Poproím o kontrolu. Možna tam neco je pomaljší PC.

[celeston]

Logfile of random's system information tool 1.09 (written by random/random)
Run by Ondra at 2015-11-30 11:50:37
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 65 GB (63%) free of 103 GB
Total RAM: 8169 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:50:41, on 30.11.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18098)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Windows\vsnpstd3.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Windows\tsnpstd3.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\trend micro\Ondra.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [tsnpstd3] C:\Windows\tsnpstd3.exe
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: TP-LINK Wireless Configuration Utility.lnk = C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel® PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Origin Client Service - Electronic Arts - D:\Origin\OriginClientService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8487 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
winlogon.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE"
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe"
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe" 5d4182fc-c3ac-4295-ae0b-c3d98555ca83
\??\C:\Windows\system32\conhost.exe "-1220735651178248859815795826481481312293176526894410778722859901024611030012288
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe" serviceapp
\??\C:\Windows\system32\conhost.exe "-1325377647-15070625657911633115601764601619117400-2109577626-5874773561311376001
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Windows\vsnpstd3.exe"
"C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE" /tsr
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
"C:\Windows\tsnpstd3.exe"
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\wbem\unsecapp.exe -Embedding
"C:\Windows\system32\GWX\GWX.exe"
C:\Windows\servicing\TrustedInstaller.exe
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
"C:\Users\Ondra\Desktop\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

=========Mozilla firefox=========

ProfilePath - C:\Users\Ondra\AppData\Roaming\Mozilla\Firefox\Profiles\3ik8yj4h.default-1428859787136

prefs.js - "browser.startup.homepage" - "https://www.seznam.cz/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.45.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.45.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-10-10 655480]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-02 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-10-10 559624]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-02 172968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2015-10-12 2655520]
"ShadowPlay"=C:\Windows\system32\nvspcap64.dll [2015-10-12 1710752]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2010-11-19 11613288]
"snpstd3"=C:\Windows\vsnpstd3.exe [2006-09-18 843776]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-02-19 7416088]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-06 6133520]
"tsnpstd3"=C:\Windows\tsnpstd3.exe [2007-06-15 368640]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
TP-LINK Wireless Configuration Utility.lnk - C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe

C:\Users\Ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-26 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\!SASCORE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux1"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-11-30 11:50:37 ----D---- C:\rsit
2015-11-14 15:04:17 ----A---- C:\Windows\SYSWOW64\nvaudcap32v.dll
2015-11-14 15:04:17 ----A---- C:\Windows\system32\drivers\nvvad64v.sys
2015-11-12 17:53:44 ----A---- C:\Windows\system32\win32k.sys
2015-11-10 19:31:32 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2015-11-10 19:31:32 ----A---- C:\Windows\SYSWOW64\wups.dll
2015-11-10 19:31:32 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2015-11-10 19:31:32 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2015-11-10 19:31:32 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2015-11-10 19:31:32 ----A---- C:\Windows\system32\wuwebv.dll
2015-11-10 19:31:32 ----A---- C:\Windows\system32\wups2.dll
2015-11-10 19:31:32 ----A---- C:\Windows\system32\wups.dll
2015-11-10 19:31:32 ----A---- C:\Windows\system32\wudriver.dll
2015-11-10 19:31:32 ----A---- C:\Windows\system32\wucltux.dll
2015-11-10 19:31:32 ----A---- C:\Windows\system32\wuaueng.dll
2015-11-10 19:31:32 ----A---- C:\Windows\system32\wuauclt.exe
2015-11-10 19:31:32 ----A---- C:\Windows\system32\wuapp.exe
2015-11-10 19:31:32 ----A---- C:\Windows\system32\wuapi.dll
2015-11-10 19:31:32 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2015-11-10 19:31:32 ----A---- C:\Windows\system32\WinSetupUI.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\occache.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-11-10 19:26:37 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-11-10 19:26:37 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-11-10 19:26:37 ----A---- C:\Windows\system32\iernonce.dll
2015-11-10 19:26:37 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-11-10 19:26:37 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-11-10 19:26:37 ----A---- C:\Windows\system32\ie4uinit.exe
2015-11-10 19:26:36 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-11-10 19:26:36 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-11-10 19:26:36 ----A---- C:\Windows\SYSWOW64\jscript.dll
2015-11-10 19:26:36 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-11-10 19:26:36 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-11-10 19:26:36 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-11-10 19:26:36 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-11-10 19:26:36 ----A---- C:\Windows\system32\urlmon.dll
2015-11-10 19:26:36 ----A---- C:\Windows\system32\occache.dll
2015-11-10 19:26:36 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-11-10 19:26:36 ----A---- C:\Windows\system32\iedkcs32.dll
2015-11-10 19:26:35 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-11-10 19:26:35 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-11-10 19:26:35 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-11-10 19:26:35 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-11-10 19:26:35 ----A---- C:\Windows\system32\msfeeds.dll
2015-11-10 19:26:35 ----A---- C:\Windows\system32\iesetup.dll
2015-11-10 19:26:35 ----A---- C:\Windows\system32\iertutil.dll
2015-11-10 19:26:35 ----A---- C:\Windows\system32\ieapfltr.dll
2015-11-10 19:26:35 ----A---- C:\Windows\system32\dxtrans.dll
2015-11-10 19:26:34 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-11-10 19:26:34 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2015-11-10 19:26:34 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-11-10 19:26:34 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-11-10 19:26:34 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-11-10 19:26:34 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-11-10 19:26:34 ----A---- C:\Windows\system32\vbscript.dll
2015-11-10 19:26:34 ----A---- C:\Windows\system32\jsproxy.dll
2015-11-10 19:26:34 ----A---- C:\Windows\system32\ieui.dll
2015-11-10 19:26:34 ----A---- C:\Windows\system32\ieframe.dll
2015-11-10 19:26:34 ----A---- C:\Windows\system32\dxtmsft.dll
2015-11-10 19:26:33 ----A---- C:\Windows\system32\wininet.dll
2015-11-10 19:26:33 ----A---- C:\Windows\system32\webcheck.dll
2015-11-10 19:26:33 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-11-10 19:26:33 ----A---- C:\Windows\system32\mshtmled.dll
2015-11-10 19:26:33 ----A---- C:\Windows\system32\jscript9diag.dll
2015-11-10 19:26:33 ----A---- C:\Windows\system32\jscript9.dll
2015-11-10 19:26:33 ----A---- C:\Windows\system32\jscript.dll
2015-11-10 19:26:33 ----A---- C:\Windows\system32\ieUnatt.exe
2015-11-10 19:26:32 ----A---- C:\Windows\system32\msrating.dll
