Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

COM Surrogate opět útočí

Moderátor: Moderátoři

Pravidla fóra
Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní: http://forum.viry.cz/viewtopic.php?f=12&t=123975 . Děkujeme za pochopení.
Zpráva
Autor
Felly006
Návštěvník
Návštěvník
Příspěvky: 22
Registrován: 28 lis 2016 12:41

COM Surrogate opět útočí

#1 Příspěvek od Felly006 »

Dobrý den,
nedávno jsem ve vlákně http://forum.viry.cz/viewtopic.php?f=4&t=150690 řešil problémy s COM Surrogate, problém byl vyřešen, ale opět se vrátil + mi v prohlížeči vyskakují různé reklamy.
Můžete prosím ještě jednou poradit a popř. poradit do budoucna, jak se před touto havětí bránit? Děkuji mnohokrát.


Logfile of random's system information tool 1.14 (written by random/random)
Run by Felly at 2017-01-09 10:56:25
Microsoft Windows 10 Pro
System drive C: has 47 GB (21%) free of 228 GB
Total RAM: 8075 MB (68% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:56:26, on 09.01.2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.14393.0000)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\secd.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\WINDOWS\SysWOW64\RunDll32.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
C:\Program Files\trend micro\Felly_RSITx64.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_77\bin\ssv.dll
O2 - BHO: Microsoft OneDrive for Business Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_77\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [OneDrive] "C:\Users\Felly\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [CNAP2 Launcher] C:\WINDOWS\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE
O4 - HKCU\..\Run: [DAEMON Tools Lite Automount] "C:\Program Files\DAEMON Tools Lite\DTAgent.exe" -autorun
O4 - HKCU\..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
O4 - HKCU\..\Run: [AppleIEDAV] C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
O4 - HKCU\..\Run: [iCloudDrive] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
O4 - HKCU\..\Run: [iCloudPhotos] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
O4 - HKCU\..\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
O4 - HKCU\..\RunOnce: [Uninstall C:\Users\Felly\AppData\Local\Microsoft\OneDrive\17.3.6302.0225_1\amd64] C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Felly\AppData\Local\Microsoft\OneDrive\17.3.6302.0225_1\amd64"
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2935431814-3145136583-2795862769-1002\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2935431814-3145136583-2795862769-1002\..\RunOnce: [WAB Migrate] %ProgramFiles%\Windows Mail\wab.exe /Upgrade (User 'UpdatusUser')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files (x86)\Microsoft Office\Root\Office16\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIE.dll
O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll
O9 - Extra 'Tools' menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll
O9 - Extra button: Odeslat do zarízení Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Odeslat do zarízení &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O10 - Broken Internet access because of LSP provider 'c:\program files (x86)\bonjour\mdnsnsp.dll' missing
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{54ff5337-5837-4a74-a662-b689417c71d9}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O20 - AppInit_DLLs: C:\WINDOWS\SysWoW64\nvinit.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: Disc Soft Lite Bus Service - Disc Soft Ltd - C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @oem13.inf,%ibm.svcDesc0%;Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) Identity Protection Technology Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @oem13.inf,%Lenovo.svcDesc1%;Lenovo Platform Service (LPlatSvc) - Unknown owner - C:\WINDOWS\system32\LPlatSvc.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NIHardwareService - Native Instruments GmbH - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\WINDOWS\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001 (Sense) - Unknown owner - C:\Program Files (x86)\Windows Defender Advanced Threat Protection\MsSense.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: SynTPEnh Caller Service (SynTPEnhService) - Synaptics Incorporated - C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: Mobile Broadband Service (WMCoreService) - Ericsson AB - C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 14155 bytes

======Enumerating Processes======

C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-d2ec10fc-26f0-43fb-b86d-06887448ee43 -SystemEventPortName:HostProcess-f1f05151-3150-431d-bb06-a3aa7a609b30 -IoCancelEventPortName:HostProcess-923033ea-4717-44ba-b890-55b8bfef0f03 -NonStateChangingEventPortName:HostProcess-18c6930a-78fb-4b6c-bbaa-262bed2853bc -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:a36a9bc5-d71e-4358-9d8b-c8d06a22acc9 -DeviceGroupId:
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\LPlatSvc.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
"C:\WINDOWS\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k LocalSystemNetworkRestricted
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\WINDOWS\system32\dashost.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe"
C:\WINDOWS\System32\svchost.exe -k utcsvc
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
"C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe"
"C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
C:\WINDOWS\system32\svchost.exe -k imgsvc
"C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe"
"C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe"
C:\WINDOWS\system32\svchost.exe -k appmodel
"C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe" servicemode
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe"
C:\WINDOWS\System32\WinLogon.exe -SpecialSession
C:\WINDOWS\System32\dwm.exe
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\WINDOWS\system32\nvvsvc.exe -session
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
C:\WINDOWS\system32\sihost.exe
C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup
C:\WINDOWS\system32\taskhostw.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\WINDOWS\Explorer.EXE
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe"
"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe"
"C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" -Embedding
"C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe"
"C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe"
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\secd.exe -Embedding
"C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe"
"C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
C:\WINDOWS\System32\fontdrvhost.exe
"C:\WINDOWS\SysWOW64\RunDll32.exe" "C:\Program Files\ThinkPad\Bluetooth Software\SysWOW64\BtMmHook.dll",SetAndWaitBtMmHook
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe" -startup
"C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.145.0_x64__kzf8qxf38zg5c\SkypeHost.exe" -ServerName:SkypeHost.ServerServer
C:\WINDOWS\system32\ApplicationFrameHost.exe -Embedding
"C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.1118.10000.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe" -ServerName:App.AppXzst44mncqdg84v7sv6p7yznqwssy6f7f.mca
C:\WINDOWS\system32\AUDIODG.EXE 0x574
C:\Windows\System32\SystemSettingsBroker.exe -Embedding
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-a703605c-1756-40ee-ba65-c1a22df5a678 -SystemEventPortName:HostProcess-abd18c39-845f-49dc-a941-3432fc4ac878 -IoCancelEventPortName:HostProcess-ce8a3294-9d83-48c2-afc5-123b4f77c93a -NonStateChangingEventPortName:HostProcess-195d305a-b62c-45c1-86c6-bab89de9bb4d -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:c3cca0dd-da9e-4a09-86ba-654384ba7291 -DeviceGroupId:WpdFsGroup
"C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-9d39abb1-6f08-46b3-8e21-122cbea5a2ea -SystemEventPortName:HostProcess-74181d2c-bf72-4f94-8fb6-b35b6713286c -IoCancelEventPortName:HostProcess-1a6c7bc6-b39b-44ca-b36a-5ad502b7ac34 -NonStateChangingEventPortName:HostProcess-e1974838-eba5-44d7-9073-4b7a4b5e5887 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:a3717852-6c31-48c0-91f5-1fa00b635a17 -DeviceGroupId:
"C:\WINDOWS\system32\LPlatSvc.exe" -EM
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe282_ Global\UsGthrCtrlFltPipeMssGthrPipe282 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 624 652 660 8192 656
C:\WINDOWS\system32\DllHost.exe /Processid:{49F6E667-6658-4BD1-9DE9-6AF87F9FAF85}
"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca
C:\Windows\System32\smartscreen.exe -Embedding
"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca
C:\WINDOWS\system32\wbem\wmiprvse.exe
"C:\Users\Felly\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\WINDOWS\tasks\CreateExplorerShellUnelevatedTask.job - C:\WINDOWS\explorer.exe /NOUACCHECK
C:\WINDOWS\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\system32\tasks\avast! Emergency Update - C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
C:\WINDOWS\system32\tasks\CCleanerSkipUAC - "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
C:\WINDOWS\system32\tasks\GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\WINDOWS\system32\tasks\GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\WINDOWS\system32\tasks\Microsoft\XblGameSave\XblGameSaveTask - %windir%\System32\XblGameSaveTask.exe standby
C:\WINDOWS\system32\tasks\Microsoft\XblGameSave\XblGameSaveTaskLogon - %windir%\System32\XblGameSaveTask.exe logon
C:\WINDOWS\system32\tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join - %SystemRoot%\System32\dsregcmd.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start - C:\WINDOWS\system32\sc.exe start wuauserv
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\sih - %systemroot%\System32\sihclient.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\sihboot - %systemroot%\System32\sihclient.exe /boot
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -upload
C:\WINDOWS\system32\tasks\Microsoft\Windows\WCM\WiFiTask - %SystemRoot%\System32\WiFiTask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Maintenance Install - %systemroot%\system32\usoclient.exe StartInstall
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval - %systemroot%\system32\MusNotification.exe Display
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Policy Install - %systemroot%\system32\usoclient.exe StartInstall
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Reboot - %systemroot%\system32\MusNotification.exe Reboot
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Refresh Settings - %systemroot%\system32\usoclient.exe RefreshSettings
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Resume On Boot - %systemroot%\system32\usoclient.exe ResumeUpdate
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan - %systemroot%\system32\usoclient.exe StartScan
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display - C:\windows\system32\MusNotification.exe Display
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot - C:\windows\system32\MusNotification.exe ReadyToReboot
C:\WINDOWS\system32\tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone - %windir%\system32\tzsync.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\WINDOWS\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\srtasks.exe ExecuteScheduledSPPCreation
C:\WINDOWS\system32\tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask - %windir%\system32\rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\Subscription\EnableLicenseAcquisition - %SystemRoot%\system32\UpgradeSubscription.exe -e
C:\WINDOWS\system32\tasks\Microsoft\Windows\Subscription\LicenseAcquisition - %SystemRoot%\system32\UpgradeSubscription.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Optimization - %windir%\system32\defrag.exe -c -h -g -# -m 8 -i 13500
C:\WINDOWS\system32\tasks\Microsoft\Windows\Speech\SpeechModelDownloadTask - %windir%\system32\speech_onecore\common\SpeechModelDownload.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SpacePort\SpaceAgentTask - %windir%\system32\SpaceAgent.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SpacePort\SpaceManagerTask - %windir%\system32\spaceman.exe /Work
C:\WINDOWS\system32\tasks\Microsoft\Windows\Shell\FamilySafetyMonitor - %windir%\System32\wpcmon.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SharedPC\Account Cleanup - %windir%\System32\rundll32.exe %windir%\System32\Windows.SharedPC.AccountManager.dll,StartMaintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\WINDOWS\system32\tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers - %SystemRoot%\System32\drvinst.exe 6
C:\WINDOWS\system32\tasks\Microsoft\Windows\NlaSvc\WiFiTask - %SystemRoot%\System32\WiFiTask.exe nla
C:\WINDOWS\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\WINDOWS\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser - %SystemRoot%\System32\MbaeParserTask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Management\Provisioning\Logon - %windir%\system32\ProvTool.exe /turn 5
C:\WINDOWS\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotificationWindows.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Location\WindowsActionDialog - %windir%\System32\WindowsActionDialog.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClient - %windir%\system32\dmclient.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload - %windir%\system32\dmclient.exe utcwnf
C:\WINDOWS\system32\tasks\Microsoft\Windows\EnterpriseMgmt\MDMMaintenenceTask - %windir%\system32\MDMAgent.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DUSM\dusmtask - %SystemRoot%\System32\dusmtask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskFootprint\Diagnostics - %windir%\system32\disksnapshot.exe -z
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskCleanup\SilentCleanup - %windir%\system32\cleanmgr.exe /autoclean /d %systemdrive%
C:\WINDOWS\system32\tasks\Microsoft\Windows\Device Information\Device - %windir%\system32\devicecensus.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c -h -o -$
C:\WINDOWS\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Clip\License Validation - %SystemRoot%\system32\ClipUp.exe -p -s -o
C:\WINDOWS\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\WINDOWS\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup - %windir%\system32\rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\appuriverifierdaily - %windir%\system32\AppHostRegistrationVerifier.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\appuriverifierinstall - %windir%\system32\AppHostRegistrationVerifier.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState - %windir%\system32\rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup - %windir%\system32\dstokenclean.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattelrunner.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\StartupAppTask - %windir%\system32\rundll32.exe Startupscan.dll,SusRunTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe
C:\WINDOWS\system32\tasks\Microsoft\Office\Office Automatic Updates - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe /update SCHEDULEDTASK displaylevel=False
C:\WINDOWS\system32\tasks\Microsoft\Office\Office ClickToRun Service Monitor - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe /WatchService
C:\WINDOWS\system32\tasks\Microsoft\Office\Office Subscription Maintenance - C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe
C:\WINDOWS\system32\tasks\Apple\AppleSoftwareUpdate - C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe -task

=========Google Chrome=========

C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Extension ahfgeienlihckogmohjhadlkjgocpleb 1 Obchod Chrome 0.2
Extension bepbmhgboaologfdajaanbcjmnhjmhfn 0
Extension cfhdojbkjhnklbpkdaibdccddilifddb 1 Adblock Plus 1.12.4
Extension eemcgdkfndhakfknompkggombfjjjeno 1 Bookmark Manager 0.1
Extension ennkphjdgehloodpbhlhldgbnhmacadg 1 Settings 0.2
Extension gfdkimpbcpahaombhbimeihdjnejgicl 1 Feedback 1.0
Extension gighmmpiobklfepjocnamgkkbiglidom 1 AdBlock 3.8.4
Extension gomekmidlodglbbmalcneegieacbdmki 0 Avast Online Security 12.0.163
Extension jogjmeegdjegaoilmiinaplaljoglcnm 1 Link to file on GD 0.3
Extension kmendfapggjehodndflmmgagdbamhnfd 1 CryptoTokenExtension 0.9.38
Extension mfehgcgbbipciphmccgaenjidiccnmng 1 Cloud Print 0.1
Extension mfffpogegjflfpflabcdkioaeobkgjik 1 GaiaAuthExtension 0.0.1
Extension mgndgikekgjfcpckkfioiadnlibdjbkf 1 Chrome 0.1
Extension mhjfbmdgcfjbbpaeojofohoefgiehjai 1 Chrome PDF Viewer 1
Extension neajdppkdcdipfabeoofebfddakdcjhd 1 Google Network Speech 1.0
Extension nkeimhogjdpnpccoofpliimaahmaaome 1 Google Hangouts 1.3.1
Extension nmmhkkegccagdldgiimedpiccmgmieda 1 Platby Internetového obchodu Chrome 1.0.0.0
Extension pkedcjkdefgpdelpbcmbmeomcjbeemfm 1 Chrome Media Router 5516.1005.0.3
Homepage:
default_search_provider.search_url:
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Preferences
Homepage:
default_search_provider.search_url:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gomekmidlodglbbmalcneegieacbdmki]
"Path"=


