Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 05-12-2016
Ran by ADMIN (administrator) on ENVY (06-12-2016 00:34:54)
Running from C:\Users\ADMIN\Dropbox\Install\forum-viry-cz
Loaded Profiles: ADMIN (Available Profiles: ADMIN)
Platform: Windows 8.1 Pro (Update) (X64) Language: Tchèque (République tchèque)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Promethean) C:\Program Files\Activ Software\ActivDriver\ActivControlsvc.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\55.0.2883.17\remoting_host.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\55.0.2883.17\remoting_host.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Greenshot) C:\Program Files\Greenshot\Greenshot.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
() C:\Program Files\Activ Software\ActivDriver\FlashExtension\flashbridge-wrapper-crossplatform.exe
(Dropbox, Inc.) C:\Users\ADMIN\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Dominik Reichl) C:\Users\ADMIN\Dropbox\KeePass\KeePass.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Ghisler Software GmbH) C:\PRO\totalcmd\TOTALCMD.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\ADMIN\Dropbox\Install\forum-viry-cz\RSITx64.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ActivManager] => C:\Program Files\Activ Software\ActivDriver\ActivMgr.exe [683872 2013-11-22] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508240 2015-08-05] (Adobe Systems Incorporated)
HKLM\...\Run: [Greenshot] => C:\Program Files\Greenshot\Greenshot.exe [540672 2015-04-19] (Greenshot)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrotray.exe [3499920 2014-09-12] (Adobe Systems Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-1367650372-3115982969-2173390595-1001\...\Run: [Dropbox Update] => C:\Users\ADMIN\AppData\Local\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-12] (Dropbox, Inc.)
HKU\S-1-5-21-1367650372-3115982969-2173390595-1001\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-1367650372-3115982969-2173390595-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23819048 2016-11-11] (Google)
HKU\S-1-5-21-1367650372-3115982969-2173390595-1001\...\RunOnce: [Application Restart #1] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1082472 2016-11-08] (Google Inc.)
HKU\S-1-5-21-1367650372-3115982969-2173390595-1001\...\MountPoints2: {fe64b9ab-03cf-11e5-82dc-28924a19be73} - "D:\LG_PC_Programs.exe" 
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-11-11] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-11-11] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-11-11] (Google)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\ADMIN\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-11-28] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\ADMIN\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-11-28] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\ADMIN\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-11-28] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\ADMIN\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-11-28] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\ADMIN\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-11-28] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\ADMIN\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-11-28] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\ADMIN\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-11-28] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\ADMIN\AppData\Roaming\Dropbox\bin\DropboxExt64.3.0.dll [2016-11-28] (Dropbox, Inc.)
Startup: C:\Users\ADMIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2016-12-04]
ShortcutTarget: Dropbox.lnk -> C:\Users\ADMIN\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\ADMIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KeePass.lnk [2015-08-08]
ShortcutTarget: KeePass.lnk -> C:\Users\ADMIN\Dropbox\KeePass\KeePass.exe (Dominik Reichl)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ActivSDK Flash Extension.lnk [2014-05-26]
ShortcutTarget: ActivSDK Flash Extension.lnk -> C:\Windows\Installer\{633EB44A-B19A-409E-8321-78B363553398}\NewShortcut1_08A9BB67B3284FEA9EC29BCD3F863A4A.exe (Flexera Software, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\KeePass.lnk [2014-02-11]
ShortcutTarget: KeePass.lnk -> C:\PRO\KeePass\KeePass.exe (No File)
GroupPolicy: Restriction <======= ATTENTION
GroupPolicy\User: Restriction <======= ATTENTION
GroupPolicyScripts: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

AutoConfigURL: [S-1-5-21-1367650372-3115982969-2173390595-1001] => hxxp://proxyconf.esc-rennes.fr/
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{1579A2DE-D484-43AD-B0B0-459A30435310}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{217F8144-7DFA-4346-8B89-2F678555B909}: [DhcpNameServer] 10.0.0.138
ManualProxies: 0hxxp://proxyconf.esc-rennes.fr/

