Prosím o kontrolu logu RSIT

Zpráva

angeldave · #1 Příspěvek od **angeldave** » 25 zář 2015 20:06

dobrý den, prosím o preventivní kontrolu logu z RSIt
neustále mi vyskakují reklamy po kliknuti na hypertextový odkaz. mam i ABP, nýbrž asi nic platný.

lu Logfile of random's system information tool 1.10 (written by random/random)
Run by Dave at 2015-09-25 21:05:52
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 447 MB (1%) free of 67 GB
Total RAM: 3071 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:05:59, on 25.9.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18015)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
C:\Users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
D:\iTunes\iTunesHelper.exe
C:\Users\Dave\AppData\Local\Google\Update\1.3.28.15\GoogleCrashHandler.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\Dave.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkID= ... artPage%7D
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [SoundMax] "C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe" /tray
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files (x86)\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [Google Update] "C:\Users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - http://dlcdnet.asus.com/pub/ASUS/misc/d ... .2.5.0.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - http://www.nvidia.com/content/DriverDow ... rtScan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EFD331EA-BB3F-4B83-AB36-3AF0E7BE7F47}: NameServer = 82.163.143.172,82.163.142.174
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\Windows\SYSTEM32\crypserv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 10 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9584 bytes

======Listing Processes======

\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe"
"C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
"C:\Program Files\Bonjour\mDNSResponder.exe"
C:\Windows\System32\svchost.exe -k utcsvc
"C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k SDRSVC
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" nss 5a317625-6aae-49ff-b187-2507cf673714 1
\??\C:\Windows\system32\conhost.exe "-823972040-1630799353402905540-9869612993260525801537331617788338889-1245307532
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2436
"C:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"taskhost.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" serviceapp
\??\C:\Windows\system32\conhost.exe "3235220761221411772-1267690603289583553-585176819-986108246-1269626930-94993616
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
"C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe" /tray
"C:\Users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe"
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"D:\iTunes\iTunesHelper.exe"
"C:\Users\Dave\AppData\Local\Google\Update\1.3.28.15\GoogleCrashHandler.exe"
"C:\Users\Dave\AppData\Local\Google\Update\1.3.28.15\GoogleCrashHandler64.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Windows\system32\GWX\GWX.exe"
"C:\Program Files\iPod\bin\iPodService.exe"
"C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer10_Logfile.log
"C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer10_Logfile.log
"C:\Program Files (x86)\CCleaner\CCleaner.exe" /MONITOR /uac
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe"
"C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe" --type=watcher --on-initialized-event-handle=348 --parent-handle=352
"C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="2972.0.1525631161\48156774" --supports-dual-gpus=false --gpu-driver-bug-workarounds=2,20,45,55 --gpu-vendor-id=0x10de --gpu-device-id=0x05e3 --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.4144 --ignored=" --type=renderer " /prefetch:822062411
"C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/AutofillEnabled/Default/*BrowserBlacklist/Enabled/CaptivePortalInterstitial/Enabled/*ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/Unused_2/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledNoIdForLargePopulation/*RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/Default/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/*SdchPersistence/Default/SessionRestoreBackgroundLoading/Restore/*SettingsEnforcement/enforce_always_with_extensions_and_dse/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_13/*UMA-Uniformity-Trial-10-Percent/group_07/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_02/*UMA-Uniformity-Trial-5-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="2972.2.1167899121\1661997753" --font-cache-shared-handle=2508 /prefetch:673131151
"C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/AutofillEnabled/Default/*BrowserBlacklist/Enabled/CaptivePortalInterstitial/Enabled/*ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/Unused_2/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledNoIdForLargePopulation/*RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/Default/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/*SdchPersistence/Default/SessionRestoreBackgroundLoading/Restore/*SettingsEnforcement/enforce_always_with_extensions_and_dse/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_13/*UMA-Uniformity-Trial-10-Percent/group_07/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_02/*UMA-Uniformity-Trial-5-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="2972.3.1546902508\778802937" --font-cache-shared-handle=2652 /prefetch:673131151
taskeng.exe {AEE1DA71-5CA3-4364-8951-91E9A2C7CBB9}
"C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/*AutofillEnabled/Default/*BrowserBlacklist/Enabled/*CaptivePortalInterstitial/Enabled/*ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/*NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/Unused_2/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/*PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledNoIdForLargePopulation/*RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/Default/*ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/*SdchPersistence/Default/SessionRestoreBackgroundLoading/Restore/*SettingsEnforcement/enforce_always_with_extensions_and_dse/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_13/*UMA-Uniformity-Trial-10-Percent/group_07/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_02/*UMA-Uniformity-Trial-5-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="2972.22.1029832319\2136460250" --font-cache-shared-handle=4252 /prefetch:673131151
C:\Windows\system32\AUDIODG.EXE 0x304
"C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/*AutofillEnabled/Default/*BrowserBlacklist/Enabled/*CaptivePortalInterstitial/Enabled/*ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/*NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/Unused_2/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/*PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledNoIdForLargePopulation/*RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/Default/*ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/*SdchPersistence/Default/SessionRestoreBackgroundLoading/Restore/*SettingsEnforcement/enforce_always_with_extensions_and_dse/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_13/*UMA-Uniformity-Trial-10-Percent/group_07/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_02/*UMA-Uniformity-Trial-5-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="2972.25.1115840785\648610991" --font-cache-shared-handle=6720 /prefetch:673131151
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/*AutofillEnabled/Default/*BrowserBlacklist/Enabled/*CaptivePortalInterstitial/Enabled/*ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/*NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/Unused_2/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/*PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledNoIdForLargePopulation/*RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/Default/*ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/*SdchPersistence/Default/SessionRestoreBackgroundLoading/Restore/*SettingsEnforcement/enforce_always_with_extensions_and_dse/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_13/*UMA-Uniformity-Trial-10-Percent/group_07/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_02/*UMA-Uniformity-Trial-5-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="2972.26.1058839861\10357107" --font-cache-shared-handle=5380 /prefetch:673131151
"C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/*AutofillEnabled/Default/*BrowserBlacklist/Enabled/*CaptivePortalInterstitial/Enabled/*ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group8 pct:10h stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/*NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/Unused_2/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/*PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledNoIdForLargePopulation/*RefreshTokenDeviceId/Enabled/RememberCertificateErrorDecisions/Default/*ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/*SdchPersistence/Default/SessionRestoreBackgroundLoading/Restore/*SettingsEnforcement/enforce_always_with_extensions_and_dse/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group6/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-1-Percent/group_13/*UMA-Uniformity-Trial-10-Percent/group_07/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_02/*UMA-Uniformity-Trial-5-Percent/default/*UMA-Uniformity-Trial-50-Percent/default/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="2972.27.1866819986\1106800302" --font-cache-shared-handle=4244 /prefetch:673131151
"C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe" --type=ppapi --channel="2972.28.568706105\1884359633" --ppapi-flash-args=enable_hw_video_decode=1 --lang=cs --ignored=" --type=renderer " /prefetch:-632637702
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 536 540 548 65536 544
"C:\Users\Dave\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2069795599-3599756936-1552587187-1001Core.job - C:\Users\Dave\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2069795599-3599756936-1552587187-1001UA.job - C:\Users\Dave\AppData\Local\Facebook\Update\FacebookUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2069795599-3599756936-1552587187-1001Core.job - C:\Users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2069795599-3599756936-1552587187-1001UA.job - C:\Users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\uz9t4kyi.default

