Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

PC odesílám spam :-(

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Odpovědět
Zpráva
Autor
pavel15
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 17 lis 2015 14:08

PC odesílám spam :-(

#1 Příspěvek od pavel15 »

Zdravím, mám problém, moje PC odesílám spam z mého mailového účtu. Prosím o pomoc. Přikládám log
Děkuji
PB
Logfile of random's system information tool 1.10 (written by random/random)
Run by Jan Beran at 2015-11-17 14:02:47
Microsoft Windows 8.1
System drive C: has 377 GB (84%) free of 450 GB
Total RAM: 4009 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:02:56, on 17. 11. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)
Boot mode: Normal

Running processes:
C:\Windows\jmesoft\hotkey.exe
C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
C:\Program Files\trend micro\Jan Beran.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [jmekey] C:\windows\jmesoft\hotkey.exe
O4 - HKLM\..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
O4 - HKLM\..\Run: [LVT] C:\Program Files\Lenovo\LVT\LJYZ.exe 1
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [MalwareProtectionLive] C:\Users\Jan Beran\AppData\Local\MalwareProtectionLive\MalwareProtectionClient.exe
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra button: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL
O18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\mcafee\msc\mcsniepl.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
O23 - Service: Lenovo Browser Guard Service (CltMngSvc) - ClientConnect LTD - C:\PROGRA~2\LenovoBrowserGuard\Main\bin\CltMngSvc.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: McAfee Home Network (HomeNetSvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: JME Keyboard Driver (JME Keyboard) - Unknown owner - C:\Windows\jmesoft\Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo System Agent Service - LENOVO INCORPORATED. - C:\Program Files\Lenovo\iMController\SystemAgentService.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: LSCWinService - Unknown owner - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: McAfee AP Service (McAPExe) - McAfee, Inc. - C:\Program Files\McAfee\MSC\McAPExe.exe
O23 - Service: McAfee Activation Service (McAWFwk) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\actwiz\mcawfwk.exe
O23 - Service: McAfee CSP Service (mccspsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\CSP\1.6.1008.0\McCSPServiceHost.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\mcafee\VirusScan\mcods.exe
O23 - Service: McAfee Platform Services (mcpltsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Service Controller (mfemms) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - Unknown owner - C:\windows\system32\mfevtps.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFDriverCreatorReadSpool9 (NitroDriverReadSpool9) - Nitro PDF Software - C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\windows\SysWOW64\NLSSRV32.EXE
O23 - Service: Cyberlink RichVideo64 Service(CRVS) (RichVideo64) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12710 bytes

======Listing Processes======





wininit.exe

C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\WLANExt.exe 1087354763520
\??\C:\windows\system32\conhost.exe 0x4
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe" /service
"C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe"
C:\windows\System32\svchost.exe -k utcsvc
"C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
C:\Windows\jmesoft\Service.exe
"C:\Program Files\Lenovo\iMController\SystemAgentService.exe"
"C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe"
"C:\windows\system32\mfevtps.exe"
"C:\windows\system32\mfevtps.exe" -mms
"C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe"
"C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe"
C:\windows\SysWOW64\NLSSRV32.EXE
"C:\Program Files\CyberLink\Shared files\RichVideo64.exe"
"C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE"
C:\windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" -mms
"C:\Program Files\McAfee\MSC\McAPExe.exe"
"C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe"
"C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc
"C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe"
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-2e34e22d-d6bb-4395-ab9f-c576355ef050 -SystemEventPortName:HostProcess-656630f0-f5ee-4cee-9379-366ebd4c1219 -IoCancelEventPortName:HostProcess-27524a76-5398-4fca-91db-98bdf3222f8c -NonStateChangingEventPortName:HostProcess-988ecc4c-e859-4039-969e-d3a7184973cc -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:0648f224-de14-4c4d-bd69-5f60c87d1fd4 -DeviceGroupId:WpdFsGroup
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-01c97861-4a5c-46cd-ab3d-63594c1390bb -SystemEventPortName:HostProcess-2f208243-3e14-4015-b799-b9cc515bf9da -IoCancelEventPortName:HostProcess-d3b275ec-4787-46e3-9239-c77cb311abcb -NonStateChangingEventPortName:HostProcess-e487e71f-4cbb-4b5c-9e1d-9f7d1e90be24 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:dcc28ac2-3f76-461d-b722-2a74442db233 -DeviceGroupId:WudfDefaultDevicePool
dashost.exe {dd71f79c-54e9-406c-a4f1823535ff3359}
C:\PROGRA~2\LenovoBrowserGuard\Main\bin\CltMngSvc.exe
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe"
C:\windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files\Common Files\McAfee\CSP\1.6.1008.0\McCSPServiceHost.exe"
C:\windows\system32\SearchIndexer.exe /Embedding
C:\windows\system32\rundll32.exe C:\windows\system32\pla.dll,PlaHost "LSC Memory" "0x10d8_0xb9c_0xa02dff54"
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\windows\System32\WinLogon.exe -SpecialSession
-hiberboot
taskhostex.exe
C:\windows\Explorer.EXE
"C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe" /platui -Embedding
C:\Windows\System32\skydrive.exe -Embedding
"C:\Program Files\Dolby Digital Plus\ddp.exe" -autostart
"C:\Windows\System32\igfxtray.exe"
"C:\windows\system32\igfxsrvc.exe" -Embedding
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
"C:\windows\system32\GWX\GWX.exe"
"C:\Windows\jmesoft\hotkey.exe"
"C:\Windows\jmesoft\JME_LOAD.exe"
"C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
"C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
"C:\Users\Jan Beran\AppData\Local\MalwareProtectionLive\MalwareProtectionClient.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
C:\windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Windows\System32\SettingSyncHost.exe" -Embedding
"C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE"
"C:\Program Files\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6380 CREDAT:267521 /prefetch:2
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6380 CREDAT:3020085 /prefetch:2
"C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe" --domain-id 4e00205a-2ab1-4423-8f77-cc25b82cde1d
"C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe" --domain-id 4e00205a-2ab1-4423-8f77-cc25b82cde1d
"C:\windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe" -Embedding

"C:\Users\Jan Beran\AppData\Local\Microsoft\Windows\INetCache\IE\6ZIWRUW0\RSITx64.exe"

