08-28 17:55 -------- d-----w- c:\program files (x86)\Air Conflicts Vietnam
2015-08-24 11:40 . 2015-08-27 17:28 -------- d-----w- c:\program files (x86)\Air Conflicts - Pacific Carriers
2015-08-23 13:29 . 2015-08-23 13:33 -------- d-----w- c:\program files (x86)\il-2 sturmovik cliffs of dover
2015-08-23 10:56 . 2015-08-23 10:56 118784 ----a-w- c:\windows\SysWow64\MSSTDFMT.DLL
2015-08-23 10:56 . 2015-08-23 10:56 1227264 ----a-w- c:\windows\SysWow64\dx8vb.dll
2015-08-23 10:53 . 2015-08-24 11:35 -------- d-----w- c:\program files (x86)\IL-2 Sturmovik 1946
2015-08-21 07:20 . 2015-08-21 07:20 14800 ----a-w- c:\windows\WiseHDInfo64.dll
2015-08-21 07:14 . 2015-01-10 13:32 128288 ----a-w- c:\windows\system32\IObitSmartDefragExtension.dll
2015-08-21 07:14 . 2014-06-04 13:17 34080 ----a-w- c:\windows\system32\SmartDefragBootTime.exe
2015-08-21 01:00 . 2015-08-11 01:20 25191936 ----a-w- c:\windows\system32\mshtml.dll
2015-08-21 01:00 . 2015-08-11 01:14 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2015-08-21 01:00 . 2015-08-11 00:33 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2015-08-20 22:41 . 2015-08-21 08:33 -------- d-----w- c:\program files (x86)\Common Files\Steam
2015-08-20 18:14 . 2015-08-07 04:22 573048 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2015-08-20 17:55 . 2015-08-11 04:52 69416 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2015-08-20 17:55 . 2015-08-11 04:52 50472 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2015-08-20 13:37 . 2015-08-20 13:37 -------- d-----w- c:\users\Admin\AppData\Local\O&O
2015-08-20 13:34 . 2015-08-20 16:28 -------- d-----w- c:\windows\system32\oodag
2015-08-20 13:31 . 2015-08-20 13:31 -------- d-----w- c:\programdata\OO Software
2015-08-20 01:19 . 2015-07-30 13:13 103120 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-08-20 01:19 . 2015-07-30 13:13 124624 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-19 20:37 . 2015-08-19 20:37 -------- d-----w- c:\users\Admin\AppData\Roaming\Ubisoft
2015-08-19 19:29 . 2015-07-28 20:05 774656 ----a-w- c:\windows\system32\invagent.dll
2015-08-19 19:29 . 2015-07-28 20:05 743424 ----a-w- c:\windows\system32\generaltel.dll
2015-08-19 19:29 . 2015-07-28 20:05 437760 ----a-w- c:\windows\system32\devinv.dll
2015-08-19 19:29 . 2015-07-28 20:05 1116672 ----a-w- c:\windows\system32\appraiser.dll
2015-08-19 19:29 . 2015-07-28 20:05 69120 ----a-w- c:\windows\system32\acmigration.dll
2015-08-19 19:29 . 2015-07-28 20:05 227328 ----a-w- c:\windows\system32\aepdu.dll
2015-08-19 19:29 . 2015-07-28 19:55 1148416 ----a-w- c:\windows\system32\aeinv.dll
2015-08-19 19:29 . 2015-07-28 20:09 17344 ----a-w- c:\windows\system32\CompatTelRunner.exe
2015-08-19 19:27 . 2015-07-10 17:51 44032 ----a-w- c:\windows\system32\tsgqec.dll
2015-08-19 19:27 . 2015-07-10 17:51 3722752 ----a-w- c:\windows\system32\mstscax.dll
2015-08-19 19:27 . 2015-07-10 17:34 3221504 ----a-w- c:\windows\SysWow64\mstscax.dll
2015-08-19 19:27 . 2015-07-10 17:51 158720 ----a-w- c:\windows\system32\aaclient.dll
2015-08-19 19:27 . 2015-07-10 17:34 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2015-08-19 19:27 . 2015-07-10 17:33 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2015-08-19 19:27 . 2015-07-15 03:19 52736 ----a-w- c:\windows\system32\basesrv.dll
2015-08-19 19:21 . 2015-07-01 20:49 260096 ----a-w- c:\windows\system32\WebClnt.dll
2015-08-19 19:21 . 2015-07-01 20:48 102912 ----a-w- c:\windows\system32\davclnt.dll
2015-08-19 19:21 . 2015-07-01 20:30 206848 ----a-w- c:\windows\SysWow64\WebClnt.dll
2015-08-19 19:21 . 2015-07-01 20:30 82432 ----a-w- c:\windows\SysWow64\davclnt.dll
2015-08-19 19:21 . 2015-07-15 03:19 2004992 ----a-w- c:\windows\system32\msxml6.dll
2015-08-19 19:21 . 2015-07-15 03:19 1887232 ----a-w- c:\windows\system32\msxml3.dll
2015-08-19 19:21 . 2015-07-15 03:14 2048 ----a-w- c:\windows\system32\msxml6r.dll
2015-08-19 19:21 . 2015-07-15 03:13 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-08-19 19:21 . 2015-07-15 02:55 1390592 ----a-w- c:\windows\SysWow64\msxml6.dll
2015-08-19 19:21 . 2015-07-15 02:55 1241088 ----a-w- c:\windows\SysWow64\msxml3.dll
2015-08-19 19:21 . 2015-07-15 02:51 2048 ----a-w- c:\windows\SysWow64\msxml6r.dll
2015-08-19 19:21 . 2015-07-15 02:51 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
2015-08-19 19:19 . 2015-07-09 17:57 193536 ----a-w- c:\windows\system32\notepad.exe
2015-08-19 19:19 . 2015-07-09 17:57 193536 ----a-w- c:\windows\notepad.exe
2015-08-19 19:19 . 2015-07-09 17:42 179712 ----a-w- c:\windows\SysWow64\notepad.exe
2015-08-19 19:16 . 2015-07-10 17:51 14177280 ----a-w- c:\windows\system32\shell32.dll
2015-08-06 11:01 . 2015-08-06 22:48 -------- d-----w- c:\users\Admin\AppData\Roaming\Mount&Blade With Fire and Sword
2015-08-06 10:51 . 2015-08-28 20:26 -------- d-----w- c:\program files (x86)\Mount&Blade With Fire and Sword
2015-08-05 18:08 . 2015-08-29 07:35 -------- d-----w- c:\programdata\Local Settings
2015-08-05 18:07 . 2015-08-28 17:52 -------- d-----w- c:\users\Admin\AppData\Roaming\Microsoft Visual
2015-08-05 08:02 . 2015-08-05 08:02 -------- d-----w- c:\users\Admin\AppData\Local\Sniper Elite Nazi Zombie Army 2
2015-08-05 08:02 . 2015-08-05 08:02 -------- d-----w- c:\users\Admin\AppData\Local\EMU
2015-08-02 17:43 . 2015-08-02 17:44 -------- d-----w- c:\users\Admin\AppData\Roaming\Mount&Blade Warband
2015-08-02 17:43 . 2015-08-02 17:43 -------- d-----w- c:\programdata\SkidRow
2015-08-02 17:17 . 2015-08-02 17:17 -------- d-----w- c:\program files (x86)\TaleWorlds Entertainment
2015-08-01 19:42 . 2015-08-02 10:48 -------- d-----w- c:\users\Admin\AppData\Local\Sniper Elite Nazi Zombie Army
2015-08-01 19:42 . 2015-08-01 19:42 -------- d-----w- c:\users\Admin\AppData\Local\FLT
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-08-29 10:06 . 2014-04-11 12:34 113880 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-08-28 19:54 . 2014-05-06 11:24 1170432 ------w- c:\windows\SysWow64\dvttrn.dll
2015-08-26 11:40 . 2014-04-11 12:34 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-08-24 15:31 . 2013-05-19 10:12 778440 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-08-24 15:31 . 2013-05-19 10:12 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-08-23 10:56 . 2000-05-22 12:58 608448 ----a-w- c:\windows\SysWow64\COMCTL32.OCX
2015-08-20 00:55 . 2012-07-11 11:07 132483416 ----a-w- c:\windows\system32\MRT.exe
2015-08-19 21:17 . 2014-08-02 18:12 298032 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2015-08-19 21:17 . 2012-08-07 15:09 298032 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2015-08-19 20:47 . 2014-07-27 19:43 298032 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2015-08-17 23:30 . 2014-07-30 20:51 1316184 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2015-08-17 23:30 . 2013-12-24 15:04 1423120 ----a-w- c:\windows\SysWow64\nvspcap.dll
2015-08-17 23:29 . 2014-07-30 20:51 1756608 ----a-w- c:\windows\system32\nvspbridge64.dll
2015-08-17 23:29 . 2013-12-24 15:04 1710568 ----a-w- c:\windows\system32\nvspcap64.dll
2015-08-11 04:52 . 2014-07-30 20:46 72504 ----a-w- c:\windows\system32\nvaudcap64v.dll
2015-08-07 11:06 . 2015-02-19 09:18 3106384 ----a-w- c:\windows\SysWow64\nvapi.dll
2015-08-07 11:06 . 2015-02-19 09:18 12513288 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2015-08-07 11:06 . 2012-10-10 20:23 3518248 ----a-w- c:\windows\system32\nvapi64.dll
2015-08-07 11:06 . 2012-10-10 20:23 17124832 ----a-w- c:\windows\system32\nvwgf2umx.dll
2015-08-07 04:34 . 2012-11-18 00:29 2558768 ----a-w- c:\windows\system32\nvsvcr.dll
2015-08-07 04:34 . 2012-09-02 19:16 62768 ----a-w- c:\windows\system32\nvshext.dll
2015-08-07 04:34 . 2012-09-02 19:16 937592 ----a-w- c:\windows\system32\nvvsvc.exe
2015-08-07 04:34 . 2012-09-02 19:16 385328 ----a-w- c:\windows\system32\nvmctray.dll
2015-08-07 04:34 . 2012-09-02 19:16 6883448 ----a-w- c:\windows\system32\nvcpl.dll
2015-08-07 04:34 . 2012-09-02 19:16 3492144 ----a-w- c:\windows\system32\nvsvc64.dll
2015-08-03 10:12 . 2015-02-19 09:20 5133709 ----a-w- c:\windows\system32\nvcoproc.bin
2015-07-15 18:10 . 2015-08-19 19:28 342016 ----a-w- c:\windows\system32\schannel.dll
2015-07-15 17:55 . 2015-08-19 19:28 248832 ----a-w- c:\windows\SysWow64\schannel.dll
2015-07-15 17:54 . 2015-08-19 19:28 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2015-07-11 18:53 . 2015-07-11 12:09 37624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-07-04 18:07 . 2015-07-15 17:13 2087424 ----a-w- c:\windows\system32\ole32.dll
2015-07-04 17:48 . 2015-07-15 17:13 1414656 ----a-w- c:\windows\SysWow64\ole32.dll
2015-06-23 23:29 . 2015-06-23 23:29 1217192 ----a-w- c:\windows\SysWow64\FM20.DLL
2015-06-18 06:41 . 2014-04-11 12:34 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-06-18 06:41 . 2014-04-11 12:34 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-06-17 17:47 . 2015-07-15 17:14 404992 ----a-w- c:\windows\system32\gdi32.dll
2015-06-17 17:37 . 2015-07-15 17:14 312320 ----a-w- c:\windows\SysWow64\gdi32.dll
2015-06-15 21:50 . 2015-07-15 17:13 112064 ----a-w- c:\windows\system32\consent.exe
2015-06-15 21:45 . 2015-07-15 17:13 504320 ----a-w- c:\windows\system32\msihnd.dll
2015-06-15 21:45 . 2015-07-15 17:13 3242496 ----a-w- c:\windows\system32\msi.dll
2015-06-15 21:45 . 2015-07-15 17:13 70656 ----a-w- c:\windows\system32\appinfo.dll
2015-06-15 21:45 . 2015-07-15 17:13 1941504 ----a-w- c:\windows\system32\authui.dll
2015-06-15 21:44 . 2015-07-15 17:13 128000 ----a-w- c:\windows\system32\msiexec.exe
2015-06-15 21:43 . 2015-07-15 17:13 337408 ----a-w- c:\windows\SysWow64\msihnd.dll
2015-06-15 21:43 . 2015-07-15 17:13 2364416 ----a-w- c:\windows\SysWow64\msi.dll
2015-06-15 21:43 . 2015-07-15 17:13 1805824 ----a-w- c:\windows\SysWow64\authui.dll
2015-06-15 21:42 . 2015-07-15 17:13 73216 ----a-w- c:\windows\SysWow64\msiexec.exe
2015-06-15 21:42 . 2015-07-15 17:13 25088 ----a-w- c:\windows\system32\msimsg.dll
2015-06-15 21:37 . 2015-07-15 17:13 25088 ----a-w- c:\windows\SysWow64\msimsg.dll
2015-06-12 07:50 . 2015-06-30 11:46 12221144 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D0320D7E-B163-47CF-A622-67D1393627FB}\mpengine.dll
2015-06-11 17:56 . 2015-07-15 17:12 1112576 ----a-w- c:\windows\system32\rdpcorets.dll
2015-06-11 17:16 . 2015-07-15 17:12 162816 ----a-w- c:\windows\system32\rdpudd.dll
2015-06-11 17:15 . 2015-07-15 17:12 20992 ----a-w- c:\windows\system32\drivers\rdpvideominiport.sys
2015-06-08 12:13 . 2015-07-08 20:33 428880 ----a-w- c:\windows\system32\LavasoftTcpService64.dll
2015-06-02 00:07 . 2015-07-15 17:14 254976 ----a-w- c:\windows\system32\cewmdm.dll
2015-06-01 23:47 . 2015-07-15 17:14 210432 ----a-w- c:\windows\SysWow64\cewmdm.dll
2009-12-06 17:18 26624 --sh--w- c:\windows\bfcs2.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2014-11-19 1092448]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"seznam-listicka-distribuce"="c:\program files (x86)\Seznam.cz\distribution\szninstall.exe" [2013-05-16 1062472]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MS VISUAL PRO.lnk - c:\users\Admin\AppData\Roaming\Microsoft Visual\VFP6.exe [2015-8-28 360448]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
OnTranslator.lnk - c:\program files (x86)\OnTranslator.com\OnTranslator.exe /h [2015-7-27 1110016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R1 ArcCtrl;ArcCtrl;c:\windows\system32\drivers\ArcCtrl.sys;c:\windows\SYSNATIVE\drivers\ArcCtrl.sys [x]
R1 ArcSec;ArcSec;c:\windows\system32\drivers\ArcSec.sys;c:\windows\SYSNATIVE\drivers\ArcSec.sys [x]
R1 archlp;archlp;c:\windows\system32\drivers\archlp.sys;c:\windows\SYSNATIVE\drivers\archlp.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 ExtTag;ExtTag;c:\programdata\ExtTag\ExtTag.exe;c:\programdata\ExtTag\ExtTag.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys;c:\windows\SYSNATIVE\DRIVERS\avchv.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys;c:\windows\SYSNATIVE\DRIVERS\s1018bus.sys [x]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys;c:\windows\SYSNATIVE\DRIVERS\s1018mdfl.sys [x]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys;c:\windows\SYSNATIVE\DRIVERS\s1018mdm.sys [x]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys;c:\windows\SYSNATIVE\DRIVERS\s1018mgmt.sys [x]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys;c:\windows\SYSNATIVE\DRIVERS\s1018nd5.sys [x]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys;c:\windows\SYSNATIVE\DRIVERS\s1018obex.sys [x]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys;c:\windows\SYSNATIVE\DRIVERS\s1018unic.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 usbrndis6;Adaptér USB RNDIS6;c:\windows\system32\DRIVERS\usb80236.sys;c:\windows\SYSNATIVE\DRIVERS\usb80236.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WiseHDInfo;WiseHDInfo;c:\windows\WiseHDInfo64.dll;c:\windows\WiseHDInfo64.dll [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\elrawdsk64.sys;c:\windows\SYSNATIVE\drivers\elrawdsk64.sys [x]
S2 {09F57980-3432-4AFC-957D-27AC45FAE1F5};Power Control [2014/06/08 19:50];c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl;c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [x]
S2 CyberLink PowerDVD 13 Media Server Monitor Service;CyberLink PowerDVD 13 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [x]
S2 CyberLink PowerDVD 13 Media Server Service;CyberLink PowerDVD 13 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 NixSrv;NixSrv Service;c:\program files\NixSrv\NixSrv.exe;c:\program files\NixSrv\NixSrv.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l160x64.sys;c:\windows\SYSNATIVE\DRIVERS\l160x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
.
.
Obsah adresáře 'Naplánované úlohy'
.
2015-08-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-08 15:31]
.
2015-08-29 c:\windows\Tasks\InstallShield Update Task.job
- c:\windows\system32\wscript.exe [2014-02-12 01:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\.QMDeskTopGCIcon]
@="{B7667919-3765-4815-A66D-98A09BE662D6}"
[HKEY_CLASSES_ROOT\CLSID\{B7667919-3765-4815-A66D-98A09BE662D6}]
c:\program files (x86)\Tencent\QQPCMgr\10.10.16443.223\QMGCShellExt64.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2015-08-17 1710568]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-08-17 2634872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\programdata\ExtTag\Indigotip.dll
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://%66%65%65%64.%73%6E%61%70%64%6F. ... Kzi21J0JLf
uDefault_Search_URL = www.google.com
mStart Page = www.google.com
mDefault_Search_URL = www.google.com
mDefault_Page_URL = www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = www.google.com
Trusted Zone: localhost
Trusted Zone: webcompanion.com
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zfecvo39.default\
FF - prefs.js: browser.startup.homepage - c:\programdata\ExtTags\ff.HP
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -
.
BHO-{9FD3D761-2B09-DA1A-0229-0248A05B0334} - (no file)
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
AddRemove-{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} - c:\programdata\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
AddRemove-{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} - c:\programdata\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
.
.
"ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\sidebar.exe pid: 3404 DC: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\sidebar.exe pid: 3796 DC: C:]
--
"ServiceDll"="%systemroot%\system32\wuaueng.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\WUDFHost.exe pid: 3100 3C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\WUDFHost.exe pid: 816 3C: C:]
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{09F57980-3432-4AFC-957D-27AC45FAE1F5}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl"
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_232_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_232_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG18.00.00.01PROFESSIONAL"="1EF5D26F22C85A9C115E27DBE909A590C185E66B9EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D1407A6171C11EC38DE3DC038D530D6EB3452BA7FD869164D679400D9220F5EC9E3796850F05686EE3F993BE39A095390B734E792CCA90E4244E24F5256A4633F6FC538B8467EBDD5184F13A44D9DF4E48909150A7BA0465E5377913FC4C425EB7C87B9DEDD5CD612078818BDE0D4DA6B3CC46BE8C64E2D775093473F32405070CF918B8B0332293A63DC24BDC4012A565E5D24A764B6D4F51FADA45536EB0310BF017EEAD247808B9926459ABCFA7C7B90922AA2DAE1446AB40693E6BEA2CF303833978B3FE41DE4AA833FABDE1E5ED186629D9D065E74831D1BAEBE0C41BE5DB8C990DF0DDB344C295908AE1549D0780D90503B96BB549874B2478CB3A94AC5542BD741D87D6CE6BE4E49C21FDF492FFE28CC858F0FC3A4EE5761601EC161BAB0020F690DA0E181274D63EB11CBAFDACD71CBEAC7701B43D155B63207F2E7360BBB0AF86D20A50E338567144EF5E2037F003E3D6DFDA4B878BCB25C012BB3D0B10AD3728E5A3B1E47EA9B8794503257ACA4C6AF7E569BE8CF64F51C6FDB10CA096429BCDB3199695A337B75F14DE32783FA3D5ECE1EB45F5A6456168B7A3C068705FCA5918DAECD7AD9357348E3AFE743DC2E44070015C9AE9ADACD6201EB0AB768F25A4358584AC61FABF84F11C4B1436AD744A127D6F877274030D3ECC401B952E4EED4006D02738575E21154C1C16D092EA370C408E37270788996BFE3BA41C7E05A0178B2BD49D35C726DB0BC7A3CE0D78A158D2AA3729F268E317F55A9159329F854B7E66924165FC9962DBE5E43DCB208883933765CA0A2D381351F6511C4B10AB2383814751B30F29258C41727AE4D0D96060E3E2DA4FAD4B86F36A7A2AB25AFCFF7CC72BF74B65BBC3F40F1A048696EDEB3988070A26D6FD9BF074FCFDEE07337FBB9DB1CFB0DD0C47515E07D6480E5540725E7495172E5C0BA6F61AD3A763EC5480E4C37CA010A2C149D761FFD3D113F47F842EDB02FDE177BC20268D82AE12D69C76450C1161DCA3526EDFA54FEF03D43CD02A97F81E4DE1EC8FD3EA0F78FF26D5B68BD028209C9F9EF23996C5A6B3A4BD1BA5943F9E5EDC5BB4484B30BE0F1E5313E6574302D2A853095988E164A7D3328A8EF465CB56B96CA65210046CFD7EA25F3C4C2BD4DBC7F8F6C2A47AE391ED3E529F315A28854BB981B0F31BEBBA5968737EB5D7E122913AAEF126551CA060B153D008078797AE23D3FDEB93DE830879B5EFEF678876970138C2AFEE3F4F636B48CC11EBD8881BB43D033D0C1FDA3E01ADE3786671F4E4B4ED25FE97D8F043EB5DF7AC60816637E2AF14370FA86FB482F575FC738ACF75B54F83444E7D915"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
Celkový čas: 2015-08-30 14:32:18
ComboFix-quarantined-files.txt 2015-08-30 12:32
ComboFix2.txt 2015-08-29 23:02
ComboFix3.txt 2015-08-29 08:06
ComboFix4.txt 2015-08-27 16:47
.
Před spuštěním: Volných bajtů: 393 851 678 720
Po spuštění: Volných bajtů: 393 353 031 680
.
- - End Of File - - 227D624877A97064CDE7987842546936
A36C5E4F47E84449FF07ED3517B43A31