prefs.js - "browser.search.useDBForOrder" - true
prefs.js - "browser.startup.homepage" - "http://www.seznam.cz/"
prefs.js - "extensions.enabledItems" - "{B64D9B05-48E1-4CEB-BF58-E0643994E900}:4.6.0.1126, {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.28"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobeï¿½ Flashï¿½ Player 19.0.0.185 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=]
"Description"=iTunes Detector Plug-in
"Path"=

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0]
"Description"=
"Path"=D:\iTunes\Mozilla Plugins\npitunes.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.7.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\SysWOW64\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.6]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobeï¿½ Flashï¿½ Player 19.0.0.185 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.65.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/JavaPlugin,version=10.65.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videolan.org/vlc,version=2.2.1]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files\VideoLAN\VLC\npvlc.dll

C:\Program Files (x86)\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd}
{AB2CE124-6272-4b12-94A9-7303C7397BD1}

C:\Program Files (x86)\Mozilla Firefox\components\
browser.xpt
browserdirprovider.dll
brwsrcmp.dll
components.list
FeedConverter.js
FeedProcessor.js
FeedWriter.js
fuelApplication.js
GPSDGeolocationProvider.js
jsconsole-clhandler.js
NetworkGeolocationProvider.js
nsAddonRepository.js
nsBadCertHandler.js
nsBlocklistService.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsContentDispatchChooser.js
nsContentPrefService.js
nsDefaultCLH.js
nsDownloadManagerUI.js
nsExtensionManager.js
nsFormAutoComplete.js
nsHandlerService.js
nsHelperAppDlg.js
nsINIProcessor.js
nsLivemarkService.js
nsLoginInfo.js
nsLoginManager.js
nsLoginManagerPrompter.js
nsMicrosummaryService.js
nsPlacesAutoComplete.js
nsPlacesDBFlush.js
nsPlacesTransactionsService.js
nsPrivateBrowsingService.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsTaggingService.js
nsTryToClose.js
nsUpdateService.js
nsUpdateServiceStub.js
nsUpdateTimerManager.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsURLFormatter.js
nsWebHandlerApp.js
pluginGlue.js
storage-Legacy.js
storage-mozStorage.js
txEXSLTRegExFunctions.js
WebContentConverter.js

C:\Program Files (x86)\Mozilla Firefox\plugins\
facepad__facebook_photo_album_downloader-0.8.2-fx.xpi
npnul32.dll
nppdf32.dll

C:\Program Files (x86)\Mozilla Firefox\searchplugins\
google.xml
jyxo-cz.xml
mall-cz.xml
seznam-cz.xml
slunecnice-cz.xml
wikipedia-cz.xml

C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\uz9t4kyi.default\extensions\
staged

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2015-04-30 1337000]
"ShadowPlay"=C:\Windows\system32\nvspcap64.dll [2015-01-16 1514528]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2015-05-01 2685072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMax"=C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [2008-09-24 3862528]
"CCleaner Monitoring"=C:\Program Files (x86)\CCleaner\CCleaner64.exe [2015-04-23 8204056]
"Google Update"=C:\Users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-29 144200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring]
C:\Program Files (x86)\CCleaner\CCleaner64.exe [2015-04-23 8204056]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4000 Series]
C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIBEE.EXE [2007-10-09 213504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Users\Dave\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-29 144200]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoogleChromeAutoLaunch_C62251D359A8F5B5CC8EADB510991ABB]
C:\Users\Dave\AppData\Local\Google\Chrome\Application\chrome.exe [2015-09-19 815944]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
C:\Program Files\Microsoft Security Client\msseces.exe [2015-04-30 1337000]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files (x86)\Skype\Phone\Skype.exe [2015-03-25 31682144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Startup Cleaner]
C:\Program Files (x86)\CM Data Software\CM DiskCleaner\Startup Cleaner.exe [2006-10-08 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
D:\Steam\steam.exe [2015-08-19 2899136]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"=C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [2009-06-05 1310720]
"iTunesHelper"=D:\iTunes\iTunesHelper.exe [2015-07-11 157992]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26 2217832]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLinkedConnections"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"mixer1"=wdmaud.drv
"VIDC.XFR1"=xfcodec64.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw64.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm
"wave2"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.txt - open - "C:\Program Files (x86)\PSPad editor\PSPad.exe" "%1"