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-10-25 219304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-10-18 655480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-25 2339032]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-10-25 153768]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-10-18 559624]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-25 1733240]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01 1144072]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01 1144072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2014-01-29 391152]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2014-01-29 771568]
"Persistence"=C:\windows\system32\igfxpers.exe [2014-01-29 770544]
"IAStorIcon"=C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe [2013-08-07 36352]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-10-24 13662936]
"RtHDVBg_Dolby"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2013-10-29 1360600]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"jmekey"=C:\windows\jmesoft\hotkey.exe [2013-07-24 118784]
"jmesoft"=C:\Windows\jmesoft\ServiceLoader.exe [2011-08-17 28672]
"LVT"=C:\Program Files\Lenovo\LVT\LJYZ.exe [2011-11-24 886112]
"CLMLServer"=C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [2009-12-05 103720]
"UpdateP2GoShortCut"=C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [2011-12-07 214312]
"RemoteControl10"=C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [2013-03-09 95192]
"MalwareProtectionLive"=C:\Users\Jan Beran\AppData\Local\MalwareProtectionLive\MalwareProtectionClient.exe [2015-10-16 850464]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-07 6133520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2014-01-22 624640]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McNaiAnn]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcpltsvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfeaack]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfeaack.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfeavfk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfeavfk.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefire]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfefirek.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfehidk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfehidk.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfemms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfencbdc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfencbdc.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfetdi2k]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfetdi2k.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mfevtp]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"SoftwareSASGeneration"=1
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoRun"=0
"NoFolderOptions"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-11-17 14:02:47 ----D---- C:\rsit
2015-11-17 14:02:47 ----D---- C:\Program Files\trend micro
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\lsasrv.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\mrxsmb.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\ksecpkg.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\cng.sys
2015-11-11 03:43:39 ----A---- C:\windows\SYSWOW64\certcli.dll
2015-11-11 03:43:39 ----A---- C:\windows\system32\drivers\mrxsmb20.sys
2015-11-11 03:43:39 ----A---- C:\windows\system32\certcli.dll
2015-11-11 03:43:30 ----A---- C:\windows\SYSWOW64\untfs.dll
2015-11-11 03:43:30 ----A---- C:\windows\system32\untfs.dll
2015-11-11 03:43:29 ----A---- C:\windows\SYSWOW64\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tunnel.sys
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tpm.sys
2015-11-11 03:43:28 ----A---- C:\windows\SYSWOW64\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\tdx.sys
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\afd.sys
2015-11-11 03:43:26 ----A---- C:\windows\system32\win32k.sys
2015-11-11 03:43:25 ----A---- C:\windows\system32\AuthHost.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\winload.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\ntoskrnl.exe
2015-11-11 03:43:23 ----A---- C:\windows\system32\winresume.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapi.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\WUSettingsProvider.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wucltux.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuaueng.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuauclt.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapi.dll
2015-11-11 03:43:14 ----A---- C:\windows\SYSWOW64\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\localspl.dll
2015-11-11 03:43:06 ----A---- C:\windows\system32\mshtml.dll
2015-11-11 03:43:04 ----A---- C:\windows\SYSWOW64\mshtml.dll
2015-11-11 03:43:02 ----A---- C:\windows\system32\ieframe.dll
2015-11-11 03:43:00 ----A---- C:\windows\SYSWOW64\ieframe.dll
2015-11-11 03:42:59 ----A---- C:\windows\system32\jscript9.dll
2015-11-11 03:42:58 ----A---- C:\windows\SYSWOW64\iertutil.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\jscript.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\iertutil.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript9.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\ie4uinit.exe
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\ieapfltr.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\ieapfltr.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\system32\IKEEXT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\drivers\wfplwfs.sys
2015-11-11 03:42:53 ----A---- C:\windows\system32\BFE.DLL
2015-11-01 15:34:02 ----RHD---- C:\MSOCache
2015-10-25 14:15:26 ----D---- C:\Program Files\Microsoft Office 15
2015-10-18 14:55:02 ----D---- C:\Users\Jan Beran\AppData\Roaming\Windows Live Writer
2015-10-18 14:47:36 ----D---- C:\Program Files (x86)\Windows Live
2015-10-18 14:47:12 ----D---- C:\windows\PCHEALTH
2015-10-18 14:47:02 ----D---- C:\Program Files\Windows Live
2015-10-18 14:45:55 ----D---- C:\Program Files (x86)\Microsoft
2015-10-18 14:11:36 ----D---- C:\Users\Jan Beran\AppData\Roaming\CDTPL
2015-10-18 14:10:46 ----D---- C:\Program Files (x86)\SysTools DBX Converter
2015-10-18 13:41:50 ----D---- C:\Users\Jan Beran\AppData\Roaming\AVAST Software
2015-10-18 13:37:25 ----D---- C:\windows\SYSWOW64\vbox
2015-10-18 13:37:25 ----D---- C:\windows\system32\vbox
2015-10-18 13:36:41 ----A---- C:\windows\system32\drivers\ngvss.sys
2015-10-18 13:36:41 ----A---- C:\windows\system32\drivers\aswVmm.sys
2015-10-18 13:36:41 ----A---- C:\windows\system32\drivers\aswStm.sys
2015-10-18 13:36:41 ----A---- C:\windows\system32\drivers\aswsp.sys
2015-10-18 13:36:41 ----A---- C:\windows\system32\drivers\aswsnx.sys
2015-10-18 13:36:41 ----A---- C:\windows\system32\drivers\aswRvrt.sys
2015-10-18 13:36:41 ----A---- C:\windows\system32\drivers\aswRdr2.sys
2015-10-18 13:36:41 ----A---- C:\windows\system32\drivers\aswMonFlt.sys
2015-10-18 13:36:41 ----A---- C:\windows\system32\drivers\aswHwid.sys
2015-10-18 13:36:40 ----A---- C:\windows\system32\aswBoot.exe
2015-10-18 13:36:32 ----A---- C:\windows\avastSS.scr
2015-10-18 13:33:46 ----D---- C:\Program Files\AVAST Software
2015-10-18 13:30:45 ----D---- C:\ProgramData\AVAST Software
2015-10-18 12:59:01 ----D---- C:\Program Files\CGI IT Czech Republic s.r.o
2015-10-18 12:59:00 ----D---- C:\Program Files (x86)\CGI IT Czech Republic s.r.o