2015-11-10 19:26:32 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-11-10 19:26:32 ----A---- C:\Windows\system32\mshtml.dll
2015-11-10 19:23:49 ----A---- C:\Windows\system32\ntoskrnl.exe
2015-11-10 19:23:48 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-11-10 19:23:48 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-11-10 19:23:48 ----A---- C:\Windows\system32\schannel.dll
2015-11-10 19:23:48 ----A---- C:\Windows\system32\ncrypt.dll
2015-11-10 19:23:48 ----A---- C:\Windows\system32\kerberos.dll
2015-11-10 19:23:47 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2015-11-10 19:23:47 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2015-11-10 19:23:47 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-11-10 19:23:47 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-11-10 19:23:47 ----A---- C:\Windows\system32\drivers\cng.sys
2015-11-10 19:23:46 ----A---- C:\Windows\SYSWOW64\bcryptprimitives.dll
2015-11-10 19:23:46 ----A---- C:\Windows\system32\bcryptprimitives.dll
2015-11-10 19:23:45 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2015-11-10 19:23:45 ----A---- C:\Windows\system32\wow64.dll
2015-11-10 19:23:45 ----A---- C:\Windows\system32\rpcrt4.dll
2015-11-10 19:23:45 ----A---- C:\Windows\system32\ntdll.dll
2015-11-10 19:23:45 ----A---- C:\Windows\system32\lsasrv.dll
2015-11-10 19:23:45 ----A---- C:\Windows\system32\KernelBase.dll
2015-11-10 19:23:45 ----A---- C:\Windows\system32\kernel32.dll
2015-11-10 19:23:45 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-11-10 19:23:45 ----A---- C:\Windows\system32\conhost.exe
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-11-10 19:23:44 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\wow32.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\user.exe
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\srclient.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\setup16.exe
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\instnm.exe
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2015-11-10 19:23:44 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\wow64win.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\wow64cpu.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\winsrv.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\wdigest.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\TSpkg.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\sspisrv.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\sspicli.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\srcore.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\srclient.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\smss.exe
2015-11-10 19:23:44 ----A---- C:\Windows\system32\secur32.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\rstrui.exe
2015-11-10 19:23:44 ----A---- C:\Windows\system32\ntvdm64.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\msv1_0.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\msobjs.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\msaudite.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\lsass.exe
2015-11-10 19:23:44 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2015-11-10 19:23:44 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2015-11-10 19:23:44 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2015-11-10 19:23:44 ----A---- C:\Windows\system32\csrsrv.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\cryptbase.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\credssp.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\auditpol.exe
2015-11-10 19:23:44 ----A---- C:\Windows\system32\apisetschema.dll
2015-11-10 19:23:44 ----A---- C:\Windows\system32\adtschema.dll
2015-11-10 19:23:41 ----A---- C:\Windows\system32\drivers\tdx.sys
2015-11-10 19:23:41 ----A---- C:\Windows\system32\drivers\afd.sys
2015-11-10 19:23:40 ----A---- C:\Windows\SYSWOW64\sdbinst.exe
2015-11-10 19:23:40 ----A---- C:\Windows\SYSWOW64\apphelp.dll
2015-11-10 19:23:40 ----A---- C:\Windows\system32\shimeng.dll
2015-11-10 19:23:40 ----A---- C:\Windows\system32\sdbinst.exe
2015-11-10 19:23:40 ----A---- C:\Windows\system32\apphelp.dll
2015-11-10 19:23:40 ----A---- C:\Windows\system32\aelupsvc.dll
2015-11-10 19:23:39 ----A---- C:\Windows\SYSWOW64\shimeng.dll
2015-11-10 19:23:38 ----A---- C:\Windows\system32\drivers\ndis.sys
2015-11-10 19:23:34 ----A---- C:\Windows\SYSWOW64\InkEd.dll
2015-11-10 19:23:34 ----A---- C:\Windows\system32\InkEd.dll
2015-11-10 19:23:33 ----A---- C:\Windows\system32\jnwmon.dll
2015-11-04 21:42:25 ----D---- C:\Program Files (x86)\Mozilla Firefox