======List of files/folders created in the last 3 months======

2015-09-21 23:26:55 ----D---- C:\Users\Dave\AppData\Roaming\TeamViewer
2015-09-21 23:26:46 ----A---- C:\Windows\system32\drivers\teamviewervpn.sys
2015-09-21 23:26:38 ----D---- C:\Program Files (x86)\TeamViewer
2015-09-12 05:56:03 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-09-12 05:56:00 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-09-12 05:56:00 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-09-12 05:55:59 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-09-12 05:55:57 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-09-12 05:55:57 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-09-12 05:55:56 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-09-12 05:55:56 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-09-12 05:55:56 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-09-12 05:55:54 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-09-12 05:55:54 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-09-12 05:55:54 ----A---- C:\Windows\SYSWOW64\jscript.dll
2015-09-12 05:55:53 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-09-12 05:55:52 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-09-12 05:55:51 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-09-12 05:55:50 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-09-12 05:55:50 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-09-12 05:55:50 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-09-12 05:55:50 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-09-12 05:55:50 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-09-12 05:55:48 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-09-12 05:55:48 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-09-12 05:55:48 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-09-12 05:55:48 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-09-12 05:55:47 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-09-12 05:55:47 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-09-12 05:55:46 ----A---- C:\Windows\system32\vbscript.dll
2015-09-12 05:55:46 ----A---- C:\Windows\system32\jscript9diag.dll
2015-09-12 05:55:46 ----A---- C:\Windows\system32\jscript.dll
2015-09-12 05:55:45 ----A---- C:\Windows\system32\jscript9.dll
2015-09-12 05:55:44 ----A---- C:\Windows\system32\ieui.dll
2015-09-12 05:55:43 ----A---- C:\Windows\system32\ieframe.dll
2015-09-12 05:55:41 ----A---- C:\Windows\system32\iesetup.dll
2015-09-12 05:55:41 ----A---- C:\Windows\system32\iernonce.dll
2015-09-12 05:55:41 ----A---- C:\Windows\system32\ie4uinit.exe
2015-09-12 05:55:40 ----A---- C:\Windows\system32\msrating.dll
2015-09-12 05:55:40 ----A---- C:\Windows\system32\iertutil.dll
2015-09-12 05:55:39 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-09-12 05:55:38 ----A---- C:\Windows\system32\ieUnatt.exe
2015-09-12 05:55:37 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-09-12 05:55:36 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-09-12 05:55:36 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-09-12 05:55:34 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-09-12 05:55:34 ----A---- C:\Windows\system32\mshtmled.dll
2015-09-12 05:55:34 ----A---- C:\Windows\system32\mshtml.dll
2015-09-12 05:55:33 ----A---- C:\Windows\system32\msfeeds.dll
2015-09-12 05:55:32 ----A---- C:\Windows\system32\wininet.dll
2015-09-12 05:55:32 ----A---- C:\Windows\system32\jsproxy.dll
2015-09-12 05:55:32 ----A---- C:\Windows\system32\iedkcs32.dll
2015-09-12 05:55:32 ----A---- C:\Windows\system32\ieapfltr.dll
2015-09-12 05:55:32 ----A---- C:\Windows\system32\dxtrans.dll
2015-09-12 05:55:32 ----A---- C:\Windows\system32\dxtmsft.dll
2015-09-12 05:55:31 ----A---- C:\Windows\system32\urlmon.dll
2015-09-12 05:55:31 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-09-10 14:17:14 ----A---- C:\Windows\SYSWOW64\tzres.dll
2015-09-10 14:17:13 ----A---- C:\Windows\system32\tzres.dll
2015-09-09 08:20:22 ----A---- C:\Windows\system32\schedsvc.dll
2015-09-09 08:20:19 ----A---- C:\Windows\SYSWOW64\authui.dll
2015-09-09 08:20:19 ----A---- C:\Windows\system32\consent.exe
2015-09-09 08:20:19 ----A---- C:\Windows\system32\authui.dll
2015-09-09 08:20:19 ----A---- C:\Windows\system32\appinfo.dll
2015-09-09 08:20:15 ----A---- C:\Windows\SYSWOW64\InkEd.dll
2015-09-09 08:20:15 ----A---- C:\Windows\system32\jnwmon.dll
2015-09-09 08:20:15 ----A---- C:\Windows\system32\InkEd.dll
2015-09-09 08:20:08 ----A---- C:\Windows\SYSWOW64\dwmcore.dll
2015-09-09 08:20:08 ----A---- C:\Windows\SYSWOW64\dwmapi.dll
2015-09-09 08:20:08 ----A---- C:\Windows\system32\dwmcore.dll
2015-09-09 08:20:08 ----A---- C:\Windows\system32\dwmapi.dll
2015-09-09 08:19:37 ----A---- C:\Windows\system32\UtcResources.dll
2015-09-09 08:19:37 ----A---- C:\Windows\system32\diagtrack.dll
2015-09-09 08:19:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2015-09-09 08:19:35 ----A---- C:\Windows\system32\tdh.dll
2015-09-09 08:19:35 ----A---- C:\Windows\system32\ntdll.dll
2015-09-09 08:19:35 ----A---- C:\Windows\system32\kernel32.dll
2015-09-09 08:19:34 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2015-09-09 08:19:33 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2015-09-09 08:19:33 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2015-09-09 08:19:32 ----A---- C:\Windows\SYSWOW64\tdh.dll
2015-09-09 08:19:32 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2015-09-09 08:19:32 ----A---- C:\Windows\system32\lsasrv.dll
2015-09-09 08:19:32 ----A---- C:\Windows\system32\KernelBase.dll
2015-09-09 08:19:32 ----A---- C:\Windows\system32\advapi32.dll
2015-09-09 08:19:31 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2015-09-09 08:19:30 ----A---- C:\Windows\system32\wow64.dll
2015-09-09 08:19:30 ----A---- C:\Windows\system32\rstrui.exe
2015-09-09 08:19:29 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-09-09 08:19:29 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-09-09 08:19:29 ----A---- C:\Windows\system32\winsrv.dll