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43294
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod jaro3 » 30 srp 2015 15:17

ComboFix se odinstaluje takto:
Start-Spustit a zadej ComboFix /Uninstall

Vyčisti systém CCleanerem

Stáhni si OTC

na plochu. Poklepej na něj. Potom klikni na Clean up!.
Restartuj PC , pokud Ti bude doporučeno.


Vlož nový log z HJT + informuj o problémech.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

bobsch2
Level 1.5
Level 1.5
Příspěvky: 106
Registrován: prosinec 09
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod bobsch2 » 30 srp 2015 16:25

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 16:21:14, on 30.8.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17937)
CHROME: 43.0.2357.81
FIREFOX: 37.0.2 (x86 cs)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
C:\Program Files (x86)\OnTranslator.com\OnTranslator.exe
C:\Users\Admin\AppData\Roaming\Microsoft Visual\VFP6.exe
C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
C:\Users\Admin\Desktop\Správa PC\Čištění PC od havěti\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://%66%65%65%64.%73%6E%61%70%64%6F. ... Kzi21J0JLf
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://%66%65%65%64.%73%6F%6E%69%63-%73 ... JvpjJZk&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Users\Admin\LOCALS~1\Temp\msayuysae.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [seznam-listicka-distribuce] "C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe" -s -d listicka 1 szn-software-listicka cz.seznam.software.autoupdate
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKCU\..\Run: [NokiaSuite.exe] C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-18\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'Default user')
O4 - Startup: MS VISUAL PRO.lnk = Admin\AppData\Roaming\Microsoft Visual\VFP6.exe
O4 - Global Startup: OnTranslator.lnk = C:\Program Files (x86)\OnTranslator.com\OnTranslator.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: http://*.webcompanion.com
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\ProgramData\ExtTag\Overhome.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: CyberLink PowerDVD 13 Media Server Monitor Service - CyberLink - C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
O23 - Service: CyberLink PowerDVD 13 Media Server Service - CyberLink - C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ExtTag - Unknown owner - C:\ProgramData\ExtTag\ExtTag.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NixSrv Service (NixSrv) - Unknown owner - C:\Program Files\NixSrv\NixSrv.exe
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9700 bytes




Rising Antivirus už v mém PC není, ale nemohu se zbavit search.safefinder.com, Web search

bobsch2
Level 1.5
Level 1.5
Příspěvky: 106
Registrován: prosinec 09
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod bobsch2 » 30 srp 2015 17:54

Zkusím přeinstalovat Chrome

Uživatelský avatar
jaro3
člen Security týmu
Guru Level 15
Guru Level 15
Příspěvky: 43294
Registrován: červen 07
Bydliště: Jižní Čechy
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod jaro3 » 30 srp 2015 20:04

Zavři ostatní aplikace a prohlížeče, odpoj se od netu a fixni v HJT:
Návod

Kód: Vybrat vše

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://%66%65%65%64.%73%6E%61%70%64%6F. ... Kzi21J0JLf
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://%66%65%65%64.%73%6F%6E%69%63-%73 ... JvpjJZk&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=C:\Users\Admin\LOCALS~1\Temp\msayuysae.exe
O20 - AppInit_DLLs: C:\ProgramData\ExtTag\Overhome.dll


C:\Users\Admin\LOCALS~1\Temp\msayuysae.exe --- smaž tento soubor
C:\ProgramData\ExtTag smaž tuto složku


Prosím stáhni příslušnou verzi programu pro Tvůj systém 32-bit/64-bit FarbarRecovery Scan Tool (FrSt)
32bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/81/
64bit.:
http://www.bleepingcomputer.com/downloa ... ool/dl/82/
a ulož jej na plochu. ,pak spusť FrSt.
Potvrď způsob užití.
Neměň žádné z výchozích nastavení a klikni na položku „Scan“ („Skenovat“) .Když je skenování dokončeno, ukážou se dva logy = FRST.txt a Addition.txt a uloží se na ploše.Prosím zkopíruj sem celý jejich obsah.
Při práci s programy HJT, ComboFix,MbAM, SDFix aj. zavřete všechny ostatní aplikace a prohlížeče!
Neposílejte logy do soukromých zpráv.Po dobu mé nepřítomnosti mě zastupuje memphisto , Žbeky a Orcus.
Pokud budete spokojeni , můžete podpořit naše forum:Podpora fóra

bobsch2
Level 1.5
Level 1.5
Příspěvky: 106
Registrován: prosinec 09
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod bobsch2 » 01 zář 2015 20:13

Additional scan result of Farbar Recovery Scan Tool (x64) Version:30-08-2015
Ran by Admin (2015-09-01 19:44:56)
Running from C:\Users\Admin\Desktop\Správa PC\Čištění PC od havěti
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Admin (S-1-5-21-572532400-2546031134-3008305638-1000 - Administrator - Enabled) => C:\Users\Admin
Administrator (S-1-5-21-572532400-2546031134-3008305638-500 - Administrator - Disabled)
Arnochtomag (S-1-5-21-572532400-2546031134-3008305638-1006 - Limited - Enabled) => C:\Users\Arnochtomag
Guest (S-1-5-21-572532400-2546031134-3008305638-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-572532400-2546031134-3008305638-1003 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-572532400-2546031134-3008305638-1000\...\uTorrent) (Version: 3.4.3.40097 - BitTorrent Inc.)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Aktualizace NVIDIA 2.5.13.6 (Version: 2.5.13.6 - NVIDIA Corporation) Hidden
Brother HL-2030 (HKLM-x32\...\{ED4FA91A-2037-4D2E-809B-279264B7E7E0}) (Version: 1.00 - Brother)
CCleaner (HKLM\...\CCleaner) (Version: 5.09 - Piriform)
Centrum zařízení Windows Mobile (HKLM\...\{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}) (Version: 6.1.6965.0 - Microsoft Corporation)
ConvertXtoDVD 4.1.19.365 (HKLM-x32\...\{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1) (Version: 4.1.19.365 - )
CyberLink PowerDVD 13 (HKLM-x32\...\InstallShield_{3CFDF154-7E60-4E98-A8DF-C693A4F8E6B6}) (Version: 13.0.3105.58 - CyberLink Corp.)
Eusing Free MP3 Cutter (HKLM-x32\...\Eusing Free MP3 Cutter) (Version: - )
Fable III (x32 Version: 1.0.0001.131 - Microsoft Game Studios) Hidden
FastStone Image Viewer 4.9 (HKLM-x32\...\FastStone Image Viewer) (Version: 4.9 - FastStone Soft)
globalupdate Helper (x32 Version: 1.3.25.0 - globalupdate Inc.) Hidden <==== ATTENTION
Google Earth (HKLM-x32\...\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}) (Version: 6.2.2.6613 - Google)
Google Chrome (HKU\S-1-5-21-572532400-2546031134-3008305638-1000\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Handset WinDriver 1.02.03.00 (HKLM-x32\...\Handset WinDriver) (Version: 1.02.03.00 - Huawei technologies Co., Ltd.)
InfoMapa 17 (HKLM-x32\...\{64C60321-0B07-4E9E-B1D9-BA3F954676D2}) (Version: 17.0.0 - PJsoft s.r.o.)
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 4.1.5.30 - IObit)
Java 7 Update 10 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417010FF}) (Version: 7.0.100 - Oracle)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Kalendář (HKU\S-1-5-21-572532400-2546031134-3008305638-1000\...\Kalendar) (Version: 3.2.7 - pyramidak)
K-Lite Codec Pack 8.7.0 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 8.7.0 - )
Magic ISO Maker v5.5 (build 0281) (HKLM-x32\...\Magic ISO Maker v5.5 (build 0281)) (Version: - )
Malwarebytes Anti-Malware verze 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (čeština) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1029) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM-x32\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM-x32\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

bobsch2
Level 1.5
Level 1.5
Příspěvky: 106
Registrován: prosinec 09
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod bobsch2 » 01 zář 2015 20:13

Mozilla Firefox 37.0.2 (x86 cs) (HKLM-x32\...\Mozilla Firefox 37.0.2 (x86 cs)) (Version: 37.0.2 - Mozilla)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MWSnap 3 (HKLM-x32\...\MWSnap 3) (Version: 3.0.0.74 - Mirek Wojtowicz)
Nástroj pro odesílání služby Windows Live (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Nero Burning ROM 11 (HKLM-x32\...\{E656D89A-8CBB-497F-918F-8361A4071C26}) (Version: 11.0.10400 - Nero AG)
Nero Prerequisite Installer 1.0 (HKLM-x32\...\{011E92F1-AF76-4983-8707-79F8F1956439}) (Version: 11.0.11500 - Nero AG)
Nokia Connectivity Cable Driver (HKLM-x32\...\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)
Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.8.54.0 - Nokia)
Nokia Suite (x32 Version: 3.8.54.0 - Nokia) Hidden
NVIDIA GeForce Experience 2.5.13.6 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.5.13.6 - NVIDIA Corporation)
NVIDIA Ovladač 3D Vision 355.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 355.60 - NVIDIA Corporation)
NVIDIA Ovladač HD audia 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)
NVIDIA Ovladač řídící jednotky 3D Vision 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)
NVIDIA Ovladače grafiky 355.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 355.60 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{80407BA7-7763-4395-AB98-5233F1B34E65}) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Systémový software PhysX 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
OnTranslator (HKLM-x32\...\OnTranslator) (Version: 1.0.156 - )
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
Ovládací panel NVIDIA 355.60 (Version: 355.60 - NVIDIA Corporation) Hidden
PC Connectivity Solution (HKLM-x32\...\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.0 - Tracker Software Products Ltd)
PeaZip 5.6.0 (HKLM-x32\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version: - Giorgio Tani)
Photo Collage Maker 4.1.2 (HKLM-x32\...\{5BC0748C-22F5-4358-80F2-2CB990CC2917}_is1) (Version: 4.1.2 - PearlMountain Technology Co., Ltd)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Seznam Software (HKU\S-1-5-21-572532400-2546031134-3008305638-1000\...\SeznamInstall) (Version: - Seznam.cz)
SHIELD Streaming (Version: 4.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.5.13.6 - NVIDIA Corporation) Hidden
Skype Toolbars (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.3.7280 - Skype Technologies S.A.)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartMaps Router - Cyklomapa ČR 1.6.4.7 (HKLM-x32\...\SmartMaps Router - Cyklomapa ČR_is1) (Version: 1.6.4.7 - PLANstudio s.r.o.)
Winamp (HKLM-x32\...\Winamp) (Version: 5.66 - Nullsoft, Inc)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{1407B87C-36E3-4FC1-9051-D08B21E1096F}) (Version: 14.0.8117.416 - Microsoft Corporation)
World of Tanks v.0.6.7 (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1) (Version: - Wargaming.net)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-572532400-2546031134-3008305638-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Admin\AppData\Local\Google\Chrome\Application\43.0.2357.81\delegate_execute.exe (Google Inc.)