======List of files/folders modified in the last 1 month======

2015-11-17 14:02:48 ----D---- C:\windows\Temp
2015-11-17 14:02:47 ----RD---- C:\Program Files
2015-11-17 14:00:00 ----D---- C:\windows\system32\sru
2015-11-17 13:38:50 ----D---- C:\windows\Prefetch
2015-11-17 13:38:39 ----SHD---- C:\windows\Installer
2015-11-16 07:02:40 ----D---- C:\windows\rescache
2015-11-16 06:58:34 ----SHD---- C:\System Volume Information
2015-11-16 06:57:35 ----D---- C:\windows\Microsoft.NET
2015-11-15 13:02:58 ----D---- C:\windows\system32\config
2015-11-15 09:56:07 ----RAD---- C:\windows\System32
2015-11-15 09:56:07 ----D---- C:\windows\Inf
2015-11-15 09:56:07 ----A---- C:\windows\system32\PerfStringBackup.INI
2015-11-15 09:52:24 ----D---- C:\windows\WinSxS
2015-11-15 09:52:22 ----D---- C:\windows\system32\DriverStore
2015-11-14 10:18:00 ----D---- C:\windows\system32\catroot
2015-11-14 10:17:36 ----RD---- C:\windows\ToastData
2015-11-14 10:17:36 ----D---- C:\windows\SysWOW64
2015-11-14 10:17:36 ----D---- C:\windows\system32\drivers
2015-11-14 09:55:25 ----D---- C:\windows\AppReadiness
2015-11-13 10:28:50 ----D---- C:\windows\CbsTemp
2015-11-13 08:27:07 ----AD---- C:\Windows
2015-11-13 07:02:56 ----RSD---- C:\windows\assembly
2015-11-11 16:09:50 ----D---- C:\ProgramData\McAfee
2015-11-11 16:03:34 ----D---- C:\windows\apppatch
2015-11-11 07:07:45 ----HD---- C:\Program Files\WindowsApps
2015-11-11 07:04:00 ----A---- C:\windows\system32\MRT.exe
2015-11-11 07:02:58 ----D---- C:\windows\system32\catroot2
2015-11-09 06:20:08 ----D---- C:\Program Files (x86)\McAfee
2015-11-06 08:48:21 ----D---- C:\windows\system32\NDF
2015-11-03 01:23:06 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2015-10-30 09:16:19 ----SHD---- C:\$Recycle.Bin
2015-10-25 14:38:34 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2015-10-25 14:37:58 ----D---- C:\Program Files (x86)\Common Files
2015-10-25 14:37:53 ----D---- C:\Program Files (x86)\Microsoft.NET
2015-10-25 14:22:24 ----D---- C:\Program Files (x86)\Microsoft Office
2015-10-25 14:17:18 ----RSD---- C:\windows\Fonts
2015-10-20 15:37:04 ----D---- C:\Users\Jan Beran\AppData\Roaming\Nitro PDF
2015-10-20 13:22:42 ----SD---- C:\Users\Jan Beran\AppData\Roaming\Microsoft
2015-10-19 05:17:40 ----SD---- C:\ProgramData\Microsoft
2015-10-18 14:52:44 ----D---- C:\windows\system32\Tasks
2015-10-18 14:52:30 ----RD---- C:\Program Files (x86)
2015-10-18 14:47:13 ----D---- C:\Program Files\Common Files\microsoft shared
2015-10-18 13:30:45 ----HD---- C:\ProgramData
2015-10-18 11:48:03 ----D---- C:\windows\system32\wdi
2015-10-18 11:45:35 ----SD---- C:\windows\system32\CompatTel
2015-10-18 11:45:35 ----D---- C:\windows\system32\appraiser

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2015-10-18 65224]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2015-10-18 274808]
R0 iaStorA;iaStorA; C:\windows\System32\drivers\iaStorA.sys [2013-08-07 644968]
R0 mfehidk;McAfee Inc. mfehidk; C:\windows\system32\drivers\mfehidk.sys [2015-07-02 875928]
R0 mfewfpk;McAfee Inc. mfewfpk; C:\windows\system32\drivers\mfewfpk.sys [2015-07-02 344704]
R0 ngvss;ngvss; C:\windows\system32\drivers\ngvss.sys [2015-10-18 132656]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr2.sys [2015-10-18 93528]
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys [2015-11-07 1059656]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2015-11-07 449992]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\windows\system32\DRIVERS\vwififlt.sys [2013-08-22 71680]
R2 aswHwid;avast! HardwareID; C:\windows\system32\drivers\aswHwid.sys [2015-10-18 28656]
R2 aswMonFlt;aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [2015-10-18 90968]
R2 aswStm;aswStm; C:\windows\system32\drivers\aswStm.sys [2015-10-18 153744]
R2 VBoxAswDrv;VBoxAsw Support Driver; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2015-10-18 274336]
R3 cfwids;McAfee Inc. cfwids; C:\windows\system32\drivers\cfwids.sys [2015-07-02 77536]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2014-01-22 4221440]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2013-10-29 3698904]
R3 iwdbus;@oem4.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\windows\System32\drivers\iwdbus.sys [2013-12-27 27032]
R3 MEIx64;@oem12.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\windows\system32\DRIVERS\TeeDriverx64.sys [2013-09-04 99288]
R3 mfeaack;McAfee Inc. mfeaack; C:\windows\system32\drivers\mfeaack.sys [2015-07-02 412440]
R3 mfeavfk;McAfee Inc. mfeavfk; C:\windows\system32\drivers\mfeavfk.sys [2015-07-02 347800]
R3 mfefirek;McAfee Inc. mfefirek; C:\windows\system32\drivers\mfefirek.sys [2015-07-02 496888]
R3 mfencbdc;McAfee Inc. mfencbdc; C:\windows\system32\DRIVERS\mfencbdc.sys [2015-06-28 529080]
R3 RSP2STOR;@oem7.inf,%Rts5229%;Realtek PCIE CardReader Driver - P2; C:\windows\system32\DRIVERS\RtsP2Stor.sys [2013-07-05 290008]
R3 RTL8168;@oem6.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\windows\system32\DRIVERS\Rt630x64.sys [2013-06-21 816344]
R3 RTWlanE;@oem11.inf,%RTWlanE.DeviceDesc.DispName%;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\windows\system32\DRIVERS\rtwlane.sys [2013-08-21 2944216]
R3 usbscan;@sti.inf,%usbscan.SvcDesc%;USB Scanner Driver; C:\windows\System32\drivers\usbscan.sys [2014-10-29 44544]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\windows\System32\Drivers\usbvideo.sys [2014-06-21 212736]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\windows\system32\DRIVERS\vwifimp.sys [2013-08-22 36864]
S0 mfeelamk;McAfee Inc. mfeelamk; C:\windows\system32\drivers\mfeelamk.sys [2015-07-02 80920]
S3 e1iexpress;@net1ic64.inf,%e1iExpress.Service.DispName%;Intel(R) PRO/1000 PCI Express Network Connection Driver I; C:\windows\system32\DRIVERS\e1i63x64.sys [2013-06-18 460288]
S3 HipShieldK;McAfee Inc. HipShieldK; C:\windows\system32\drivers\HipShieldK.sys [2015-05-19 207208]
S3 intaud_WaveExtensible;@oem3.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\windows\system32\drivers\intelaud.sys [2013-12-27 38296]
S3 IntcDAud;@oem1.inf,%IntcDAud.SvcDesc%;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2014-01-22 450520]
S3 mfencrk;McAfee Inc. mfencrk; C:\windows\system32\DRIVERS\mfencrk.sys [2015-06-28 109728]
S3 NETwNe64;@netwew02.inf,___ %NIC_Service_DispName_WIN8_64%;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit; C:\windows\system32\DRIVERS\NETwew02.sys [2013-06-18 4649440]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-10-18 146600]
R2 ClickToRunSvc;Služba Microsoft Office ClickToRun; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2015-10-07 2780856]
R2 CltMngSvc;Lenovo Browser Guard Service; C:\PROGRA~2\LenovoBrowserGuard\Main\bin\CltMngSvc.exe [2015-05-06 2735408]
R2 Dashboard Service;Dashboard Service; C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe [2013-08-09 25184]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\windows\System32\svchost.exe [2014-10-29 38792]
R2 HomeNetSvc;McAfee Home Network; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [2015-07-21 368048]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-08-07 15720]
R2 IdeaTouch.LocalDataServer.Education;IdeaTouch.LocalDataServer.Education; C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe [2012-05-17 7680]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-05-12 733696]
R2 Intel(R) ME Service;Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2013-09-04 131544]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-09-04 169432]
R2 JME Keyboard;JME Keyboard Driver; C:\Windows\jmesoft\Service.exe [2011-08-17 32768]
R2 Lenovo System Agent Service;Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [2014-05-22 584960]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-09-04 390616]
R2 McAPExe;McAfee AP Service; C:\Program Files\McAfee\MSC\McAPExe.exe [2015-08-21 782608]
R2 mccspsvc;McAfee CSP Service; C:\Program Files\Common Files\McAfee\CSP\1.6.1008.0\McCSPServiceHost.exe [2015-07-23 1694152]
R2 McMPFSvc;McAfee Personal Firewall Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [2015-07-21 368048]
R2 McNaiAnn;McAfee VirusScan Announcer; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [2015-07-21 368048]
R2 mcpltsvc;McAfee Platform Services; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [2015-07-21 368048]
R2 McProxy;McAfee Proxy Service; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [2015-07-21 368048]
R2 mfemms;McAfee Service Controller; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [2015-07-15 373704]
R2 mfevtp;McAfee Validation Trust Protection Service; C:\windows\system32\mfevtps.exe [2015-06-29 254792]
R2 MSK80Service;McAfee Anti-Spam Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [2015-07-21 368048]
R2 NitroDriverReadSpool9;NitroPDFDriverCreatorReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [2014-02-14 230920]
R2 nlsX86cc;Nalpeiron Licensing Service; C:\windows\SysWOW64\NLSSRV32.EXE [2014-02-14 69640]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2013-05-14 390632]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-03-28 249648]
R3 AvastVBoxSvc;AvastVBox COM Service; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2015-10-18 4048280]
R3 mfefire;McAfee Firewall Core Service; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [2015-06-29 232656]
R3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2015-10-16 150600]
S3 BBSvc;Bing Bar Update Service; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\windows\System32\svchost.exe [2014-10-29 38792]
S3 cphs;Intel(R) Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2014-01-29 279024]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2014-03-18 43696]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-05-12 822232]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-04-23 532224]
S3 LSCWinService;LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [2014-02-20 1662424]
S3 McAWFwk;McAfee Activation Service; c:\PROGRA~1\COMMON~1\mcafee\actwiz\mcawfwk.exe [2014-03-12 332528]
S3 McODS;McAfee Scanner; C:\Program Files\mcafee\VirusScan\mcods.exe [2015-07-17 639456]
S4 McOobeSv2;McAfee OOBE Service2; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [2015-07-21 368048]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: PC odesílám spam :-(