======Registry dump======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-12-04 214216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft OneDrive for Business Browser Helper - C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-12-04 2888904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Lync Browser Helper - C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-12-04 151240]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_77\bin\ssv.dll [2016-04-10 462400]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft OneDrive for Business Browser Helper - C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-12-04 1955520]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-04-10 173120]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2016-04-10 183216]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2016-04-10 411056]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2016-04-10 453552]
"nwiz"=C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2016-04-10 2498368]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2016-04-10 1795912]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04 446392]
"CNAP2 Launcher"=C:\WINDOWS\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE [2010-10-14 226784]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2016-12-06 176440]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OneDrive"=C:\Users\Felly\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2016-09-10 554184]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2016-03-11 8686296]
"CNAP2 Launcher"=C:\WINDOWS\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE [2010-10-14 226784]
"DAEMON Tools Lite Automount"=C:\Program Files\DAEMON Tools Lite\DTAgent.exe [2016-08-29 4299968]
"iCloudServices"=C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [2016-11-17 67384]
"AppleIEDAV"=C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [2016-07-09 1084688]
"iCloudDrive"=C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [2016-11-17 110392]
"iCloudPhotos"=C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [2016-11-17 356664]
"ApplePhotoStreams"=C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [2016-11-17 67896]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Uninstall C:\Users\Felly\AppData\Local\Microsoft\OneDrive\17.3.6302.0225_1\amd64"=C:\WINDOWS\system32\cmd.exe [2016-07-16 232960]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2016-11-18 9080768]
"IMSS"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [2013-07-02 113656]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS6ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\Windows\system32\nvinitx.dll, C:\WINDOWS\system32\nvinitx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
igfxdev.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"DSCAutomationHostEnabled"=2
"EnableCursorSuppression"=1
"EnableUIADesktopToggle"=0
"undockwithoutlogon"=1
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"ForceActiveDesktopOn"=0
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
"StubPath"=%SystemRoot%\inf\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"msacm.vorbis"=vorbis.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2016-12-19 18:29:35 ----D---- C:\Program Files\iPod
2016-12-19 18:29:35 ----AD---- C:\Program Files\iTunes
2016-12-17 12:29:13 ----A---- C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2016-12-17 12:29:12 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.dll
2016-12-17 12:29:12 ----A---- C:\WINDOWS\SYSWOW64\mfmp4srcsnk.dll
2016-12-17 12:29:12 ----A---- C:\WINDOWS\SYSWOW64\MFMediaEngine.dll
2016-12-17 12:29:12 ----A---- C:\WINDOWS\SYSWOW64\AppXDeploymentClient.dll
2016-12-17 12:29:12 ----A---- C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-12-17 12:29:12 ----A---- C:\WINDOWS\system32\ole32.dll
2016-12-17 12:29:12 ----A---- C:\WINDOWS\system32\msi.dll
2016-12-17 12:29:12 ----A---- C:\WINDOWS\system32\msdtctm.dll
2016-12-17 12:29:11 ----A---- C:\WINDOWS\SYSWOW64\TextInputFramework.dll
2016-12-17 12:29:11 ----A---- C:\WINDOWS\SYSWOW64\InputService.dll
2016-12-17 12:29:11 ----A---- C:\WINDOWS\SYSWOW64\d3d10warp.dll
2016-12-17 12:29:11 ----A---- C:\WINDOWS\system32\hvloader.exe
2016-12-17 12:29:11 ----A---- C:\WINDOWS\system32\hvix64.exe
2016-12-17 12:29:11 ----A---- C:\WINDOWS\system32\hvax64.exe
2016-12-17 12:29:11 ----A---- C:\WINDOWS\system32\AppXDeploymentClient.dll
2016-12-17 12:29:10 ----A---- C:\WINDOWS\SYSWOW64\WordBreakers.dll
2016-12-17 12:29:10 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Core.TextInput.dll
2016-12-17 12:29:10 ----A---- C:\WINDOWS\SYSWOW64\InputLocaleManager.dll
2016-12-17 12:29:10 ----A---- C:\WINDOWS\SYSWOW64\EditBufferTestHook.dll
2016-12-17 12:29:10 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2016-12-17 12:29:10 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2016-12-17 12:29:09 ----A---- C:\WINDOWS\system32\Windows.Media.dll
2016-12-17 12:29:09 ----A---- C:\WINDOWS\system32\mfmp4srcsnk.dll
2016-12-17 12:29:09 ----A---- C:\WINDOWS\system32\MFMediaEngine.dll
2016-12-17 12:29:09 ----A---- C:\WINDOWS\system32\LicenseManager.dll
2016-12-17 12:29:09 ----A---- C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-12-17 12:29:09 ----A---- C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2016-12-17 12:29:08 ----A---- C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2016-12-17 12:29:08 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2016-12-17 12:29:08 ----A---- C:\WINDOWS\system32\facecredentialprovider.dll
2016-12-17 12:29:08 ----A---- C:\WINDOWS\system32\CoreUIComponents.dll
2016-12-17 12:29:08 ----A---- C:\WINDOWS\system32\aadtb.dll
2016-12-17 12:29:08 ----A---- C:\WINDOWS\system32\aadcloudap.dll
2016-12-17 12:29:06 ----A---- C:\WINDOWS\SYSWOW64\WindowsCodecs.dll
2016-12-17 12:29:06 ----A---- C:\WINDOWS\SYSWOW64\user32.dll
2016-12-17 12:29:05 ----A---- C:\WINDOWS\SYSWOW64\win32k.sys
2016-12-17 12:29:05 ----A---- C:\WINDOWS\SYSWOW64\sspicli.dll
2016-12-17 12:29:05 ----A---- C:\WINDOWS\system32\WordBreakers.dll
2016-12-17 12:29:05 ----A---- C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2016-12-17 12:29:05 ----A---- C:\WINDOWS\system32\TextInputFramework.dll
2016-12-17 12:29:05 ----A---- C:\WINDOWS\system32\InputService.dll
2016-12-17 12:29:05 ----A---- C:\WINDOWS\system32\InputLocaleManager.dll
2016-12-17 12:29:05 ----A---- C:\WINDOWS\system32\EditBufferTestHook.dll
2016-12-17 12:29:04 ----A---- C:\WINDOWS\SYSWOW64\win32kfull.sys
2016-12-17 12:29:04 ----A---- C:\WINDOWS\system32\win32kfull.sys
2016-12-17 12:29:04 ----A---- C:\WINDOWS\system32\win32k.sys
2016-12-17 12:29:04 ----A---- C:\WINDOWS\system32\user32.dll
2016-12-17 12:29:04 ----A---- C:\WINDOWS\system32\ShareHost.dll
2016-12-17 12:29:04 ----A---- C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-12-17 12:29:04 ----A---- C:\WINDOWS\system32\ieframe.dll
2016-12-17 12:29:03 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2016-12-17 12:29:03 ----A---- C:\WINDOWS\system32\cdp.dll
2016-12-17 12:29:01 ----A---- C:\WINDOWS\SYSWOW64\msi.dll
2016-12-17 12:29:01 ----A---- C:\WINDOWS\SYSWOW64\gdi32full.dll
2016-12-17 12:29:01 ----A---- C:\WINDOWS\system32\securekernel.exe
2016-12-17 12:29:01 ----A---- C:\WINDOWS\system32\gdi32full.dll
2016-12-17 12:29:01 ----A---- C:\WINDOWS\system32\CoreMessaging.dll
2016-12-17 12:29:01 ----A---- C:\WINDOWS\system32\CloudExperienceHost.dll
2016-12-17 12:29:00 ----A---- C:\WINDOWS\system32\winresume.exe
2016-12-17 12:29:00 ----A---- C:\WINDOWS\system32\winload.exe
2016-12-17 12:29:00 ----A---- C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-12-17 12:28:59 ----A---- C:\WINDOWS\SYSWOW64\WinTypes.dll
2016-12-17 12:28:59 ----A---- C:\WINDOWS\SYSWOW64\Windows.Media.Protection.PlayReady.dll
2016-12-17 12:28:59 ----A---- C:\WINDOWS\system32\WinTypes.dll
2016-12-17 12:28:59 ----A---- C:\WINDOWS\system32\lsasrv.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Logon.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\SYSWOW64\Windows.Security.Authentication.OnlineId.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\SYSWOW64\wincorlib.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\SYSWOW64\LicenseManager.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\SYSWOW64\CoreMessaging.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\SYSWOW64\combase.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\SYSWOW64\cdp.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\SYSWOW64\aadtb.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\system32\enterprisecsps.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\system32\DeviceEnroller.exe
2016-12-17 12:28:58 ----A---- C:\WINDOWS\system32\combase.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\system32\appraiser.dll
2016-12-17 12:28:58 ----A---- C:\WINDOWS\system32\acmigration.dll
2016-12-17 12:28:57 ----A---- C:\WINDOWS\SYSWOW64\ShareHost.dll
2016-12-17 12:28:57 ----A---- C:\WINDOWS\SYSWOW64\mdmregistration.dll
2016-12-17 12:28:57 ----A---- C:\WINDOWS\SYSWOW64\jscript9diag.dll
2016-12-17 12:28:57 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2016-12-17 12:28:57 ----A---- C:\WINDOWS\SYSWOW64\Chakradiag.dll
2016-12-17 12:28:57 ----A---- C:\WINDOWS\SYSWOW64\bcrypt.dll
2016-12-17 12:28:57 ----A---- C:\WINDOWS\system32\wincorlib.dll
2016-12-17 12:28:57 ----A---- C:\WINDOWS\system32\mdmregistration.dll
2016-12-17 12:28:57 ----A---- C:\WINDOWS\system32\drivers\cng.sys
2016-12-17 12:28:57 ----A---- C:\WINDOWS\system32\drivers\clfs.sys
2016-12-17 12:28:57 ----A---- C:\WINDOWS\system32\bcrypt.dll
2016-12-17 12:28:56 ----A---- C:\WINDOWS\SYSWOW64\Chakra.dll
2016-12-17 12:28:56 ----A---- C:\WINDOWS\system32\win32kbase.sys
2016-12-17 12:28:56 ----A---- C:\WINDOWS\system32\jscript9.dll
2016-12-17 12:28:56 ----A---- C:\WINDOWS\system32\Chakra.dll
2016-12-17 12:28:56 ----A---- C:\WINDOWS\system32\fveapibase.dll
2016-12-17 12:28:55 ----A---- C:\WINDOWS\system32\mshtml.dll
2016-12-17 12:28:55 ----A---- C:\WINDOWS\system32\indexeddbserver.dll
2016-12-17 12:28:55 ----A---- C:\WINDOWS\system32\fveapi.dll
2016-12-17 12:28:55 ----A---- C:\WINDOWS\system32\drivers\dxgmms1.sys
2016-12-17 12:28:54 ----A---- C:\WINDOWS\system32\WindowsCodecs.dll
2016-12-17 12:28:54 ----A---- C:\WINDOWS\system32\edgehtml.dll
2016-12-17 12:28:54 ----A---- C:\WINDOWS\system32\drivers\dxgmms2.sys
2016-12-17 12:28:54 ----A---- C:\WINDOWS\system32\drivers\dxgkrnl.sys
2016-12-17 12:28:54 ----A---- C:\WINDOWS\system32\cdd.dll
2016-12-17 12:28:53 ----A---- C:\WINDOWS\SYSWOW64\edgehtml.dll
2016-12-17 12:28:53 ----A---- C:\WINDOWS\SYSWOW64\CoreUIComponents.dll
2016-12-17 12:28:52 ----A---- C:\WINDOWS\SYSWOW64\ole32.dll
2016-12-17 12:28:52 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2016-12-17 12:28:52 ----A---- C:\WINDOWS\SYSWOW64\indexeddbserver.dll
2016-12-17 12:28:51 ----A---- C:\WINDOWS\system32\d3d10warp.dll
2016-12-17 12:28:50 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.LockScreen.dll
2016-12-17 12:28:50 ----A---- C:\WINDOWS\system32\sspicli.dll
2016-12-17 12:28:50 ----A---- C:\WINDOWS\system32\CryptoWinRT.dll
2016-12-10 09:02:46 ----A---- C:\WINDOWS\SYSWOW64\usercpl.dll
2016-12-10 09:02:46 ----A---- C:\WINDOWS\SYSWOW64\ReAgentc.exe
2016-12-10 09:02:45 ----A---- C:\WINDOWS\SYSWOW64\wsecedit.dll
2016-12-10 09:02:45 ----A---- C:\WINDOWS\SYSWOW64\stobject.dll
2016-12-10 09:02:45 ----A---- C:\WINDOWS\SYSWOW64\SearchFolder.dll
2016-12-10 09:02:45 ----A---- C:\WINDOWS\SYSWOW64\msctf.dll
2016-12-10 09:02:43 ----A---- C:\WINDOWS\SYSWOW64\netshell.dll
2016-12-10 09:02:42 ----A---- C:\WINDOWS\SYSWOW64\migisol.dll
2016-12-10 09:02:40 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2016-12-10 09:02:40 ----A---- C:\WINDOWS\SYSWOW64\ieproxy.dll
2016-12-10 09:02:38 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2016-12-10 09:02:38 ----A---- C:\WINDOWS\SYSWOW64\setupugc.exe
2016-12-10 09:02:38 ----A---- C:\WINDOWS\SYSWOW64\DevicePairing.dll
2016-12-10 09:02:37 ----A---- C:\WINDOWS\SYSWOW64\comdlg32.dll
2016-12-10 09:02:36 ----A---- C:\WINDOWS\SYSWOW64\mtxclu.dll
2016-12-10 09:02:36 ----A---- C:\WINDOWS\SYSWOW64\msdtcuiu.dll
2016-12-10 09:02:36 ----A---- C:\WINDOWS\SYSWOW64\CloudStorageWizard.exe
2016-12-10 09:02:34 ----A---- C:\WINDOWS\SYSWOW64\Windows.Storage.ApplicationData.dll
2016-12-10 09:02:34 ----A---- C:\WINDOWS\SYSWOW64\Windows.StateRepositoryClient.dll
2016-12-10 09:02:34 ----A---- C:\WINDOWS\SYSWOW64\Windows.StateRepository.dll
2016-12-10 09:02:33 ----A---- C:\WINDOWS\SYSWOW64\hevcdecoder.dll
2016-12-10 09:02:32 ----A---- C:\WINDOWS\SYSWOW64\zipfldr.dll
2016-12-10 09:02:32 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Immersive.dll
2016-12-10 09:02:30 ----A---- C:\WINDOWS\SYSWOW64\WsmSvc.dll
2016-12-10 09:02:30 ----A---- C:\WINDOWS\SYSWOW64\WSManHTTPConfig.exe
2016-12-10 09:02:30 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Search.dll
2016-12-10 09:02:30 ----A---- C:\WINDOWS\SYSWOW64\Windows.Shell.Search.UriHandler.dll
2016-12-10 09:02:30 ----A---- C:\WINDOWS\SYSWOW64\UIAutomationCore.dll
2016-12-10 09:02:30 ----A---- C:\WINDOWS\SYSWOW64\StoreAgent.dll
2016-12-10 09:02:30 ----A---- C:\WINDOWS\SYSWOW64\InstallAgentUserBroker.exe
2016-12-10 09:02:30 ----A---- C:\WINDOWS\SYSWOW64\InstallAgent.exe
2016-12-10 09:02:29 ----A---- C:\WINDOWS\SYSWOW64\wscapi.dll
2016-12-10 09:02:29 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2016-12-10 09:02:29 ----A---- C:\WINDOWS\SYSWOW64\Windows.ApplicationModel.Store.dll
2016-12-10 09:02:29 ----A---- C:\WINDOWS\SYSWOW64\twinui.dll
2016-12-10 09:02:29 ----A---- C:\WINDOWS\SYSWOW64\shell32.dll
2016-12-10 09:02:29 ----A---- C:\WINDOWS\SYSWOW64\sendmail.dll
2016-12-10 09:02:29 ----A---- C:\WINDOWS\SYSWOW64\LaunchWinApp.exe
2016-12-10 09:02:28 ----A---- C:\WINDOWS\SYSWOW64\wscinterop.dll
2016-12-10 09:02:28 ----A---- C:\WINDOWS\SYSWOW64\RTWorkQ.dll
2016-12-10 09:02:28 ----A---- C:\WINDOWS\SYSWOW64\ngccredprov.dll
2016-12-10 09:02:28 ----A---- C:\WINDOWS\SYSWOW64\efswrt.dll
2016-12-10 09:02:28 ----A---- C:\WINDOWS\SYSWOW64\cryptngc.dll
2016-12-10 09:02:27 ----A---- C:\WINDOWS\SYSWOW64\PlayToManager.dll
2016-12-10 09:02:26 ----A---- C:\WINDOWS\SYSWOW64\ntshrui.dll
2016-12-10 09:02:26 ----A---- C:\WINDOWS\SYSWOW64\ntdll.dll
2016-12-10 09:02:25 ----A---- C:\WINDOWS\SYSWOW64\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll
2016-12-10 09:02:25 ----A---- C:\WINDOWS\SYSWOW64\NetSetupShim.dll
2016-12-10 09:02:25 ----A---- C:\WINDOWS\SYSWOW64\NetCfgNotifyObjectHost.exe
2016-12-10 09:02:24 ----A---- C:\WINDOWS\SYSWOW64\mspaint.exe
2016-12-10 09:02:24 ----A---- C:\WINDOWS\SYSWOW64\msmpeg2vdec.dll