======List of files/folders modified in the last 1 month======

2015-11-30 11:50:41 ----D---- C:\Windows\Prefetch
2015-11-30 11:50:40 ----D---- C:\Program Files\trend micro
2015-11-30 11:34:13 ----D---- C:\Windows\inf
2015-11-30 11:34:12 ----D---- C:\Windows\Temp
2015-11-30 11:34:12 ----D---- C:\Windows
2015-11-30 09:00:09 ----D---- C:\Windows\System32
2015-11-30 09:00:09 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-11-30 08:57:11 ----D---- C:\Windows\system32\config
2015-11-30 08:54:14 ----D---- C:\ProgramData\NVIDIA
2015-11-29 16:23:47 ----D---- C:\ProgramData\Origin
2015-11-29 08:43:51 ----D---- C:\Windows\system32\drivers
2015-11-28 08:58:05 ----SHD---- C:\System Volume Information
2015-11-18 06:11:12 ----A---- C:\Windows\system32\MetaViewer64.dll
2015-11-14 16:57:30 ----D---- C:\Users\Ondra\AppData\Roaming\Skype
2015-11-14 15:04:51 ----D---- C:\ProgramData\NVIDIA Corporation
2015-11-14 15:04:41 ----D---- C:\Windows\system32\DriverStore
2015-11-14 15:04:30 ----D---- C:\Windows\SysWOW64
2015-11-14 15:03:52 ----D---- C:\Windows\LiveKernelReports
2015-11-13 17:35:55 ----D---- C:\Windows\winsxs
2015-11-11 20:25:41 ----D---- C:\Windows\rescache
2015-11-11 19:39:32 ----D---- C:\Windows\debug
2015-11-11 19:10:54 ----D---- C:\Windows\Microsoft.NET
2015-11-11 19:08:25 ----RSD---- C:\Windows\assembly
2015-11-11 19:01:03 ----D---- C:\Windows\SYSWOW64\cs-CZ
2015-11-11 19:01:01 ----D---- C:\Windows\system32\cs-CZ
2015-11-11 19:01:00 ----D---- C:\Windows\SYSWOW64\en-US
2015-11-11 19:01:00 ----D---- C:\Windows\system32\en-US
2015-11-11 19:01:00 ----D---- C:\Program Files\Internet Explorer
2015-11-11 19:00:58 ----D---- C:\Program Files (x86)\Internet Explorer
2015-11-11 19:00:55 ----D---- C:\Windows\AppPatch
2015-11-11 19:00:53 ----D---- C:\Windows\system32\migration
2015-11-10 21:23:49 ----D---- C:\Windows\system32\MRT
2015-11-10 21:22:03 ----A---- C:\Windows\system32\MRT.exe
2015-11-10 21:21:15 ----SHD---- C:\Windows\Installer
2015-11-10 21:17:55 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2015-11-10 21:16:53 ----D---- C:\Program Files\Windows Journal
2015-11-10 21:16:37 ----D---- C:\Windows\system32\catroot2
2015-11-10 19:30:07 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2015-11-07 15:41:04 ----D---- C:\Windows\system32\Tasks
2015-11-07 15:16:00 ----D---- C:\Program Files (x86)\Rockstar Games
2015-11-07 15:15:54 ----D---- C:\Program Files\Rockstar Games
2015-11-05 18:03:46 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2015-11-05 06:02:12 ----RD---- C:\Program Files (x86)