Internet Explorer:
==================
HKU\S-1-5-21-1367650372-3115982969-2173390595-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-11-20] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-11-20] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-11-20] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-22] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-11-20] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-22] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-1367650372-3115982969-2173390595-1001 -> Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-09-12] (Adobe Systems Incorporated)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-11-20] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-11-20] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-11-20] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-11-20] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 9f4clvbd.default
FF ProfilePath: C:\Users\ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\9f4clvbd.default [2016-11-20]
FF Homepage: Mozilla\Firefox\Profiles\9f4clvbd.default -> about:newtab
FF Extension: (Adblock Plus) - C:\Users\ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\9f4clvbd.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-12]
FF Extension: (DownThemAll!) - C:\Users\ADMIN\AppData\Roaming\Mozilla\Firefox\Profiles\9f4clvbd.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2016-07-24]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: (Adobe Acrobat - Create PDF) - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn [2015-03-09] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-12] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-08-06] (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\Win64Plugin\npAdobeExManDetectX64.dll [2013-12-02] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-12] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-22] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-22] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-11-20] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-11-20] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll [2014-09-12] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-08-06] (Adobe Systems)
FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll [2013-12-02] (Adobe Systems)

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> chrome://blank/
CHR StartupUrls: Default -> "chrome://apps/"
CHR DefaultSearchKeyword: Default -> google.cz___
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.7.796\_platform_specific\win_x64\widevinecdmadapter.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\54.0.2840.99\PepperFlash\pepflashplayer.dll => No File
CHR Profile: C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default [2016-12-06]
CHR Extension: (Magic Actions for YouTube™) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\abjcfabbhafbcdfjoecdgepllmpfceif [2016-11-22]
CHR Extension: (No Name) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\alelhddbbhepgpmgidjdcjakblofbmce [2015-04-28]
CHR Extension: (Google Drive) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (2048) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\clgddkicplcbgjfobecebadodeggpghp [2015-01-09]
CHR Extension: (Recherche Google) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-26]
CHR Extension: (Search by Image (by Google)) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm [2016-10-25]
CHR Extension: (Tampermonkey) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2016-09-22]
CHR Extension: (Dropbox pour Gmail) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpdmhfocilnekecfjgimjdeckachfbec [2015-12-09]
CHR Extension: (Empty New Tab Page) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpjamkmjmigaoobjbekmfgabipmfilij [2016-10-01]
CHR Extension: (Adobe Acrobat) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2016-09-22]
CHR Extension: (Bureau à distance Google Chrome) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2016-07-24]
CHR Extension: (Google Docs hors connexion) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-22]
CHR Extension: (AdBlock) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-12-06]
CHR Extension: (Video Control Extension) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\hicmdpdhcadcekoiogaeocejgcknkpob [2015-12-10]
CHR Extension: (New Tab Redirect) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpgjfneehieebagbmdbhnlpiopdcmna [2015-04-26]
CHR Extension: (Video Downloader [FVD]) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp [2015-05-06]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2016-10-10]
CHR Extension: (SmoothScroll) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\nbokbjkabcmbfdlbddjidfmibcpneigj [2016-12-06]
CHR Extension: (Backspace to go Back) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlffgllnjjkheddehpolbanogdeaogbc [2016-12-04]
CHR Extension: (Paiements via le Chrome Web Store) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Télécharger des vidéos – FVD Downloader) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\nocpfkkbaekckhcoekockfbidpcjgkbd [2015-12-09]
CHR Extension: (Recent Bookmarks) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\olndffocioplakeilhkgenfgdincjlpn [2015-05-01]
CHR Extension: (SpeakIt!) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgeolalilifpodheeocdmbhehgnkkbak [2016-12-06]
CHR Extension: (Gmail) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR Extension: (Chrome Media Router) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-10-25]
CHR Profile: C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Guest Profile [2016-01-30]