2016-12-10 09:02:24 ----A---- C:\WINDOWS\SYSWOW64\MFPlay.dll
2016-12-10 09:02:24 ----A---- C:\WINDOWS\SYSWOW64\mfplat.dll
2016-12-10 09:02:24 ----A---- C:\WINDOWS\SYSWOW64\mfmkvsrcsnk.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\windows.storage.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\rasapi32.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\NMAA.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\MosStorage.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\mos.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\mfsvr.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\mfcore.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\mfaudiocnv.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\MapsBtSvc.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\MapRouter.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\MapGeocoder.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\MapControlCore.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\MapConfiguration.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\LogonController.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\KernelBase.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\JpMapControl.dll
2016-12-10 09:02:23 ----A---- C:\WINDOWS\SYSWOW64\BingMaps.dll
2016-12-10 09:02:17 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Xaml.Resources.dll
2016-12-10 09:02:17 ----A---- C:\WINDOWS\SYSWOW64\Windows.UI.Xaml.dll
2016-12-10 09:02:17 ----A---- C:\WINDOWS\SYSWOW64\Windows.Internal.Management.dll
2016-12-10 09:02:17 ----A---- C:\WINDOWS\SYSWOW64\gameux.dll
2016-12-10 09:02:17 ----A---- C:\WINDOWS\SYSWOW64\ExplorerFrame.dll
2016-12-10 09:02:17 ----A---- C:\WINDOWS\SYSWOW64\explorer.exe
2016-12-10 09:02:17 ----A---- C:\WINDOWS\SYSWOW64\dxgi.dll
2016-12-10 09:02:17 ----A---- C:\WINDOWS\SYSWOW64\dmenrollengine.dll
2016-12-10 09:02:17 ----A---- C:\WINDOWS\SYSWOW64\DisplayManager.dll
2016-12-10 09:02:17 ----A---- C:\WINDOWS\SYSWOW64\d3d11.dll
2016-12-10 09:02:16 ----A---- C:\WINDOWS\SYSWOW64\xolehlp.dll
2016-12-10 09:02:16 ----A---- C:\WINDOWS\SYSWOW64\policymanager.dll
2016-12-10 09:02:16 ----A---- C:\WINDOWS\SYSWOW64\msdtcprx.dll
2016-12-10 09:02:16 ----A---- C:\WINDOWS\SYSWOW64\MrmCoreR.dll
2016-12-10 09:02:16 ----A---- C:\WINDOWS\SYSWOW64\dwmcore.dll
2016-12-10 09:02:16 ----A---- C:\WINDOWS\SYSWOW64\DeviceFlows.DataModel.dll
2016-12-10 09:02:15 ----A---- C:\WINDOWS\SYSWOW64\AudioSes.dll
2016-12-10 09:02:15 ----A---- C:\WINDOWS\SYSWOW64\AUDIOKSE.dll
2016-12-10 09:02:15 ----A---- C:\WINDOWS\SYSWOW64\apprepsync.dll
2016-12-10 09:02:15 ----A---- C:\WINDOWS\SYSWOW64\apprepapi.dll
2016-12-10 09:02:15 ----A---- C:\WINDOWS\SYSWOW64\actxprxy.dll
2016-12-10 09:02:15 ----A---- C:\WINDOWS\SYSWOW64\ActivationManager.dll
2016-12-10 09:02:14 ----A---- C:\WINDOWS\SYSWOW64\BcastDVRHelper.dll
2016-12-10 09:02:14 ----A---- C:\WINDOWS\SYSWOW64\bcastdvr.exe
2016-12-10 09:02:14 ----A---- C:\WINDOWS\SYSWOW64\AppCapture.dll
2016-12-10 08:58:42 ----A---- C:\WINDOWS\system32\wlidsvc.dll
2016-12-10 08:58:42 ----A---- C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2016-12-10 08:58:42 ----A---- C:\WINDOWS\system32\Windows.StateRepositoryClient.dll
2016-12-10 08:58:42 ----A---- C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll
2016-12-10 08:58:42 ----A---- C:\WINDOWS\system32\Windows.StateRepository.dll
2016-12-10 08:58:42 ----A---- C:\WINDOWS\system32\VPNv2CSP.dll
2016-12-10 08:58:31 ----A---- C:\WINDOWS\system32\hevcdecoder.dll
2016-12-10 08:58:24 ----A---- C:\WINDOWS\system32\zipfldr.dll
2016-12-10 08:58:23 ----A---- C:\WINDOWS\system32\wuaueng.dll
2016-12-10 08:58:23 ----A---- C:\WINDOWS\system32\wkssvc.dll
2016-12-10 08:58:23 ----A---- C:\WINDOWS\system32\winlogon.exe
2016-12-10 08:58:23 ----A---- C:\WINDOWS\system32\Windows.UI.Immersive.dll
2016-12-10 08:58:23 ----A---- C:\WINDOWS\system32\ReAgentc.exe
2016-12-10 08:58:21 ----A---- C:\WINDOWS\system32\wuuhext.dll
2016-12-10 08:58:21 ----A---- C:\WINDOWS\system32\WsmSvc.dll
2016-12-10 08:58:21 ----A---- C:\WINDOWS\system32\WSManHTTPConfig.exe
2016-12-10 08:58:21 ----A---- C:\WINDOWS\system32\VEStoreEventHandlers.dll
2016-12-10 08:58:21 ----A---- C:\WINDOWS\system32\usercpl.dll
2016-12-10 08:58:21 ----A---- C:\WINDOWS\system32\UIAutomationCore.dll
2016-12-10 08:58:21 ----A---- C:\WINDOWS\system32\StoreAgent.dll
2016-12-10 08:58:21 ----A---- C:\WINDOWS\system32\InstallAgentUserBroker.exe
2016-12-10 08:58:21 ----A---- C:\WINDOWS\system32\InstallAgent.exe
2016-12-10 08:58:20 ----A---- C:\WINDOWS\system32\Windows.UI.Search.dll
2016-12-10 08:58:20 ----A---- C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2016-12-10 08:58:20 ----A---- C:\WINDOWS\system32\umpoext.dll
2016-12-10 08:58:20 ----A---- C:\WINDOWS\system32\drivers\modem.sys
2016-12-10 08:58:19 ----A---- C:\WINDOWS\system32\twinui.dll
2016-12-10 08:58:19 ----A---- C:\WINDOWS\system32\msctf.dll
2016-12-10 08:58:19 ----A---- C:\WINDOWS\system32\lsm.dll
2016-12-10 08:58:19 ----A---- C:\WINDOWS\system32\LaunchWinApp.exe
2016-12-10 08:58:18 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2016-12-10 08:58:18 ----A---- C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2016-12-10 08:58:18 ----A---- C:\WINDOWS\system32\StorSvc.dll
2016-12-10 08:58:18 ----A---- C:\WINDOWS\system32\stobject.dll
2016-12-10 08:58:18 ----A---- C:\WINDOWS\system32\SRHInproc.dll
2016-12-10 08:58:18 ----A---- C:\WINDOWS\system32\SRH.dll
2016-12-10 08:58:18 ----A---- C:\WINDOWS\system32\drivers\srv2.sys
2016-12-10 08:58:18 ----A---- C:\WINDOWS\system32\drivers\mrxsmb20.sys
2016-12-10 08:58:18 ----A---- C:\WINDOWS\system32\drivers\mrxsmb10.sys
2016-12-10 08:58:17 ----A---- C:\WINDOWS\system32\wscsvc.dll
2016-12-10 08:58:17 ----A---- C:\WINDOWS\system32\wscapi.dll
2016-12-10 08:58:17 ----A---- C:\WINDOWS\system32\shell32.dll
2016-12-10 08:58:17 ----A---- C:\WINDOWS\system32\sendmail.dll
2016-12-10 08:58:17 ----A---- C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2016-12-10 08:58:17 ----A---- C:\WINDOWS\system32\EditionUpgradeHelper.dll
2016-12-10 08:58:17 ----A---- C:\WINDOWS\system32\DeviceReactivation.dll
2016-12-10 08:58:17 ----A---- C:\WINDOWS\system32\cryptngc.dll
2016-12-10 08:58:16 ----A---- C:\WINDOWS\system32\sppobjs.dll
2016-12-10 08:58:16 ----A---- C:\WINDOWS\system32\SearchFolder.dll
2016-12-10 08:58:16 ----A---- C:\WINDOWS\system32\NgcCtnr.dll
2016-12-10 08:58:16 ----A---- C:\WINDOWS\system32\ngccredprov.dll
2016-12-10 08:58:16 ----A---- C:\WINDOWS\system32\NetworkMobileSettings.dll
2016-12-10 08:58:15 ----A---- C:\WINDOWS\system32\DataSenseHandlers.dll
2016-12-10 08:58:14 ----A---- C:\WINDOWS\system32\wsecedit.dll
2016-12-10 08:58:13 ----A---- C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2016-12-10 08:58:13 ----A---- C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2016-12-10 08:58:13 ----A---- C:\WINDOWS\system32\SettingsHandlers_StorageSense.dll
2016-12-10 08:58:13 ----A---- C:\WINDOWS\system32\efswrt.dll
2016-12-10 08:58:12 ----A---- C:\WINDOWS\system32\wscinterop.dll
2016-12-10 08:58:11 ----A---- C:\WINDOWS\system32\sppwinob.dll
2016-12-10 08:58:11 ----A---- C:\WINDOWS\system32\services.exe
2016-12-10 08:58:11 ----A---- C:\WINDOWS\system32\RTWorkQ.dll
2016-12-10 08:58:11 ----A---- C:\WINDOWS\system32\RDXTaskFactory.dll
2016-12-10 08:58:10 ----A---- C:\WINDOWS\system32\RjvMDMConfig.dll
2016-12-10 08:58:10 ----A---- C:\WINDOWS\system32\rasmans.dll
2016-12-10 08:58:10 ----A---- C:\WINDOWS\system32\drivers\rdbss.sys
2016-12-10 08:58:09 ----A---- C:\WINDOWS\system32\vpnike.dll
2016-12-10 08:58:09 ----A---- C:\WINDOWS\system32\RDXService.dll
2016-12-10 08:58:09 ----A---- C:\WINDOWS\system32\rascustom.dll
2016-12-10 08:58:09 ----A---- C:\WINDOWS\system32\ProvSysprep.dll
2016-12-10 08:58:08 ----A---- C:\WINDOWS\system32\sppnp.dll
2016-12-10 08:58:08 ----A---- C:\WINDOWS\system32\PlayToManager.dll
2016-12-10 08:58:08 ----A---- C:\WINDOWS\system32\drivers\partmgr.sys
2016-12-10 08:58:07 ----A---- C:\WINDOWS\system32\wpnprv.dll
2016-12-10 08:58:07 ----A---- C:\WINDOWS\system32\wpncore.dll
2016-12-10 08:58:06 ----A---- C:\WINDOWS\system32\ntshrui.dll
2016-12-10 08:58:06 ----A---- C:\WINDOWS\system32\ntdll.dll
2016-12-10 08:58:06 ----A---- C:\WINDOWS\system32\cscui.dll
2016-12-10 08:58:05 ----A---- C:\WINDOWS\system32\netshell.dll
2016-12-10 08:58:05 ----A---- C:\WINDOWS\system32\NetSetupShim.dll
2016-12-10 08:58:05 ----A---- C:\WINDOWS\system32\netplwiz.dll
2016-12-10 08:58:05 ----A---- C:\WINDOWS\system32\NetCfgNotifyObjectHost.exe
2016-12-10 08:58:04 ----A---- C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.BackgroundManagerPolicy.dll
2016-12-10 08:58:03 ----A---- C:\WINDOWS\system32\mspaint.exe
2016-12-10 08:58:03 ----A---- C:\WINDOWS\system32\msmpeg2vdec.dll
2016-12-10 08:58:02 ----A---- C:\WINDOWS\system32\SyncCenter.dll
2016-12-10 08:58:02 ----A---- C:\WINDOWS\system32\modernexecserver.dll
2016-12-10 08:58:02 ----A---- C:\WINDOWS\system32\MFPlay.dll
2016-12-10 08:58:02 ----A---- C:\WINDOWS\system32\mfplat.dll
2016-12-10 08:58:02 ----A---- C:\WINDOWS\system32\mfmkvsrcsnk.dll
2016-12-10 08:58:02 ----A---- C:\WINDOWS\system32\mfcore.dll
2016-12-10 08:58:02 ----A---- C:\WINDOWS\system32\mfaudiocnv.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\NMAA.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\MosStorage.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\moshostcore.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\moshost.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\mos.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\mfsvr.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\MapsStore.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\MapsBtSvc.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\MapRouter.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\MapGeocoder.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\MapControlCore.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\MapConfiguration.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\JpMapControl.dll
2016-12-10 08:58:01 ----A---- C:\WINDOWS\system32\BingMaps.dll
2016-12-10 08:58:00 ----A---- C:\WINDOWS\system32\windows.storage.dll
2016-12-10 08:58:00 ----A---- C:\WINDOWS\system32\rasapi32.dll
2016-12-10 08:58:00 ----A---- C:\WINDOWS\system32\migisol.dll
2016-12-10 08:57:59 ----A---- C:\WINDOWS\system32\lpremove.exe
2016-12-10 08:57:58 ----A---- C:\WINDOWS\system32\LogonController.dll
2016-12-10 08:57:57 ----A---- C:\WINDOWS\system32\KernelBase.dll
2016-12-10 08:57:54 ----A---- C:\WINDOWS\system32\wininet.dll
2016-12-10 08:57:54 ----A---- C:\WINDOWS\system32\ieproxy.dll
2016-12-10 08:57:54 ----A---- C:\WINDOWS\system32\IdCtrls.dll
2016-12-10 08:57:50 ----A---- C:\WINDOWS\system32\urlmon.dll
2016-12-10 08:57:49 ----A---- C:\WINDOWS\system32\HttpsDataSource.dll
2016-12-10 08:57:49 ----A---- C:\WINDOWS\system32\EAMProgressHandler.dll
2016-12-10 08:57:48 ----A---- C:\WINDOWS\system32\gameux.dll
2016-12-10 08:57:48 ----A---- C:\WINDOWS\system32\drivers\fastfat.sys
2016-12-10 08:57:45 ----A---- C:\WINDOWS\system32\ExplorerFrame.dll
2016-12-10 08:57:45 ----A---- C:\WINDOWS\explorer.exe
2016-12-10 08:57:44 ----A---- C:\WINDOWS\system32\Windows.Internal.Management.dll
2016-12-10 08:57:44 ----A---- C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2016-12-10 08:57:44 ----A---- C:\WINDOWS\system32\dxgi.dll
2016-12-10 08:57:44 ----A---- C:\WINDOWS\system32\dpapisrv.dll
2016-12-10 08:57:44 ----A---- C:\WINDOWS\system32\dmenrollengine.dll
2016-12-10 08:57:44 ----A---- C:\WINDOWS\system32\DisplayManager.dll
2016-12-10 08:57:43 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2016-12-10 08:57:43 ----A---- C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-12-10 08:57:43 ----A---- C:\WINDOWS\system32\setupugc.exe
2016-12-10 08:57:43 ----A---- C:\WINDOWS\system32\dwmcore.dll
2016-12-10 08:57:43 ----A---- C:\WINDOWS\system32\dosvc.dll
2016-12-10 08:57:43 ----A---- C:\WINDOWS\system32\dialserver.dll
2016-12-10 08:57:43 ----A---- C:\WINDOWS\system32\DevicePairing.dll
2016-12-10 08:57:43 ----A---- C:\WINDOWS\system32\DeviceFlows.DataModel.dll
2016-12-10 08:57:43 ----A---- C:\WINDOWS\system32\d3d11.dll
2016-12-10 08:57:42 ----A---- C:\WINDOWS\system32\ReportingCSP.dll
2016-12-10 08:57:42 ----A---- C:\WINDOWS\system32\domgmt.dll
2016-12-10 08:57:41 ----A---- C:\WINDOWS\system32\policymanager.dll
2016-12-10 08:57:41 ----A---- C:\WINDOWS\system32\dmcertinst.exe
2016-12-10 08:57:41 ----A---- C:\WINDOWS\system32\comdlg32.dll
2016-12-10 08:57:40 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2016-12-10 08:57:40 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2016-12-10 08:57:39 ----A---- C:\WINDOWS\system32\MrmCoreR.dll
2016-12-10 08:57:39 ----A---- C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2016-12-10 08:57:39 ----A---- C:\WINDOWS\system32\CloudStorageWizard.exe
2016-12-10 08:57:39 ----A---- C:\WINDOWS\system32\cdpusersvc.dll
2016-12-10 08:57:39 ----A---- C:\WINDOWS\system32\cdpsvc.dll
2016-12-10 08:57:38 ----A---- C:\WINDOWS\system32\CbtBackgroundManagerPolicy.dll
2016-12-10 08:57:12 ----A---- C:\WINDOWS\system32\browserbroker.dll
2016-12-10 08:57:07 ----A---- C:\WINDOWS\system32\audiosrv.dll
2016-12-10 08:57:07 ----A---- C:\WINDOWS\system32\AudioSes.dll
2016-12-10 08:57:07 ----A---- C:\WINDOWS\system32\AUDIOKSE.dll
2016-12-10 08:57:07 ----A---- C:\WINDOWS\system32\AudioEng.dll
2016-12-10 08:57:07 ----A---- C:\WINDOWS\system32\AudioEndpointBuilder.dll
2016-12-10 08:57:07 ----A---- C:\WINDOWS\system32\apprepsync.dll
2016-12-10 08:57:07 ----A---- C:\WINDOWS\system32\apprepapi.dll
2016-12-10 08:57:07 ----A---- C:\WINDOWS\system32\actxprxy.dll
2016-12-10 08:57:07 ----A---- C:\WINDOWS\system32\ActivationManager.dll
2016-12-10 08:57:07 ----A---- C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2016-12-10 08:57:05 ----A---- C:\WINDOWS\system32\aitstatic.exe
2016-12-10 08:57:04 ----A---- C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll
2016-12-10 08:57:02 ----A---- C:\WINDOWS\system32\EDPCleanup.exe
2016-12-10 08:57:02 ----A---- C:\WINDOWS\system32\AppReadiness.dll
2016-12-10 08:57:01 ----A---- C:\WINDOWS\system32\BcastDVRHelper.dll
2016-12-10 08:57:01 ----A---- C:\WINDOWS\system32\bcastdvr.exe
2016-12-10 08:57:01 ----A---- C:\WINDOWS\system32\AppCapture.dll
2016-12-10 08:56:40 ----A---- C:\WINDOWS\system32\drivers\xboxgip.sys
2016-12-10 08:56:40 ----A---- C:\WINDOWS\system32\drivers\tpm.sys
2016-12-10 08:56:40 ----A---- C:\WINDOWS\system32\drivers\pci.sys
2016-12-10 08:56:40 ----A---- C:\WINDOWS\system32\drivers\bthport.sys