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2015-10-10 65224]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2015-10-10 274808]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2015-10-10 93528]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2015-11-06 1059656]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2015-11-06 449992]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2015-10-10 28656]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2015-10-10 90968]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2015-10-10 153744]
R3 asmthub3;ASMedia USB3 Hub Service; C:\Windows\system32\DRIVERS\asmthub3.sys [2010-12-08 122856]
R3 asmtxhci;ASMEDIA XHCI Service; C:\Windows\system32\DRIVERS\asmtxhci.sys [2010-12-08 369640]
R3 athur;Wireless Network Adapter Service; C:\Windows\system32\DRIVERS\athurx.sys [2012-10-18 1930240]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2010-09-21 313520]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2010-11-23 2565736]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2015-03-13 195728]
R3 NvStreamKms;NvStreamKms; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2015-10-12 20768]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad64v.sys [2015-08-11 50472]
R3 SNPSTD3;USB PC Camera (SNPSTD3); C:\Windows\system32\DRIVERS\snpstd3.sys [2007-05-02 10503168]
R3 WDC_SAM;WD SCSI Pass Thru driver; C:\Windows\system32\DRIVERS\wdcsam64.sys [2015-03-11 14464]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 !SASCORE;SAS Core Service; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2014-07-23 172344]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-10-10 146600]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 GfExperienceService;NVIDIA GeForce Experience Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2015-10-12 1156384]
R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2010-08-12 133800]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2015-10-12 1873696]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2015-10-12 5568288]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2015-03-13 935056]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2015-03-13 410768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31 144200]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-11-10 269000]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-10-31 114688]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-26 65824]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2015-11-04 147624]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 Origin Client Service;Origin Client Service; D:\Origin\OriginClientService.exe [2015-11-12 2099720]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2015-04-14 836288]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2015-04-13 1255736]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]

-----------------EOF-----------------

[Roli]

Zdravím, smaž nepotřebné soubory

pomocí CCleaneru

návod :

Čistič - tady vyčistíš PC od nepotřebných souborů a vysypeš Koš

Registry - tady vyčistíš registry (před použitím doporučuji udělat jejich zálohu kterou CCleaner nabízí)

čištění registru je třeba několikrát zopakovat !

Nástroje - tady lze odinstalovat programy, upravit co se spustí po Startu systému a obnovit systém


Stáhni a ulož na plochu AdwCleaner,

ukonči všechny programy včetně prohlížeče a dvojklikem jej spusť,

objeví se okno kde vlevo nahoře klikni na Scan.

Po dokončení skenu klikni na Clean,

proběhne restart PC kdy dojde ke smazání nepořádku.

Po té mi sem zkopíruj Report.


Nakonec použij Mbam z mého popdisu a dej mi sem z něj log po smazání.

[celeston]

# AdwCleaner v5.023 - Logfile created 30/11/2015 at 19:56:15
# Updated 30/11/2015 by Xplode
# Database : 2015-11-30.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Ondra - ONDRA-PC
# Running from : C:\Users\Ondra\Desktop\adwcleaner_5.023.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [680 bytes] ##########

[celeston]

Scan Mbank jsem udělal,ale report mi žádnej nevyskočil.

[Roli]

Scan Mbank jsem udělal,ale report mi žádnej nevyskočil.

Nevadí, hlavně že uklidil.


Stáhni a ulož na plochu ComboFix,

spusť aplikaci jako Administrátor a povol instalaci Konzole pro zotavení - Recovery Console.