==================== Restore Points =========================


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2015-08-30 00:58 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {00C7D946-D04C-4E69-8BDA-183FAEF79AB6} - System32\Tasks\{09DCC461-BB0F-4E94-9E74-22763A260634} => pcalua.exe -a "C:\Users\Admin\Desktop\Hry\Rajsen\Risen - RPG\Risen - cestina\cestina\CZ_100.exe" -d "C:\Users\Admin\Desktop\Hry\Rajsen\Risen - RPG\Risen - cestina\cestina"
Task: {1AE1BBAD-E05E-48D0-B918-A85A65961329} - System32\Tasks\{C6B88EC9-55F8-41F4-8BB7-B63A102BCD01} => pcalua.exe -a C:\Users\Admin\Downloads\ComboFix.exe -d C:\Users\Admin\Downloads -c C:\Users\Admin\Desktop\CFScript.txt
Task: {25B62139-A00C-46D1-8847-2CC7985CF002} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {261973D1-9600-4E1B-BD72-E68B3A924CD3} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-24] (Adobe Systems Incorporated)
Task: {340E2711-6915-44A7-84C7-099F5ADCEF84} - System32\Tasks\{5DAA6C18-4E11-47AB-84E7-6D7833E6EF52} => pcalua.exe -a "C:\Program Files (x86)\RelevantKnowledge\rlvknlg.exe" -c -bootremove -uninst:RelevantKnowledge
Task: {3897B494-4051-4BFD-92E5-DBA892F7354A} - System32\Tasks\{C6B59C89-344D-4E3C-9153-4E0CF15EF0E8} => pcalua.exe -a C:\Users\Admin\Downloads\Gothic_1CZ.exe -d C:\Users\Admin\Downloads
Task: {3B80B10B-087F-4706-9D74-6419E6000CDE} - \RegClean Pro -> No File <==== ATTENTION
Task: {40DE6A1B-AC9E-44A0-8D13-2489CE293E0A} - System32\Tasks\{9B477FB9-8BC7-4F33-A1E9-636DF3922594} => pcalua.exe -a F:\PCCompanion\setup.exe -d F:\PCCompanion
Task: {578EA27A-9071-4E80-A4BA-05E42A123101} - System32\Tasks\{0FBAF4DF-8142-4912-9154-A92C468E764A} => pcalua.exe -a C:\Users\Admin\Desktop\Hry\thief\Setup.exe -d C:\Users\Admin\Desktop\Hry\thief
Task: {5A0FDD56-4D69-40EB-8055-8349D84758BC} - \RegClean Pro_UPDATES -> No File <==== ATTENTION
Task: {62322C77-FADE-4442-8038-79C332569AAC} - System32\Tasks\{27C639D0-31A1-434B-A9A3-9D2CABBEFC65} => pcalua.exe -a "C:\Users\Admin\Desktop\Hry\IL-2 Sturmovik Cliffs of Dover (2011) [PCDVD][MULTi5][WwW.ZoNaTorrent.CoM]\Fairlight\Installer.exe" -d "C:\Users\Admin\Desktop\Hry\IL-2 Sturmovik Cliffs of Dover (2011) [PCDVD][MULTi5][WwW.ZoNaTorrent.CoM]\Fairlight"
Task: {6834A504-A859-4F99-8E86-13B0B7EEA1DB} - System32\Tasks\InstallShield Update Task => Wscript.exe //nologo //E:jscript //B "C:\Program Files (x86)\InstallShield\isupdate.ini"
Task: {7B28679D-60B4-49FB-A39F-38EBC3A457DA} - \Advanced System~Protector -> No File <==== ATTENTION
Task: {84EF171F-0762-4824-B70A-143681D64EFC} - System32\Tasks\{49192437-391E-4B3A-9256-E6402568EF3D} => pcalua.exe -a C:\Users\Admin\Downloads\MorphVOX_Install-157.exe -d C:\Users\Admin\Desktop
Task: {8E25C4FD-A423-415E-B609-7A904A769373} - \AmiUpdXp -> No File <==== ATTENTION
Task: {964E0D69-A457-4023-BAF9-48C47E41CF6D} - System32\Tasks\{A84B4894-F2BC-4FA6-B787-FBD25C6123DF} => pcalua.exe -a "C:\Program Files (x86)\Unzip Wizard\UNWISE.EXE" -c C:\Program Files (x86)\Unzip Wizard\INSTALL.LOG
Task: {9E05A5A0-ADC7-4E2F-95AD-83457B5DD26A} - System32\Tasks\{090A7667-9D2C-4E90-9B83-2922596563FD} => pcalua.exe -a C:\Users\Admin\AppData\Local\Temp\SQZF289.tmp\keygen.exe -d C:\Windows\system32
Task: {9F86CA0A-32CD-475D-B78C-97CD1283BB7D} - System32\Tasks\{AC96AB1F-438D-47D1-9BC2-16F547003F67} => pcalua.exe -a C:\Users\Admin\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=ima
Task: {A5385174-5EAA-4B3F-9E3B-58944EF4CCBD} - \Advanced System~Protector_startup -> No File <==== ATTENTION
Task: {A8F8A46E-9664-41E2-A538-30EF5ADE4FD6} - \LaunchPreSignup -> No File <==== ATTENTION
Task: {C02F444F-8654-44BF-B25D-FEA7A2829C70} - System32\Tasks\{AF2A1FB2-24B4-4D40-ADF2-D867A5E147E3} => pcalua.exe -a C:\Users\Admin\AppData\Roaming\Seznam.cz\szninstall.exe -c -X
Task: {C49BD088-C7DA-4519-8B5E-520F7B6E637C} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {D02BC64D-079C-41CD-9CF0-E1F706320F21} - System32\Tasks\{D624BE6C-F0AB-4C15-981A-0C95A856ECA9} => pcalua.exe -a C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe -c /M{B0C7D637-D9A6-491C-B803-1D276C3F9A59}
Task: {D59D9B85-6D43-4079-BAA2-09B3BBD2A182} - \RegClean Pro_DEFAULT -> No File <==== ATTENTION
Task: {DA37DB67-96CA-4836-978F-4E40454B1B6A} - System32\Tasks\Trigger KMS Activation => C:\Program Files\Microsoft Office\KMSnano Final\TriggerKMS.exe [2013-02-10] ()
Task: {DB20D204-7042-4F0C-9665-53BF3B46A67D} - System32\Tasks\{389ACD93-CBD3-4507-A487-D1A36D626301} => pcalua.exe -a "C:\Program Files\AVAST Software\Avast\aswRunDll.exe" -c "C:\Program Files\AVAST Software\Avast\Setup\setiface.dll" RunSetup
Task: {DB9FAE8C-3A83-4F7A-B6C0-C8ED1E2B73C6} - System32\Tasks\{B950C4C6-4734-4D6E-BC69-F2ADE9C07C35} => pcalua.exe -a "C:\Users\Admin\Desktop\Hry\Gothic 3\autorun.exe" -d "C:\Users\Admin\Desktop\Hry\Gothic 3"
Task: {DD060631-9601-4512-BBE7-EA69E77D895F} - System32\Tasks\{F29D1072-6705-4251-8B58-BB7B5B2EEA1A} => C:\Program Files (x86)\Gothic III\Gothic3.exe
Task: {E23EB6D8-5F33-44C6-8EA5-207BF3CD5700} - System32\Tasks\IQA => cmd.exe /c start chrome.exe
Task: {E2D39DB3-0708-477B-9A75-072266F4F2D0} - System32\Tasks\{902BF9B6-3414-4490-93BB-10A705F68841} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
Task: {E4CFAFF6-C78A-4E65-B9FE-168F3E66B4BE} - System32\Tasks\{3B19F664-59A6-4263-94F2-7AB0900885F9} => pcalua.exe -a "C:\Program Files (x86)\The Vanishing of Ethan Carter\Binaries\Launcher.exe" -d "C:\Program Files (x86)\The Vanishing of Ethan Carter\Binaries"
Task: {EB2CEC04-3A21-4F24-9A24-4B0EA8A111F9} - System32\Tasks\{8689D3D1-0BD5-4502-9FA5-4B2AEFC983DE} => pcalua.exe -a C:\PROGRA~2\MagicISO\UNWISE.EXE -c C:\PROGRA~2\MagicISO\INSTALL.LOG
Task: {F3D89ACD-803E-4AB2-AB10-2B9CD7294E89} - System32\Tasks\{A23A7049-3A3C-477E-B480-8DB6C0A9E7C5} => pcalua.exe -a E:\Fairlight\Installer.exe -d E:\Fairlight
Task: {F3E2E9B2-B228-4CF8-84C6-A820CF6AB9EB} - System32\Tasks\{BF663582-C208-4911-B6B9-9A9951C80BC1} => pcalua.exe -a E:\setup.exe -d E:\
Task: {F6E69577-5DA7-4E9B-A8A9-674B8951C293} - System32\Tasks\{8F2036A6-9E1E-4AAB-A96E-7E3D9DC1E974} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
Task: {FC876918-7B99-4DEF-B7BE-B02EE9C3F830} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-08-20] (Piriform Ltd)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\InstallShield Update Task.job => Wscript.exe M/nologo /E:jscript /B C:\Program Files (x86)\InstallShield\isupdate.ini

==================== Loaded Modules (Whitelisted) ==============

2012-09-02 21:16 - 2015-08-07 06:34 - 00116344 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-08-27 10:20 - 2015-08-27 10:20 - 00033792 _____ () C:\ProgramData\ExtTag\ExtTag.exe
2015-08-23 08:47 - 2015-08-23 08:47 - 00379392 _____ () C:\Program Files\NixSrv\NixSrv.exe
2014-08-02 20:12 - 2014-08-02 20:33 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2015-09-01 15:20 - 2015-09-01 15:20 - 00855040 _____ () C:\Program Files\NixSrv\packages\ce951302-b47b-4947-a46d-2422effc295c\NixHost.exe
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2015-08-29 09:15 - 2015-08-29 09:15 - 00150528 _____ () C:\ProgramData\ExtTag\DentoTam.exe
2015-08-24 20:28 - 2015-08-24 20:28 - 00047104 _____ () C:\Program Files\CCleaner\lang\lang-1029.dll
2015-08-20 19:55 - 2015-08-18 01:31 - 00011896 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 08507232 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtGui4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 02354016 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtCore4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 01014624 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtNetwork4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 00364384 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtXml4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 02480992 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtDeclarative4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 01346912 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtScript4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 00206176 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtSql4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 02653024 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtXmlPatterns4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 00033120 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qgif4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 00035680 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qico4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 00207200 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qjpeg4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 11166560 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtWebKit4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 00276832 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\phonon4.dll
2014-11-11 11:21 - 2014-11-11 11:21 - 00392552 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\ssoengine.dll
2014-11-11 11:21 - 2014-11-11 11:21 - 00059752 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\securestorage.dll
2014-11-19 13:47 - 2014-11-19 13:47 - 00438624 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\NService.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 00446304 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 00520544 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtMultimediaKit1.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 00720736 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtOpenGL4.dll
2014-11-19 13:46 - 2014-11-19 13:46 - 00606560 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\CommonUpdateChecker.dll
2014-11-19 13:48 - 2014-11-19 13:48 - 00093024 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\qjson.dll
2014-06-08 19:48 - 2013-07-05 07:24 - 00861960 _____ () C:\Program Files (x86)\CyberLink\PowerDVD13\common\UNO\UNO.dll
2014-06-08 19:47 - 2013-05-02 02:06 - 00081920 _____ () C:\Program Files (x86)\CyberLink\PowerDVD13\Common\koan\_ctypes.pyd
2014-06-08 19:47 - 2013-05-02 02:06 - 00053248 _____ () C:\Program Files (x86)\CyberLink\PowerDVD13\Common\Koan\_socket.pyd
2014-06-08 19:47 - 2013-05-02 02:06 - 00655360 _____ () C:\Program Files (x86)\CyberLink\PowerDVD13\Common\Koan\_ssl.pyd
2014-06-08 19:48 - 2013-07-05 07:24 - 00043272 _____ () C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DHProcedure\DHProcedure.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51
AlternateDataStreams: C:\ProgramData\TEMP:24051EFF
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879
AlternateDataStreams: C:\ProgramData\TEMP:661DFA1C
AlternateDataStreams: C:\ProgramData\TEMP:A9662AE0
AlternateDataStreams: C:\ProgramData\TEMP:D026A5A4

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Roqmij => ""="service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-572532400-2546031134-3008305638-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-572532400-2546031134-3008305638-1000\...\webcompanion.com -> hxxp://webcompanion.com