2015-09-09 08:19:29 ----A---- C:\Windows\system32\srcore.dll
2015-09-09 08:19:29 ----A---- C:\Windows\system32\rpcrt4.dll
2015-09-09 08:19:29 ----A---- C:\Windows\system32\kerberos.dll
2015-09-09 08:19:29 ----A---- C:\Windows\system32\csrsrv.dll
2015-09-09 08:19:29 ----A---- C:\Windows\system32\conhost.exe
2015-09-09 08:19:28 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-09-09 08:19:28 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-09-09 08:19:28 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-09-09 08:19:28 ----A---- C:\Windows\SYSWOW64\setup16.exe
2015-09-09 08:19:28 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-09-09 08:19:28 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2015-09-09 08:19:28 ----A---- C:\Windows\system32\wdigest.dll
2015-09-09 08:19:28 ----A---- C:\Windows\system32\TSpkg.dll
2015-09-09 08:19:28 ----A---- C:\Windows\system32\sspicli.dll
2015-09-09 08:19:28 ----A---- C:\Windows\system32\smss.exe
2015-09-09 08:19:28 ----A---- C:\Windows\system32\schannel.dll
2015-09-09 08:19:28 ----A---- C:\Windows\system32\ncrypt.dll
2015-09-09 08:19:28 ----A---- C:\Windows\system32\msv1_0.dll
2015-09-09 08:19:28 ----A---- C:\Windows\system32\lsass.exe
2015-09-09 08:19:28 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-09-09 08:19:28 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-09-09 08:19:27 ----A---- C:\Windows\SYSWOW64\srclient.dll
2015-09-09 08:19:27 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-09-09 08:19:27 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2015-09-09 08:19:27 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2015-09-09 08:19:27 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2015-09-09 08:19:27 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-09-09 08:19:27 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-09-09 08:19:27 ----A---- C:\Windows\system32\wow64win.dll
2015-09-09 08:19:27 ----A---- C:\Windows\system32\sspisrv.dll
2015-09-09 08:19:27 ----A---- C:\Windows\system32\srclient.dll
2015-09-09 08:19:27 ----A---- C:\Windows\system32\secur32.dll
2015-09-09 08:19:27 ----A---- C:\Windows\system32\ntvdm64.dll
2015-09-09 08:19:27 ----A---- C:\Windows\system32\cryptbase.dll
2015-09-09 08:19:27 ----A---- C:\Windows\system32\credssp.dll
2015-09-09 08:19:27 ----A---- C:\Windows\system32\auditpol.exe
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-09-09 08:19:26 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-09-09 08:19:26 ----A---- C:\Windows\SYSWOW64\wow32.dll
2015-09-09 08:19:26 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-09-09 08:19:26 ----A---- C:\Windows\SYSWOW64\instnm.exe
2015-09-09 08:19:26 ----A---- C:\Windows\system32\wow64cpu.dll
2015-09-09 08:19:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2015-09-09 08:19:26 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2015-09-09 08:19:26 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2015-09-09 08:19:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 08:19:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2015-09-09 08:19:25 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-09-09 08:19:25 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-09-09 08:19:25 ----A---- C:\Windows\SYSWOW64\user.exe
2015-09-09 08:19:25 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-09-09 08:19:25 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2015-09-09 08:19:25 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-09-09 08:19:25 ----A---- C:\Windows\system32\msaudite.dll
2015-09-09 08:19:25 ----A---- C:\Windows\system32\apisetschema.dll
2015-09-09 08:19:25 ----A---- C:\Windows\system32\adtschema.dll
2015-09-09 08:19:24 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-09-09 08:19:24 ----A---- C:\Windows\system32\msobjs.dll
2015-09-09 08:19:00 ----A---- C:\Windows\SYSWOW64\msxml6.dll
2015-09-09 08:19:00 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2015-09-09 08:19:00 ----A---- C:\Windows\system32\msxml6.dll
2015-09-09 08:19:00 ----A---- C:\Windows\system32\msxml3.dll
2015-09-09 08:18:59 ----A---- C:\Windows\SYSWOW64\msxml6r.dll
2015-09-09 08:18:59 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2015-09-09 08:18:59 ----A---- C:\Windows\system32\msxml6r.dll
2015-09-09 08:18:59 ----A---- C:\Windows\system32\msxml3r.dll
2015-09-09 08:18:55 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2015-09-09 08:18:54 ----A---- C:\Windows\system32\appidapi.dll
2015-09-09 08:18:52 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2015-09-09 08:18:52 ----A---- C:\Windows\system32\appidsvc.dll
2015-09-09 08:18:50 ----A---- C:\Windows\system32\setbcdlocale.dll
2015-09-09 08:18:50 ----A---- C:\Windows\system32\drivers\appid.sys
2015-09-09 08:18:50 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2015-09-09 08:18:21 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2015-09-09 08:18:21 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2015-09-09 08:18:21 ----A---- C:\Windows\system32\win32k.sys
2015-09-09 08:18:21 ----A---- C:\Windows\system32\lpk.dll
2015-09-09 08:18:21 ----A---- C:\Windows\system32\atmlib.dll
2015-09-09 08:18:21 ----A---- C:\Windows\system32\atmfd.dll
2015-09-09 08:18:20 ----A---- C:\Windows\SYSWOW64\lpk.dll
2015-09-09 08:18:20 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2015-09-09 08:18:20 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2015-09-09 08:18:20 ----A---- C:\Windows\system32\fontsub.dll
2015-09-09 08:18:20 ----A---- C:\Windows\system32\dciman32.dll
2015-09-09 08:17:59 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2015-09-09 08:17:59 ----A---- C:\Windows\SYSWOW64\wups.dll
2015-09-09 08:17:59 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2015-09-09 08:17:59 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2015-09-09 08:17:59 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2015-09-09 08:17:59 ----A---- C:\Windows\system32\wuwebv.dll
2015-09-09 08:17:59 ----A---- C:\Windows\system32\wups2.dll