CHR Profile: C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Profile 4 [2016-01-30]
CHR Extension: (Google Slides) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-14]
CHR Extension: (Google Docs) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-14]
CHR Extension: (Google Drive) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-14]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-14]
CHR Extension: (YouTube) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-14]
CHR Extension: (Recherche Google) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-14]
CHR Extension: (Google Sheets) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-14]
CHR Extension: (Google Wallet) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-14]
CHR Extension: (Gmail) - C:\Users\ADMIN\AppData\Local\Google\Chrome\User Data\Profile 4\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-14]
CHR HKU\S-1-5-21-1367650372-3115982969-2173390595-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx [2014-09-12]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ActivControl; C:\Program Files\Activ Software\ActivDriver\ActivControlsvc.exe [21864 2013-11-22] (Promethean)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 chromoting; C:\Program Files (x86)\Google\Chrome Remote Desktop\55.0.2883.17\remoting_host.exe [76392 2016-10-16] (Google Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2946304 2016-10-30] (Microsoft Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [319080 2015-01-08] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1069248 2014-02-06] () [File not signed]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
S3 MOSUMAC; C:\Windows\system32\DRIVERS\MOSUMAC.sys [57208 2014-03-26] (ASIX Electronics Corp.)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-09-04] (Intel Corporation)
S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [273040 2012-09-07] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-24] (Synaptics Incorporated)
S3 SmbDrvIntel; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-24] (Synaptics Incorporated)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 cpuz137; \??\C:\Users\ADMIN\AppData\Local\Temp\cpuz137\cpuz137_x64.sys [X]
S3 DUMeterDrv; \??\C:\Program Files (x86)\DU Meter\DUMETR64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-12-06 00:34 - 2016-12-06 00:34 - 00000000 ____D C:\FRST
2016-12-06 00:31 - 2016-12-06 00:34 - 00000000 ____D C:\rsit
2016-12-06 00:31 - 2016-12-06 00:31 - 00000000 ____D C:\Program Files\trend micro
2016-12-06 00:25 - 2016-12-06 00:25 - 00912452 _____ C:\Users\ADMIN\Downloads\rkill (1).zip
2016-12-06 00:24 - 2016-12-06 00:24 - 04656523 _____ C:\Users\ADMIN\Downloads\tdsskiller.zip
2016-12-06 00:24 - 2016-12-06 00:24 - 00912452 _____ C:\Users\ADMIN\Downloads\rkill.zip
2016-12-06 00:21 - 2016-12-06 00:21 - 00000000 ___HD C:\OneDriveTemp
2016-12-05 20:43 - 2016-12-05 20:43 - 104893122 _____ C:\Users\ADMIN\Downloads\drive-download-20161205T194252Z.zip
2016-12-05 20:38 - 2016-12-05 20:39 - 104901806 _____ C:\Users\ADMIN\Downloads\TEST FOLDER.zip
2016-12-05 20:34 - 2016-12-05 20:36 - 104857600 _____ C:\Users\ADMIN\Downloads\100MB-testfile (2).rar
2016-12-05 20:32 - 2016-12-05 20:33 - 104857600 _____ C:\Users\ADMIN\Downloads\100MB-testfile (1).rar
2016-12-05 20:28 - 2016-12-05 20:31 - 104857600 _____ C:\Users\ADMIN\Downloads\100MB-testfile.rar
2016-12-05 19:59 - 2016-12-05 19:59 - 00000000 ____D C:\Users\ADMIN\Downloads\TEST
2016-12-05 19:27 - 2016-12-06 00:21 - 00000000 ___RD C:\Users\ADMIN\OneDrive - CSC Production
2016-12-04 17:17 - 2016-12-04 17:17 - 00010235 _____ C:\Users\ADMIN\Downloads\adresy.xlsx
2016-12-04 13:30 - 2016-12-04 13:30 - 00000000 ____D C:\Users\ADMIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-11-30 11:02 - 2016-11-30 11:02 - 00000000 ____D C:\Users\ADMIN\Dropbox\Documents2\ADMIN-Documents\google-mobile-report
2016-11-30 11:02 - 2016-11-30 10:26 - 00206532 _____ C:\Users\ADMIN\Dropbox\Documents2\ADMIN-Documents\96. oddíl Šipka - Pokřik (8x).pdf
2016-11-29 16:38 - 2016-11-29 16:38 - 00001965 _____ C:\Users\Public\Desktop\@RISK 7.5.lnk
2016-11-29 16:38 - 2016-11-29 16:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palisade DecisionTools
2016-11-29 16:38 - 2016-11-29 16:38 - 00000000 ____D C:\Program Files (x86)\Palisade
2016-11-29 16:36 - 2016-11-29 16:36 - 00000000 ____D C:\Users\ADMIN\AppData\Local\Downloaded Installations
2016-11-29 12:08 - 2016-11-28 20:35 - 00751526 _____ C:\Users\ADMIN\Dropbox\Documents2\ADMIN-Documents\kap6.pdf
2016-11-27 19:23 - 2016-11-27 19:37 - 188604430 _____ C:\Users\ADMIN\Downloads\tabor_2016_2560px.zip
2016-11-22 16:35 - 2016-11-19 21:23 - 00001539 _____ C:\Users\ADMIN\Dropbox\Documents2\ADMIN-Documents\1440p-canvas2560x1440.ini
2016-11-22 16:34 - 2016-11-19 13:00 - 00000000 ____D C:\Users\ADMIN\Dropbox\Documents2\ADMIN-Documents\Soubory aplikace Outlook
2016-11-20 16:44 - 2016-11-20 16:44 - 00000000 ___HT C:\Windows\wusa.lock
2016-11-20 16:44 - 2016-11-20 16:44 - 00000000 ____D C:\6aed83f071292512ab933b
2016-11-12 23:38 - 2016-12-04 13:29 - 00000000 ____D C:\Users\ADMIN\Desktop\What We Do in the Shadows (2014) [1080p]
2016-11-12 23:38 - 2016-10-06 14:29 - 00194030 _____ C:\Users\ADMIN\Desktop\the.little.prince.2015.english-french.720p.bluray.x264.shaanig.ass
2016-11-12 23:38 - 2016-10-02 17:46 - 942637081 _____ C:\Users\ADMIN\Desktop\the.little.prince.2015.english-french.720p.bluray.x264.shaanig..mkv
2016-11-12 21:42 - 2016-11-12 21:42 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2016-11-12 21:42 - 2016-11-12 21:42 - 00000000 ____D C:\Users\Default User\AppData\Local\Google