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-572532400-2546031134-3008305638-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: Media is not connected to internet.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: a2AntiMalware => 2
MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: Browser Manager => 2
MSCONFIG\Services: CLHNServiceForPowerDVD => 2
MSCONFIG\Services: CyberLink PowerDVD 11.0 Monitor Service => 2
MSCONFIG\Services: CyberLink PowerDVD 11.0 Service => 2
MSCONFIG\Services: gusvc => 3
MSCONFIG\Services: nvUpdatusService => 2
MSCONFIG\Services: tor => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^OnTranslator.lnk => C:\Windows\pss\OnTranslator.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Admin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Arcania-Fall-of-Setarrif-FLT-crack.exe => C:\Windows\pss\Arcania-Fall-of-Setarrif-FLT-crack.exe.Startup
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: MagicWand => C:\Users\Admin\AppData\Roaming\MagicWand\upd.exe
MSCONFIG\startupreg: mncgtkvuSrv => C:\Windows\system32\mncgtkvu.vbe
MSCONFIG\startupreg: mncppcqnSrv => C:\Windows\system32\mncppcqn.vbe
MSCONFIG\startupreg: mncruvtahSrv => C:\Windows\system32\mncruvtah.vbe
MSCONFIG\startupreg: mnctftvaqSrv => C:\Windows\system32\mnctftvaq.vbe
MSCONFIG\startupreg: NokiaSuite.exe => C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray
MSCONFIG\startupreg: NtVdmSrv => C:\Windows\inf\ntvdm.vbe
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: PowerDVD13Agent => "C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe"
MSCONFIG\startupreg: RTHDVCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: ShadowPlay => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [TCP Query User{887B5C15-E11D-43CA-A519-F6EF1406E574}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{CE5160CA-FB52-4ED1-9E29-6EA10E941954}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{D3F4E587-BFD6-4CC5-9CC6-98263C7B42A5}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{3C8F1E52-9F44-4ECB-9EC9-BBB2059EC23D}C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe] => (Allow) C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe
FirewallRules: [UDP Query User{EBF995F6-BEAA-4C0C-9FB4-990875524276}C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe] => (Allow) C:\program files (x86)\gog.com\the witcher 2 enhanced edition\bin\witcher2.exe
FirewallRules: [{8F4691A1-7399-413F-9EB7-ED7AD75AE51E}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{11F842B6-A2D9-4352-8759-17E664A68D24}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{76CAACB2-1744-4B3C-B740-EEE466B3D4AC}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13.exe
FirewallRules: [{5FD4287E-683E-42BC-ADF5-6CD56A17FDF0}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
FirewallRules: [{E69664EB-35D4-44B6-B0C7-FD609892AF0B}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe
FirewallRules: [{5933C135-7690-4D31-9973-4AA2B09E9A9A}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13ML.exe
FirewallRules: [{E84DF9AA-70CA-4E6B-8237-93CB592410E8}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\Movie\PowerDVD.exe
FirewallRules: [{036E7684-28E8-4EBA-9D15-D6F7CFB75B20}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD13\Movie\PowerDVD Cinema\PowerDVDCinema13.exe
FirewallRules: [TCP Query User{C8DFAA03-A9D5-4194-88E4-6E9BACA77A4F}C:\program files (x86)\enemy front\bin32\enemyfront.exe] => (Allow) C:\program files (x86)\enemy front\bin32\enemyfront.exe
FirewallRules: [UDP Query User{3DDB36FB-DF16-48A9-BF4A-55D221A9D474}C:\program files (x86)\enemy front\bin32\enemyfront.exe] => (Allow) C:\program files (x86)\enemy front\bin32\enemyfront.exe
FirewallRules: [{9A655714-F8A0-4693-9F50-7AF0792809EF}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{FDC0C60F-4956-4A3A-92CC-964AD442B59F}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{34FF7F20-1942-4B9B-9CA9-5F1080BADEFB}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{EBC18DC1-D835-4744-B88B-E7199DFE6B0A}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{DF9E0772-BF44-4EFE-8311-7233885A7225}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{FA19911B-3812-4E3A-9860-535E7704D8A4}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{535E8C6A-FA9D-4B1F-819B-EF31A94E3FFE}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{6BB6A130-E894-4200-9960-FE90110210E6}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{B6206120-7514-4F87-B974-12E570F79125}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{A9D558AF-D029-4EA3-9489-A3054574ADAC}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{665E8DA7-D879-42DF-A7D9-404243F74227}] => (Allow) C:\Program Files (x86)\nokia\nokia suite\nokiasuite.exe
FirewallRules: [TCP Query User{484E426F-1F09-436C-A027-0C5298BD1CAD}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{75C96630-AD20-40A0-9B61-6508612DC6F4}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [{15B1EF33-A284-469E-80CA-6A7EB8B789E3}] => (Allow) %systemroot%\WindowsMobile\wmdHost.exe
FirewallRules: [{C25EE099-C24A-4C6A-B449-1593800162A6}] => (Allow) %systemroot%\WindowsMobile\wmdHost.exe
FirewallRules: [{6914B1B4-49A6-40EF-833A-1788E74B5270}] => (Allow) LPort=26675
FirewallRules: [TCP Query User{CA87DCFC-4D70-4538-8798-4F314121DDC1}C:\games\world_of_tanks\wotlauncher.exe] => (Allow) C:\games\world_of_tanks\wotlauncher.exe
FirewallRules: [UDP Query User{E03F378C-A014-4A33-9EA0-DFD9D83A3E4C}C:\games\world_of_tanks\wotlauncher.exe] => (Allow) C:\games\world_of_tanks\wotlauncher.exe
FirewallRules: [{95C50C80-E1FC-4292-848A-9B63E2B576CB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8D1CF62F-37F0-455B-B0D6-63D2E7DEFDD6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1B033450-D7E9-47BA-8B15-8D7FC8951616}] => (Allow) C:\Users\Arnochtomag\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{843FD86E-FD56-4F0D-93A9-C34123DA0E52}] => (Allow) C:\Users\Arnochtomag\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [TCP Query User{335A6754-4380-426C-B383-B1910E928099}C:\users\admin\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\users\admin\appdata\roaming\utorrent\utorrent.exe
FirewallRules: [UDP Query User{2CF3905E-8FA4-480A-983F-601691EC64AB}C:\users\admin\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\users\admin\appdata\roaming\utorrent\utorrent.exe
FirewallRules: [{ECDFAF33-6075-427A-B467-EAC84540E950}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{94A850D0-161B-4377-AFB1-E765909F46DD}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [TCP Query User{CE17E552-C83A-4128-B65C-BBA6F847E52D}C:\users\admin\záloha registrů\microsoft office 2010\microsoft office 2010 professional plus x64_x86 activator\keygen.exe] => (Allow) C:\users\admin\záloha registrů\microsoft office 2010\microsoft office 2010 professional plus x64_x86 activator\keygen.exe
FirewallRules: [UDP Query User{DB479934-EDCD-4E45-9FE9-3DA9BA1400B7}C:\users\admin\záloha registrů\microsoft office 2010\microsoft office 2010 professional plus x64_x86 activator\keygen.exe] => (Allow) C:\users\admin\záloha registrů\microsoft office 2010\microsoft office 2010 professional plus x64_x86 activator\keygen.exe
FirewallRules: [TCP Query User{475CEEB8-5E2C-4DC7-AB5C-AE0FC14603FD}C:\windows\syswow64\svchost.exe] => (Allow) C:\windows\syswow64\svchost.exe
FirewallRules: [UDP Query User{4488F341-8D3F-4547-9EF0-AD141A74AE38}C:\windows\syswow64\svchost.exe] => (Allow) C:\windows\syswow64\svchost.exe
FirewallRules: [{D2B2C281-34CE-418C-9193-BC6AC8E78D29}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{0D72D27C-1609-4F13-BB94-501A2B50C7DA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{30C265EF-8AF7-4360-B472-45B5212B60BB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{449D9CC5-3B8C-4083-8BCD-B3E3E074E7AE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{478D4D49-397E-41B3-9E54-7F0D382B7FAE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [TCP Query User{F3DF28A3-60BE-4E06-BC4B-A1BDB50D6C32}C:\users\admin\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\users\admin\appdata\roaming\utorrent\utorrent.exe
FirewallRules: [UDP Query User{E6F22576-8CE9-4EB7-88E7-79448FDCE6EB}C:\users\admin\appdata\roaming\utorrent\utorrent.exe] => (Allow) C:\users\admin\appdata\roaming\utorrent\utorrent.exe
FirewallRules: [{DD411AD5-1AD9-4991-A844-29B47A09B4BB}] => (Allow) C:\Users\Admin\AppData\Local\Chromium\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: ArcCtrl
Description: ArcCtrl
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ArcCtrl
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: archlp
Description: archlp
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: archlp
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: ArcSec
Description: ArcSec
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ArcSec
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Teredo Tunneling Pseudo-Interface
Description: Adaptér tunelového režimu Microsoft Teredo
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Standardní klávesnice PS/2
Description: Standardní klávesnice PS/2
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardní klávesnice)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/01/2015 06:53:27 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu Mapi nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (09/01/2015 06:29:44 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu Mapi nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (09/01/2015 06:23:17 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu Mapi nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (09/01/2015 05:52:57 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu Mapi nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (09/01/2015 05:22:53 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu Mapi nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (09/01/2015 04:52:48 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu Mapi nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (09/01/2015 04:22:53 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu Mapi nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (09/01/2015 03:52:37 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: Popisovač protokolu Mapi nebyl načten. Popis chyby: Uvedený modul nebyl nalezen. (HRESULT : 0x8007007e).

Error: (09/01/2015 03:52:30 PM) (Source: Microsoft Office 14) (EventID: 2001) (User: )
Description: Microsoft Outlook: Rejected Safe Mode action : Poslední spuštění aplikace Outlook se nezdařilo. Spuštěním Outlook v nouzovém režimu můžete odstranit nebo zjistit problém a dosáhnout tak úspěšného spuštění aplikace. Některé funkce nebudou pravděpodobně v tomto režimu k dispozici.

Chcete aplikaci Outlook spustit v nouzovém režimu?.
Rejected Safe Mode action : Microsoft Outlook.

Error: (09/01/2015 03:21:01 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (09/01/2015 03:20:42 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Zavedení následujícího ovladače pro spouštění počítače nebo systému se nezdařilo:
ArcCtrl
archlp
ArcSec

Error: (08/31/2015 12:11:29 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Stínové kopie svazku C: byly přerušeny, protože z důvodu limitu stanoveného uživatelem se nepodařilo zvětšit úložiště stínové kopie.

Error: (08/31/2015 10:50:25 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Zavedení následujícího ovladače pro spouštění počítače nebo systému se nezdařilo:
ArcCtrl
archlp
ArcSec

Error: (08/30/2015 05:51:09 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Stínové kopie svazku C: byly přerušeny, protože z důvodu limitu stanoveného uživatelem se nepodařilo zvětšit úložiště stínové kopie.

Error: (08/30/2015 04:10:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Služba Windows Search neuspěla při spuštění v důsledku následující chyby:
%%1053

Error: (08/30/2015 04:10:14 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Při čekání na připojení služby Windows Search bylo dosaženo časového limitu (60000 ms).

Error: (08/30/2015 04:10:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Služba Windows Search neuspěla při spuštění v důsledku následující chyby:
%%1053

Error: (08/30/2015 04:10:06 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Při čekání na připojení služby Windows Search bylo dosaženo časového limitu (60000 ms).

Error: (08/30/2015 04:09:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Služba Windows Search neuspěla při spuštění v důsledku následující chyby:
%%1053

Error: (08/30/2015 04:09:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Při čekání na připojení služby Windows Search bylo dosaženo časového limitu (60000 ms).


Microsoft Office:
=========================
Error: (09/01/2015 06:53:27 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: MapiUvedený modul nebyl nalezen. (HRESULT : 0x8007007e)

Error: (09/01/2015 06:29:44 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: MapiUvedený modul nebyl nalezen. (HRESULT : 0x8007007e)

Error: (09/01/2015 06:23:17 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: MapiUvedený modul nebyl nalezen. (HRESULT : 0x8007007e)

Error: (09/01/2015 05:52:57 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: MapiUvedený modul nebyl nalezen. (HRESULT : 0x8007007e)

Error: (09/01/2015 05:22:53 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: MapiUvedený modul nebyl nalezen. (HRESULT : 0x8007007e)

Error: (09/01/2015 04:52:48 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: MapiUvedený modul nebyl nalezen. (HRESULT : 0x8007007e)

Error: (09/01/2015 04:22:53 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: MapiUvedený modul nebyl nalezen. (HRESULT : 0x8007007e)

Error: (09/01/2015 03:52:37 PM) (Source: Windows Search Service) (EventID: 3083) (User: )
Description: MapiUvedený modul nebyl nalezen. (HRESULT : 0x8007007e)

Error: (09/01/2015 03:52:30 PM) (Source: Microsoft Office 14) (EventID: 2001) (User: )
Description: Microsoft OutlookPoslední spuštění aplikace Outlook se nezdařilo. Spuštěním Outlook v nouzovém režimu můžete odstranit nebo zjistit problém a dosáhnout tak úspěšného spuštění aplikace. Některé funkce nebudou pravděpodobně v tomto režimu k dispozici.

Chcete aplikaci Outlook spustit v nouzovém režimu?

Error: (09/01/2015 03:21:01 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity:
===================================
Date: 2015-08-29 12:19:00.311
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-08-29 12:19:00.264
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-08-29 12:19:00.217
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-08-29 12:19:00.170
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-08-29 12:12:08.564
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-08-29 12:12:08.501
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-08-29 12:12:08.454
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-08-29 12:12:08.408
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-08-29 09:23:34.038
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2015-08-29 09:23:33.987
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz
Percentage of memory in use: 40%
Total physical RAM: 4095.12 MB
Available physical RAM: 2454.07 MB
Total Virtual: 8188.44 MB
Available Virtual: 6335.69 MB

==================== Drives ================================

Drive c: (WINDOWS_SEVEN) (Fixed) (Total:931.51 GB) (Free:346.51 GB) NTFS ==>[drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 3BB385E0)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

bobsch2
Level 1.5
Level 1.5
Příspěvky: 106
Registrován: prosinec 09
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod bobsch2 » 01 zář 2015 20:17

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:30-08-2015
Ran by Admin (administrator) on PCASUS (01-09-2015 19:44:03)
Running from C:\Users\Admin\Desktop\Správa PC\Čištění PC od havěti
Loaded Profiles: Admin (Available Profiles: Admin & Arnochtomag)
Platform: Windows 7 Enterprise Service Pack 1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
() C:\ProgramData\ExtTag\ExtTag.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Program Files\NixSrv\NixSrv.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
() C:\Program Files\NixSrv\packages\ce951302-b47b-4947-a46d-2422effc295c\NixHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Microsoft Corporation) C:\Users\Admin\AppData\Local\Temp\msqzrfwvr.pif
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft) C:\Program Files (x86)\OnTranslator.com\OnTranslator.exe
(Microsoft Corporation) C:\Users\Admin\AppData\Roaming\Microsoft Visual\VFP6.exe
(brother) C:\Program Files (x86)\Brownie\BrStsW64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(brother) C:\Program Files (x86)\Brownie\brpjp04a.exe
() C:\ProgramData\ExtTag\DentoTam.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2634872 2015-08-18] (NVIDIA Corporation)
HKLM-x32\...\Run: [seznam-listicka-distribuce] => C:\Program Files (x86)\Seznam.cz\distribution\szninstall.exe [1062472 2013-05-16] ()
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKU\S-1-5-21-572532400-2546031134-3008305638-1000\...\Run: [NokiaSuite.exe] => C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1092448 2014-11-19] (Nokia)
HKU\S-1-5-21-572532400-2546031134-3008305638-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8455960 2015-08-20] (Piriform Ltd)
HKU\S-1-5-21-572532400-2546031134-3008305638-1000\...\RunOnce: [BrStsW64.exe] => C:\Program Files (x86)\Brownie\BrStsW64.exe [3695928 2009-08-19] (brother)
AppInit_DLLs: C:\ProgramData\ExtTag\Indigotip.dll => C:\ProgramData\ExtTag\Indigotip.dll [212992 2015-08-29] ()
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MS VISUAL PRO.lnk [2015-08-05]
ShortcutTarget: MS VISUAL PRO.lnk -> C:\Users\Admin\AppData\Roaming\Microsoft Visual\VFP6.exe (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\OnTranslator.lnk [2015-08-21]
ShortcutTarget: OnTranslator.lnk -> C:\Program Files (x86)\OnTranslator.com\OnTranslator.exe (Microsoft)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 01 C:\Windows\SysWOW64\mswsock.dll [231424 2014-02-12] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 C:\Windows\System32\mswsock.dll [327168 2014-02-12] (Microsoft Corporation)ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{718F08A7-6A6D-4B81-873F-8BB9197B3E44}: [DhcpNameServer] 10.0.0.138