2015-09-09 08:17:59 ----A---- C:\Windows\system32\wups.dll
2015-09-09 08:17:59 ----A---- C:\Windows\system32\wudriver.dll
2015-09-09 08:17:59 ----A---- C:\Windows\system32\wucltux.dll
2015-09-09 08:17:59 ----A---- C:\Windows\system32\wuaueng.dll
2015-09-09 08:17:59 ----A---- C:\Windows\system32\wuauclt.exe
2015-09-09 08:17:59 ----A---- C:\Windows\system32\wuapp.exe
2015-09-09 08:17:59 ----A---- C:\Windows\system32\wuapi.dll
2015-09-09 08:17:59 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2015-09-09 08:17:59 ----A---- C:\Windows\system32\WinSetupUI.dll
2015-09-06 21:55:10 ----SHD---- C:\$RECYCLE.BIN
2015-09-06 21:55:05 ----D---- C:\Windows\temp
2015-09-06 21:55:04 ----A---- C:\ComboFix.txt
2015-09-06 21:18:03 ----D---- C:\AdwCleaner
2015-08-24 23:46:43 ----D---- C:\Program Files (x86)\StarnetPlayer-internal
2015-08-17 13:28:12 ----D---- C:\Program Files (x86)\RescueTime for Chrome ChromeOS
2015-08-16 10:57:59 ----D---- C:\Program Files (x86)\Looper for YouTube
2015-08-16 10:18:54 ----D---- C:\Program Files (x86)\SPOTS A better way to start
2015-08-12 00:34:53 ----A---- C:\Windows\SYSWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-12 00:34:53 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-11 21:42:48 ----A---- C:\Windows\system32\notepad.exe
2015-08-11 21:42:48 ----A---- C:\Windows\notepad.exe
2015-08-11 21:42:47 ----A---- C:\Windows\SYSWOW64\notepad.exe
2015-08-11 21:42:47 ----A---- C:\Windows\system32\generaltel.dll
2015-08-11 21:42:47 ----A---- C:\Windows\system32\devinv.dll
2015-08-11 21:42:47 ----A---- C:\Windows\system32\appraiser.dll
2015-08-11 21:42:46 ----A---- C:\Windows\system32\invagent.dll
2015-08-11 21:42:46 ----A---- C:\Windows\system32\aeinv.dll
2015-08-11 21:42:46 ----A---- C:\Windows\system32\acmigration.dll
2015-08-11 21:42:45 ----A---- C:\Windows\system32\mstscax.dll
2015-08-11 21:42:45 ----A---- C:\Windows\system32\CompatTelRunner.exe
2015-08-11 21:42:45 ----A---- C:\Windows\system32\aepdu.dll
2015-08-11 21:42:44 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2015-08-11 21:42:43 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2015-08-11 21:42:43 ----A---- C:\Windows\SYSWOW64\rdvidcrl.dll
2015-08-11 21:42:43 ----A---- C:\Windows\system32\wksprt.exe
2015-08-11 21:42:43 ----A---- C:\Windows\system32\tsgqec.dll
2015-08-11 21:42:43 ----A---- C:\Windows\system32\rdvidcrl.dll
2015-08-11 21:42:35 ----A---- C:\Windows\system32\sysmain.dll
2015-08-11 21:42:34 ----A---- C:\Windows\system32\drivers\mountmgr.sys
2015-08-11 21:42:30 ----A---- C:\Windows\system32\msmmsp.dll
2015-08-11 21:41:41 ----A---- C:\Windows\system32\basesrv.dll
2015-08-11 21:40:39 ----A---- C:\Windows\SYSWOW64\WebClnt.dll
2015-08-11 21:40:39 ----A---- C:\Windows\SYSWOW64\davclnt.dll
2015-08-11 21:40:39 ----A---- C:\Windows\system32\WebClnt.dll
2015-08-11 21:40:39 ----A---- C:\Windows\system32\davclnt.dll
2015-08-11 21:40:34 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2015-08-11 21:40:34 ----A---- C:\Windows\system32\FntCache.dll
2015-08-11 21:40:34 ----A---- C:\Windows\system32\DWrite.dll
2015-08-11 21:40:31 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2015-08-11 21:40:31 ----A---- C:\Windows\system32\d3d10warp.dll
2015-08-11 21:40:27 ----A---- C:\Windows\system32\shell32.dll
2015-08-11 21:40:25 ----A---- C:\Windows\SYSWOW64\shell32.dll
2015-08-11 21:40:01 ----A---- C:\Windows\system32\mcupdate_GenuineIntel.dll
2015-08-05 23:06:07 ----D---- C:\ProgramData\regid.1995-09.com.example
2015-08-05 23:06:06 ----D---- C:\Program Files (x86)\Firefox portable - TV
2015-08-01 20:30:19 ----D---- C:\Program Files (x86)\Chrome to Mobile
2015-08-01 19:48:41 ----D---- C:\Program Files (x86)\SystemHelp
2015-08-01 19:05:25 ----D---- C:\$Windows.~BT
2015-08-01 16:19:50 ----D---- C:\Program Files (x86)\Post to Tumblr
2015-07-29 21:46:03 ----D---- C:\Program Files (x86)\StarnetPlayer-Test
2015-07-27 23:19:25 ----D---- C:\Program Files\VideoLAN
2015-07-23 10:28:58 ----D---- C:\Users\Dave\AppData\Roaming\TaiG
2015-07-20 16:48:01 ----D---- C:\Program Files\iPod
2015-07-20 16:47:59 ----D---- C:\ProgramData\Apple Computer
2015-07-20 16:47:59 ----D---- C:\Program Files\iTunes
2015-07-20 16:46:14 ----D---- C:\Program Files (x86)\Apple Software Update
2015-07-20 16:45:54 ----D---- C:\Program Files\Common Files\Apple
2015-07-20 16:45:37 ----D---- C:\Program Files\Bonjour
2015-07-20 16:45:37 ----D---- C:\Program Files (x86)\Bonjour
2015-07-20 16:44:47 ----D---- C:\ProgramData\Apple
2015-07-17 18:03:28 ----A---- C:\Windows\SYSWOW64\ole32.dll
2015-07-17 18:03:28 ----A---- C:\Windows\system32\ole32.dll
2015-07-15 17:05:25 ----A---- C:\Windows\SYSWOW64\cewmdm.dll
2015-07-15 17:05:25 ----A---- C:\Windows\system32\cewmdm.dll
2015-07-15 17:05:15 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-07-15 17:05:15 ----A---- C:\Windows\system32\rdpcorets.dll
2015-07-15 17:05:11 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2015-07-15 17:05:11 ----A---- C:\Windows\system32\gdi32.dll
2015-07-15 17:03:52 ----A---- C:\Windows\SYSWOW64\cryptsvc.dll
2015-07-15 17:03:52 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2015-07-15 17:03:52 ----A---- C:\Windows\system32\wintrust.dll
2015-07-15 17:03:52 ----A---- C:\Windows\system32\cryptsvc.dll
2015-07-15 17:03:52 ----A---- C:\Windows\system32\crypt32.dll
2015-07-15 17:03:51 ----A---- C:\Windows\SYSWOW64\wintrust.dll
2015-07-15 17:03:51 ----A---- C:\Windows\system32\cryptnet.dll
2015-07-15 17:03:50 ----A---- C:\Windows\SYSWOW64\cryptnet.dll
2015-07-15 17:03:08 ----A---- C:\Windows\system32\msi.dll
2015-07-15 17:03:07 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2015-07-15 17:03:07 ----A---- C:\Windows\SYSWOW64\msiexec.exe
2015-07-15 17:03:07 ----A---- C:\Windows\SYSWOW64\msi.dll
2015-07-15 17:03:07 ----A---- C:\Windows\system32\msihnd.dll
2015-07-15 17:03:07 ----A---- C:\Windows\system32\msiexec.exe
2015-07-15 17:03:06 ----A---- C:\Windows\SYSWOW64\msimsg.dll
2015-07-15 17:03:06 ----A---- C:\Windows\system32\msimsg.dll