Poté se zobrazí okno s licenčními podmínkami které potvrdíš kliknutím na ANO,

pak ještě jednou klik na ANO a už to jede.

Celá akce trvá okolo 10 minut ale může i déle, během skenu se nepokoušej spouštět nic jiného.

Při skenovaní může být PC i restartováno nelekat se.

Upozornění: po dobu skenu vypni rezidentní štít Antiviru a AntiSpy programu,

protože Combofix se pokouší napadené soubory smazat a tyto programy mu můžou bránit.

Po dokončení skenu nebo následném restartu aplikace vytvoří log, uložený na C:/Combofix.txt

(při opakovaném použití jsou logy číslovány Combofix2.txt atd.), jeho obsah zkopíruj sem.


V případě nejasností je ZDE obrázkový návod.

[celeston]

ComboFix 15-11-30.01 - Ondra 01.12.2015 17:56:50.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8169.6080 [GMT 1:00]
Spuštěný z: c:\users\Ondra\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Vytvořen nový Bod Obnovení
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-11-01 do 2015-12-01 )))))))))))))))))))))))))))))))
.
.
2015-12-01 16:59 . 2015-12-01 16:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-11-30 19:03 . 2015-12-01 16:46 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-11-30 19:02 . 2015-11-30 19:03 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2015-11-30 19:02 . 2015-10-05 08:50 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-11-30 19:02 . 2015-10-05 08:50 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-11-30 19:01 . 2015-11-30 19:03 -------- d-----w- c:\users\Ondra\AppData\Roaming\Malwarebytes
2015-11-30 19:01 . 2015-11-30 19:02 -------- d-----w- c:\programdata\Malwarebytes
2015-11-30 19:01 . 2015-10-05 08:50 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-11-30 19:01 . 2015-11-30 19:02 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2015-11-30 18:55 . 2015-11-30 18:56 -------- d-----w- C:\AdwCleaner
2015-11-14 14:04 . 2015-08-11 04:52 69416 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2015-11-14 14:04 . 2015-08-11 04:52 50472 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2015-11-12 16:53 . 2015-11-03 17:55 3211264 ----a-w- c:\windows\system32\win32k.sys
2015-11-10 18:23 . 2015-10-20 01:12 5570496 ----a-w- c:\windows\system32\ntoskrnl.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-11-18 05:11 . 2015-04-12 17:35 6361488 ----a-w- c:\windows\system32\MetaViewer64.dll
2015-11-10 20:22 . 2015-04-13 06:46 145617392 ----a-w- c:\windows\system32\MRT.exe
2015-11-10 18:30 . 2015-04-13 10:51 780488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-11-10 18:30 . 2015-04-13 10:51 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-11-06 17:02 . 2015-04-12 17:03 449992 ----a-w- c:\windows\system32\drivers\aswsp.sys
2015-11-06 17:02 . 2015-04-12 17:03 1059656 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2015-10-29 17:50 . 2015-11-10 18:23 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2015-10-29 17:50 . 2015-11-10 18:23 309248 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2015-10-29 17:50 . 2015-11-10 18:23 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2015-10-29 17:50 . 2015-11-10 18:23 103424 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2015-10-29 17:49 . 2015-11-10 18:23 562176 ----a-w- c:\windows\apppatch\AcLayers.dll
2015-10-29 17:49 . 2015-11-10 18:23 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2015-10-29 17:49 . 2015-11-10 18:23 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll
2015-10-29 17:49 . 2015-11-10 18:23 211968 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2015-10-29 17:39 . 2015-11-10 18:23 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2015-10-20 01:05 . 2015-11-10 18:23 344064 ----a-w- c:\windows\system32\schannel.dll
2015-10-20 00:45 . 2015-11-10 18:23 251392 ----a-w- c:\windows\SysWow64\schannel.dll
2015-10-20 00:45 . 2015-11-10 18:23 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2015-10-13 00:29 . 2015-10-13 00:29 875720 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2015-10-13 00:22 . 2015-10-13 00:22 869568 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2015-10-12 03:05 . 2015-04-12 15:23 1423304 ----a-w- c:\windows\SysWow64\nvspcap.dll
2015-10-12 03:05 . 2015-04-12 15:23 1316000 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2015-10-12 03:04 . 2015-04-12 15:23 1756424 ----a-w- c:\windows\system32\nvspbridge64.dll
2015-10-12 03:04 . 2015-04-12 15:23 1710752 ----a-w- c:\windows\system32\nvspcap64.dll
2015-10-10 07:36 . 2015-10-10 07:36 378880 ----a-w- c:\windows\system32\aswBoot.exe
2015-10-10 07:36 . 2015-04-12 17:03 274808 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-10-10 07:36 . 2015-04-12 17:03 153744 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-10-10 07:36 . 2015-04-12 17:03 90968 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2015-10-10 07:36 . 2015-04-12 17:03 65224 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-10-10 07:36 . 2015-04-12 17:03 28656 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-10-10 07:36 . 2015-04-12 17:03 93528 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-10-10 07:36 . 2015-10-10 07:36 43112 ----a-w- c:\windows\avastSS.scr
2015-10-01 18:06 . 2015-10-14 15:28 692672 ----a-w- c:\windows\system32\winload.efi
2015-10-01 18:04 . 2015-10-14 15:28 616360 ----a-w- c:\windows\system32\winresume.efi
2015-10-01 18:00 . 2015-10-14 15:28 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
2015-10-01 18:00 . 2015-10-14 15:28 59392 ----a-w- c:\windows\system32\appidapi.dll
2015-10-01 18:00 . 2015-10-14 15:28 32768 ----a-w- c:\windows\system32\appidsvc.dll
2015-10-01 18:00 . 2015-10-14 15:28 17920 ----a-w- c:\windows\system32\appidcertstorecheck.exe
2015-10-01 18:00 . 2015-10-14 15:28 147456 ----a-w- c:\windows\system32\appidpolicyconverter.exe
2015-10-01 17:50 . 2015-10-14 15:28 50688 ----a-w- c:\windows\SysWow64\appidapi.dll
2015-10-01 17:00 . 2015-10-14 15:28 61440 ----a-w- c:\windows\system32\drivers\appid.sys
2015-09-18 19:22 . 2015-10-15 14:42 25432 ----a-w- c:\windows\system32\CompatTelRunner.exe
2015-09-18 19:19 . 2015-10-15 14:42 700416 ----a-w- c:\windows\system32\invagent.dll
2015-09-18 19:19 . 2015-10-15 14:42 766464 ----a-w- c:\windows\system32\generaltel.dll
2015-09-18 19:19 . 2015-10-15 14:42 503808 ----a-w- c:\windows\system32\devinv.dll
2015-09-18 19:19 . 2015-10-15 14:42 1291264 ----a-w- c:\windows\system32\appraiser.dll
2015-09-18 19:19 . 2015-10-15 14:42 73216 ----a-w- c:\windows\system32\acmigration.dll
2015-09-18 19:09 . 2015-10-15 14:42 1163776 ----a-w- c:\windows\system32\aeinv.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-02-19 7416088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-11-06 6133520]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-06-15 368640]
.
c:\users\Ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TP-LINK Wireless Configuration Utility.lnk - c:\program files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe -nogui [2015-4-12 846848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Origin Client Service;Origin Client Service;d:\origin\OriginClientService.exe;d:\origin\OriginClientService.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 athur;Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys;c:\windows\SYSNATIVE\DRIVERS\athurx.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - NVSTREAMKMS
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-11-11 18:39 997704 ----a-w- c:\program files (x86)\Google\Chrome\Application\46.0.2490.86\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2015-11-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-13 18:30]
.
2015-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-04-12 16:28]
.
2015-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-04-12 16:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-10-10 07:36 780616 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-10-12 2655520]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2015-10-12 1710752]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-18 843776]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Ondra\AppData\Roaming\Mozilla\Firefox\Profiles\3ik8yj4h.default-1428859787136\
FF - prefs.js: browser.startup.homepage - hxxps://www.seznam.cz/
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Celkový čas: 2015-12-01 18:01:30
ComboFix-quarantined-files.txt 2015-12-01 17:01
.
Před spuštěním: Volných bajtů: 67 430 293 504
Po spuštění: Volných bajtů: 67 138 322 432
.
- - End Of File - - 1215F0FE68038F0EB74EE84C202293D1
A36C5E4F47E84449FF07ED3517B43A31

[Roli]

Mbam nyní odinstaluj.