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-572532400-2546031134-3008305638-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dl ... ar=msnhome
HKU\S-1-5-21-572532400-2546031134-3008305638-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKU\S-1-5-21-572532400-2546031134-3008305638-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73 ... JvpjJZk&q={searchTerms}
SearchScopes: HKLM-x32 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search
SearchScopes: HKU\S-1-5-21-572532400-2546031134-3008305638-1000 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73 ... JvpjJZk&q={searchTerms}
SearchScopes: HKU\S-1-5-21-572532400-2546031134-3008305638-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-572532400-2546031134-3008305638-1000 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73 ... JvpjJZk&q={searchTerms}
BHO: No Name -> {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -> No File
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2012-12-26] (Oracle Corporation)
BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File
BHO: No Name -> {9FD3D761-2B09-DA1A-0229-0248A05B0334} -> No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-12-26] (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-12-18] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-12-18] (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zfecvo39.default
FF Homepage: C:\ProgramData\ExtTags\ff.HP
FF NewTab: C:\ProgramData\ExtTags\ff.NT
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-19] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2013-12-30] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\system32\npDeployJava1.dll [2012-12-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.10.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2012-12-26] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2013-12-30] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-19] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2013-12-30] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-12-18] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-12-18] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin -> C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll [2014-11-19] ( )
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-08-07] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-08-07] (NVIDIA Corporation)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2013-12-30] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-572532400-2546031134-3008305638-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2013-12-30] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-572532400-2546031134-3008305638-1000: @Google.com/GoogleEarthPlugin -> C:\Users\Admin\AppData\Local\Google\Google Earth\plugin\npgeplugin.dll [2012-04-14] (Google)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll [2013-12-30] (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zfecvo39.default\searchplugins\findit.xml [2015-08-29]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\findit.xml [2015-08-29]
FF Extension: Noia Fox - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zfecvo39.default\Extensions\{7b90e860-5d61-11e0-80e3-0800200c9a66}.xpi [2015-07-05]
FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-02-06]
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zfecvo39.default\extensions\defsearchp@gmail.com [not found]
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zfecvo39.default\extensions\deskCutv2@gmail.com [not found]
FF Extension: No Name - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zfecvo39.default\extensions\f8783004-c434-4bd0-9f81-9a39dd64baaa@08ad07c4-3f21-451d-9045-9e0d5dc8aa9e.com [not found]
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome:
=======
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-08-26]
CHR Extension: (Seznam Lištička - Email) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgjpfhpjcgdppjbgnpnjllokbmcdllig [2015-08-26]
CHR Extension: (Seznam Lištička - Slovník) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blmojkbhnkkphngknkmgccmlenfaelkd [2015-08-26]
CHR Extension: (Adblock Plus) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-08-26]
CHR Extension: (Google Search) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-08-26]
CHR Extension: (Gmail Offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2015-08-26]
CHR Extension: (History Button) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fofpnhmbgmmeaialapfddhbhfongoinh [2015-08-26]
CHR Extension: (AdBlock) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-08-26]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-08]
CHR Extension: (Seznam Lištička - Rychlá volba) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\olfeabkoenfaoljndfecamgilllcpiak [2015-08-26]
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-23]
CHR HKLM-x32\...\Chrome\Extension: [gehmndecgbcffhmfjkenpamdgechcgpe] - https://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome.DST2CBW7JA7DLYCBYA6HB5H3GA - C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe

Opera:
=======
OPR Extension: (vux777) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\bekmnilenpmnmmiaokgoclkegllkgbok [2014-04-22]
OPR Extension: (sailormax) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\cnbpedcoekjafichoehopgaaldogogch [2014-04-22]
OPR Extension: (No Name) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\kfjnfapiocpibeddeekmbikhpegjhdgi [2014-09-27]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 CyberLink PowerDVD 13 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [77576 2013-07-05] (CyberLink)
R2 CyberLink PowerDVD 13 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [327432 2013-07-05] (CyberLink)
R2 ExtTag; C:\ProgramData\ExtTag\ExtTag.exe [33792 2015-08-27] () [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1155192 2015-08-18] (NVIDIA Corporation)
S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 NixSrv; C:\Program Files\NixSrv\NixSrv.exe [379392 2015-08-23] () [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1872504 2015-08-18] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5544568 2015-08-18] (NVIDIA Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-08-02] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AtcL001; C:\Windows\System32\DRIVERS\l160x64.sys [61440 2009-10-13] (Atheros Communications, Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2015-01-26] ()
R1 ElRawDisk; C:\Windows\system32\drivers\elrawdsk64.sys [31432 2012-04-17] (EldoS Corporation)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-12-30] () [File not signed]
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2011-10-24] (Huawei Technologies Co., Ltd.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2015-01-26] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-08-29] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19576 2015-08-18] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [50472 2015-08-11] (NVIDIA Corporation)
S3 s1018bus; C:\Windows\System32\DRIVERS\s1018bus.sys [113704 2009-03-25] (MCCI Corporation)
S3 s1018mdfl; C:\Windows\System32\DRIVERS\s1018mdfl.sys [19496 2009-03-25] (MCCI Corporation)
S3 s1018mdm; C:\Windows\System32\DRIVERS\s1018mdm.sys [153128 2009-03-25] (MCCI Corporation)
S3 s1018mgmt; C:\Windows\System32\DRIVERS\s1018mgmt.sys [133160 2009-03-25] (MCCI Corporation)
S3 s1018nd5; C:\Windows\System32\DRIVERS\s1018nd5.sys [34856 2009-03-25] (MCCI Corporation)
S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [128552 2009-03-25] (MCCI Corporation)
S3 s1018unic; C:\Windows\System32\DRIVERS\s1018unic.sys [146472 2009-03-25] (MCCI Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2014-07-26] () [File not signed]
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-12] (Microsoft Corporation)
S3 WiseHDInfo; C:\Windows\WiseHDInfo64.dll [14800 2015-08-21] (wisecleaner.com)
R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-07-06] (CyberLink Corp.)
U3 aqgcfbtq; C:\Windows\System32\Drivers\aqgcfbtq.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder)
S1 ArcCtrl; system32\drivers\ArcCtrl.sys [X]
S1 archlp; system32\drivers\archlp.sys [X]
S1 ArcSec; system32\drivers\ArcSec.sys [X]
S3 avchv; system32\DRIVERS\avchv.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

bobsch2
Level 1.5
Level 1.5
Příspěvky: 106
Registrován: prosinec 09
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod bobsch2 » 01 zář 2015 20:18