======List of files/folders modified in the last 1 month======

2017-01-09 10:56:25 ----D---- C:\Program Files\trend micro
2017-01-09 10:52:41 ----D---- C:\WINDOWS\Prefetch
2017-01-09 10:47:00 ----D---- C:\WINDOWS\Temp
2017-01-09 10:46:15 ----RD---- C:\WINDOWS\Microsoft.NET
2017-01-09 10:25:45 ----A---- C:\WINDOWS\SYSWOW64\log.txt
2017-01-09 10:25:35 ----D---- C:\WINDOWS\system32\SleepStudy
2017-01-09 10:03:00 ----D---- C:\WINDOWS\system32\sru
2017-01-08 14:20:38 ----HD---- C:\ProgramData
2017-01-06 22:46:43 ----D---- C:\Users\Felly\AppData\Roaming\vlc
2017-01-06 13:20:05 ----D---- C:\WINDOWS\AppReadiness
2017-01-05 14:36:25 ----SHD---- C:\System Volume Information
2017-01-05 12:12:40 ----HD---- C:\Program Files\WindowsApps
2017-01-02 14:51:03 ----D---- C:\WINDOWS\LiveKernelReports
2017-01-02 11:32:22 ----D---- C:\WINDOWS\System32
2017-01-01 10:43:24 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2016-12-31 16:29:04 ----D---- C:\Users\Felly\AppData\Roaming\Mp3tag
2016-12-30 18:34:17 ----D---- C:\ProgramData\NVIDIA
2016-12-30 17:18:38 ----D---- C:\Users\Felly\AppData\Roaming\Skype
2016-12-30 14:29:27 ----SHDC---- C:\WINDOWS\Installer
2016-12-30 14:29:25 ----RD---- C:\Program Files (x86)\Skype
2016-12-30 14:29:25 ----D---- C:\Program Files (x86)\Common Files
2016-12-24 17:04:05 ----D---- C:\WINDOWS\system32\config
2016-12-24 12:04:40 ----AD---- C:\ProgramData\regid.1991-06.com.microsoft
2016-12-24 12:04:28 ----RD---- C:\WINDOWS\assembly
2016-12-24 12:03:53 ----AD---- C:\Program Files (x86)\Microsoft Office
2016-12-24 09:52:25 ----RSD---- C:\WINDOWS\Fonts
2016-12-21 11:06:54 ----RD---- C:\Program Files (x86)
2016-12-21 11:06:53 ----D---- C:\WINDOWS\Tasks
2016-12-20 11:28:54 ----D---- C:\WINDOWS\rescache
2016-12-19 21:47:40 ----D---- C:\ProgramData\TrackMania
2016-12-19 18:32:21 ----D---- C:\WINDOWS\system32\catroot2
2016-12-19 18:29:35 ----RD---- C:\Program Files
2016-12-19 18:29:35 ----D---- C:\Program Files\Common Files\Apple
2016-12-18 13:39:24 ----D---- C:\WINDOWS\WinSxS
2016-12-17 17:44:16 ----D---- C:\WINDOWS\SYSWOW64\en-US
2016-12-17 17:44:16 ----D---- C:\WINDOWS\system32\en-US
2016-12-17 17:44:16 ----AD---- C:\WINDOWS\SysWOW64
2016-12-17 17:44:15 ----D---- C:\WINDOWS\system32\drivers
2016-12-17 17:44:15 ----D---- C:\WINDOWS\system32\Boot
2016-12-17 17:44:15 ----D---- C:\WINDOWS\ShellExperiences
2016-12-17 17:44:15 ----D---- C:\WINDOWS\AppPatch
2016-12-17 17:44:14 ----D---- C:\WINDOWS\system32\DriverStore
2016-12-17 12:35:08 ----D---- C:\WINDOWS\CbsTemp
2016-12-17 12:32:01 ----D---- C:\WINDOWS\system32\MRT
2016-12-17 12:30:38 ----AC---- C:\WINDOWS\system32\MRT.exe
2016-12-12 00:56:25 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2016-12-10 15:20:49 ----D---- C:\WINDOWS\system32\NDF
2016-12-10 15:13:37 ----D---- C:\WINDOWS\INF
2016-12-10 11:19:22 ----D---- C:\WINDOWS\SYSWOW64\oobe
2016-12-10 11:19:22 ----D---- C:\WINDOWS\SYSWOW64\Dism
2016-12-10 11:19:22 ----D---- C:\WINDOWS\system32\WinBioPlugIns
2016-12-10 11:19:22 ----D---- C:\WINDOWS\system32\wbem
2016-12-10 11:19:22 ----D---- C:\WINDOWS\system32\Sysprep
2016-12-10 11:19:22 ----D---- C:\WINDOWS\system32\sr-Latn-CS
2016-12-10 11:19:22 ----D---- C:\WINDOWS\system32\oobe
2016-12-10 11:19:21 ----RD---- C:\WINDOWS\ImmersiveControlPanel
2016-12-10 11:19:21 ----D---- C:\WINDOWS\system32\Dism
2016-12-10 11:19:21 ----D---- C:\WINDOWS\servicing
2016-12-10 11:19:21 ----D---- C:\WINDOWS\bcastdvr
2016-12-10 11:19:21 ----D---- C:\Windows
2016-12-10 11:19:21 ----D---- C:\Program Files\Internet Explorer
2016-12-10 11:19:21 ----D---- C:\Program Files (x86)\Internet Explorer