Pokud jsi tak ještě neučinil, přesuň Combofix na plochu

otevři si Poznámkový blok

do něj zkopíruj skript z následujícího okna:

Kód: Vybrat vše

RegLock::  
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

ulož Tebou vytvořený TXT soubor jako CFScript.txt na plochu,

po uložení uchop vytvořený skript levým myšítkem a přesuň ho nad ikonu Combofixu, kde ho upustíš:



Po aplikaci na Tebe vypadne další log, zkopíruj ho sem

Upozornění : může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou,

v tom případě znovu restartuj a přitom mačkej F8 poté zvol Poslední známou funkční konfiguraci

[celeston]

ComboFix 15-11-30.01 - Ondra 01.12.2015 18:14:02.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.8169.6435 [GMT 1:00]
Spuštěný z: c:\users\Ondra\Desktop\ComboFix.exe
Použité ovládací přepínače :: c:\users\Ondra\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-11-01 do 2015-12-01 )))))))))))))))))))))))))))))))
.
.
2015-12-01 17:16 . 2015-12-01 17:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-11-30 19:01 . 2015-11-30 19:03 -------- d-----w- c:\users\Ondra\AppData\Roaming\Malwarebytes
2015-11-30 19:01 . 2015-11-30 19:02 -------- d-----w- c:\programdata\Malwarebytes
2015-11-30 19:01 . 2015-11-30 19:02 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2015-11-30 18:55 . 2015-11-30 18:56 -------- d-----w- C:\AdwCleaner
2015-11-14 14:04 . 2015-08-11 04:52 69416 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2015-11-14 14:04 . 2015-08-11 04:52 50472 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2015-11-12 16:53 . 2015-11-03 17:55 3211264 ----a-w- c:\windows\system32\win32k.sys
2015-11-10 18:23 . 2015-10-20 01:12 5570496 ----a-w- c:\windows\system32\ntoskrnl.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-11-18 05:11 . 2015-04-12 17:35 6361488 ----a-w- c:\windows\system32\MetaViewer64.dll
2015-11-10 20:22 . 2015-04-13 06:46 145617392 ----a-w- c:\windows\system32\MRT.exe
2015-11-10 18:30 . 2015-04-13 10:51 780488 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-11-10 18:30 . 2015-04-13 10:51 142536 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-11-06 17:02 . 2015-04-12 17:03 449992 ----a-w- c:\windows\system32\drivers\aswsp.sys
2015-11-06 17:02 . 2015-04-12 17:03 1059656 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2015-10-29 17:50 . 2015-11-10 18:23 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2015-10-29 17:50 . 2015-11-10 18:23 309248 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2015-10-29 17:50 . 2015-11-10 18:23 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2015-10-29 17:50 . 2015-11-10 18:23 103424 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2015-10-29 17:49 . 2015-11-10 18:23 562176 ----a-w- c:\windows\apppatch\AcLayers.dll
2015-10-29 17:49 . 2015-11-10 18:23 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2015-10-29 17:49 . 2015-11-10 18:23 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll
2015-10-29 17:49 . 2015-11-10 18:23 211968 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2015-10-29 17:39 . 2015-11-10 18:23 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2015-10-20 01:05 . 2015-11-10 18:23 344064 ----a-w- c:\windows\system32\schannel.dll
2015-10-20 00:45 . 2015-11-10 18:23 251392 ----a-w- c:\windows\SysWow64\schannel.dll
2015-10-20 00:45 . 2015-11-10 18:23 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2015-10-13 00:29 . 2015-10-13 00:29 875720 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2015-10-13 00:22 . 2015-10-13 00:22 869568 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2015-10-12 03:05 . 2015-04-12 15:23 1423304 ----a-w- c:\windows\SysWow64\nvspcap.dll
2015-10-12 03:05 . 2015-04-12 15:23 1316000 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2015-10-12 03:04 . 2015-04-12 15:23 1756424 ----a-w- c:\windows\system32\nvspbridge64.dll
2015-10-12 03:04 . 2015-04-12 15:23 1710752 ----a-w- c:\windows\system32\nvspcap64.dll
2015-10-10 07:36 . 2015-10-10 07:36 378880 ----a-w- c:\windows\system32\aswBoot.exe
2015-10-10 07:36 . 2015-04-12 17:03 274808 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-10-10 07:36 . 2015-04-12 17:03 153744 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-10-10 07:36 . 2015-04-12 17:03 90968 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2015-10-10 07:36 . 2015-04-12 17:03 65224 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-10-10 07:36 . 2015-04-12 17:03 28656 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-10-10 07:36 . 2015-04-12 17:03 93528 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-10-10 07:36 . 2015-10-10 07:36 43112 ----a-w- c:\windows\avastSS.scr