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-01 19:43 - 2015-09-01 19:44 - 00000000 ____D C:\FRST
2015-09-01 19:29 - 2015-09-01 19:29 - 02188800 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2015-09-01 18:18 - 2015-09-01 19:12 - 00000000 ____D C:\Users\Admin\Downloads\Enemy At The Gates (2001) [1080p]
2015-09-01 18:18 - 2015-09-01 18:31 - 1828300042 _____ C:\Users\Admin\Downloads\Enemy.At.The.Gates.2001.1080p.BrRip.x264.YIFY.mp4
2015-08-31 11:09 - 2015-08-31 11:09 - 00000000 ____D C:\Users\Admin\AppData\Local\GHISLER
2015-08-30 19:54 - 2015-08-30 20:48 - 00000000 ____D C:\Program Files (x86)\Grand Theft Auto V
2015-08-30 18:01 - 2015-08-30 18:01 - 00929360 _____ (Google Inc.) C:\Users\Admin\Downloads\ChromeSetup (1).exe
2015-08-30 17:59 - 2015-08-30 19:18 - 1098274408 _____ C:\Users\Admin\Downloads\Microsoft-Office-2013-Professional-Plus-CZ-+-Crack-[Kedar_CZ].rar
2015-08-30 16:06 - 2015-09-01 15:20 - 00000504 _____ C:\Windows\setupact.log
2015-08-30 16:06 - 2015-08-30 16:06 - 00001456 _____ C:\Windows\PFRO.log
2015-08-30 16:06 - 2015-08-30 16:06 - 00000000 _____ C:\Windows\setuperr.log
2015-08-30 15:56 - 2015-08-30 15:57 - 00000948 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-08-30 15:56 - 2015-08-30 15:56 - 00002786 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-08-30 15:56 - 2015-08-30 15:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-08-30 15:56 - 2015-08-30 15:56 - 00000000 ____D C:\Program Files\CCleaner
2015-08-30 12:47 - 2015-08-30 12:51 - 56469666 _____ C:\Users\Admin\Downloads\GTA-5-CZ.rar
2015-08-30 11:44 - 2015-08-30 16:08 - 00014336 ___SH C:\Users\Admin\Downloads\Thumbs.db
2015-08-30 11:43 - 2015-08-30 11:43 - 00195540 _____ C:\Users\Admin\Downloads\Grand.Theft.Auto.V.torrent
2015-08-29 09:15 - 2015-08-29 09:15 - 00000000 ____D C:\ProgramData\ExtTags
2015-08-29 09:14 - 2015-09-01 15:22 - 00000000 ____D C:\ProgramData\ExtTag
2015-08-27 18:57 - 2015-08-27 18:57 - 00000000 ____D C:\Users\Admin\AppData\Local\bitComposer
2015-08-26 21:24 - 2015-08-26 21:24 - 00001712 _____ C:\DelFix.txt
2015-08-26 21:22 - 2015-08-26 21:22 - 00781312 _____ C:\Users\Admin\Downloads\delfix_1.011 (1).exe
2015-08-26 15:30 - 2015-08-26 15:08 - 00024064 _____ C:\Windows\zoek-delete.exe
2015-08-26 09:32 - 2015-09-01 19:36 - 00490130 _____ C:\Windows\WindowsUpdate.log
2015-08-26 09:27 - 2015-08-26 09:27 - 00515360 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-25 15:08 - 2015-08-25 15:08 - 00749634 _____ C:\Users\Admin\Downloads\DarkSouls_2_PLUS24_TRN-dEViATED.rar
2015-08-25 15:05 - 2015-08-25 15:05 - 01189934 _____ C:\Users\Admin\Downloads\dark_souls2_v1.01_1.02_trn.rar
2015-08-25 15:00 - 2015-08-25 15:01 - 00000000 ___HD C:\Users\Admin\Downloads\.ptmp596980
2015-08-25 15:00 - 2015-08-25 15:00 - 00000000 ____D C:\Steam
2015-08-25 14:55 - 2015-08-25 14:55 - 06283063 _____ C:\Users\Admin\Downloads\codex-dark.souls.ii.upd.1.10.7z
2015-08-25 14:45 - 2015-08-25 14:45 - 04830660 _____ C:\Users\Admin\Downloads\dark-souls-2-steam-v1.7-cz (1).zip
2015-08-25 14:38 - 2015-08-25 14:38 - 08200847 _____ C:\Users\Admin\Downloads\dark-souls-2.rar
2015-08-25 14:29 - 2015-08-25 14:29 - 04935534 _____ C:\Users\Admin\Downloads\dark-souls-2-steam-v1.10-cz (1).zip
2015-08-25 11:13 - 2015-08-25 11:13 - 00121144 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2015-08-25 09:43 - 2015-08-25 11:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DarkSoulsII
2015-08-25 09:25 - 2015-08-28 22:25 - 00000000 ____D C:\Program Files (x86)\Dark Souls 2
2015-08-25 09:16 - 2015-08-29 09:15 - 00001639 _____ C:\Users\Admin\Desktop\Google Chrome.lnk
2015-08-24 17:10 - 2015-08-24 17:10 - 00001332 _____ C:\Users\Admin\Downloads\Clean Registry for Free!.lnk
2015-08-24 17:09 - 2015-08-24 17:09 - 00003368 _____ C:\Windows\System32\Tasks\IQA
2015-08-24 17:02 - 2015-08-24 17:02 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Quick Access
2015-08-24 16:58 - 2015-08-24 17:03 - 00000000 ____D C:\Program Files (x86)\1E007420-1440428285-1100-5FCD-001E8C545F1D
2015-08-24 16:57 - 2015-08-24 18:57 - 00000000 ____D C:\Program Files\NixSrv
2015-08-24 16:54 - 2015-08-25 08:32 - 00000000 ____D C:\ProgramData\update
2015-08-24 16:51 - 2015-08-24 16:51 - 01601812 _____ C:\Users\Admin\Downloads\air.conflicts.pacific.carriers.crack.free.rar
2015-08-24 16:51 - 2015-08-24 16:51 - 01601812 _____ C:\Users\Admin\Downloads\air.conflicts.pacific.carriers.crack.free (1).rar
2015-08-24 16:51 - 2015-08-24 16:51 - 00000000 ___HD C:\Users\Admin\Downloads\.ptmp505228
2015-08-24 16:45 - 2015-08-24 16:45 - 00020316 _____ C:\Users\Admin\Downloads\Dark_Souls_2_+_DLC_(2014)_PC_RePack_от_R.G._Freedom.torrent
2015-08-24 13:51 - 2015-08-28 19:55 - 00000000 ____D C:\Program Files (x86)\Air Conflicts Vietnam
2015-08-24 13:40 - 2015-08-27 19:28 - 00000000 ____D C:\Program Files (x86)\Air Conflicts - Pacific Carriers
2015-08-24 13:01 - 2015-08-24 13:01 - 00011257 _____ C:\Users\Admin\Downloads\[kat.cr]air.conflicts.pacific.carriers.flt.torrent
2015-08-23 20:07 - 2015-08-26 22:44 - 00000000 ____D C:\Users\Admin\Downloads\Avengers Age of Ultron (2015) HDRip XviD-MAXSPEED
2015-08-23 20:01 - 2015-08-23 20:01 - 00719192 _____ C:\Users\Admin\Downloads\MatroskaSplitter.exe
2015-08-23 19:54 - 2015-08-23 19:55 - 03958982 _____ C:\Users\Admin\Downloads\MatroskaPackFull_1.1.2.zip
2015-08-23 18:43 - 2015-08-23 19:50 - 00000000 ____D C:\Users\Admin\Downloads\Avengers Age of Ultron 2015 720p HDRip HEVC x265 [Dual Audio] [English 5.1+ Hindi Cam 2.0] RSY™ TG
2015-08-23 15:46 - 2015-08-24 17:52 - 00001921 _____ C:\Users\Admin\Desktop\Launcher – zástupce.lnk
2015-08-23 15:29 - 2015-08-23 15:33 - 00000000 ____D C:\Program Files (x86)\il-2 sturmovik cliffs of dover
2015-08-23 15:29 - 2015-08-23 15:29 - 00003074 _____ C:\Windows\System32\Tasks\{A23A7049-3A3C-477E-B480-8DB6C0A9E7C5}
2015-08-23 14:47 - 2015-08-23 14:47 - 00023376 _____ C:\Users\Admin\Downloads\IL-2_Sturmovik_Cliffs_of_Dover_(2011)_[PCDVD][MULTi5].torrent
2015-08-23 14:04 - 2015-08-23 14:04 - 11532846 _____ C:\Users\Admin\Downloads\everesthome220.exe
2015-08-23 14:03 - 2015-08-23 14:04 - 22923352 _____ C:\Users\Admin\Downloads\aida64extreme500.exe
2015-08-23 14:01 - 2015-08-23 14:01 - 09070797 _____ C:\Users\Admin\Downloads\GPU-Z.0.8.1.exe
2015-08-23 12:56 - 2015-08-23 12:56 - 01227264 _____ (Корпорация Майкрософт) C:\Windows\SysWOW64\dx8vb.dll
2015-08-23 12:56 - 2015-08-23 12:56 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSSTDFMT.DLL
2015-08-23 12:53 - 2015-08-24 13:35 - 00000000 ____D C:\Program Files (x86)\IL-2 Sturmovik 1946
2015-08-23 11:16 - 2015-08-23 11:16 - 00022040 _____ C:\Users\Admin\Downloads\War_Thunder_v.1.43.7.49_(ENG-RUS)_[L].torrent
2015-08-23 11:10 - 2015-08-23 11:10 - 00014387 _____ C:\Users\Admin\Downloads\057DC6B650E51D578AA4273A2D6027C2A43BB8D0.torrent
2015-08-23 11:05 - 2015-08-23 11:05 - 00017489 _____ C:\Users\Admin\Downloads\IL-2_Sturmovik-_1946_(Eng)_(PC_DVD).torrent
2015-08-22 20:38 - 2015-08-22 20:38 - 01642565 _____ C:\Users\Admin\Downloads\Far-Cry-4--CRACK-FIX.rar
2015-08-22 20:38 - 2015-08-22 20:38 - 00184853 _____ C:\Users\Admin\Downloads\Far-Cry-4---CRACK-FIX.rar
2015-08-22 20:37 - 2015-08-22 20:37 - 00511512 _____ C:\Users\Admin\Downloads\Far-Cry-4-CRACK.rar
2015-08-21 21:16 - 2015-08-21 21:19 - 11570585 _____ C:\Users\Admin\Downloads\tvm-oim115.7z
2015-08-21 21:10 - 2015-08-21 21:10 - 00057098 _____ C:\Users\Admin\Downloads\MOUNT.AND.BLADE.WFAS.V1.143.ALL.PROPHET.NODVD.ZIP
2015-08-21 20:45 - 2015-08-21 20:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mount&Blade With Fire and Sword
2015-08-21 19:58 - 2015-08-21 19:58 - 00000000 ____D C:\Users\Admin\Documents\1C SoftClub
2015-08-21 19:35 - 2015-08-21 19:35 - 00021759 _____ C:\Users\Admin\Downloads\The.Witcher.3.Wild.Hunt.Patch.v1.07-GOG (1).torrent
2015-08-21 19:33 - 2015-08-21 19:33 - 00021759 _____ C:\Users\Admin\Downloads\The.Witcher.3.Wild.Hunt.Patch.v1.07-GOG.torrent
2015-08-21 19:27 - 2015-08-21 19:27 - 00001065 _____ C:\Users\Admin\Desktop\TORRENTS – zástupce.lnk
2015-08-21 15:04 - 2015-08-21 15:04 - 00021805 _____ C:\Users\Admin\Downloads\The_Witcher_3-_Wild_Hunt_Patch_1.08.2_(GOG).torrent
2015-08-21 12:29 - 2015-08-21 12:29 - 00000000 ____D C:\Users\Admin\Documents\The Witcher 3
2015-08-21 10:15 - 2015-08-21 10:16 - 15560438 _____ C:\Users\Admin\Downloads\Wise-Care-365-Pro-3.57-Build-317-+-Keygen.rar
2015-08-21 09:20 - 2015-08-21 09:20 - 00014800 _____ (wisecleaner.com) C:\Windows\WiseHDInfo64.dll
2015-08-21 09:19 - 2015-08-21 09:19 - 06132488 _____ (WiseCleaner.com ) C:\Users\Admin\Downloads\WiseCare365.exe
2015-08-21 09:16 - 2015-08-21 09:16 - 06994944 _____ (IObit ) C:\Users\Admin\Downloads\smart-defrag4-setup (1).exe
2015-08-21 09:14 - 2015-01-10 15:32 - 00128288 _____ (IObit) C:\Windows\system32\IObitSmartDefragExtension.dll
2015-08-21 09:14 - 2014-06-04 15:17 - 00034080 _____ (IObit) C:\Windows\system32\SmartDefragBootTime.exe
2015-08-21 09:11 - 2015-08-21 09:11 - 06994944 _____ (IObit ) C:\Users\Admin\Downloads\smart-defrag4-setup.exe
2015-08-21 03:00 - 2015-08-11 03:20 - 25191936 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-21 03:00 - 2015-08-11 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-21 03:00 - 2015-08-11 02:33 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-08-21 03:00 - 2015-08-11 02:20 - 19871232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-08-21 01:13 - 2015-08-21 01:13 - 00003478 _____ C:\Windows\System32\Tasks\{27C639D0-31A1-434B-A9A3-9D2CABBEFC65}
2015-08-20 20:14 - 2015-08-07 06:22 - 00573048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-08-20 20:11 - 2015-08-20 20:12 - 11874046 _____ C:\Users\Admin\Downloads\dfsetup219.exe
2015-08-20 20:09 - 2015-08-20 20:09 - 00056952 _____ C:\Users\Admin\Downloads\Defraggler103093cz.zip
2015-08-20 20:07 - 2015-08-07 13:06 - 42840184 _____ C:\Windows\system32\nvcompiler.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 37819000 _____ C:\Windows\SysWOW64\nvcompiler.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 22520624 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 18540336 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 16630096 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 15510112 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 14928048 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 14673920 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 13656016 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 12179496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 11076216 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-08-20 20:07 - 2015-08-07 13:06 - 02937648 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 02624816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 01898104 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6435560.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 01567576 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 01558832 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6435560.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 01104440 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 01063216 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 01059960 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00985208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00942688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00931448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00512720 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00421544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00408184 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00364152 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00204648 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-08-20 20:07 - 2015-08-07 13:06 - 00177088 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00155792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00150648 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00128512 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00040280 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-08-20 20:07 - 2015-08-07 13:06 - 00033050 _____ C:\Windows\system32\nvinfo.pb
2015-08-20 19:55 - 2015-08-11 06:52 - 00069416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-08-20 19:55 - 2015-08-11 06:52 - 00050472 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-08-20 19:43 - 2015-08-20 19:43 - 22508192 _____ C:\Users\Admin\Downloads\iobit_toolbox (1).zip
2015-08-20 15:37 - 2015-08-20 15:37 - 00000000 ____D C:\Users\Admin\AppData\Local\O&O
2015-08-20 15:34 - 2015-08-20 18:28 - 00000000 ____D C:\Windows\system32\oodag
2015-08-20 15:31 - 2015-08-20 15:31 - 00000000 ____D C:\ProgramData\OO Software
2015-08-20 15:30 - 2015-08-20 15:30 - 00198724 _____ C:\Users\Admin\Downloads\Wolfenstein.-.The.New.Order.torrent
2015-08-20 15:24 - 2015-08-20 15:26 - 12337152 _____ C:\Users\Admin\Downloads\iobit_toolbox.zip
2015-08-20 15:23 - 2015-08-20 15:25 - 33815702 _____ C:\Users\Admin\Downloads\OODefrag18Professional64Enu.exe
2015-08-20 14:52 - 2015-08-20 14:53 - 05403720 _____ (Dll-Files.com ) C:\Users\Admin\Downloads\dffsetup-isdone.exe
2015-08-20 13:44 - 2015-08-20 13:44 - 00330371 _____ C:\Users\Admin\Downloads\isdone (1).zip
2015-08-20 13:44 - 2015-08-20 13:44 - 00235360 _____ C:\Users\Admin\Downloads\isdone (2).zip
2015-08-20 10:39 - 2015-08-20 10:40 - 00679936 _____ C:\Users\Admin\Downloads\Detection (1).msi
2015-08-20 10:34 - 2015-08-20 10:34 - 00679936 _____ C:\Users\Admin\Downloads\Detection.msi
2015-08-20 03:19 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-20 03:19 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-20 00:57 - 2015-08-20 00:57 - 00036438 _____ C:\Users\Admin\Downloads\Far_Cry_4_[v1_5]_Repack-R_G_Mechanics.torrent
2015-08-19 22:43 - 2015-08-19 22:43 - 00167980 _____ C:\Users\Admin\Downloads\Ghost.Recon.Future.Soldier.čeština.rar
2015-08-19 22:37 - 2015-08-19 22:37 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Ubisoft
2015-08-19 21:34 - 2015-07-21 02:39 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-08-19 21:34 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-08-19 21:34 - 2015-07-16 22:54 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-08-19 21:34 - 2015-07-16 22:37 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-08-19 21:34 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-19 21:34 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-19 21:34 - 2015-07-16 22:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-08-19 21:34 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-19 21:34 - 2015-07-16 22:35 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-08-19 21:34 - 2015-07-16 22:27 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-19 21:34 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-19 21:34 - 2015-07-16 22:26 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-08-19 21:34 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-19 21:34 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-19 21:34 - 2015-07-16 22:21 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-08-19 21:34 - 2015-07-16 22:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-08-19 21:34 - 2015-07-16 22:21 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-08-19 21:34 - 2015-07-16 22:12 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-08-19 21:34 - 2015-07-16 22:08 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-19 21:34 - 2015-07-16 22:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-08-19 21:34 - 2015-07-16 21:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-08-19 21:34 - 2015-07-16 21:54 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-19 21:34 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-08-19 21:34 - 2015-07-16 21:51 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-19 21:34 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-08-19 21:34 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-19 21:34 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-08-19 21:34 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-08-19 21:34 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-08-19 21:34 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-08-19 21:34 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-08-19 21:34 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-19 21:34 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-08-19 21:34 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-08-19 21:34 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-08-19 21:34 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-19 21:34 - 2015-07-16 21:35 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-08-19 21:34 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-19 21:34 - 2015-07-16 21:33 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-08-19 21:34 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-19 21:34 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-08-19 21:34 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-08-19 21:34 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-08-19 21:34 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-08-19 21:34 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-08-19 21:34 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-08-19 21:34 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-19 21:34 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-08-19 21:34 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-08-19 21:34 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-08-19 21:34 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-08-19 21:34 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-19 21:34 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-08-19 21:34 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-08-19 21:34 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-08-19 21:34 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-08-19 21:29 - 2015-07-28 22:09 - 00017344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-08-19 21:29 - 2015-07-28 22:05 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-08-19 21:29 - 2015-07-28 22:05 - 00774656 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-08-19 21:29 - 2015-07-28 22:05 - 00743424 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-08-19 21:29 - 2015-07-28 22:05 - 00437760 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-08-19 21:29 - 2015-07-28 22:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-08-19 21:29 - 2015-07-28 22:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-08-19 21:29 - 2015-07-28 21:55 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-08-19 21:28 - 2015-08-24 17:31 - 19284168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-08-19 21:28 - 2015-07-15 20:15 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-08-19 21:28 - 2015-07-15 20:15 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-19 21:28 - 2015-07-15 20:15 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-08-19 21:28 - 2015-07-15 20:15 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-08-19 21:28 - 2015-07-15 20:12 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-08-19 21:28 - 2015-07-15 20:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-08-19 21:28 - 2015-07-15 20:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-08-19 21:28 - 2015-07-15 20:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-08-19 21:28 - 2015-07-15 20:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-08-19 21:28 - 2015-07-15 20:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-08-19 21:28 - 2015-07-15 20:10 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-08-19 21:28 - 2015-07-15 20:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-08-19 21:28 - 2015-07-15 20:10 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-08-19 21:28 - 2015-07-15 20:10 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-08-19 21:28 - 2015-07-15 20:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-08-19 21:28 - 2015-07-15 20:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-08-19 21:28 - 2015-07-15 20:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-08-19 21:28 - 2015-07-15 20:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:59 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-08-19 21:28 - 2015-07-15 19:59 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-08-19 21:28 - 2015-07-15 19:56 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-19 21:28 - 2015-07-15 19:55 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-08-19 21:28 - 2015-07-15 19:55 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-08-19 21:28 - 2015-07-15 19:55 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-08-19 21:28 - 2015-07-15 19:55 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-08-19 21:28 - 2015-07-15 19:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-08-19 21:28 - 2015-07-15 19:54 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-19 21:28 - 2015-07-15 19:54 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-19 21:28 - 2015-07-15 19:54 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-08-19 21:28 - 2015-07-15 19:54 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-08-19 21:28 - 2015-07-15 19:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-08-19 21:28 - 2015-07-15 19:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-08-19 21:28 - 2015-07-15 19:54 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-08-19 21:28 - 2015-07-15 19:53 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-08-19 21:28 - 2015-07-15 19:53 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-19 21:28 - 2015-07-15 19:53 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-08-19 21:28 - 2015-07-15 19:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-08-19 21:28 - 2015-07-15 19:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-08-19 21:28 - 2015-07-15 19:53 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-08-19 21:28 - 2015-07-15 19:49 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-08-19 21:28 - 2015-07-15 19:48 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 18:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-19 21:28 - 2015-07-15 18:46 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-19 21:28 - 2015-07-15 18:46 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-19 21:28 - 2015-07-15 18:37 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-08-19 21:28 - 2015-07-15 18:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-08-19 21:28 - 2015-07-15 18:34 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 18:34 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 18:34 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-08-19 21:28 - 2015-07-15 18:34 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-08-19 21:27 - 2015-07-15 05:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2015-08-19 21:27 - 2015-07-10 19:51 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-08-19 21:27 - 2015-07-10 19:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2015-08-19 21:27 - 2015-07-10 19:51 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-08-19 21:27 - 2015-07-10 19:34 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-19 21:27 - 2015-07-10 19:34 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-08-19 21:27 - 2015-07-10 19:33 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-08-19 21:21 - 2015-07-15 05:19 - 02004992 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-08-19 21:21 - 2015-07-15 05:19 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-08-19 21:21 - 2015-07-15 05:14 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-08-19 21:21 - 2015-07-15 05:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-08-19 21:21 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-08-19 21:21 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-08-19 21:21 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-08-19 21:21 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-08-19 21:21 - 2015-07-01 22:49 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-08-19 21:21 - 2015-07-01 22:48 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2015-08-19 21:21 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-08-19 21:21 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-08-19 21:20 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-08-19 21:20 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-08-19 21:20 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-08-19 21:20 - 2015-07-30 20:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-08-19 21:20 - 2015-07-30 20:06 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-19 21:20 - 2015-07-30 20:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-08-19 21:20 - 2015-07-30 20:06 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-08-19 21:20 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-08-19 21:20 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-19 21:20 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-08-19 21:20 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-19 21:20 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-08-19 21:20 - 2015-07-30 19:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-08-19 21:20 - 2015-07-30 18:56 - 03208192 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-19 21:20 - 2015-07-30 18:52 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-19 21:20 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-19 21:19 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2015-08-19 21:19 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2015-08-19 21:19 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2015-08-19 21:16 - 2015-07-10 19:51 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-19 21:16 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-19 21:11 - 2015-07-20 20:12 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-19 21:11 - 2015-07-20 20:12 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-19 21:11 - 2015-07-20 20:12 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-19 21:11 - 2015-07-20 20:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-19 21:11 - 2015-07-20 20:12 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-19 21:11 - 2015-07-20 20:12 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-19 21:11 - 2015-07-20 20:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-19 21:11 - 2015-07-20 20:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-19 21:11 - 2015-07-20 20:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-19 21:11 - 2015-07-20 20:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-19 21:11 - 2015-07-20 20:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-08-19 21:11 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-19 21:11 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-19 21:11 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-19 21:11 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-19 21:11 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-19 20:10 - 2015-08-19 20:10 - 00018983 _____ C:\Users\Admin\Downloads\ghost recon future soldier.torrent
2015-08-19 20:10 - 2015-08-19 20:10 - 00018983 _____ C:\Users\Admin\Downloads\[limetorrents.cc]Tom.Clancy's.Ghost.Recon.Future.Soldier..2012..PC...RePack.от.Audioslave.torrent
2015-08-07 17:50 - 2015-08-08 23:33 - 00000000 ____D C:\Users\Admin\Downloads\Spy.2015.HC.HDRip.XviD.AC3-EVO
2015-08-07 17:50 - 2015-08-07 17:50 - 00119460 _____ C:\Users\Admin\Downloads\Spy.2015.HC.HDRip.XviD.AC3-EVO (1).torrent
2015-08-07 17:49 - 2015-08-07 17:49 - 00119460 _____ C:\Users\Admin\Downloads\Spy.2015.HC.HDRip.XviD.AC3-EVO.torrent
2015-08-06 23:16 - 2015-08-06 23:16 - 00015062 _____ C:\Users\Admin\Downloads\Black_Sea_2014_1080p_BRRip_x264_DTS-JYK.torrent
2015-08-06 14:13 - 2015-08-06 14:13 - 02564290 _____ C:\Users\Admin\Downloads\Mount_Blade_With_Fire_and_Sword_v1.138_+_8_Trainer.rar
2015-08-06 14:12 - 2015-08-06 14:12 - 02563119 _____ C:\Users\Admin\Downloads\Mount_Blade_With_Fire_and_Sword_v1.139_+_8_Trainer.rar
2015-08-06 13:01 - 2015-08-07 00:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mount&Blade With Fire and Sword
2015-08-06 13:01 - 2015-08-06 13:15 - 00000000 ____D C:\Users\Admin\Documents\Mount&Blade With Fire and Sword
2015-08-06 12:51 - 2015-08-28 22:26 - 00000000 ____D C:\Program Files (x86)\Mount&Blade With Fire and Sword
2015-08-06 12:43 - 2015-08-06 12:43 - 00347791 _____ C:\Users\Admin\Downloads\Mount-&-Blade-With-Fire-and-Sword-Čeština-aj-na-steam-verzie (1).rar
2015-08-06 12:42 - 2015-08-06 12:42 - 00347791 _____ C:\Users\Admin\Downloads\Mount-&-Blade-With-Fire-and-Sword-Čeština-aj-na-steam-verzie.rar
2015-08-06 12:40 - 2015-08-06 12:40 - 00017970 _____ C:\Users\Admin\Downloads\Mount.and.Blade.With.Fire.and.Sword-SKIDROW.torrent
2015-08-06 12:28 - 2015-08-19 20:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikace Chrome
2015-08-05 21:10 - 2015-08-29 09:15 - 00000998 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-05 21:10 - 2015-08-05 21:10 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-05 20:18 - 2015-07-12 20:12 - 00000841 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-08-05 20:16 - 2015-08-05 20:16 - 00003148 _____ C:\Windows\System32\Tasks\{AC96AB1F-438D-47D1-9BC2-16F547003F67}
2015-08-05 20:08 - 2015-08-05 20:08 - 00037790 _____ C:\Users\Admin\Downloads\Outcast.srt
2015-08-05 20:07 - 2015-08-28 19:52 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft Visual
2015-08-05 14:34 - 2015-08-21 10:11 - 00000000 ____D C:\Users\Admin\Downloads\Outcast (2014)
2015-08-05 14:34 - 2015-08-05 14:34 - 00008363 _____ C:\Users\Admin\Downloads\Outcast+%282014%29+720p+BrRip+x264+-+YIFY.torrent
2015-08-05 14:29 - 2015-08-05 14:29 - 00012027 _____ C:\Users\Admin\Downloads\FF8A98F88E57EDC1533D1FB860DE8C23834BF416.torrent
2015-08-05 14:25 - 2015-08-05 14:25 - 00012255 _____ C:\Users\Admin\Downloads\[limetorrents.cc]Sniper.Elite.Nazi.Zombie.Army.Repack.torrent
2015-08-05 12:34 - 2015-08-05 12:34 - 00000000 ___HD C:\Users\Admin\Downloads\.ptmp548701
2015-08-05 10:55 - 2015-08-05 10:55 - 00012391 _____ C:\Users\Admin\Downloads\480FE20CDC1E4825CAD3BC107405F84642E0B43A.torrent
2015-08-05 10:02 - 2015-08-05 10:02 - 00000000 ____D C:\Users\Admin\AppData\Local\Sniper Elite Nazi Zombie Army 2
2015-08-05 10:02 - 2015-08-05 10:02 - 00000000 ____D C:\Users\Admin\AppData\Local\EMU
2015-08-03 09:38 - 2015-08-03 09:38 - 01299570 _____ C:\Users\Admin\Downloads\Akce30%naskolnisortiment.xlsx
2015-08-02 20:24 - 2015-08-02 20:24 - 00929145 _____ () C:\Users\Admin\Downloads\Mount-and-Blade-Warband-Čeština.exe
2015-08-02 20:09 - 2015-08-02 20:09 - 06839355 _____ C:\Users\Admin\Downloads\M&BW_CZfix.zip
2015-08-02 19:45 - 2015-08-20 00:03 - 00000000 ____D C:\Users\Admin\Documents\Mount&Blade Warband Savegames
2015-08-02 19:43 - 2015-08-02 20:53 - 00000000 ____D C:\Users\Admin\Documents\Mount&Blade Warband
2015-08-02 19:43 - 2015-08-02 19:44 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mount&Blade Warband
2015-08-02 19:43 - 2015-08-02 19:43 - 00000000 ____D C:\ProgramData\SkidRow
2015-08-02 19:17 - 2015-08-02 19:17 - 00000000 ____D C:\Program Files (x86)\TaleWorlds Entertainment
2015-08-02 18:21 - 2015-08-02 18:21 - 00055216 _____ C:\Users\Admin\Downloads\Mount_and_Blade_Warband_Viking_Conquest_Reforged_Edition-SKIDROW.torrent
2015-08-02 15:09 - 2015-08-02 15:09 - 00016686 _____ C:\Users\Admin\Downloads\Mad_Max_Fury_Road_[2015]_720p_HDRip_x264_Triple_Audio_[Eng_+Hindi_+_Tamil]...Hon3y.torrent
2015-08-02 15:05 - 2015-08-02 15:05 - 00069832 _____ C:\Users\Admin\Downloads\The-Maze-Runner(0000246401).srt
2015-08-02 15:01 - 2015-08-02 15:01 - 00017601 _____ C:\Users\Admin\Downloads\The_Maze_Runner_(2014)_1080p_BrRip_x264_-_YIFY.torrent
2015-08-02 13:57 - 2015-08-02 13:57 - 00000000 ___HD C:\Users\Admin\Downloads\.ptmp268061
2015-08-02 13:37 - 2015-08-02 13:38 - 00000000 ___HD C:\Users\Admin\Downloads\.ptmp352026
2015-08-02 13:36 - 2015-08-02 13:36 - 03444973 _____ C:\Users\Admin\Downloads\Sniper Elite Nazi Zombie Army - HDxDaniel.rar