#2 Příspěvek od Rudy »

1. E-mailový účet přeheslujte.
2. Spusťte tuto utilitu:
Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
pavel15
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 17 lis 2015 14:08

Re: PC odesílám spam :-(

#3 Příspěvek od pavel15 »

# AdwCleaner v5.021 - Logfile created 18/11/2015 at 17:15:44
# Updated 14/11/2015 by Xplode
# Database : 2015-11-17.2 [Server]
# Operating system : Windows 8.1 (x64)
# Username : Jan Beran - KOVARSTVI_BERAN
# Running from : C:\Users\Jan Beran\Desktop\adwcleaner_5.021.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****

[-] Service Deleted : CltMngSvc

***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\Amazon\ABB
[-] Folder Deleted : C:\Program Files (x86)\LenovoBrowserGuard
[-] Folder Deleted : C:\Users\Jan Beran\AppData\Local\LenovoBrowserGuard
[-] Folder Deleted : C:\Users\Jan Beran\AppData\Local\MalwareProtectionLive

***** [ Files ] *****

[-] File Deleted : C:\Users\Jan Beran\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Malware Protection Live.lnk

***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [MalwareProtectionLive]
[-] Key Deleted : HKLM\SOFTWARE\LenovoBrowserGuard
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LenovoBrowserGuard
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MalwareProtectionLive
[-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\C3F6D7A0BA2FDE84EB329997B1FF786D
[-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\C3F6D7A0BA2FDE84EB329997B1FF786D
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\C3F6D7A0BA2FDE84EB329997B1FF786D

***** [ Web browsers ] *****


*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1875 bytes] ##########
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: PC odesílám spam :-(

#4 Příspěvek od Rudy »

Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
pavel15
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 17 lis 2015 14:08

Re: PC odesílám spam :-(

#5 Příspěvek od pavel15 »

Logfile of random's system information tool 1.10 (written by random/random)
Run by Jan Beran at 2015-11-19 07:27:18
Microsoft Windows 8.1
System drive C: has 378 GB (84%) free of 450 GB
Total RAM: 4009 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:27:21, on 19. 11. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)
Boot mode: Normal

Running processes:
C:\Windows\jmesoft\hotkey.exe
C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files\trend micro\Jan Beran.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O4 - HKLM\..\Run: [jmekey] C:\windows\jmesoft\hotkey.exe
O4 - HKLM\..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
O4 - HKLM\..\Run: [LVT] C:\Program Files\Lenovo\LVT\LJYZ.exe 1
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra button: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: JME Keyboard Driver (JME Keyboard) - Unknown owner - C:\Windows\jmesoft\Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo System Agent Service - LENOVO INCORPORATED. - C:\Program Files\Lenovo\iMController\SystemAgentService.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: LSCWinService - Unknown owner - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFDriverCreatorReadSpool9 (NitroDriverReadSpool9) - Nitro PDF Software - C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\windows\SysWOW64\NLSSRV32.EXE
O23 - Service: Cyberlink RichVideo64 Service(CRVS) (RichVideo64) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10534 bytes