File C:\WINDOWS\system32\winlogon.exe is digitally signed
File C:\WINDOWS\system32\wininit.exe is digitally signed
File C:\WINDOWS\explorer.exe is digitally signed
File C:\WINDOWS\SysWOW64\explorer.exe is digitally signed
File C:\WINDOWS\system32\svchost.exe is digitally signed
File C:\WINDOWS\SysWOW64\svchost.exe is digitally signed
File C:\WINDOWS\system32\services.exe is digitally signed
File C:\WINDOWS\system32\User32.dll is digitally signed
File C:\WINDOWS\SysWOW64\User32.dll is digitally signed
File C:\WINDOWS\system32\userinit.exe is digitally signed
File C:\WINDOWS\SysWOW64\userinit.exe is digitally signed
File C:\WINDOWS\system32\rpcss.dll is digitally signed
File C:\WINDOWS\system32\Drivers\volsnap.sys is digitally signed

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\WINDOWS\system32\drivers\aswRvrt.sys [2016-09-10 74544]
R0 aswVmm;avast! VM Monitor; C:\WINDOWS\system32\drivers\aswVmm.sys [2016-10-13 293352]
R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-100; C:\WINDOWS\system32\drivers\iorate.sys [2016-11-02 48992]
R0 nvpciflt;nvpciflt; C:\WINDOWS\system32\DRIVERS\nvpciflt.sys [2016-04-10 40080]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [2016-09-10 103064]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2016-09-21 969184]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2016-10-03 513632]
R2 aswMonFlt;aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [2016-09-10 108816]
R2 aswStm;aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [2016-09-10 163416]
R2 clreg;@%SystemRoot%\system32\drivers\registry.sys,-100; C:\WINDOWS\System32\drivers\registry.sys [2016-07-16 70144]
R2 risdxc;risdxc; C:\WINDOWS\system32\DRIVERS\risdxc64.sys [2011-05-26 101888]
R3 dtlitescsibus;@oem1.inf,%DTLITESCSIBUS.DeviceDesc%;DAEMON Tools Lite Virtual SCSI Bus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [2016-10-03 30264]
R3 dtliteusbbus;@oem43.inf,%DTLITEUSBBUS.DeviceDesc%;DAEMON Tools Lite Virtual USB Bus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [2016-10-03 47672]
R3 e1cexpress;@oem9.inf,%e1cExpress.Service.DispName%;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\WINDOWS\system32\DRIVERS\e1c64x64.sys [2016-04-10 468752]
R3 ecnssndis;@oem21.inf,%Ericsson.SvcDesc%; Mobile Broadband Driver; C:\WINDOWS\System32\Drivers\wwuss64.sys [2011-06-14 26664]
R3 ecnssndisfltr;@oem21.inf,%Ericsson.FltSvcDesc%; Mobile Broadband Driver Filter; C:\WINDOWS\System32\Drivers\wwussf64.sys [2011-06-14 30248]
R3 IBMPMDRV;IBMPMDRV; C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys [2016-04-10 82240]
R3 l36wgps;@oem27.inf,%ServiceName%; Mobile Broadband GPS Port; C:\WINDOWS\system32\DRIVERS\l36wgps64.sys [2011-07-01 101416]
R3 Mbm3CBus;@oem23.inf,%l36g.Service.Desc.4%;F5521gw Mobile Broadband Device (WDM); C:\WINDOWS\System32\drivers\Mbm3CBus.sys [2011-04-29 419400]
R3 Mbm3DevMt;@oem40.inf,%l36g.Service.Name%; Mobile Broadband Device Management Driver (WDM); C:\WINDOWS\system32\DRIVERS\Mbm3DevMt.sys [2011-04-29 430664]
R3 Mbm3mdfl;@oem3.inf,%l36g.Filter.Name%; Mobile Broadband Modem Port Filter; C:\WINDOWS\system32\DRIVERS\Mbm3mdfl.sys [2011-04-29 19528]
R3 Mbm3Mdm;@oem3.inf,%l36g.Service.Name%; Mobile Broadband Modem Port Driver; C:\WINDOWS\system32\DRIVERS\Mbm3Mdm.sys [2011-04-29 483400]
R3 NETwNe64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit; C:\WINDOWS\System32\drivers\NETwew01.sys [2016-07-16 3343872]
R3 nvlddmkm;nvlddmkm; C:\WINDOWS\system32\DRIVERS\nvlddmkm.sys [2016-04-10 11204240]
R3 SynTP;@oem61.inf,%SynTP.SvcDesc%;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2016-10-03 642144]
S0 megasas2i;megasas2i; C:\WINDOWS\System32\drivers\MegaSas2i.sys [2016-10-05 64352]
S0 scmbus;@scmbus.inf,%scmbus.SvcDesc%;Microsoft Storage Class Memory Bus Driver; C:\WINDOWS\System32\drivers\scmbus.sys [2016-07-16 88416]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\WINDOWS\System32\drivers\AcpiDev.sys [2016-07-16 18432]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\WINDOWS\system32\drivers\applockerfltr.sys [2016-07-16 15360]
S3 AppvStrm;@%systemroot%\system32\drivers\AppvStrm.sys,-101; C:\WINDOWS\system32\drivers\AppvStrm.sys [2016-09-15 127328]
S3 AppvVemgr;@%systemroot%\system32\drivers\AppvVemgr.sys,-101; C:\WINDOWS\system32\drivers\AppvVemgr.sys [2016-07-16 157024]
S3 AppvVfs;@%systemroot%\system32\drivers\AppvVfs.sys,-101; C:\WINDOWS\system32\drivers\AppvVfs.sys [2016-07-16 141152]
S3 aswHwid;avast! HardwareID; C:\WINDOWS\system32\drivers\aswHwid.sys [2016-09-10 37656]
S3 BazisPortableCDBus;Portable WinCDEmu driver; C:\WINDOWS\system32\drivers\BazisPortableCDBus.sys [2016-04-10 283480]
S3 BthPan;@bthpan.inf,%BthPan.DisplayName%;Bluetooth Device (Personal Area Network); C:\WINDOWS\System32\drivers\bthpan.sys [2016-10-05 128512]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Bluetooth Port Driver; C:\WINDOWS\System32\drivers\BTHport.sys [2016-11-11 967168]
S3 BTHUSB;@bth.inf,%BTHUSB.SvcDesc%;Bluetooth Radio USB Driver; C:\WINDOWS\System32\drivers\BTHUSB.sys [2016-09-10 84992]
S3 btwaudio;Bluetooth Audio Device Service; C:\WINDOWS\system32\drivers\btwaudio.sys [2011-10-17 146984]
S3 btwavdt;Bluetooth AVDT Service; C:\WINDOWS\System32\drivers\btwavdt.sys [2011-10-17 164392]
S3 btwl2cap;Bluetooth L2CAP Service; C:\WINDOWS\system32\DRIVERS\btwl2cap.sys [2011-10-17 39976]
S3 btwrchid;btwrchid; C:\WINDOWS\System32\drivers\btwrchid.sys [2011-10-17 21544]
S3 hvservice;@%SystemRoot%\system32\drivers\hvservice.sys,-16; C:\WINDOWS\system32\drivers\hvservice.sys [2016-08-06 73568]
S3 cht4iscsi;cht4iscsi; C:\WINDOWS\System32\drivers\cht4sx64.sys [2016-07-16 346976]
S3 cht4vbd;@cht4vx64.inf,%cht4vbd.generic%;Chelsio Virtual Bus Driver; C:\WINDOWS\System32\drivers\cht4vx64.sys [2016-07-16 2104160]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\WINDOWS\System32\drivers\iagpio.sys [2016-07-16 33280]
S3 iaLPSS2i_GPIO2;@iaLPSS2i_GPIO2_SKL.inf,%iaLPSS2i_GPIO2.SVCDESC%;Intel(R) Serial IO GPIO Driver v2; C:\WINDOWS\System32\drivers\iaLPSS2i_GPIO2.sys [2016-07-16 64512]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\WINDOWS\System32\drivers\IndirectKmd.sys [2016-07-16 35840]
S3 irda;IrDA; C:\WINDOWS\system32\drivers\irda.sys [2016-07-16 120320]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [2016-12-11 192216]
S3 MsSecFlt;@%SystemRoot%\System32\Drivers\mssecflt.sys,-1001; C:\WINDOWS\system32\drivers\mssecflt.sys [2016-07-16 179040]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\WINDOWS\system32\drivers\NetAdapterCx.sys [2016-07-16 90624]
S3 niks4m2audio;@oem33.inf,%MediaDevice.Desc%;Traktor Kontrol S4 MK2 WDM Audio; C:\WINDOWS\System32\Drivers\niks4m2audio.sys [2015-09-04 382920]
S3 niks4m2usb;@oem22.inf,%USBDriver.SvcDesc%;Traktor Kontrol S4 MK2; C:\WINDOWS\system32\DRIVERS\niks4m2usb.sys [2015-09-04 104304]
S3 niks8audio;Traktor Kontrol S8 WDM Audio; C:\WINDOWS\System32\Drivers\niks8audio.sys [2015-09-03 375208]
S3 niks8usb;Traktor Kontrol S8; C:\WINDOWS\system32\DRIVERS\niks8usb.sys [2015-09-03 95584]
S3 NVHDA;@oem2.inf,%NVHDA.SvcDesc%;Service for NVIDIA High Definition Audio Driver; C:\WINDOWS\system32\drivers\nvhda64v.sys [2016-04-10 214168]
S3 scmdisk0101;@scmdisk0101.inf,%scmdisk0101.SvcDesc%;Microsoft NVDIMM-N disk driver; C:\WINDOWS\System32\drivers\scmdisk0101.sys [2016-07-16 123904]
S3 SmbDrvI;SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [2016-04-10 52912]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device Service;Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2016-09-22 83768]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2016-09-10 197128]
R2 btwdins;Bluetooth Service; C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe [2011-10-17 970016]
R2 CDPUserSvc_4ec9da1;CDPUserSvc_4ec9da1; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
R2 ClickToRunSvc;Služba Microsoft Office Klikni a spusť; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2016-12-04 3698888]
R2 IBMPMSVC;@oem13.inf,%ibm.svcDesc0%;Lenovo PM Service; C:\WINDOWS\system32\ibmpmsvc.exe [2016-04-10 180736]
R2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service; C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe [2014-07-09 214464]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-07-02 327672]
R2 LPlatSvc;@oem13.inf,%Lenovo.svcDesc1%;Lenovo Platform Service; C:\WINDOWS\system32\LPlatSvc.exe [2016-04-10 710144]
R2 NIHardwareService;NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2016-03-04 14136944]
R2 nvsvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvvsvc.exe [2015-11-05 1255544]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2013-10-29 1260320]
R2 OneSyncSvc_4ec9da1;Sync Host_4ec9da1; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2015-07-23 410768]
R2 SynTPEnhService;SynTPEnh Caller Service; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [2016-10-03 259176]
R3 Disc Soft Lite Bus Service;Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [2016-08-29 1467072]
R3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted;"ServiceDll"=%SystemRoot%\System32\RMapi.dll
S2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe []
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; %SystemRoot%\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=%SystemRoot%\System32\CDPUserSvc.dll
S2 MessagingService_4ec9da1;MessagingService_4ec9da1; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-09-20 324224]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2016-05-25 43696]
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; %SystemRoot%\System32\svchost.exe -k Camera;"ServiceDll"=%SystemRoot%\system32\FrameServer.dll
S3 HvHost;@%SystemRoot%\system32\hvhostsvc.dll,-100; %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll"=%SystemRoot%\System32\hvhostsvc.dll
S3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2016-12-06 651576]
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll"=%SystemRoot%\System32\irmon.dll
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2016-12-03 209088]
S3 PimIndexMaintenanceSvc_4ec9da1;Contact Data_4ec9da1; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 Sense;@%ProgramFiles%\Windows Defender Advanced Threat Protection\MsSense.exe,-1001; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2016-09-15 2889896]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S4 AppVClient;@%systemroot%\system32\AppVClient.exe,-102; C:\WINDOWS\system32\AppVClient.exe [2016-09-15 823136]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; %SystemRoot%\System32\svchost.exe -k netsvcs;"ServiceDll"=%systemroot%\system32\Windows.SharedPC.AccountManager.dll