bobsch2
Level 1.5
Level 1.5
Příspěvky: 106
Registrován: prosinec 09
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod bobsch2 » 01 zář 2015 20:19

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-01 19:25 - 2013-05-19 12:12 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-01 19:12 - 2014-04-11 12:37 - 00000000 ____D C:\Users\Admin\Downloads\TORRENTS
2015-09-01 19:11 - 2013-06-27 16:46 - 00000000 ____D C:\Users\Admin\AppData\Roaming\uTorrent
2015-09-01 18:45 - 2015-02-26 16:17 - 00000000 ____D C:\Users\Admin\Desktop\HM Studio
2015-09-01 18:30 - 2012-07-11 09:43 - 00000000 ____D C:\Users\Admin\Documents\Soubory aplikace Outlook
2015-09-01 15:29 - 2009-07-14 06:45 - 00026336 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-01 15:29 - 2009-07-14 06:45 - 00026336 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-01 15:25 - 2012-07-12 20:13 - 00003962 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{B823CCB9-493E-4AF3-8B45-FBC31DE7423E}
2015-09-01 15:22 - 2014-02-08 20:53 - 00000095 _____ C:\Users\Admin\.accessibility.properties
2015-09-01 15:22 - 2013-06-28 18:21 - 00000000 ____D C:\Users\Admin\AppData\Roaming\OnTranslator
2015-09-01 15:22 - 2012-10-07 08:52 - 00000493 _____ C:\Windows\Brownie.ini
2015-09-01 15:22 - 2012-07-10 16:19 - 00000000 ____D C:\Users\Admin
2015-09-01 15:20 - 2012-09-02 21:16 - 00000000 ____D C:\ProgramData\NVIDIA
2015-09-01 15:20 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-31 11:06 - 2011-04-12 11:04 - 00672138 _____ C:\Windows\system32\perfh005.dat
2015-08-31 11:06 - 2011-04-12 11:04 - 00142826 _____ C:\Windows\system32\perfc005.dat
2015-08-31 11:06 - 2009-07-14 07:13 - 01593220 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-30 20:30 - 2012-06-16 19:50 - 00000423 _____ C:\Windows\BRWMARK.INI
2015-08-30 19:53 - 2012-07-10 18:33 - 00000000 ____D C:\Users\Admin\Desktop\Hry
2015-08-30 16:44 - 2015-07-05 18:16 - 00000000 __RHD C:\MSOCache
2015-08-30 16:00 - 2013-12-02 18:21 - 00000000 ____D C:\Users\Admin\záloha registrů
2015-08-30 15:58 - 2013-07-13 20:50 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Media Player Classic
2015-08-30 15:58 - 2013-06-28 19:18 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
2015-08-30 15:58 - 2012-07-12 18:14 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DAEMON Tools Lite
2015-08-30 15:50 - 2012-11-15 19:33 - 00000000 ____D C:\Windows\erdnt
2015-08-30 14:29 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-08-30 11:08 - 2015-05-03 16:32 - 00000000 ___HD C:\Users\Admin\Desktop\.ptmp75647
2015-08-29 12:06 - 2014-04-11 14:34 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-29 12:00 - 2015-07-06 23:20 - 00000468 _____ C:\Windows\Tasks\InstallShield Update Task.job
2015-08-29 09:15 - 2015-05-02 10:38 - 00001040 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-08-29 09:15 - 2015-05-02 10:14 - 00001378 _____ C:\Users\Arnochtomag\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-28 21:54 - 2014-05-06 13:24 - 01170432 ____N C:\Windows\SysWOW64\dvttrn.dll
2015-08-27 23:58 - 2013-12-21 14:28 - 00000000 ____D C:\Program Files\Enigma Software Group
2015-08-27 19:26 - 2012-07-11 13:34 - 00000000 ____D C:\Users\Admin\Desktop\Správa PC
2015-08-27 18:34 - 2009-07-14 04:34 - 22544384 _____ C:\Windows\system32\config\system.bak
2015-08-27 18:34 - 2009-07-14 04:34 - 106299392 _____ C:\Windows\system32\config\software.bak
2015-08-27 18:34 - 2009-07-14 04:34 - 00348160 _____ C:\Windows\system32\config\default.bak
2015-08-27 18:34 - 2009-07-14 04:34 - 00102400 _____ C:\Windows\system32\config\sam.bak
2015-08-27 18:34 - 2009-07-14 04:34 - 00032768 _____ C:\Windows\system32\config\security.bak
2015-08-27 18:32 - 2014-02-06 18:20 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-08-26 21:24 - 2014-02-09 14:40 - 00000000 ____D C:\AdwCleaner
2015-08-26 14:23 - 2013-07-12 10:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Seznam.cz
2015-08-26 13:40 - 2014-04-11 14:34 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-08-26 12:48 - 2009-07-14 07:37 - 00000000 ____D C:\Windows\DigitalLocker
2015-08-26 11:06 - 2014-06-07 20:31 - 00000000 ____D C:\Users\Admin\Desktop\Renka
2015-08-26 11:05 - 2011-10-28 12:02 - 00000000 ___RD C:\Users\Admin\Documents\ROBERT-DOKUMENTY
2015-08-25 14:32 - 2012-12-16 00:30 - 00000000 ____D C:\Program Files\Game
2015-08-25 09:22 - 2012-11-18 14:17 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Vso
2015-08-25 09:14 - 2011-04-12 11:10 - 00000000 ____D C:\Windows\RemotePackages
2015-08-25 09:11 - 2013-06-28 18:21 - 00000000 ____D C:\Program Files (x86)\OnTranslator.com
2015-08-25 08:30 - 2015-07-01 20:44 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-08-24 17:31 - 2013-05-19 12:12 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-24 17:31 - 2013-05-19 12:12 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-24 17:31 - 2013-05-19 12:12 - 00003852 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-24 17:13 - 2012-09-13 20:34 - 00000000 ____D C:\Users\Admin\AppData\Local\Chromium
2015-08-24 17:05 - 2013-07-13 19:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-24 16:57 - 2014-04-22 15:25 - 00000000 ____D C:\Program Files (x86)\2K Games
2015-08-24 15:11 - 2015-05-27 21:51 - 00000000 ____D C:\Users\Admin\Downloads\[FileTracker.pl]Miasto 44 1,4gb[wilu75]
2015-08-24 15:11 - 2015-05-08 21:00 - 00000000 ____D C:\Users\Admin\Downloads\Dark.Souls.Prepare.to.Die.Edition - RELOADED
2015-08-24 15:11 - 2015-03-05 22:25 - 00000000 ____D C:\Users\Admin\Downloads\The Imitation Game (2014) [1080p]
2015-08-24 12:28 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-08-23 19:55 - 2015-05-02 08:45 - 00000000 ____D C:\Users\Admin\AppData\Roaming\PeaZip
2015-08-23 19:53 - 2012-11-18 14:17 - 00001057 _____ C:\Users\Admin\AppData\Roaming\vso_ts_preview.xml
2015-08-23 12:56 - 2000-05-22 14:58 - 00608448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\COMCTL32.OCX
2015-08-22 10:08 - 2014-04-12 23:17 - 00000000 ____D C:\Users\Admin\Desktop\plocha
2015-08-22 01:47 - 2013-09-24 21:33 - 00000000 ____D C:\games
2015-08-22 01:42 - 2014-07-27 17:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-08-22 01:42 - 2012-09-03 14:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-08-21 11:50 - 2014-07-27 17:18 - 00005253 _____ C:\Users\Admin\Documents\gog_eula.txt
2015-08-21 10:23 - 2013-06-28 18:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OnTranslator
2015-08-21 10:17 - 2015-07-06 20:30 - 00000000 ____D C:\Program Files (x86)\IObit
2015-08-21 10:11 - 2012-07-10 18:25 - 00000000 ____D C:\Users\Admin\Documents\Lauvsnes
2015-08-21 10:09 - 2014-07-26 22:12 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DAEMON Tools Pro
2015-08-21 10:09 - 2013-06-18 16:22 - 00000000 ____D C:\ProgramData\VSO
2015-08-21 10:09 - 2012-07-18 17:45 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype
2015-08-21 09:17 - 2012-07-10 16:54 - 00000000 ____D C:\Windows\Panther
2015-08-21 09:14 - 2015-07-06 20:30 - 00000000 ____D C:\ProgramData\IObit
2015-08-21 09:14 - 2015-07-06 20:29 - 00000000 ____D C:\Users\Admin\AppData\Roaming\IObit
2015-08-20 20:15 - 2012-07-11 13:21 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-08-20 20:14 - 2012-09-02 21:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-08-20 20:09 - 2012-07-11 13:21 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-08-20 12:33 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-08-20 09:43 - 2014-12-12 13:41 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-20 09:43 - 2014-05-07 19:19 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-20 03:18 - 2012-07-11 08:36 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-08-20 03:12 - 2009-07-14 04:34 - 00000627 _____ C:\Windows\win.ini
2015-08-20 03:10 - 2014-02-12 20:08 - 00000000 ____D C:\Windows\system32\MRT
2015-08-20 02:55 - 2012-07-11 13:07 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-19 23:17 - 2014-08-02 20:12 - 00298032 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2015-08-19 23:17 - 2012-08-07 17:09 - 00298032 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2015-08-19 22:47 - 2014-07-27 21:43 - 00298032 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2015-08-19 22:34 - 2013-10-10 13:01 - 00000000 ____D C:\Windows\SysWOW64\directx
2015-08-19 20:41 - 2015-05-02 10:14 - 00000000 ____D C:\Users\Arnochtomag
2015-08-19 20:41 - 2013-11-17 19:14 - 00000000 ____D C:\Users\Public\CyberLink
2015-08-19 20:41 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-08-19 19:52 - 2012-09-02 21:17 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-08-18 01:30 - 2014-07-30 22:51 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-08-18 01:30 - 2013-12-24 17:04 - 01423120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-08-18 01:29 - 2014-07-30 22:51 - 01756608 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-08-18 01:29 - 2013-12-24 17:04 - 01710568 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-08-11 06:52 - 2014-07-30 22:46 - 00072504 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2015-08-08 23:33 - 2014-04-22 22:39 - 00000000 ____D C:\Windows\Minidump
2015-08-07 13:06 - 2015-02-19 11:18 - 12513288 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-08-07 13:06 - 2015-02-19 11:18 - 03106384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-08-07 13:06 - 2012-10-10 22:23 - 17124832 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-08-07 13:06 - 2012-10-10 22:23 - 03518248 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-08-07 06:34 - 2012-11-18 02:29 - 02558768 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-08-07 06:34 - 2012-09-02 21:16 - 06883448 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-08-07 06:34 - 2012-09-02 21:16 - 03492144 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-08-07 06:34 - 2012-09-02 21:16 - 00937592 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-08-07 06:34 - 2012-09-02 21:16 - 00385328 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-08-07 06:34 - 2012-09-02 21:16 - 00062768 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-08-06 12:03 - 2015-07-08 21:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-08-05 23:16 - 2009-07-14 07:08 - 00032634 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-08-05 21:03 - 2015-07-06 18:56 - 00000000 ____D C:\ppsfile
2015-08-05 20:18 - 2014-09-07 14:42 - 00000000 ____D C:\Program Files (x86)\Activision Value
2015-08-03 12:12 - 2015-02-19 11:20 - 05133709 _____ C:\Windows\system32\nvcoproc.bin
2015-08-02 12:48 - 2015-08-01 21:42 - 00000000 ____D C:\Users\Admin\AppData\Local\Sniper Elite Nazi Zombie Army