======List of files/folders modified in the last 3 months======

2015-09-25 21:05:59 ----D---- C:\Windows\Prefetch
2015-09-25 21:05:55 ----D---- C:\Program Files\trend micro
2015-09-25 20:01:24 ----D---- C:\Windows\system32\config
2015-09-24 22:27:26 ----SHD---- C:\System Volume Information
2015-09-24 19:49:45 ----D---- C:\Users\Dave\AppData\Roaming\Mozilla
2015-09-24 18:13:00 ----D---- C:\Users\Dave\AppData\Roaming\vlc
2015-09-24 09:50:42 ----D---- C:\Windows\SysWOW64
2015-09-24 09:50:36 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2015-09-21 23:27:46 ----D---- C:\Windows\system32\drivers
2015-09-21 23:27:46 ----D---- C:\Windows\inf
2015-09-21 23:27:45 ----D---- C:\Windows\system32\DriverStore
2015-09-21 23:26:56 ----RSD---- C:\Windows\Fonts
2015-09-21 23:26:38 ----RD---- C:\Program Files (x86)
2015-09-21 23:26:36 ----D---- C:\Windows\system32\Tasks
2015-09-18 19:05:05 ----D---- C:\ProgramData
2015-09-17 19:54:52 ----D---- C:\Windows
2015-09-16 21:47:26 ----D---- C:\Windows\Microsoft.NET
2015-09-16 21:45:46 ----RSD---- C:\Windows\assembly
2015-09-15 21:56:07 ----D---- C:\Windows\Tasks
2015-09-15 16:42:03 ----D---- C:\Windows\System32
2015-09-15 16:42:03 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-09-15 16:36:31 ----D---- C:\Windows\winsxs
2015-09-15 16:27:45 ----D---- C:\Windows\SYSWOW64\tr-TR
2015-09-15 16:27:45 ----D---- C:\Windows\SYSWOW64\ja-JP
2015-09-15 16:27:45 ----D---- C:\Windows\SYSWOW64\fr-FR
2015-09-15 16:27:45 ----D---- C:\Windows\SYSWOW64\en-US
2015-09-15 16:27:45 ----D---- C:\Windows\SYSWOW64\el-GR
2015-09-15 16:27:45 ----D---- C:\Windows\SYSWOW64\de-DE
2015-09-15 16:27:45 ----D---- C:\Windows\SYSWOW64\cs-CZ
2015-09-15 16:27:45 ----D---- C:\Windows\ehome
2015-09-15 16:27:44 ----D---- C:\Windows\SYSWOW64\ru-RU
2015-09-15 16:27:44 ----D---- C:\Windows\SYSWOW64\ar-SA
2015-09-15 16:27:44 ----D---- C:\Windows\system32\tr-TR
2015-09-15 16:27:44 ----D---- C:\Windows\system32\ru-RU
2015-09-15 16:27:44 ----D---- C:\Windows\system32\ja-JP
2015-09-15 16:27:44 ----D---- C:\Windows\system32\fr-FR
2015-09-15 16:27:44 ----D---- C:\Windows\system32\en-US
2015-09-15 16:27:44 ----D---- C:\Windows\system32\el-GR
2015-09-15 16:27:44 ----D---- C:\Windows\system32\de-DE
2015-09-15 16:27:44 ----D---- C:\Windows\system32\cs-CZ
2015-09-15 16:27:44 ----D---- C:\Windows\system32\ar-SA
2015-09-15 16:27:43 ----D---- C:\Program Files\Internet Explorer
2015-09-15 16:27:41 ----D---- C:\Windows\PolicyDefinitions
2015-09-15 16:27:39 ----D---- C:\Program Files (x86)\Internet Explorer
2015-09-15 16:27:23 ----D---- C:\Windows\AppPatch
2015-09-15 00:55:46 ----SHD---- C:\Windows\Installer
2015-09-15 00:55:46 ----D---- C:\Config.Msi
2015-09-15 00:54:28 ----D---- C:\Windows\system32\MRT
2015-09-15 00:43:51 ----D---- C:\Windows\debug
2015-09-15 00:41:08 ----D---- C:\Windows\system32\catroot2
2015-09-15 00:30:48 ----D---- C:\Users\Dave\AppData\Roaming\Zoner
2015-09-15 00:30:46 ----RD---- C:\Program Files
2015-09-15 00:30:00 ----D---- C:\Users\Dave\AppData\Roaming\DVDVideoSoft
2015-09-15 00:29:59 ----D---- C:\Program Files (x86)\DVDVideoSoft
2015-09-15 00:29:50 ----D---- C:\Program Files (x86)\Common Files
2015-09-15 00:29:34 ----D---- C:\Program Files (x86)\Mozilla Firefox
2015-09-10 08:25:17 ----D---- C:\Program Files\Windows Journal
2015-09-10 08:25:05 ----D---- C:\Windows\system32\Boot
2015-09-08 17:18:21 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2015-09-06 21:55:07 ----AD---- C:\Qoobox
2015-09-06 21:50:30 ----A---- C:\Windows\system.ini
2015-09-06 21:50:22 ----D---- C:\Windows\system32\drivers\etc
2015-09-06 21:44:48 ----D---- C:\Windows\SYSWOW64\drivers
2015-09-05 20:19:11 ----D---- C:\Windows\Logs
2015-08-26 18:37:02 ----A---- C:\Windows\system32\MRT.exe
2015-08-12 08:42:55 ----SD---- C:\Windows\system32\CompatTel
2015-08-12 08:42:54 ----D---- C:\Windows\system32\appraiser
2015-08-12 08:42:47 ----D---- C:\Windows\system32\drivers\tr-TR
2015-08-12 08:42:47 ----D---- C:\Windows\system32\drivers\ru-RU
2015-08-12 08:42:47 ----D---- C:\Windows\system32\drivers\ja-JP
2015-08-12 08:42:47 ----D---- C:\Windows\system32\drivers\en-US
2015-08-12 08:42:47 ----D---- C:\Windows\system32\drivers\el-GR
2015-08-12 08:42:47 ----D---- C:\Windows\system32\drivers\de-DE
2015-08-12 08:42:47 ----D---- C:\Windows\system32\drivers\cs-CZ
2015-08-12 08:42:47 ----D---- C:\Windows\system32\drivers\ar-SA
2015-08-05 21:57:35 ----D---- C:\Users\Dave\AppData\Roaming\Media Player Classic
2015-08-01 19:06:21 ----D---- C:\Windows\Panther
2015-07-28 18:46:08 ----D---- C:\Windows\SoftwareDistribution
2015-07-25 14:21:03 ----SD---- C:\Windows\system32\GWX
2015-07-23 10:28:58 ----SD---- C:\Users\Dave\AppData\Roaming\Microsoft
2015-07-22 21:39:16 ----D---- C:\Users\Dave\AppData\Roaming\Apple Computer
2015-07-20 16:45:59 ----D---- C:\Windows\system32\catroot
2015-07-20 16:45:54 ----D---- C:\Program Files\Common Files
2015-07-17 17:32:05 ----SD---- C:\Windows\SYSWOW64\GWX
2015-07-17 17:31:58 ----D---- C:\Windows\system32\wbem
2015-07-05 12:08:23 ----N---- C:\Windows\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 JRAID;JRAID; C:\Windows\system32\DRIVERS\jraid.sys [2014-05-21 123704]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2015-03-04 280376]
R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-10-26 834544]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2015-03-04 124568]
R3 ADIHdAudAddService;ADI UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\ADIHdAud.sys [2009-06-05 475136]