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118199
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: COM Surrogate opět útočí

#2 Příspěvek od Rudy »

Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Felly006
Návštěvník
Návštěvník
Příspěvky: 22
Registrován: 28 lis 2016 12:41

Re: COM Surrogate opět útočí

#3 Příspěvek od Felly006 »

# AdwCleaner v6.042 - Logfile created 10/01/2017 at 15:35:41
# Updated on 06/01/2017 by Malwarebytes
# Database : 2017-01-10.1 [Server]
# Operating System : Windows 10 Pro (X64)
# Username : Felly - FIRENTB
# Running from : C:\Users\Felly\Desktop\adwcleaner_6.042.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support



***** [ Services ] *****



***** [ Folders ] *****



***** [ Files ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Shortcuts ] *****



***** [ Scheduled Tasks ] *****



***** [ Registry ] *****



***** [ Web browsers ] *****



*************************

:: "Tracing" keys deleted
:: Winsock2 - Deleted C:\Program Files (x86)\Bonjour\mdnsNSP.dll
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [2768 Bytes] - [18/04/2016 06:14:30]
C:\AdwCleaner\AdwCleaner[C2].txt - [1404 Bytes] - [29/11/2016 10:15:04]
C:\AdwCleaner\AdwCleaner[C3].txt - [960 Bytes] - [10/01/2017 15:35:41]
C:\AdwCleaner\AdwCleaner[S1].txt - [3426 Bytes] - [18/04/2016 06:12:40]
C:\AdwCleaner\AdwCleaner[S2].txt - [1464 Bytes] - [29/11/2016 10:14:16]
C:\AdwCleaner\AdwCleaner[S3].txt - [1432 Bytes] - [10/01/2017 15:35:33]

########## EOF - C:\AdwCleaner\AdwCleaner[C3].txt - [1251 Bytes] ##########

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118199
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: COM Surrogate opět útočí

#4 Příspěvek od Rudy »

Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Felly006
Návštěvník
Návštěvník
Příspěvky: 22
Registrován: 28 lis 2016 12:41

Re: COM Surrogate opět útočí

#5 Příspěvek od Felly006 »

Jen poznamenám, že po dobu testu jsem měl vypnutý antivirový software, protože mi blokoval stránku s FRST Launcherem.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 08-01-2017
Ran by Felly (administrator) on FIRENTB (10-01-2017 20:30:25)
Running from C:\Users\Felly\Desktop
Loaded Profiles: Felly & UpdatusUser (Available Profiles: Felly & UpdatusUser)
Platform: Windows 10 Pro Version 1607 (X64) Language: Angličtina (Spojené státy)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(Lenovo.) C:\Windows\System32\LPlatSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Ericsson AB) C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
(Lenovo.) C:\Windows\System32\LPlatSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple, Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\secd.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.145.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.1118.10000.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(forum.viry.cz) C:\Users\Felly\Desktop\FRSTLauncher.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2498368 2016-04-10] ()
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1795912 2016-04-10] (NVIDIA Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [CNAP2 Launcher] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE [226784 2010-10-14] (CANON INC.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2016-12-06] (Apple Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9080768 2016-11-18] (AVAST Software)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-07-02] (Intel Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2935431814-3145136583-2795862769-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8686296 2016-03-11] (Piriform Ltd)
HKU\S-1-5-21-2935431814-3145136583-2795862769-1001\...\Run: [CNAP2 Launcher] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\CNAP2LAK.EXE [226784 2010-10-14] (CANON INC.)
HKU\S-1-5-21-2935431814-3145136583-2795862769-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4299968 2016-08-29] (Disc Soft Ltd)
HKU\S-1-5-21-2935431814-3145136583-2795862769-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2016-11-17] (Apple Inc.)
HKU\S-1-5-21-2935431814-3145136583-2795862769-1001\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1084688 2016-07-09] (Apple Inc.)
HKU\S-1-5-21-2935431814-3145136583-2795862769-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [110392 2016-11-17] (Apple Inc.)
HKU\S-1-5-21-2935431814-3145136583-2795862769-1001\...\Run: [iCloudPhotos] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe [356664 2016-11-17] (Apple Inc.)
HKU\S-1-5-21-2935431814-3145136583-2795862769-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [67896 2016-11-17] (Apple Inc.)
HKU\S-1-5-21-2935431814-3145136583-2795862769-1002\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2016-07-16] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [185632 2016-04-10] (NVIDIA Corporation)
AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [185632 2016-04-10] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWoW64\nvinit.dll => C:\WINDOWS\SysWoW64\nvinit.dll [164008 2016-04-10] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-09-10] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2016-04-10]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5-x64 07 C:\Program Files\Bonjour\mdnsNSP.dll No File
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 4.4.4.4
Tcpip\..\Interfaces\{54ff5337-5837-4a74-a662-b689417c71d9}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{54ff5337-5837-4a74-a662-b689417c71d9}: [DhcpNameServer] 8.8.8.8 4.4.4.4
Tcpip\..\Interfaces\{b0bae3d4-87e4-4811-8f54-994923102b5a}: [DhcpNameServer] 10.0.0.138

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-2935431814-3145136583-2795862769-1001 -> {DA884FE0-40CB-4134-8821-AEE461F47D17} URL = hxxp://tv.seznam.cz/hledej?w={searchTerms}&sourceid=QuickSearch_16194
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-12-04] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-12-04] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2016-12-04] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\ssv.dll [2016-04-10] (Oracle Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-12-04] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-04-10] (Oracle Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-04] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-04] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-04] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-12-04] (Microsoft Corporation)

FireFox:
========
FF HKU\S-1-5-21-2935431814-3145136583-2795862769-1001\...\Firefox\Extensions: [xdmff@xdman.sourceforge.net] - C:\Users\Felly\Desktop\aaa\XDM\xdmff => not found
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll [2014-07-09] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll [2014-07-09] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\dtplugin\npDeployJava1.dll [2016-04-10] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\plugin2\npjp2.dll [2016-04-10] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-12-04] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-12-04] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-07-23] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-07-23] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-21] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-21] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)