2015-10-01 18:06 . 2015-10-14 15:28 692672 ----a-w- c:\windows\system32\winload.efi
2015-10-01 18:04 . 2015-10-14 15:28 616360 ----a-w- c:\windows\system32\winresume.efi
2015-10-01 18:00 . 2015-10-14 15:28 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
2015-10-01 18:00 . 2015-10-14 15:28 59392 ----a-w- c:\windows\system32\appidapi.dll
2015-10-01 18:00 . 2015-10-14 15:28 32768 ----a-w- c:\windows\system32\appidsvc.dll
2015-10-01 18:00 . 2015-10-14 15:28 17920 ----a-w- c:\windows\system32\appidcertstorecheck.exe
2015-10-01 18:00 . 2015-10-14 15:28 147456 ----a-w- c:\windows\system32\appidpolicyconverter.exe
2015-10-01 17:50 . 2015-10-14 15:28 50688 ----a-w- c:\windows\SysWow64\appidapi.dll
2015-10-01 17:00 . 2015-10-14 15:28 61440 ----a-w- c:\windows\system32\drivers\appid.sys
2015-09-18 19:22 . 2015-10-15 14:42 25432 ----a-w- c:\windows\system32\CompatTelRunner.exe
2015-09-18 19:19 . 2015-10-15 14:42 700416 ----a-w- c:\windows\system32\invagent.dll
2015-09-18 19:19 . 2015-10-15 14:42 766464 ----a-w- c:\windows\system32\generaltel.dll
2015-09-18 19:19 . 2015-10-15 14:42 503808 ----a-w- c:\windows\system32\devinv.dll
2015-09-18 19:19 . 2015-10-15 14:42 1291264 ----a-w- c:\windows\system32\appraiser.dll
2015-09-18 19:19 . 2015-10-15 14:42 73216 ----a-w- c:\windows\system32\acmigration.dll
2015-09-18 19:09 . 2015-10-15 14:42 1163776 ----a-w- c:\windows\system32\aeinv.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-02-19 7416088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-11-06 6133520]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2007-06-15 368640]
.
c:\users\Ondra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Výřezy obrazovky a spuštění aplikace OneNote 2007.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TP-LINK Wireless Configuration Utility.lnk - c:\program files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe -nogui [2015-4-12 846848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Origin Client Service;Origin Client Service;d:\origin\OriginClientService.exe;d:\origin\OriginClientService.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 athur;Wireless Network Adapter Service;c:\windows\system32\DRIVERS\athurx.sys;c:\windows\SYSNATIVE\DRIVERS\athurx.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
.
.
--- Ostatní služby/ovladače v paměti ---
.
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - NVSTREAMKMS
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-11-11 18:39 997704 ----a-w- c:\program files (x86)\Google\Chrome\Application\46.0.2490.86\Installer\chrmstp.exe
.
Obsah adresáře 'Naplánované úlohy'
.
2015-11-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-13 18:30]
.
2015-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-04-12 16:28]
.
2015-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-04-12 16:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-10-10 07:36 780616 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-10-12 2655520]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2015-10-12 1710752]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-18 843776]
.
------- Doplňkový sken -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xportovat do aplikace Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Ondra\AppData\Roaming\Mozilla\Firefox\Profiles\3ik8yj4h.default-1428859787136\
FF - prefs.js: browser.startup.homepage - hxxps://www.seznam.cz/
.
.
Celkový čas: 2015-12-01 18:17:21
ComboFix-quarantined-files.txt 2015-12-01 17:17
ComboFix2.txt 2015-12-01 17:01
.
Před spuštěním: Volných bajtů: 67 118 571 520
Po spuštění: Volných bajtů: 67 060 383 744
.
- - End Of File - - 4DDCE27E3913FFD02A63E2649801BFD5
A36C5E4F47E84449FF07ED3517B43A31

[Roli]

Přes Start >> Spustit zkopíruj do okna:

ComboFix /Uninstall

a stiskni Enter

To odinstaluje ComboFix a smaže s ním související soubory a složky.


Použij T-Cleaner, který smaže případné zbytky po aplikacích které jsme použili.

Jen před jeho stažením a při použití stopni antivir, protože ho muže detekovat jako vir ale není tomu tak.


Pak dej vědět jaký je stav PC.

[celeston]

Snad už lepší.Děkuji moc.

[Roli]

Není zač a