R3 Afc;PPdus ASPI Shell; C:\Windows\SysWOW64\drivers\Afc.sys [2006-11-14 22784]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2005-03-29 8192]
R3 NvStreamKms;NvStreamKms; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2015-01-16 19600]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad64v.sys [2014-11-22 38032]
R3 teamviewervpn;TeamViewer VPN Adapter; C:\Windows\system32\DRIVERS\teamviewervpn.sys [2015-08-18 35112]
S1 NetworkX;NetworkX; C:\Windows\syswow64\ckldrv.sys [2004-07-30 31654]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver; C:\Windows\System32\Drivers\ssadadb.sys [2013-06-21 38080]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 cpuz126;cpuz126; \??\C:\Users\Dave\AppData\Local\Temp\cpuz64.sys []
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2014-06-16 110336]
S3 dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 145920]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\drivers\Dot4Prt.sys [2010-11-20 19968]
S3 dot4usb;Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 43008]
S3 grmnusb;Garmin USB Driver; C:\Windows\system32\drivers\grmnusb.sys [2009-05-08 20520]
S3 HTCAND64;HTC Device Driver; C:\Windows\System32\Drivers\ANDROIDUSB.sys [2009-11-01 33736]
S3 htcnprot;HTC NDIS Protocol Driver; C:\Windows\system32\DRIVERS\htcnprot.sys [2010-06-25 36928]
S3 IT9135BDA;IT9135 BDA Devices; C:\Windows\System32\Drivers\IT9135BDA.sys [2010-02-03 113280]
S3 ivusb;Initio Driver for USB Default Controller; C:\Windows\system32\DRIVERS\ivusb.sys [2010-07-29 29720]
S3 mvusbews;USB EWS Device; C:\Windows\System32\Drivers\mvusbews.sys [2010-03-06 20480]
S3 PAC207;SoC PC-Camera; C:\Windows\system32\DRIVERS\PFC027.SYS [2006-12-05 572416]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [2008-08-28 25600]
S3 Ph3xIB64;Philips 713x Inbox PCI TV Card; C:\Windows\system32\DRIVERS\Ph3xIB64.sys [2009-06-10 1627520]
S3 pwdrvio;pwdrvio; \??\C:\Windows\syswow64\pwdrvio.sys []
S3 pwdspio;pwdspio; \??\C:\Windows\syswow64\pwdspio.sys []
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2013-06-21 169288]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2013-06-21 21320]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2013-06-21 188232]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2013-06-21 158024]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2014-06-16 206080]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TFsExDisk;TFsExDisk; \??\C:\Windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\drivers\usb8023x.sys [2013-02-12 19968]
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2015-06-10 54784]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 ACDaemon;ArcSoft Connect Daemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [2010-03-18 113152]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2015-05-29 60744]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2011-08-30 462184]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 EPSON_PM_RPCV4_01;EPSON V3 Service4(01); C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE [2007-01-11 126464]
R2 GfExperienceService;NVIDIA GeForce Experience Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2015-05-01 1152656]
R2 MDM;Machine Debug Manager; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2015-04-30 23816]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2015-05-01 1884304]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2015-01-16 21833360]
R2 NVSvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2015-02-04 932040]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2012-12-02 76888]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R2 TeamViewer;TeamViewer 10; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2015-09-11 5702416]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2015-07-11 644904]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2015-04-30 366544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S2 Crypkey License;Crypkey License; crypserv.exe []
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-24 269000]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-08-15 114688]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2009-02-26 64856]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2014-10-08 114288]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2011-07-20 440696]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2015-08-19 838336]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2010-10-26 1255736]
S4 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-03 81088]
S4 AEADIFilters;Andrea ADI Filters Service; C:\Windows\system32\AEADISRV.EXE [2009-06-05 111616]
S4 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 HPSIService;HP SI Service; C:\Windows\system32\HPSIsvc.exe [2010-04-07 127800]
S4 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S4 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [2009-06-17 73728]
S4 NAUpdate;@C:\Program Files (x86)\Nero\Update\NASvc.exe,-200; C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-03-25 490280]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 PassThru Service;Internet Pass-Through Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2011-09-15 88576]
S4 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 Printer Control;Printer Control; C:\Windows\system32\PrintCtrl.exe [2009-10-28 65536]
S4 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2010-12-08 628736]
S4 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-02-18 315488]
S4 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2015-02-04 409800]