Chrome:
=======
CHR Profile: C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default [2017-01-10]
CHR Extension: (Adblock Plus) - C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-10-27]
CHR Extension: (AdBlock) - C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-12-29]
CHR Extension: (Avast Online Security) - C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-12-18]
CHR Extension: (Link to file on GD) - C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Extensions\jogjmeegdjegaoilmiinaplaljoglcnm [2017-01-06]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-07-28]
CHR Extension: (Chrome Media Router) - C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-21]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-09-10] (AVAST Software)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3698888 2016-12-04] (Microsoft Corporation)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1467072 2016-08-29] (Disc Soft Ltd)
R2 LPlatSvc; C:\WINDOWS\system32\LPlatSvc.exe [710144 2016-04-10] (Lenovo.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-09-15] (Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [259176 2016-10-03] (Synaptics Incorporated)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
R2 WMCoreService; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [648744 2011-08-12] (Ericsson AB)
S2 Bonjour Service; "C:\Program Files\Bonjour\mDNSResponder.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [37656 2016-09-10] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [108816 2016-09-10] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [103064 2016-09-10] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-09-10] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [969184 2016-09-21] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [513632 2016-10-03] (AVAST Software)
S2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [163416 2016-09-10] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [293352 2016-10-13] (AVAST Software)
S3 BazisPortableCDBus; C:\WINDOWS\System32\drivers\BazisPortableCDBus.sys [283480 2016-04-10] (Sysprogs OU)
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-10-03] (Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2016-10-03] (Disc Soft Ltd)
R3 e1cexpress; C:\WINDOWS\system32\DRIVERS\e1c64x64.sys [468752 2016-04-10] (Intel Corporation)
R3 ecnssndis; C:\WINDOWS\System32\Drivers\wwuss64.sys [26664 2011-06-14] (Ericsson AB)
R3 ecnssndisfltr; C:\WINDOWS\System32\Drivers\wwussf64.sys [30248 2011-06-14] (Ericsson AB)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-05-25] (Huawei Technologies Co., Ltd.)
R3 l36wgps; C:\WINDOWS\system32\DRIVERS\l36wgps64.sys [101416 2011-07-01] (Ericsson AB)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-12-11] (Malwarebytes)
R3 Mbm3CBus; C:\WINDOWS\System32\drivers\Mbm3CBus.sys [419400 2011-04-29] (MCCI Corporation)
R3 Mbm3DevMt; C:\WINDOWS\system32\DRIVERS\Mbm3DevMt.sys [430664 2011-04-29] (MCCI Corporation)
R3 Mbm3mdfl; C:\WINDOWS\system32\DRIVERS\Mbm3mdfl.sys [19528 2011-04-29] (MCCI Corporation)
R3 Mbm3Mdm; C:\WINDOWS\system32\DRIVERS\Mbm3Mdm.sys [483400 2011-04-29] (MCCI Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 NETwNe64; C:\WINDOWS\System32\drivers\NETwew01.sys [3343872 2016-07-16] (Intel Corporation)
S3 niks4m2audio; C:\WINDOWS\System32\Drivers\niks4m2audio.sys [382920 2015-09-04] (Native Instruments GmbH)
S3 niks4m2usb; C:\WINDOWS\system32\DRIVERS\niks4m2usb.sys [104304 2015-09-04] (Native Instruments GmbH)
S3 niks8audio; C:\WINDOWS\System32\Drivers\niks8audio.sys [375208 2015-09-03] (Native Instruments GmbH)
S3 niks8usb; C:\WINDOWS\system32\DRIVERS\niks8usb.sys [95584 2015-09-03] (Native Instruments GmbH)
S3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [52912 2016-04-10] (Synaptics Incorporated)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R3 WwanUsbServ; C:\WINDOWS\System32\drivers\WwanUsbMp64.sys [268840 2011-08-12] (Ericsson AB)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-10 20:30 - 2017-01-10 20:31 - 00020861 _____ C:\Users\Felly\Desktop\FRST.txt
2017-01-10 20:28 - 2017-01-10 20:29 - 00112640 _____ (forum.viry.cz) C:\Users\Felly\Desktop\FRSTLauncher.exe
2017-01-10 20:27 - 2017-01-10 20:27 - 02419200 _____ (Farbar) C:\Users\Felly\Desktop\FRST64.exe
2017-01-10 15:52 - 2017-01-10 18:25 - 00000000 ____D C:\Users\Felly\Desktop\Ekonomika Podniku
2017-01-10 15:40 - 2017-01-10 15:40 - 00000000 ____D C:\WINDOWS\LastGood
2017-01-09 15:39 - 2017-01-09 15:39 - 00245340 _____ C:\Users\Felly\Downloads\EPUs_2 (1).xlsx
2017-01-09 15:39 - 2017-01-09 15:39 - 00036709 _____ C:\Users\Felly\Downloads\EPUs.xlsx
2017-01-09 14:59 - 2017-01-09 14:59 - 00311532 _____ C:\Users\Felly\Downloads\Dohromady-6-variant.pdf
2017-01-09 13:24 - 2017-01-09 13:24 - 00015515 _____ C:\Users\Felly\Downloads\Vysledky_5_1_2017_Pakova.xlsx
2017-01-09 13:23 - 2017-01-09 13:23 - 00012305 _____ C:\Users\Felly\Downloads\Seznam_Vysledky_ctvrtek_15_12_2016.xlsx
2017-01-09 12:59 - 2017-01-09 13:08 - 00245340 _____ C:\Users\Felly\Downloads\EPUs_2.xlsx
2017-01-09 10:55 - 2017-01-09 10:55 - 00000316 _____ C:\Users\Felly\Desktop\Com surrogate opět útočí.txt
2017-01-06 21:50 - 2017-01-06 21:56 - 397118142 _____ C:\Users\Felly\Downloads\HRA_O_TRŮNY_S02E01_Sever-nezapomíná.mp4
2017-01-05 17:32 - 2017-01-05 17:36 - 00000000 ____D C:\Users\Felly\Desktop\4.1.2017 vse
2017-01-02 17:27 - 2017-01-02 17:51 - 402385478 _____ C:\Users\Felly\Downloads\Hra-o-Truny-s01-06.-Zlatá-koruna.avi
2017-01-02 15:51 - 2017-01-02 15:58 - 00000000 ____D C:\Users\Felly\Desktop\¨deep
2017-01-02 15:33 - 2017-01-02 15:44 - 200217184 _____ C:\Users\Felly\Downloads\Deep-House-Redux-Vol.-1-(2016).rar
2016-12-30 19:29 - 2016-12-30 19:42 - 00000000 ____D C:\Users\Felly\Desktop\MS NOKIA
2016-12-30 19:07 - 2016-12-31 16:28 - 00000000 ____D C:\Users\Felly\Desktop\Silvestr
2016-12-29 17:43 - 2016-12-29 18:10 - 121564473 _____ C:\Users\Felly\Downloads\1x01-Na-kus-řeči-se-zvířaty-(seriál-BBC)---DVB-T-CZ.avi.crdownload
2016-12-25 08:58 - 2016-12-25 08:58 - 00007455 _____ C:\Users\Felly\Downloads\sledovane_udaje_25.12.2016.xls
2016-12-24 12:04 - 2016-12-24 12:04 - 00002486 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2016-12-24 10:25 - 2016-12-24 16:35 - 00012929 _____ C:\Users\Felly\Desktop\Drahá Anetko.docx
2016-12-24 09:52 - 2016-12-24 09:52 - 00284332 _____ C:\Users\Felly\Downloads\bellota.zip
2016-12-21 12:26 - 2016-12-21 12:26 - 00000000 ____D C:\Users\Felly\Desktop\Deep House
2016-12-21 11:55 - 2016-12-21 12:18 - 416596409 _____ C:\Users\Felly\Downloads\Deep-House.rar
2016-12-19 18:30 - 2016-12-19 18:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2016-12-19 18:29 - 2016-12-19 18:29 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk
2016-12-19 18:29 - 2016-12-19 18:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-12-19 18:29 - 2016-12-19 18:29 - 00000000 ____D C:\Program Files\iTunes
2016-12-19 18:29 - 2016-12-19 18:29 - 00000000 ____D C:\Program Files\iPod
2016-12-19 18:23 - 2016-12-19 18:24 - 80044631 _____ C:\Users\Felly\Downloads\Jillian Michaels 30 Day Shred Level 1.mp4
2016-12-17 12:29 - 2016-12-09 11:34 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-12-17 12:29 - 2016-12-09 11:34 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-12-17 12:29 - 2016-12-09 11:33 - 01354320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-12-17 12:29 - 2016-12-09 11:33 - 01173496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-12-17 12:29 - 2016-12-09 11:32 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-12-17 12:29 - 2016-12-09 11:29 - 02681200 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2016-12-17 12:29 - 2016-12-09 11:28 - 00764392 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2016-12-17 12:29 - 2016-12-09 11:19 - 01293152 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2016-12-17 12:29 - 2016-12-09 11:18 - 01100128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2016-12-17 12:29 - 2016-12-09 11:18 - 00989024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2016-12-17 12:29 - 2016-12-09 11:18 - 00947552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi
2016-12-17 12:29 - 2016-12-09 11:18 - 00811872 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.exe
2016-12-17 12:29 - 2016-12-09 11:15 - 08168000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2016-12-17 12:29 - 2016-12-09 11:15 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2016-12-17 12:29 - 2016-12-09 11:14 - 01274712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-12-17 12:29 - 2016-12-09 11:14 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2016-12-17 12:29 - 2016-12-09 11:10 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2016-12-17 12:29 - 2016-12-09 11:10 - 01461200 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2016-12-17 12:29 - 2016-12-09 11:09 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2016-12-17 12:29 - 2016-12-09 11:01 - 02323728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2016-12-17 12:29 - 2016-12-09 11:01 - 01503544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2016-12-17 12:29 - 2016-12-09 10:57 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2016-12-17 12:29 - 2016-12-09 10:52 - 01435896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2016-12-17 12:29 - 2016-12-09 10:52 - 01415752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2016-12-17 12:29 - 2016-12-09 10:51 - 00117240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll
2016-12-17 12:29 - 2016-12-09 10:45 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-12-17 12:29 - 2016-12-09 10:45 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\WordBreakers.dll
2016-12-17 12:29 - 2016-12-09 10:41 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WordBreakers.dll
2016-12-17 12:29 - 2016-12-09 10:40 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2016-12-17 12:29 - 2016-12-09 10:38 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2016-12-17 12:29 - 2016-12-09 10:37 - 00411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\facecredentialprovider.dll
2016-12-17 12:29 - 2016-12-09 10:37 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-12-17 12:29 - 2016-12-09 10:36 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2016-12-17 12:29 - 2016-12-09 10:36 - 03059200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2016-12-17 12:29 - 2016-12-09 10:36 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2016-12-17 12:29 - 2016-12-09 10:36 - 00410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2016-12-17 12:29 - 2016-12-09 10:33 - 03777536 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-12-17 12:29 - 2016-12-09 10:33 - 01589760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
2016-12-17 12:29 - 2016-12-09 10:31 - 03689984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2016-12-17 12:29 - 2016-12-09 10:31 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2016-12-17 12:29 - 2016-12-09 10:30 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2016-12-17 12:29 - 2016-12-09 10:29 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-12-17 12:29 - 2016-12-09 10:28 - 03306496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2016-12-17 12:29 - 2016-12-09 10:27 - 13084160 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-12-17 12:29 - 2016-12-09 10:27 - 05114368 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2016-12-17 12:29 - 2016-12-09 10:27 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2016-12-17 12:29 - 2016-12-09 10:26 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2016-12-17 12:29 - 2016-12-09 10:24 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-12-17 12:29 - 2016-12-09 10:23 - 12177920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-12-17 12:29 - 2016-12-09 10:22 - 02820096 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2016-12-17 12:29 - 2016-12-09 10:22 - 02688512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-12-17 12:29 - 2016-12-09 10:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-12-17 12:29 - 2016-12-09 10:21 - 00716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2016-12-17 12:29 - 2016-12-09 10:19 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2016-12-17 12:29 - 2016-12-09 10:19 - 00433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2016-12-17 12:29 - 2016-12-09 10:19 - 00261120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2016-12-17 12:29 - 2016-12-09 10:19 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2016-12-17 12:29 - 2016-12-09 10:19 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditBufferTestHook.dll
2016-12-17 12:29 - 2016-12-09 10:18 - 02138112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2016-12-17 12:29 - 2016-12-09 10:16 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2016-12-17 12:29 - 2016-12-09 10:16 - 00353280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2016-12-17 12:29 - 2016-12-09 10:15 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2016-12-17 12:29 - 2016-12-09 10:15 - 00092672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputLocaleManager.dll
2016-12-17 12:29 - 2016-12-09 10:15 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditBufferTestHook.dll
2016-12-17 12:29 - 2016-11-02 11:25 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2016-12-17 12:28 - 2016-12-09 11:42 - 01637728 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-12-17 12:28 - 2016-12-09 11:42 - 00137568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-12-17 12:28 - 2016-12-09 11:30 - 00377184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2016-12-17 12:28 - 2016-12-09 11:27 - 00172528 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll
2016-12-17 12:28 - 2016-12-09 11:20 - 02677544 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2016-12-17 12:28 - 2016-12-09 11:20 - 02189664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-12-17 12:28 - 2016-12-09 11:20 - 01738560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2016-12-17 12:28 - 2016-12-09 11:20 - 00658784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2016-12-17 12:28 - 2016-12-09 11:20 - 00402272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2016-12-17 12:28 - 2016-12-09 11:19 - 00168424 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll
2016-12-17 12:28 - 2016-12-09 11:18 - 02913144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2016-12-17 12:28 - 2016-12-09 11:18 - 01267512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
2016-12-17 12:28 - 2016-12-09 11:18 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-12-17 12:28 - 2016-12-09 11:11 - 02048496 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2016-12-17 12:28 - 2016-12-09 11:01 - 00861024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2016-12-17 12:28 - 2016-12-09 11:00 - 00106896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll
2016-12-17 12:28 - 2016-12-09 10:59 - 02166752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2016-12-17 12:28 - 2016-12-09 10:59 - 00846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
2016-12-17 12:28 - 2016-12-09 10:57 - 06668040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-12-17 12:28 - 2016-12-09 10:56 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-12-17 12:28 - 2016-12-09 10:47 - 22563328 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-12-17 12:28 - 2016-12-09 10:42 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll
2016-12-17 12:28 - 2016-12-09 10:41 - 00380928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wincorlib.dll
2016-12-17 12:28 - 2016-12-09 10:37 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2016-12-17 12:28 - 2016-12-09 10:36 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2016-12-17 12:28 - 2016-12-09 10:34 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2016-12-17 12:28 - 2016-12-09 10:34 - 00288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll
2016-12-17 12:28 - 2016-12-09 10:32 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2016-12-17 12:28 - 2016-12-09 10:31 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2016-12-17 12:28 - 2016-12-09 10:30 - 23677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-12-17 12:28 - 2016-12-09 10:30 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-12-17 12:28 - 2016-12-09 10:28 - 01004544 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2016-12-17 12:28 - 2016-12-09 10:27 - 19417088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-12-17 12:28 - 2016-12-09 10:26 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-12-17 12:28 - 2016-12-09 10:25 - 00376832 _____ (Microsoft Corporation) C:\WINDOWS\system32\CryptoWinRT.dll
2016-12-17 12:28 - 2016-12-09 10:22 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-12-17 12:28 - 2016-12-09 10:21 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-12-17 12:28 - 2016-12-09 10:21 - 01512960 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-12-17 12:28 - 2016-12-09 10:20 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-12-17 12:28 - 2016-12-09 10:20 - 03198464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2016-12-17 12:28 - 2016-12-09 10:20 - 00730624 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2016-12-17 12:28 - 2016-12-09 10:20 - 00187392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2016-12-17 12:28 - 2016-12-09 10:20 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe
2016-12-17 12:28 - 2016-12-09 10:18 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-12-17 12:28 - 2016-12-09 10:18 - 00165376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2016-12-17 12:28 - 2016-12-09 10:17 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2016-12-17 12:28 - 2016-12-09 10:17 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2016-12-17 12:28 - 2016-12-09 10:16 - 01880576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2016-12-17 12:28 - 2016-12-09 09:54 - 00483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2016-12-17 12:28 - 2016-11-02 11:28 - 00807424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2016-12-17 12:28 - 2016-09-15 17:36 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll
2016-12-13 10:27 - 2016-12-13 10:27 - 00028160 _____ C:\Users\Felly\Documents\dohoda-o-zapujceni-veci.doc
2016-12-13 10:20 - 2016-12-13 10:20 - 00029184 _____ C:\Users\Felly\Downloads\dohoda-o-zapujceni-veci.doc
2016-12-13 10:13 - 2016-12-13 10:13 - 00038912 _____ C:\Users\Felly\Downloads\smlouva-o-najmu-dopravniho-prostredku.doc
2016-12-12 21:41 - 2016-12-12 21:41 - 00000000 ___SD C:\Users\Felly\Documents\Zdroje dat
2016-12-12 21:36 - 2016-12-12 21:59 - 00000000 ____D C:\Users\Felly\Documents\EPUs
2016-12-12 20:16 - 2016-12-12 21:03 - 00313093 _____ C:\Users\Felly\Downloads\Layout úklid.pptx
2016-12-12 11:30 - 2016-12-12 11:31 - 03699008 _____ C:\Users\Felly\Downloads\Daniel-Rose---Sex-God-Method---CZ.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-10 20:30 - 2016-11-29 19:53 - 00000000 ____D C:\FRST
2017-01-10 19:53 - 2016-09-10 18:30 - 01151378 _____ C:\WINDOWS\system32\perfh005.dat
2017-01-10 19:53 - 2016-09-10 18:30 - 00294994 _____ C:\WINDOWS\system32\perfc005.dat
2017-01-10 19:53 - 2016-04-10 13:20 - 03406048 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-01-10 19:24 - 2016-09-10 08:36 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-01-10 19:04 - 2016-04-13 18:10 - 00000000 ____D C:\Users\Felly\AppData\Roaming\vlc
2017-01-10 16:35 - 2016-04-10 13:15 - 00000000 ____D C:\Users\Felly\AppData\Local\Packages
2017-01-10 15:40 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-01-10 15:37 - 2016-11-02 20:11 - 00000000 ___RD C:\Users\Felly\iCloudDrive
2017-01-10 15:36 - 2016-09-10 08:43 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-01-10 15:36 - 2016-09-10 08:37 - 00000000 ____D C:\ProgramData\NVIDIA
2017-01-10 15:35 - 2016-09-10 08:38 - 00000000 ____D C:\Users\UpdatusUser
2017-01-10 15:35 - 2016-07-16 07:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-01-10 15:35 - 2016-04-18 06:12 - 00000000 ____D C:\AdwCleaner
2017-01-10 15:25 - 2016-09-10 08:43 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2017-01-10 15:25 - 2016-04-10 19:29 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-01-10 15:24 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-01-10 15:24 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-01-09 13:53 - 2016-12-05 11:21 - 00000000 ____D C:\Users\Felly\Desktop\prosinec
2017-01-09 10:56 - 2016-11-28 12:48 - 00000000 ____D C:\Program Files\trend micro
2017-01-02 20:47 - 2016-09-10 08:43 - 00004278 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2017-01-02 14:51 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2016-12-31 16:29 - 2016-11-02 20:21 - 00000000 ____D C:\Users\Felly\AppData\Roaming\Mp3tag
2016-12-30 18:34 - 2016-10-29 18:39 - 00003860 _____ C:\WINDOWS\PFRO.log
2016-12-30 18:34 - 2016-09-10 08:36 - 04972232 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-12-30 17:18 - 2016-09-10 08:38 - 00000000 ____D C:\Users\Felly
2016-12-30 17:18 - 2016-06-22 15:21 - 00000000 ____D C:\Users\Felly\AppData\Roaming\Skype
2016-12-30 14:29 - 2016-07-16 07:04 - 00000000 ____D C:\Program Files (x86)\Common Files
2016-12-30 14:29 - 2016-06-22 15:21 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-12-30 14:29 - 2016-06-22 15:21 - 00000000 ____D C:\ProgramData\Skype
2016-12-24 17:04 - 2016-07-16 07:04 - 00000000 ____D C:\WINDOWS\system32\config
2016-12-24 12:04 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\assembly
2016-12-24 12:04 - 2016-07-16 12:47 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-12-24 12:03 - 2016-04-10 19:35 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2016-12-24 09:52 - 2016-07-16 12:47 - 00000000 __RSD C:\WINDOWS\Fonts
2016-12-21 11:55 - 2016-09-10 08:38 - 00524288 ___SH C:\WINDOWS\system32\config\COMPONENTS{b794f0c9-4b5d-11e6-80e4-e41d2d719790}.TMContainer00000000000000000002.regtrans-ms
2016-12-21 11:55 - 2016-09-10 08:38 - 00065536 ___SH C:\WINDOWS\system32\config\COMPONENTS{b794f0c9-4b5d-11e6-80e4-e41d2d719790}.TM.blf
2016-12-21 11:55 - 2016-07-16 07:04 - 55574528 _____ C:\WINDOWS\system32\config\COMPONENTS
2016-12-21 11:13 - 2016-04-18 06:05 - 00002272 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-12-21 11:06 - 2016-09-10 08:43 - 00003416 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-12-21 11:06 - 2016-09-10 08:43 - 00003292 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-12-21 11:06 - 2016-07-16 07:04 - 00000000 ___RD C:\Program Files (x86)
2016-12-21 11:06 - 2015-07-10 12:04 - 00000000 ____D C:\WINDOWS\Tasks
2016-12-20 11:28 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\rescache
2016-12-19 22:00 - 2016-06-20 19:25 - 00000000 ____D C:\Users\Felly\Documents\TrackMania
2016-12-19 21:47 - 2016-06-20 19:25 - 00000000 ____D C:\ProgramData\TrackMania
2016-12-19 18:36 - 2016-11-02 20:11 - 00000000 ____D C:\Users\Felly\AppData\Local\4109D927-F1D4-4F53-838A-5CF56A213B26.aplzod
2016-12-19 18:30 - 2016-09-10 08:38 - 00524288 ___SH C:\WINDOWS\system32\config\COMPONENTS{b794f0c9-4b5d-11e6-80e4-e41d2d719790}.TMContainer00000000000000000001.regtrans-ms
2016-12-19 18:29 - 2016-11-02 19:49 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-12-19 18:29 - 2016-07-16 07:04 - 00000000 ___RD C:\Program Files
2016-12-19 18:29 - 2015-07-10 12:04 - 00000000 __RHD C:\Users\Public\Desktop
2016-12-18 13:39 - 2016-07-16 07:04 - 00000000 ____D C:\WINDOWS\WinSxS
2016-12-17 17:46 - 2016-07-16 07:04 - 00262144 _____ C:\Users\Default\NTUSER.DAT
2016-12-17 17:44 - 2016-09-10 08:36 - 00524288 ___SH C:\WINDOWS\system32\config\DRIVERS{b794f0cf-4b5d-11e6-80e4-e41d2d719790}.TMContainer00000000000000000001.regtrans-ms
2016-12-17 17:44 - 2016-09-10 08:36 - 00065536 ___SH C:\WINDOWS\system32\config\DRIVERS{b794f0cf-4b5d-11e6-80e4-e41d2d719790}.TM.blf
2016-12-17 17:44 - 2016-07-16 12:47 - 00000796 ___SH C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
2016-12-17 17:44 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\en-US
2016-12-17 17:44 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\en-US
2016-12-17 17:44 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\drivers
2016-12-17 17:44 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\Boot
2016-12-17 17:44 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2016-12-17 17:44 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppPatch
2016-12-17 12:35 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-12-17 12:32 - 2016-04-10 14:28 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-12-17 12:30 - 2016-04-10 14:28 - 135632432 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-12-13 10:27 - 2016-04-10 13:15 - 00000000 ___RD C:\Users\Felly\Documents
2016-12-12 11:34 - 2016-11-24 15:07 - 00000000 ____D C:\Users\Felly\Desktop\iTunes
2016-12-12 00:56 - 2016-07-16 12:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-12-12 00:56 - 2016-07-16 12:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-11 18:30 - 2016-11-29 20:55 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