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-12-06 00:33 - 2015-06-16 06:46 - 00000928 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1367650372-3115982969-2173390595-1001UA.job
2016-12-06 00:30 - 2016-10-10 22:09 - 00000000 ___RD C:\Users\ADMIN\Google Drive
2016-12-06 00:25 - 2014-11-28 08:43 - 00801394 _____ C:\Windows\system32\perfh00C.dat
2016-12-06 00:25 - 2014-11-28 08:43 - 00158846 _____ C:\Windows\system32\perfc00C.dat
2016-12-06 00:25 - 2014-02-09 13:46 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1367650372-3115982969-2173390595-1001
2016-12-06 00:25 - 2014-02-09 13:45 - 02706402 _____ C:\Windows\system32\PerfStringBackup.INI
2016-12-06 00:25 - 2013-08-22 23:08 - 00739924 _____ C:\Windows\system32\perfh005.dat
2016-12-06 00:25 - 2013-08-22 23:08 - 00151610 _____ C:\Windows\system32\perfc005.dat
2016-12-06 00:25 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Inf
2016-12-06 00:21 - 2014-12-06 12:44 - 00000000 ___RD C:\Users\ADMIN\Dropbox
2016-12-06 00:21 - 2014-03-23 13:12 - 00000000 __SHD C:\Users\ADMIN\IntelGraphicsProfiles
2016-12-06 00:21 - 2014-02-09 15:30 - 00000966 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-12-06 00:20 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-12-05 23:53 - 2014-03-19 12:00 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-12-05 23:39 - 2014-02-09 15:30 - 00000970 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-12-05 22:45 - 2015-04-21 23:34 - 00000000 ____D C:\Users\ADMIN\AppData\Local\Adobe
2016-12-05 19:48 - 2014-02-09 13:39 - 00000000 ____D C:\Users\ADMIN\AppData\Local\Packages
2016-12-05 19:27 - 2014-02-09 13:39 - 00000000 ____D C:\Users\ADMIN
2016-12-04 17:33 - 2015-06-16 06:46 - 00000876 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1367650372-3115982969-2173390595-1001Core.job
2016-12-04 17:24 - 2016-10-27 18:49 - 00000000 ____D C:\Users\ADMIN\Downloads\f
2016-12-04 17:24 - 2014-02-09 15:53 - 00000000 ____D C:\Users\ADMIN\AppData\Local\GHISLER
2016-12-04 13:41 - 2016-10-10 22:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2016-12-04 13:30 - 2014-08-02 08:15 - 00000000 ____D C:\Users\ADMIN\AppData\Roaming\Dropbox
2016-11-29 17:28 - 2015-06-16 06:46 - 00003874 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1367650372-3115982969-2173390595-1001UA
2016-11-29 17:28 - 2015-06-16 06:46 - 00003494 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskUserS-1-5-21-1367650372-3115982969-2173390595-1001Core
2016-11-29 16:38 - 2014-04-26 08:26 - 00000000 ____D C:\ProgramData\FLEXnet
2016-11-29 16:37 - 2016-01-14 00:44 - 00000000 ____D C:\ProgramData\Package Cache
2016-11-22 16:40 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-11-22 16:37 - 2013-08-22 16:20 - 00000000 ____D C:\Windows\CbsTemp
2016-11-20 16:45 - 2014-02-09 15:30 - 00002213 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-11-20 16:44 - 2013-08-22 16:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-11-20 16:43 - 2014-02-11 12:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2016-11-20 14:57 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\NDF
2016-11-12 21:44 - 2014-02-09 15:30 - 00000000 ____D C:\Program Files (x86)\Google
2016-11-12 09:53 - 2014-03-19 12:00 - 00003802 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-11-12 09:53 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SysWOW64\Macromed