-----------------EOF-----------------

#2 Příspěvek od **Márty84** » 26 zář 2015 09:42

Zdravim

angeldave píše:System drive C: has 447 MB (1%) free of 67 GB

Uvolnete nejake misto na disku, system se dusi! Minimalne 3 GB.

Stahnete OTL http://oldtimer.geekstogo.com/OTL.exe a ulozte na plochu.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce
Oznacte polozky (dejte tam zatrzitka) Pro všechny uživatele, Kontrola na havěť "LOP" a Kontrola na havěť "Purity"
Do spodniho okna vlozte nasledujici text

Kód: Vybrat vše

CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
adp3132.sys
AGP440.sys
ahcix86.sys
ahcix86s.sys
atapi.sys
autochk.exe
cdrom.sys
cngaudit.dll
cryptsvc.dll
eNetHook.dll
eventlog.dll
explorer.exe
hal.dll
Changer.sys
iaStor.sys
iastorv.sys
IdeChnDr.sys
isapnp.sys
JakNDis.sys
KR10N.sys
logevent.dll
lsass.exe
mv61xx.sys
ndis.sys
netlogon.dll
ntelogon.dll
nvata.sys
nvatabus.sys
nvgts.sys
nvraid.sys
nvrd32.sys
nvstor.sys
nvstor32.sys
scecli.dll
sceclt.dll
smss.exe
svchost.exe
symmpi.sys
tcpip.sys
userinit.exe
vaxscsi.sys
viamraid.sys
viasraid.sys
ViPrt.sys
winlogon.exe
ws2_32.dll
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /s
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon" /v GinaDLL /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" /v ImagePath /c
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS" /v ImagePath /c

type c:\boot.ini >> test.txt /c
%SystemDrive%\PhysicalMBR.bin /md5

*crack* /s
*keygen* /s
*AntiWPA* /s
*loader* /s
*minodlogin* /s
*tnod* /s
*AutoKMS* /s
*activator* /s
*serial* /s
*w7lxe* /s

Kliknete na Prohledat
Po skenu se vytvori dva logy (OTL.Txt a Extras.txt), oba sem vlozte (kdyz budou dlouhe, rozdelte je do vice prispevku).

angeldave · #3 Příspěvek od **angeldave** » 26 zář 2015 18:53

otl přestalo pracovat. Vyhodí chybu a to samé se opakuje,když opakuji postup.

angeldave · #4 Příspěvek od **angeldave** » 26 zář 2015 18:55

a prosím jak vyčistím C? co smazat. mam tam systém a žádné hry,ani hudbu...atd....prostě systém a zbytkové soubory. není nejaky soft,na pročištění? důkladné. třeba aktualizace, myslim instalacni soubory, ty uz potreba nejsou, myslim.

#5 Příspěvek od **Márty84** » 26 zář 2015 19:49

Spustte OTL podle stejneho navodu jeste jednou, ale s timto upravenym skriptem

Kód: Vybrat vše

CREATERESTOREPOINT

netsvcs
drivers32
savembr:0

/md5start
atapi.sys
autochk.exe
cdrom.sys
explorer.exe
hal.dll
scecli.dll
svchost.exe
tcpip.sys
userinit.exe
winlogon.exe
/md5stop

%systemroot%*.* /U /s
%SYSTEMDRIVE%\*.exe
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\drivers\*.sys /3
%systemroot%\system32\*.* /3
%SYSTEMDRIVE%\*.exe

*crack* /s
*keygen* /s
*AntiWPA* /s
*loader* /s
*minodlogin* /s
*tnod* /s
*AutoKMS* /s
*activator* /s
*serial* /s
*w7lxe* /s

S tim mazanim jeste pockejte, treba neco smaznu skriptem, az uvidim co tam bezi.

angeldave · #6 Příspěvek od **angeldave** » 26 zář 2015 21:33

bohuzel stale to same

#7 Příspěvek od **Márty84** » 26 zář 2015 21:57

Stahnete AdwCleaner https://toolslib.net/downloads/finish/1/ a ulozte ho na plochu.
Ukoncete vsechny programy, jinak to AdwCleaner udela za vas.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce.
Kliknete na Scan a pockejte, az kontrola dobehne.
Pak kliknete na Cleaning
Program zacne pracovat (muze dojit k restartu pc) a vyplivne log (pripadne bude zde C:\AdwCleaner\AdwCleaner[C?].txt ). Ten mi sem zkopirujte.

Udelejte kontrolu s MBAM. Test nastavte podle tohoto navodu (cili Vlastni sken vsech disku) http://forum.viry.cz/viewtopic.php?f=29&t=144868 a dejte sem vysledky. Predem nic nemazte, miva obcas falesne detekce

angeldave · #8 Příspěvek od **angeldave** » 27 zář 2015 20:25

# AdwCleaner v5.009 - Logfile created 27/09/2015 at 21:19:40
# Updated 27/09/2015 by Xplode
# Database : 2015-09-27.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : Dave - DAVE-PC
# Running from : C:\Users\Dave\Desktop\adwcleaner_5.009.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

***** [ Files ] *****

[-] File Deleted : C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.bestpriceninja.com_0.localstorage
[-] File Deleted : C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_pstatic.bestpriceninja.com_0.localstorage-journal
[-] File Deleted : C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_pstatic.bestpriceninja.com_0.localstorage
[-] File Deleted : C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_pstatic.bestpriceninja.com_0.localstorage-journal
[-] File Deleted : C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cdncache-a.akamaihd.net_0.localstorage
[-] File Deleted : C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_cdncache-a.akamaihd.net_0.localstorage-journal

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

[-] Task Deleted : Adobe Flash Player Updater

***** [ Registry ] *****

***** [ Web browsers ] *****

[-] [C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : kmplayer.en.softonic.com
[-] [C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : motocross-stunt-racer.en.softonic.com
[-] [C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : blazingtools-perfect-keylogger.softonic.pl
[-] [C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : icq
[-] [C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : mystartsearch
[-] [C:\Users\Dave\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : websearch

*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C5].txt - [2293 bytes] ##########

#9 Příspěvek od **Márty84** » 28 zář 2015 10:00

Fajn, jeste MBAM.

7.11. pro neaktivitu

http://forum.viry.cz/viewtopic.php?f=12&t=123975

VIRY.CZ

Prosím o kontrolu logu RSIT

Prosím o kontrolu logu RSIT

Re: Prosím o kontrolu logu RSIT

Re: Prosím o kontrolu logu RSIT

Re: Prosím o kontrolu logu RSIT

Re: Prosím o kontrolu logu RSIT

Re: Prosím o kontrolu logu RSIT

Re: Prosím o kontrolu logu RSIT

Re: Prosím o kontrolu logu RSIT

Re: Prosím o kontrolu logu RSIT