======Listing Processes======





wininit.exe

C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\WLANExt.exe 799028274144
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
\??\C:\windows\system32\conhost.exe 0x4
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe" /service
"C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe"
C:\windows\System32\svchost.exe -k utcsvc
"C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
C:\Windows\jmesoft\Service.exe
"C:\Program Files\Lenovo\iMController\SystemAgentService.exe"
"C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe"
C:\windows\SysWOW64\NLSSRV32.EXE
"C:\Program Files\CyberLink\Shared files\RichVideo64.exe"
"C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE"
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe"
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-26422f6d-0c98-4c81-aa72-8f887241eeb1 -SystemEventPortName:HostProcess-c85556ff-0d0b-433c-99b9-12305fb2ed9b -IoCancelEventPortName:HostProcess-fba34965-29c9-414e-83a9-5c3614aa55f2 -NonStateChangingEventPortName:HostProcess-f401af98-27d8-4e47-b497-c3222ca9fc42 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:482b3809-7c3c-4b3c-8113-e1177351ba62 -DeviceGroupId:WudfDefaultDevicePool
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-df7f55f8-da1a-4ec3-ad3c-65a21c3a31a7 -SystemEventPortName:HostProcess-0cf3a182-e8a1-4117-886e-1c544e52a2ec -IoCancelEventPortName:HostProcess-1057b389-e6ec-47ba-a417-6320be261a91 -NonStateChangingEventPortName:HostProcess-f09bc5d7-ad95-488a-a01d-c00839c4cea2 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:0b4b174f-8aa4-4ce2-8191-aa5468f6965c -DeviceGroupId:WpdFsGroup
dashost.exe {322efa38-68d8-4f4d-86f272a6187a3341}
C:\windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\windows\system32\rundll32.exe C:\windows\system32\pla.dll,PlaHost "LSC Memory" "0x7d8_0x132c_0x69e4d9fc"

C:\windows\System32\WinLogon.exe -SpecialSession
-hiberboot
taskhostex.exe
C:\windows\Explorer.EXE
C:\Windows\System32\skydrive.exe -Embedding
"C:\Program Files\Dolby Digital Plus\ddp.exe" -autostart
"C:\Windows\System32\igfxtray.exe"
"C:\windows\system32\igfxsrvc.exe" -Embedding
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
"C:\Windows\jmesoft\hotkey.exe"
"C:\Windows\jmesoft\JME_LOAD.exe"
"C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
"C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
"C:\windows\system32\GWX\GWX.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
C:\windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
C:\windows\splwow64.exe 8192
"C:\Windows\System32\SettingSyncHost.exe" -Embedding
"C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe" --domain-id 4e00205a-2ab1-4423-8f77-cc25b82cde1d
"C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe" --domain-id 4e00205a-2ab1-4423-8f77-cc25b82cde1d
C:\windows\system32\wbem\wmiprvse.exe
"C:\windows\system32\SearchFilterHost.exe" 0 556 560 568 65536 564
"C:\Program Files\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:168 CREDAT:267521 /prefetch:2
"C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1309035181-1149327725-464113159-100129_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1309035181-1149327725-464113159-100129 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"

"C:\Users\Jan Beran\AppData\Local\Microsoft\Windows\INetCache\IE\3Y8VE5HV\RSITx64.exe"

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-10-25 219304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-10-18 655480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-25 2339032]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-10-25 153768]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-10-18 559624]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]
Windows Live Messenger Companion Helper - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08 393600]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-25 1733240]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]
Bing Bar Helper - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01 1144072]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{8dcb7100-df86-4384-8842-8fa844297b3f} - Bing Bar - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01 1144072]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2014-01-29 391152]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2014-01-29 771568]
"Persistence"=C:\windows\system32\igfxpers.exe [2014-01-29 770544]
"IAStorIcon"=C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe [2013-08-07 36352]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-10-24 13662936]
"RtHDVBg_Dolby"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2013-10-29 1360600]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"jmekey"=C:\windows\jmesoft\hotkey.exe [2013-07-24 118784]
"jmesoft"=C:\Windows\jmesoft\ServiceLoader.exe [2011-08-17 28672]
"LVT"=C:\Program Files\Lenovo\LVT\LJYZ.exe [2011-11-24 886112]
"CLMLServer"=C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [2009-12-05 103720]
"UpdateP2GoShortCut"=C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [2011-12-07 214312]
"RemoteControl10"=C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [2013-03-09 95192]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-07 6133520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2014-01-22 624640]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McNaiAnn]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"SoftwareSASGeneration"=1
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoRun"=0
"NoFolderOptions"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-11-18 17:14:28 ----D---- C:\AdwCleaner
2015-11-17 14:02:47 ----D---- C:\rsit
2015-11-17 14:02:47 ----D---- C:\Program Files\trend micro
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\lsasrv.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\mrxsmb.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\ksecpkg.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\cng.sys
2015-11-11 03:43:39 ----A---- C:\windows\SYSWOW64\certcli.dll
2015-11-11 03:43:39 ----A---- C:\windows\system32\drivers\mrxsmb20.sys
2015-11-11 03:43:39 ----A---- C:\windows\system32\certcli.dll
2015-11-11 03:43:30 ----A---- C:\windows\SYSWOW64\untfs.dll
2015-11-11 03:43:30 ----A---- C:\windows\system32\untfs.dll
2015-11-11 03:43:29 ----A---- C:\windows\SYSWOW64\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tunnel.sys
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tpm.sys
2015-11-11 03:43:28 ----A---- C:\windows\SYSWOW64\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\tdx.sys
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\afd.sys
2015-11-11 03:43:26 ----A---- C:\windows\system32\win32k.sys
2015-11-11 03:43:25 ----A---- C:\windows\system32\AuthHost.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\winload.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\ntoskrnl.exe
2015-11-11 03:43:23 ----A---- C:\windows\system32\winresume.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapi.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\WUSettingsProvider.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wucltux.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuaueng.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuauclt.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapi.dll
2015-11-11 03:43:14 ----A---- C:\windows\SYSWOW64\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\localspl.dll
2015-11-11 03:43:06 ----A---- C:\windows\system32\mshtml.dll
2015-11-11 03:43:04 ----A---- C:\windows\SYSWOW64\mshtml.dll
2015-11-11 03:43:02 ----A---- C:\windows\system32\ieframe.dll
2015-11-11 03:43:00 ----A---- C:\windows\SYSWOW64\ieframe.dll
2015-11-11 03:42:59 ----A---- C:\windows\system32\jscript9.dll
2015-11-11 03:42:58 ----A---- C:\windows\SYSWOW64\iertutil.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\jscript.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\iertutil.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript9.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\ie4uinit.exe
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\ieapfltr.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\ieapfltr.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\system32\IKEEXT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\drivers\wfplwfs.sys
2015-11-11 03:42:53 ----A---- C:\windows\system32\BFE.DLL
2015-11-01 15:34:02 ----RHD---- C:\MSOCache
2015-10-25 14:15:26 ----D---- C:\Program Files\Microsoft Office 15