==================== Files in the root of some directories =======

2016-05-02 11:55 - 2016-05-02 12:07 - 0000132 _____ () C:\Users\Felly\AppData\Roaming\Adobe Formát PNG CS6 – předvolby
2014-07-09 12:01 - 2014-07-09 12:01 - 0022976 _____ (Intel Corporation) C:\Users\Felly\AppData\Roaming\JomCap.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avast Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Felly\Desktop" je 65909 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]


==================== End Of Log ==============================
Přílohy
Addition.zip
(4.29 KiB) Staženo 155 x

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118199
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: COM Surrogate opět útočí

#6 Příspěvek od Rudy »

Otevřte poznámkový blok a zkopírujte do něj:
Start
S2 Bonjour Service; "C:\Program Files\Bonjour\mDNSResponder.exe" [X]

EmptyTemp:
End
Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Z logu:
Velikost slozky "C:\Users\Felly\Desktop" je 65909 MB.
To je příliš mnoho a může to zpomalovat start systému. Vytvořte v C:\Users\Felly novou složku, do níž přesuňte všechna data z plochy (kromě zástupců). Na plochu si pak dejte zástupce té složky pro snazší přístup.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Felly006
Návštěvník
Návštěvník
Příspěvky: 22
Registrován: 28 lis 2016 12:41

Re: COM Surrogate opět útočí

#7 Příspěvek od Felly006 »

Plochu přesunu hned zítra a poté defragmentuji disk. Díky za dnešní progress =)

Fix result of Farbar Recovery Scan Tool (x64) Version: 08-01-2017
Ran by Felly (10-01-2017 21:59:59) Run:2
Running from C:\Users\Felly\Desktop
Loaded Profiles: Felly & UpdatusUser (Available Profiles: Felly & UpdatusUser)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
S2 Bonjour Service; "C:\Program Files\Bonjour\mDNSResponder.exe" [X]

EmptyTemp:
End
*****************

HKLM\System\CurrentControlSet\Services\Bonjour Service => key removed successfully
Bonjour Service => service removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 189440253 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 10237863 B
Edge => 887184 B
Chrome => 819002204 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 7382 B
NetworkService => 0 B
Felly => 223971423 B
UpdatusUser => 0 B

RecycleBin => 0 B
EmptyTemp: => 1.2 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 22:00:40 ====

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118199
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: COM Surrogate opět útočí

#8 Příspěvek od Rudy »

Smazáno. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Felly006
Návštěvník
Návštěvník
Příspěvky: 22
Registrován: 28 lis 2016 12:41

Re: COM Surrogate opět útočí

#9 Příspěvek od Felly006 »

Dneska jsem opět viděl COM Surrogate v procesech hned 2x a stále mi vyskakují nepříjemné reklamy v Chrome. :o

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118199
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: COM Surrogate opět útočí

#10 Příspěvek od Rudy »

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Felly006
Návštěvník
Návštěvník
Příspěvky: 22
Registrován: 28 lis 2016 12:41

Re: COM Surrogate opět útočí

#11 Příspěvek od Felly006 »

Dnes jsem opět zahlédl COM Surrogate v procesech :(

Malwarebytes
www.malwarebytes.com

-Podrobnosti logovacího souboru-
Datum skenování: 12.01.17
Čas skenování: 15:28
Logovací soubor:
Správce: Ano

-Informace o softwaru-
Verze: 3.0.5.1299
Verze komponentů: 1.0.43
Aktualizovat verzi balíku komponent: 1.0.987
Licence: Bezplatný

-Systémová informace-
OS: Windows 10
CPU: x64
Systém souborů: NTFS
Uživatel: FIRENTB\Felly

-Shrnutí skenování-
Typ skenování: Skenování hrozeb (Threat Scan)
Výsledek: Dokončeno
Skenované objekty: 430333
Uplynulý čas: 2 min, 19 sek

-Možnosti skenování-
Paměť: Povoleno
Start: Povoleno
Systém souborů: Povoleno
Archivy: Povoleno
Rootkity: Zakázáno
Heuristika: Povoleno
Potenciálně nežádoucí program: Povoleno
Potenciálně nežádoucí modifikace: Povoleno

-Podrobnosti skenování-
Proces: 0
(Nebyly zjištěny žádné škodlivé položky)

Modul: 0
(Nebyly zjištěny žádné škodlivé položky)

Klíč registru: 0
(Nebyly zjištěny žádné škodlivé položky)

Hodnota v registru: 0
(Nebyly zjištěny žádné škodlivé položky)

Datové proudy: 0
(Nebyly zjištěny žádné škodlivé položky)

Adresář: 0
(Nebyly zjištěny žádné škodlivé položky)

Soubor: 1
PUP.Optional.CrossRider, C:\USERS\FELLY\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\https_d19tqk5t6qcjac.cloudfront.net_0.localstorage, Žádná uživatelská akce, [306], [256629],1.0.987

Fyzický sektor: 0
(Nebyly zjištěny žádné škodlivé položky)


(end)

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118199
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: COM Surrogate opět útočí

#12 Příspěvek od Rudy »

Nalezenou položku smažte a restartujte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Felly006
Návštěvník
Návštěvník
Příspěvky: 22
Registrován: 28 lis 2016 12:41

Re: COM Surrogate opět útočí

#13 Příspěvek od Felly006 »

Provedeno, počítač se aktualizoval, vyskakovacích reklam ubylo. Velmi často se však stává i na stránkách viry.cz a fóra, že vyskakují reklamy typu OPRAVA Windows atd. v samostatné kartě, viz příloha. Je to stále nějaký adware nebo je to standardní reklama na vašich stránkách? COM Surrogate se stále objevuje v procesech, plocha je vyčištěná.
Přílohy
příloha.zip
(270.31 KiB) Staženo 138 x

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 118199
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: COM Surrogate opět útočí

#14 Příspěvek od Rudy »

Kromě reklamních bannerů, které vidíte na ploše, tu vyskakovací reklamy nejsou. Zkuste ještě tyto skeny:

1. Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize




autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;





Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem.

a

2. Junkware removal tool: http://thisisudax.org/downloads/JRT.exe
•Ulozte nejlepe na plochu
•Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
•Probehne vytvoreni zalohy a nasledne prohledavani
•Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Felly006
Návštěvník
Návštěvník
Příspěvky: 22
Registrován: 28 lis 2016 12:41

Re: COM Surrogate opět útočí

#15 Příspěvek od Felly006 »

Zoek.exe v5.0.0.1 Updated 19-September-2016
Tool run by Felly on 14.01.2017 at 11:23:36,63.
Microsoft Windows 10 Pro 10.0.14393 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Felly\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

14.01.2017 11:24:22 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\Seznam.cz deleted successfully
C:\PROGRA~2\Team17 deleted successfully
C:\Program Files\Image-Line deleted successfully
C:\Program Files\Lenovo deleted successfully
C:\PROGRA~3\Comms deleted successfully
C:\PROGRA~3\SoftwareDistribution deleted successfully
C:\Users\UpdatusUser\AppData\LocalLow deleted successfully
C:\Users\Felly\AppData\Local\ActiveSync deleted successfully
C:\Users\Felly\AppData\Local\NetworkTiles deleted successfully
C:\Users\Felly\AppData\Local\PeerDistRepub deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Maps deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistPub deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistRepub deleted successfully
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\NetworkTiles deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-2935431814-3145136583-2795862769-1002\SOFTWARE\Microsoft\Internet Explorer\Approved Extensions\{6E727987-C8EA-44DA-8749-310C0FBE3C3E} deleted successfully
HKEY_USERS\S-1-5-21-2935431814-3145136583-2795862769-1001\SOFTWARE\Mozilla\Firefox\Extensions\xdmff@xdman.sourceforge.net deleted successfully

==== Deleting Services ======================


==== Deleting Files \ Folders ======================

C:\PROGRA~2\Seznam.cz not found
C:\PROGRA~2\Team17 not found
C:\Users\Felly\.android deleted
C:\JkDefrag.exe deleted
C:\PROGRA~3\{4D0E48A9-ECF9-4029-9600-9F629A79750C} deleted
C:\PROGRA~3\{5BEDCDDD-6193-41E1-8C9B-C688715F85CD} deleted
C:\PROGRA~3\{90D8CE90-3E6B-4034-A281-BC9F19B60A5B} deleted
C:\PROGRA~3\{A198E666-CBDA-4466-B380-109F6AA58D3B} deleted
C:\PROGRA~3\{EB9C1D32-304E-4E8E-8D44-C4102A190A39} deleted
C:\PROGRA~3\Package Cache deleted
C:\windows\SysNative\GroupPolicy\Adm deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\gpt.ini deleted
C:\WINDOWS\Syswow64\GroupPolicy\Adm deleted
C:\WINDOWS\Syswow64\GroupPolicy\Machine deleted
C:\WINDOWS\Syswow64\GroupPolicy\User deleted
C:\WINDOWS\Syswow64\GroupPolicy\gpt.ini.old deleted
C:\WINDOWS\Syswow64\SET75FE.tmp deleted

==== Fake Chromium Profiles Check ======================

Fake profile C:\Users\Default\AppData\Local\Google\Chrome deleted

==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
efaidnbmnnnibpcajpcglclefindmkaj - No path found[]
gomekmidlodglbbmalcneegieacbdmki - No path found[]

Avast Online Security - Felly\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki
Chrome Media Router - Felly\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm

==== Chromium Fix ======================

C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.donation-tools.org_0.localstorage deleted successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.donation-tools.org_0.localstorage-journal deleted successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_d10lpsik1i8c69.cloudfront.net_0.localstorage deleted successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_d10lpsik1i8c69.cloudfront.net_0.localstorage-journal deleted successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_d19tqk5t6qcjac.cloudfront.net_0.localstorage-journal deleted successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_pstatic.davebestdeals.com_0.localstorage deleted successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_pstatic.davebestdeals.com_0.localstorage-journal deleted successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.davebestdeals.com_0.localstorage deleted successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.davebestdeals.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
"Search Page"="http://www.google.com"
"Default_Search_URL"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/p/?LinkId=255141"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTer ... ORM=IE8SRC
HKCU\SearchScopes\{DA884FE0-40CB-4134-8821-AEE461F47D17} - http://tv.seznam.cz/hledej?w={searchTer ... arch_16194

==== Reset Google Chrome ======================

C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Felly\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Felly\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Felly\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Felly\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Felly\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=70 folders=27 144603180 bytes)

==== Empty Temp Folders ======================

C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\Felly\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 14.01.2017 at 11:42:16,38 ======================




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.0 (12.05.2016)
Operating System: Windows 10 Pro x64
Ran by Felly (Administrator) on 14.01.2017 at 11:45:22,79
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0




Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.01.2017 at 11:47:08,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Zamčeno