==================== Files in the root of some directories =======

2015-01-30 16:20 - 2015-01-30 16:20 - 0000132 _____ () C:\Users\ADMIN\AppData\Roaming\Adobe IllExport Filter CS6 Prefs
2015-01-03 14:59 - 2016-09-09 07:26 - 0000132 _____ () C:\Users\ADMIN\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-02-12 12:07 - 2014-02-12 12:07 - 0034180 _____ () C:\Users\ADMIN\AppData\Roaming\backup_AIMP_01.rar
2015-01-30 16:01 - 2016-06-27 23:49 - 0001456 _____ () C:\Users\ADMIN\AppData\Local\Adobe Save for Web 13.0 Prefs
2014-06-30 13:20 - 2014-06-30 13:24 - 0000079 _____ () C:\Users\ADMIN\AppData\Local\CrystalDiskMark30.ini
2014-02-10 01:20 - 2015-08-08 10:10 - 0007600 _____ () C:\Users\ADMIN\AppData\Local\Resmon.ResmonCfg

Some files in TEMP:
====================
C:\Users\ADMIN\AppData\Local\Temp\sfamcc00001.dll
C:\Users\ADMIN\AppData\Local\Temp\sfareca00001.dll


==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-10-25 22:54

==================== End of FRST.txt ============================