======List of files/folders modified in the last 1 month======

2015-11-19 07:04:43 ----D---- C:\windows\Microsoft.NET
2015-11-19 07:04:40 ----D---- C:\windows\Prefetch
2015-11-19 07:03:33 ----D---- C:\windows\Temp
2015-11-19 07:00:00 ----D---- C:\windows\system32\sru
2015-11-18 17:22:04 ----RAD---- C:\windows\System32
2015-11-18 17:22:04 ----D---- C:\windows\Inf
2015-11-18 17:22:04 ----A---- C:\windows\system32\PerfStringBackup.INI
2015-11-18 17:17:45 ----RD---- C:\Program Files (x86)
2015-11-18 17:17:45 ----D---- C:\ProgramData\McAfee
2015-11-18 17:17:45 ----D---- C:\Program Files\Common Files
2015-11-18 17:17:45 ----D---- C:\Program Files (x86)\Common Files
2015-11-18 17:17:44 ----RD---- C:\Program Files
2015-11-18 17:15:45 ----D---- C:\Program Files (x86)\Amazon
2015-11-18 10:08:50 ----AD---- C:\Windows
2015-11-18 07:44:21 ----D---- C:\windows\system32\config
2015-11-18 07:41:11 ----SHD---- C:\System Volume Information
2015-11-18 07:39:45 ----D---- C:\windows\system32\DriverStore
2015-11-17 14:42:31 ----D---- C:\windows\system32\drivers
2015-11-17 14:42:26 ----HD---- C:\windows\ELAMBKUP
2015-11-17 14:42:09 ----D---- C:\windows\system32\Tasks
2015-11-17 14:41:47 ----RSD---- C:\windows\assembly
2015-11-17 13:38:39 ----SHD---- C:\windows\Installer
2015-11-16 07:02:40 ----D---- C:\windows\rescache
2015-11-15 09:52:24 ----D---- C:\windows\WinSxS
2015-11-14 10:18:00 ----D---- C:\windows\system32\catroot
2015-11-14 10:17:36 ----RD---- C:\windows\ToastData
2015-11-14 10:17:36 ----D---- C:\windows\SysWOW64
2015-11-14 09:55:25 ----D---- C:\windows\AppReadiness
2015-11-13 10:28:50 ----D---- C:\windows\CbsTemp
2015-11-11 16:03:34 ----D---- C:\windows\apppatch
2015-11-11 07:07:45 ----HD---- C:\Program Files\WindowsApps
2015-11-11 07:04:00 ----A---- C:\windows\system32\MRT.exe
2015-11-11 07:02:58 ----D---- C:\windows\system32\catroot2
2015-11-06 08:48:21 ----D---- C:\windows\system32\NDF
2015-11-03 01:23:06 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2015-10-30 09:16:19 ----SHD---- C:\$Recycle.Bin
2015-10-25 14:38:34 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2015-10-25 14:37:53 ----D---- C:\Program Files (x86)\Microsoft.NET
2015-10-25 14:22:24 ----D---- C:\Program Files (x86)\Microsoft Office
2015-10-25 14:17:18 ----RSD---- C:\windows\Fonts
2015-10-20 15:37:04 ----D---- C:\Users\Jan Beran\AppData\Roaming\Nitro PDF
2015-10-20 13:22:42 ----SD---- C:\Users\Jan Beran\AppData\Roaming\Microsoft
2015-10-20 04:03:54 ----D---- C:\Users\Jan Beran\AppData\Roaming\CDTPL

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2015-10-18 65224]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2015-10-18 274808]
R0 iaStorA;iaStorA; C:\windows\System32\drivers\iaStorA.sys [2013-08-07 644968]
R0 ngvss;ngvss; C:\windows\system32\drivers\ngvss.sys [2015-10-18 132656]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr2.sys [2015-10-18 93528]
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys [2015-11-07 1059656]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2015-11-07 449992]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\windows\system32\DRIVERS\vwififlt.sys [2013-08-22 71680]
R2 aswHwid;avast! HardwareID; C:\windows\system32\drivers\aswHwid.sys [2015-10-18 28656]
R2 aswMonFlt;aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [2015-10-18 90968]
R2 aswStm;aswStm; C:\windows\system32\drivers\aswStm.sys [2015-10-18 153744]
R2 VBoxAswDrv;VBoxAsw Support Driver; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2015-10-18 274336]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2014-01-22 4221440]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2013-10-29 3698904]
R3 iwdbus;@oem4.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\windows\System32\drivers\iwdbus.sys [2013-12-27 27032]
R3 MEIx64;@oem12.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\windows\system32\DRIVERS\TeeDriverx64.sys [2013-09-04 99288]
R3 RSP2STOR;@oem7.inf,%Rts5229%;Realtek PCIE CardReader Driver - P2; C:\windows\system32\DRIVERS\RtsP2Stor.sys [2013-07-05 290008]
R3 RTL8168;@oem6.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\windows\system32\DRIVERS\Rt630x64.sys [2013-06-21 816344]
R3 RTWlanE;@oem11.inf,%RTWlanE.DeviceDesc.DispName%;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\windows\system32\DRIVERS\rtwlane.sys [2013-08-21 2944216]
R3 usbscan;@sti.inf,%usbscan.SvcDesc%;USB Scanner Driver; C:\windows\System32\drivers\usbscan.sys [2014-10-29 44544]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\windows\System32\Drivers\usbvideo.sys [2014-06-21 212736]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\windows\system32\DRIVERS\vwifimp.sys [2013-08-22 36864]
S0 mfeelamk;McAfee Inc. mfeelamk; C:\windows\system32\drivers\mfeelamk.sys [2015-07-02 80920]
S3 e1iexpress;@net1ic64.inf,%e1iExpress.Service.DispName%;Intel(R) PRO/1000 PCI Express Network Connection Driver I; C:\windows\system32\DRIVERS\e1i63x64.sys [2013-06-18 460288]
S3 intaud_WaveExtensible;@oem3.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\windows\system32\drivers\intelaud.sys [2013-12-27 38296]
S3 IntcDAud;@oem1.inf,%IntcDAud.SvcDesc%;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2014-01-22 450520]
S3 NETwNe64;@netwew02.inf,___ %NIC_Service_DispName_WIN8_64%;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit; C:\windows\system32\DRIVERS\NETwew02.sys [2013-06-18 4649440]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-10-18 146600]
R2 ClickToRunSvc;Služba Microsoft Office ClickToRun; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2015-10-07 2780856]
R2 Dashboard Service;Dashboard Service; C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe [2013-08-09 25184]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\windows\System32\svchost.exe [2014-10-29 38792]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-08-07 15720]
R2 IdeaTouch.LocalDataServer.Education;IdeaTouch.LocalDataServer.Education; C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe [2012-05-17 7680]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-05-12 733696]
R2 Intel(R) ME Service;Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2013-09-04 131544]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-09-04 169432]
R2 JME Keyboard;JME Keyboard Driver; C:\Windows\jmesoft\Service.exe [2011-08-17 32768]
R2 Lenovo System Agent Service;Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [2014-05-22 584960]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-09-04 390616]
R2 NitroDriverReadSpool9;NitroPDFDriverCreatorReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [2014-02-14 230920]
R2 nlsX86cc;Nalpeiron Licensing Service; C:\windows\SysWOW64\NLSSRV32.EXE [2014-02-14 69640]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2013-05-14 390632]
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-03-28 249648]
R3 AvastVBoxSvc;AvastVBox COM Service; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2015-10-18 4048280]
S3 BBSvc;Bing Bar Update Service; C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\windows\System32\svchost.exe [2014-10-29 38792]
S3 cphs;Intel(R) Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2014-01-29 279024]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2014-03-18 43696]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-05-12 822232]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-04-23 532224]
S3 LSCWinService;LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [2014-02-20 1662424]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2015-10-16 150600]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: PC odesílám spam :-(