==================== Files in the root of some directories =======

2015-01-29 16:08 - 2010-03-11 11:55 - 0001056 _____ () C:\Program Files\RisenPatch_Changelog.txt
2015-05-03 16:32 - 2015-05-03 16:32 - 0008182 _____ () C:\Users\Admin\AppData\Roaming\mshvpltu.dat
2015-05-03 16:32 - 2015-07-05 09:06 - 0000030 _____ () C:\Users\Admin\AppData\Roaming\mspxgj.dat
2012-11-18 14:17 - 2015-08-23 19:53 - 0001057 _____ () C:\Users\Admin\AppData\Roaming\vso_ts_preview.xml
2014-02-22 22:22 - 2014-02-22 22:22 - 0000600 _____ () C:\Users\Admin\AppData\Roaming\winscp.rnd
2012-07-13 14:54 - 2014-02-08 15:58 - 0038912 _____ () C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-12-10 22:34 - 2014-12-10 22:34 - 0002742 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel
2014-07-29 23:28 - 2014-07-29 23:32 - 0007612 _____ () C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
2015-08-24 16:57 - 2015-08-24 16:57 - 0000187 _____ () C:\Users\Admin\AppData\Local\Scot-lane.exe.config
2013-10-27 16:20 - 2014-01-19 00:30 - 0001120 _____ () C:\Users\Admin\AppData\Local\SRDownloader (1).nast
2012-07-13 18:22 - 2014-02-15 21:09 - 0001360 _____ () C:\Users\Admin\AppData\Local\SRDownloader.nast
2012-07-18 17:55 - 2012-07-18 17:55 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

Files to move or delete:
====================
C:\Users\Downloads\esetsmartinstaller_csy.exe
C:\Users\Downloads\FreeYouTubeDownload.exe
C:\Users\Downloads\GoogleChromePortable_29.0.1547.76_online.paf.exe
C:\Users\Downloads\IE10-Windows6.1-x64-cs-cz.exe
C:\Users\Downloads\IE9-Windows7-x64-csy.exe
C:\Users\Downloads\install_flashplayer11x32_mssa_aih.exe
C:\Users\Downloads\jxpiinstall.exe
C:\Users\Downloads\MicrosoftFixit-portable.exe


Some files in TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\mswhyu.exe
C:\Users\Admin\AppData\Local\Temp\NOSEventMessages.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-09-01 15:47

==================== End of FRST.txt ============================

bobsch2
Level 1.5
Level 1.5
Příspěvky: 106
Registrován: prosinec 09
Pohlaví: Muž
Stav:
Offline

Re: Rising Antivirus

Příspěvekod bobsch2 » 01 zář 2015 20:19

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-01 19:25 - 2013-05-19 12:12 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-01 19:12 - 2014-04-11 12:37 - 00000000 ____D C:\Users\Admin\Downloads\TORRENTS
2015-09-01 19:11 - 2013-06-27 16:46 - 00000000 ____D C:\Users\Admin\AppData\Roaming\uTorrent
2015-09-01 18:45 - 2015-02-26 16:17 - 00000000 ____D C:\Users\Admin\Desktop\HM Studio
2015-09-01 18:30 - 2012-07-11 09:43 - 00000000 ____D C:\Users\Admin\Documents\Soubory aplikace Outlook
2015-09-01 15:29 - 2009-07-14 06:45 - 00026336 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-01 15:29 - 2009-07-14 06:45 - 00026336 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-01 15:25 - 2012-07-12 20:13 - 00003962 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{B823CCB9-493E-4AF3-8B45-FBC31DE7423E}
2015-09-01 15:22 - 2014-02-08 20:53 - 00000095 _____ C:\Users\Admin\.accessibility.properties
2015-09-01 15:22 - 2013-06-28 18:21 - 00000000 ____D C:\Users\Admin\AppData\Roaming\OnTranslator
2015-09-01 15:22 - 2012-10-07 08:52 - 00000493 _____ C:\Windows\Brownie.ini
2015-09-01 15:22 - 2012-07-10 16:19 - 00000000 ____D C:\Users\Admin
2015-09-01 15:20 - 2012-09-02 21:16 - 00000000 ____D C:\ProgramData\NVIDIA
2015-09-01 15:20 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-31 11:06 - 2011-04-12 11:04 - 00672138 _____ C:\Windows\system32\perfh005.dat
2015-08-31 11:06 - 2011-04-12 11:04 - 00142826 _____ C:\Windows\system32\perfc005.dat
2015-08-31 11:06 - 2009-07-14 07:13 - 01593220 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-30 20:30 - 2012-06-16 19:50 - 00000423 _____ C:\Windows\BRWMARK.INI
2015-08-30 19:53 - 2012-07-10 18:33 - 00000000 ____D C:\Users\Admin\Desktop\Hry
2015-08-30 16:44 - 2015-07-05 18:16 - 00000000 __RHD C:\MSOCache
2015-08-30 16:00 - 2013-12-02 18:21 - 00000000 ____D C:\Users\Admin\záloha registrů
2015-08-30 15:58 - 2013-07-13 20:50 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Media Player Classic
2015-08-30 15:58 - 2013-06-28 19:18 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
2015-08-30 15:58 - 2012-07-12 18:14 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DAEMON Tools Lite
2015-08-30 15:50 - 2012-11-15 19:33 - 00000000 ____D C:\Windows\erdnt
2015-08-30 14:29 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-08-30 11:08 - 2015-05-03 16:32 - 00000000 ___HD C:\Users\Admin\Desktop\.ptmp75647
2015-08-29 12:06 - 2014-04-11 14:34 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-29 12:00 - 2015-07-06 23:20 - 00000468 _____ C:\Windows\Tasks\InstallShield Update Task.job
2015-08-29 09:15 - 2015-05-02 10:38 - 00001040 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-08-29 09:15 - 2015-05-02 10:14 - 00001378 _____ C:\Users\Arnochtomag\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-28 21:54 - 2014-05-06 13:24 - 01170432 ____N C:\Windows\SysWOW64\dvttrn.dll
2015-08-27 23:58 - 2013-12-21 14:28 - 00000000 ____D C:\Program Files\Enigma Software Group
2015-08-27 19:26 - 2012-07-11 13:34 - 00000000 ____D C:\Users\Admin\Desktop\Správa PC
2015-08-27 18:34 - 2009-07-14 04:34 - 22544384 _____ C:\Windows\system32\config\system.bak
2015-08-27 18:34 - 2009-07-14 04:34 - 106299392 _____ C:\Windows\system32\config\software.bak
2015-08-27 18:34 - 2009-07-14 04:34 - 00348160 _____ C:\Windows\system32\config\default.bak
2015-08-27 18:34 - 2009-07-14 04:34 - 00102400 _____ C:\Windows\system32\config\sam.bak
2015-08-27 18:34 - 2009-07-14 04:34 - 00032768 _____ C:\Windows\system32\config\security.bak
2015-08-27 18:32 - 2014-02-06 18:20 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-08-26 21:24 - 2014-02-09 14:40 - 00000000 ____D C:\AdwCleaner
2015-08-26 14:23 - 2013-07-12 10:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Seznam.cz
2015-08-26 13:40 - 2014-04-11 14:34 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-08-26 12:48 - 2009-07-14 07:37 - 00000000 ____D C:\Windows\DigitalLocker
2015-08-26 11:06 - 2014-06-07 20:31 - 00000000 ____D C:\Users\Admin\Desktop\Renka
2015-08-26 11:05 - 2011-10-28 12:02 - 00000000 ___RD C:\Users\Admin\Documents\ROBERT-DOKUMENTY
2015-08-25 14:32 - 2012-12-16 00:30 - 00000000 ____D C:\Program Files\Game
2015-08-25 09:22 - 2012-11-18 14:17 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Vso
2015-08-25 09:14 - 2011-04-12 11:10 - 00000000 ____D C:\Windows\RemotePackages
2015-08-25 09:11 - 2013-06-28 18:21 - 00000000 ____D C:\Program Files (x86)\OnTranslator.com
2015-08-25 08:30 - 2015-07-01 20:44 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-08-24 17:31 - 2013-05-19 12:12 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-24 17:31 - 2013-05-19 12:12 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-24 17:31 - 2013-05-19 12:12 - 00003852 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-24 17:13 - 2012-09-13 20:34 - 00000000 ____D C:\Users\Admin\AppData\Local\Chromium
2015-08-24 17:05 - 2013-07-13 19:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-24 16:57 - 2014-04-22 15:25 - 00000000 ____D C:\Program Files (x86)\2K Games
2015-08-24 15:11 - 2015-05-27 21:51 - 00000000 ____D C:\Users\Admin\Downloads\[FileTracker.pl]Miasto 44 1,4gb[wilu75]
2015-08-24 15:11 - 2015-05-08 21:00 - 00000000 ____D C:\Users\Admin\Downloads\Dark.Souls.Prepare.to.Die.Edition - RELOADED
2015-08-24 15:11 - 2015-03-05 22:25 - 00000000 ____D C:\Users\Admin\Downloads\The Imitation Game (2014) [1080p]
2015-08-24 12:28 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-08-23 19:55 - 2015-05-02 08:45 - 00000000 ____D C:\Users\Admin\AppData\Roaming\PeaZip
2015-08-23 19:53 - 2012-11-18 14:17 - 00001057 _____ C:\Users\Admin\AppData\Roaming\vso_ts_preview.xml
2015-08-23 12:56 - 2000-05-22 14:58 - 00608448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\COMCTL32.OCX
2015-08-22 10:08 - 2014-04-12 23:17 - 00000000 ____D C:\Users\Admin\Desktop\plocha
2015-08-22 01:47 - 2013-09-24 21:33 - 00000000 ____D C:\games
2015-08-22 01:42 - 2014-07-27 17:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2015-08-22 01:42 - 2012-09-03 14:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-08-21 11:50 - 2014-07-27 17:18 - 00005253 _____ C:\Users\Admin\Documents\gog_eula.txt
2015-08-21 10:23 - 2013-06-28 18:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OnTranslator
2015-08-21 10:17 - 2015-07-06 20:30 - 00000000 ____D C:\Program Files (x86)\IObit
2015-08-21 10:11 - 2012-07-10 18:25 - 00000000 ____D C:\Users\Admin\Documents\Lauvsnes
2015-08-21 10:09 - 2014-07-26 22:12 - 00000000 ____D C:\Users\Admin\AppData\Roaming\DAEMON Tools Pro
2015-08-21 10:09 - 2013-06-18 16:22 - 00000000 ____D C:\ProgramData\VSO
2015-08-21 10:09 - 2012-07-18 17:45 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype
2015-08-21 09:17 - 2012-07-10 16:54 - 00000000 ____D C:\Windows\Panther
2015-08-21 09:14 - 2015-07-06 20:30 - 00000000 ____D C:\ProgramData\IObit
2015-08-21 09:14 - 2015-07-06 20:29 - 00000000 ____D C:\Users\Admin\AppData\Roaming\IObit
2015-08-20 20:15 - 2012-07-11 13:21 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-08-20 20:14 - 2012-09-02 21:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-08-20 20:09 - 2012-07-11 13:21 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-08-20 12:33 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-08-20 09:43 - 2014-12-12 13:41 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-20 09:43 - 2014-05-07 19:19 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-20 03:18 - 2012-07-11 08:36 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-08-20 03:12 - 2009-07-14 04:34 - 00000627 _____ C:\Windows\win.ini
2015-08-20 03:10 - 2014-02-12 20:08 - 00000000 ____D C:\Windows\system32\MRT
2015-08-20 02:55 - 2012-07-11 13:07 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-19 23:17 - 2014-08-02 20:12 - 00298032 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2015-08-19 23:17 - 2012-08-07 17:09 - 00298032 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2015-08-19 22:47 - 2014-07-27 21:43 - 00298032 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2015-08-19 22:34 - 2013-10-10 13:01 - 00000000 ____D C:\Windows\SysWOW64\directx
2015-08-19 20:41 - 2015-05-02 10:14 - 00000000 ____D C:\Users\Arnochtomag
2015-08-19 20:41 - 2013-11-17 19:14 - 00000000 ____D C:\Users\Public\CyberLink
2015-08-19 20:41 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-08-19 19:52 - 2012-09-02 21:17 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-08-18 01:30 - 2014-07-30 22:51 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-08-18 01:30 - 2013-12-24 17:04 - 01423120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-08-18 01:29 - 2014-07-30 22:51 - 01756608 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-08-18 01:29 - 2013-12-24 17:04 - 01710568 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-08-11 06:52 - 2014-07-30 22:46 - 00072504 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2015-08-08 23:33 - 2014-04-22 22:39 - 00000000 ____D C:\Windows\Minidump
2015-08-07 13:06 - 2015-02-19 11:18 - 12513288 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-08-07 13:06 - 2015-02-19 11:18 - 03106384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-08-07 13:06 - 2012-10-10 22:23 - 17124832 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-08-07 13:06 - 2012-10-10 22:23 - 03518248 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-08-07 06:34 - 2012-11-18 02:29 - 02558768 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-08-07 06:34 - 2012-09-02 21:16 - 06883448 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-08-07 06:34 - 2012-09-02 21:16 - 03492144 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-08-07 06:34 - 2012-09-02 21:16 - 00937592 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-08-07 06:34 - 2012-09-02 21:16 - 00385328 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-08-07 06:34 - 2012-09-02 21:16 - 00062768 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-08-06 12:03 - 2015-07-08 21:39 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-08-05 23:16 - 2009-07-14 07:08 - 00032634 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-08-05 21:03 - 2015-07-06 18:56 - 00000000 ____D C:\ppsfile
2015-08-05 20:18 - 2014-09-07 14:42 - 00000000 ____D C:\Program Files (x86)\Activision Value
2015-08-03 12:12 - 2015-02-19 11:20 - 05133709 _____ C:\Windows\system32\nvcoproc.bin
2015-08-02 12:48 - 2015-08-01 21:42 - 00000000 ____D C:\Users\Admin\AppData\Local\Sniper Elite Nazi Zombie Army

==================== Files in the root of some directories =======

2015-01-29 16:08 - 2010-03-11 11:55 - 0001056 _____ () C:\Program Files\RisenPatch_Changelog.txt
2015-05-03 16:32 - 2015-05-03 16:32 - 0008182 _____ () C:\Users\Admin\AppData\Roaming\mshvpltu.dat
2015-05-03 16:32 - 2015-07-05 09:06 - 0000030 _____ () C:\Users\Admin\AppData\Roaming\mspxgj.dat
2012-11-18 14:17 - 2015-08-23 19:53 - 0001057 _____ () C:\Users\Admin\AppData\Roaming\vso_ts_preview.xml
2014-02-22 22:22 - 2014-02-22 22:22 - 0000600 _____ () C:\Users\Admin\AppData\Roaming\winscp.rnd
2012-07-13 14:54 - 2014-02-08 15:58 - 0038912 _____ () C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-12-10 22:34 - 2014-12-10 22:34 - 0002742 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel
2014-07-29 23:28 - 2014-07-29 23:32 - 0007612 _____ () C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
2015-08-24 16:57 - 2015-08-24 16:57 - 0000187 _____ () C:\Users\Admin\AppData\Local\Scot-lane.exe.config
2013-10-27 16:20 - 2014-01-19 00:30 - 0001120 _____ () C:\Users\Admin\AppData\Local\SRDownloader (1).nast
2012-07-13 18:22 - 2014-02-15 21:09 - 0001360 _____ () C:\Users\Admin\AppData\Local\SRDownloader.nast
2012-07-18 17:55 - 2012-07-18 17:55 - 0000056 ____H () C:\ProgramData\ezsidmv.dat

Files to move or delete:
====================
C:\Users\Downloads\esetsmartinstaller_csy.exe
C:\Users\Downloads\FreeYouTubeDownload.exe
C:\Users\Downloads\GoogleChromePortable_29.0.1547.76_online.paf.exe
C:\Users\Downloads\IE10-Windows6.1-x64-cs-cz.exe
C:\Users\Downloads\IE9-Windows7-x64-csy.exe
C:\Users\Downloads\install_flashplayer11x32_mssa_aih.exe
C:\Users\Downloads\jxpiinstall.exe
C:\Users\Downloads\MicrosoftFixit-portable.exe


Some files in TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\mswhyu.exe
C:\Users\Admin\AppData\Local\Temp\NOSEventMessages.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-09-01 15:47

==================== End of FRST.txt ============================


Zpět na “HiJackThis”

Kdo je online

Uživatelé prohlížející si toto fórum: Žádní registrovaní uživatelé a 111 hostů