#6 Příspěvek od Rudy »

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
C:\Program Files (x86)\Microsoft\BingBar

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9FDDE16B-836F-4806-AB1F-1455CBEFF289}]/64
[-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}]/64
[-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]/64

:services
BBSvc
SeaPort

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Před skenem vypněte antivir a po něm restartujte PC. Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
pavel15
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 17 lis 2015 14:08

Re: PC odesílám spam :-(

#7 Příspěvek od pavel15 »

Logfile of random's system information tool 1.10 (written by random/random)
Run by Jan Beran at 2015-11-20 07:42:49
Microsoft Windows 8.1
System drive C: has 380 GB (84%) free of 450 GB
Total RAM: 4009 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:42:51, on 20. 11. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)
Boot mode: Normal

Running processes:
C:\Windows\jmesoft\hotkey.exe
C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files\trend micro\Jan Beran.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL
O4 - HKLM\..\Run: [jmekey] C:\windows\jmesoft\hotkey.exe
O4 - HKLM\..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
O4 - HKLM\..\Run: [LVT] C:\Program Files\Lenovo\LVT\LJYZ.exe 1
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (file missing)
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra button: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: JME Keyboard Driver (JME Keyboard) - Unknown owner - C:\Windows\jmesoft\Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo System Agent Service - LENOVO INCORPORATED. - C:\Program Files\Lenovo\iMController\SystemAgentService.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: LSCWinService - Unknown owner - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFDriverCreatorReadSpool9 (NitroDriverReadSpool9) - Nitro PDF Software - C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\windows\SysWOW64\NLSSRV32.EXE
O23 - Service: Cyberlink RichVideo64 Service(CRVS) (RichVideo64) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9960 bytes

======Listing Processes======





wininit.exe


C:\windows\system32\lsass.exe
winlogon.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
"dwm.exe"
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\WLANExt.exe 681061007040
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
\??\C:\windows\system32\conhost.exe 0x4
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe" /service
"C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe"
C:\windows\System32\svchost.exe -k utcsvc
"C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
C:\Windows\jmesoft\Service.exe
"C:\Program Files\Lenovo\iMController\SystemAgentService.exe"
"C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe"
C:\windows\SysWOW64\NLSSRV32.EXE
"C:\Program Files\CyberLink\Shared files\RichVideo64.exe"
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\Explorer.EXE
taskhostex.exe
"C:\Program Files\Dolby Digital Plus\ddp.exe" -autostart
"C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe"
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-e8802212-95eb-481e-b8f7-be7c6686e598 -SystemEventPortName:HostProcess-0cd58c4e-05fb-4d30-9df5-71f07cafc5dc -IoCancelEventPortName:HostProcess-605d8a15-2747-4833-aa68-455b5f55845c -NonStateChangingEventPortName:HostProcess-2852e928-905d-4f85-a2d3-38c4fbe5d821 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:cc3daff6-0fd3-4a8a-aa1f-ddb06ab77b60 -DeviceGroupId:WudfDefaultDevicePool
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
dashost.exe {aed541a9-aef2-4131-aa0dbfdee298a5e1}
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-705f0e3b-fec3-491d-b155-71f9c0afb684 -SystemEventPortName:HostProcess-9a87163d-f61f-452e-8c35-1a0eaa7a2fad -IoCancelEventPortName:HostProcess-36489b32-f668-461b-9386-ac618cf9c1cd -NonStateChangingEventPortName:HostProcess-55d18baa-2c1b-4ae7-9293-05022692c137 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:2b2ad1de-24aa-42a9-8c83-449c58ad2099 -DeviceGroupId:WpdFsGroup
C:\windows\system32\SearchIndexer.exe /Embedding
"C:\windows\system32\GWX\GWX.exe"
C:\Windows\System32\skydrive.exe -Embedding
"C:\Windows\System32\igfxtray.exe"
"C:\windows\system32\igfxsrvc.exe" -Embedding
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
"C:\Windows\jmesoft\hotkey.exe"
"C:\Windows\jmesoft\JME_LOAD.exe"
"C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
"C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
C:\windows\system32\wbem\unsecapp.exe -Embedding
"C:\Windows\System32\SettingSyncHost.exe" -Embedding
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"

"C:\Program Files\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3436 CREDAT:267521 /prefetch:2
"C:\windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe" -Embedding
"C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1309035181-1149327725-464113159-10013_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1309035181-1149327725-464113159-10013 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\windows\system32\SearchFilterHost.exe" 0 564 568 576 65536 572
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\rundll32.exe C:\windows\system32\pla.dll,PlaHost "LSC Memory" "0x13e4_0x1008_0x67f87746"
C:\windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Jan Beran\AppData\Local\Microsoft\Windows\INetCache\IE\M42V5YFG\RSITx64.exe"

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-10-25 219304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-10-18 655480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-25 2339032]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-10-25 153768]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-10-18 559624]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-25 1733240]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2014-01-29 391152]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2014-01-29 771568]
"Persistence"=C:\windows\system32\igfxpers.exe [2014-01-29 770544]
"IAStorIcon"=C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe [2013-08-07 36352]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-10-24 13662936]
"RtHDVBg_Dolby"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2013-10-29 1360600]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"jmekey"=C:\windows\jmesoft\hotkey.exe [2013-07-24 118784]
"jmesoft"=C:\Windows\jmesoft\ServiceLoader.exe [2011-08-17 28672]
"LVT"=C:\Program Files\Lenovo\LVT\LJYZ.exe [2011-11-24 886112]
"CLMLServer"=C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [2009-12-05 103720]
"UpdateP2GoShortCut"=C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [2011-12-07 214312]
"RemoteControl10"=C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [2013-03-09 95192]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-07 6133520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2014-01-22 624640]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McNaiAnn]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"SoftwareSASGeneration"=1
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoRun"=0
"NoFolderOptions"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-11-20 07:29:45 ----D---- C:\_OTM
2015-11-18 17:14:28 ----D---- C:\AdwCleaner
2015-11-17 14:02:47 ----D---- C:\rsit
2015-11-17 14:02:47 ----D---- C:\Program Files\trend micro
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\lsasrv.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\mrxsmb.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\ksecpkg.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\cng.sys
2015-11-11 03:43:39 ----A---- C:\windows\SYSWOW64\certcli.dll
2015-11-11 03:43:39 ----A---- C:\windows\system32\drivers\mrxsmb20.sys
2015-11-11 03:43:39 ----A---- C:\windows\system32\certcli.dll
2015-11-11 03:43:30 ----A---- C:\windows\SYSWOW64\untfs.dll
2015-11-11 03:43:30 ----A---- C:\windows\system32\untfs.dll
2015-11-11 03:43:29 ----A---- C:\windows\SYSWOW64\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tunnel.sys
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tpm.sys
2015-11-11 03:43:28 ----A---- C:\windows\SYSWOW64\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\tdx.sys
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\afd.sys
2015-11-11 03:43:26 ----A---- C:\windows\system32\win32k.sys
2015-11-11 03:43:25 ----A---- C:\windows\system32\AuthHost.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\winload.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\ntoskrnl.exe
2015-11-11 03:43:23 ----A---- C:\windows\system32\winresume.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapi.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\WUSettingsProvider.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wucltux.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuaueng.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuauclt.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapi.dll
2015-11-11 03:43:14 ----A---- C:\windows\SYSWOW64\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\localspl.dll
2015-11-11 03:43:06 ----A---- C:\windows\system32\mshtml.dll
2015-11-11 03:43:04 ----A---- C:\windows\SYSWOW64\mshtml.dll
2015-11-11 03:43:02 ----A---- C:\windows\system32\ieframe.dll
2015-11-11 03:43:00 ----A---- C:\windows\SYSWOW64\ieframe.dll
2015-11-11 03:42:59 ----A---- C:\windows\system32\jscript9.dll
2015-11-11 03:42:58 ----A---- C:\windows\SYSWOW64\iertutil.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\jscript.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\iertutil.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript9.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\ie4uinit.exe
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\ieapfltr.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\ieapfltr.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\system32\IKEEXT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\drivers\wfplwfs.sys
2015-11-11 03:42:53 ----A---- C:\windows\system32\BFE.DLL
2015-11-01 15:34:02 ----RHD---- C:\MSOCache
2015-10-25 14:15:26 ----D---- C:\Program Files\Microsoft Office 15

======List of files/folders modified in the last 1 month======

2015-11-20 07:36:58 ----RAD---- C:\windows\System32
2015-11-20 07:36:58 ----D---- C:\windows\Inf
2015-11-20 07:36:58 ----A---- C:\windows\system32\PerfStringBackup.INI
2015-11-20 07:33:08 ----D---- C:\windows\Temp
2015-11-20 07:29:57 ----D---- C:\Program Files (x86)\Microsoft
2015-11-20 07:29:45 ----D---- C:\windows\Prefetch
2015-11-20 07:03:42 ----SHD---- C:\System Volume Information
2015-11-20 07:03:20 ----D---- C:\windows\Microsoft.NET
2015-11-20 07:00:01 ----D---- C:\windows\system32\sru
2015-11-20 06:55:25 ----D---- C:\windows\system32\config
2015-11-18 17:17:45 ----RD---- C:\Program Files (x86)
2015-11-18 17:17:45 ----D---- C:\ProgramData\McAfee
2015-11-18 17:17:45 ----D---- C:\Program Files\Common Files
2015-11-18 17:17:45 ----D---- C:\Program Files (x86)\Common Files
2015-11-18 17:17:44 ----RD---- C:\Program Files
2015-11-18 17:15:45 ----D---- C:\Program Files (x86)\Amazon
2015-11-18 10:08:50 ----AD---- C:\Windows
2015-11-18 07:39:45 ----D---- C:\windows\system32\DriverStore
2015-11-17 14:42:31 ----D---- C:\windows\system32\drivers
2015-11-17 14:42:26 ----HD---- C:\windows\ELAMBKUP
2015-11-17 14:42:09 ----D---- C:\windows\system32\Tasks
2015-11-17 14:41:47 ----RSD---- C:\windows\assembly
2015-11-17 13:38:39 ----SHD---- C:\windows\Installer
2015-11-16 07:02:40 ----D---- C:\windows\rescache
2015-11-15 09:52:24 ----D---- C:\windows\WinSxS
2015-11-14 10:18:00 ----D---- C:\windows\system32\catroot
2015-11-14 10:17:36 ----RD---- C:\windows\ToastData
2015-11-14 10:17:36 ----D---- C:\windows\SysWOW64
2015-11-14 09:55:25 ----D---- C:\windows\AppReadiness
2015-11-13 10:28:50 ----D---- C:\windows\CbsTemp
2015-11-11 16:03:34 ----D---- C:\windows\apppatch
2015-11-11 07:07:45 ----HD---- C:\Program Files\WindowsApps
2015-11-11 07:04:00 ----A---- C:\windows\system32\MRT.exe
2015-11-11 07:02:58 ----D---- C:\windows\system32\catroot2
2015-11-06 08:48:21 ----D---- C:\windows\system32\NDF
2015-11-03 01:23:06 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2015-10-30 09:16:19 ----SHD---- C:\$Recycle.Bin
2015-10-25 14:38:34 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2015-10-25 14:37:53 ----D---- C:\Program Files (x86)\Microsoft.NET
2015-10-25 14:22:24 ----D---- C:\Program Files (x86)\Microsoft Office
2015-10-25 14:17:18 ----RSD---- C:\windows\Fonts

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2015-10-18 65224]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2015-10-18 274808]
R0 iaStorA;iaStorA; C:\windows\System32\drivers\iaStorA.sys [2013-08-07 644968]
R0 ngvss;ngvss; C:\windows\system32\drivers\ngvss.sys [2015-10-18 132656]
R0 Wof;Windows Overlay File System Filter Driver; C:\windows\system32\drivers\Wof.sys [2014-11-08 157016]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr2.sys [2015-10-18 93528]
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys [2015-11-07 1059656]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2015-11-07 449992]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\windows\system32\DRIVERS\vwififlt.sys [2013-08-22 71680]
R2 aswHwid;avast! HardwareID; C:\windows\system32\drivers\aswHwid.sys [2015-10-18 28656]
R2 aswMonFlt;aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [2015-10-18 90968]
R2 aswStm;aswStm; C:\windows\system32\drivers\aswStm.sys [2015-10-18 153744]
R2 VBoxAswDrv;VBoxAsw Support Driver; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2015-10-18 274336]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2014-01-22 4221440]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2013-10-29 3698904]
R3 iwdbus;@oem4.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\windows\System32\drivers\iwdbus.sys [2013-12-27 27032]
R3 MEIx64;@oem12.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\windows\system32\DRIVERS\TeeDriverx64.sys [2013-09-04 99288]
R3 RSP2STOR;@oem7.inf,%Rts5229%;Realtek PCIE CardReader Driver - P2; C:\windows\system32\DRIVERS\RtsP2Stor.sys [2013-07-05 290008]
R3 RTL8168;@oem6.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\windows\system32\DRIVERS\Rt630x64.sys [2013-06-21 816344]
R3 RTWlanE;@oem11.inf,%RTWlanE.DeviceDesc.DispName%;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\windows\system32\DRIVERS\rtwlane.sys [2013-08-21 2944216]
R3 usbscan;@sti.inf,%usbscan.SvcDesc%;USB Scanner Driver; C:\windows\System32\drivers\usbscan.sys [2014-10-29 44544]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\windows\System32\Drivers\usbvideo.sys [2014-06-21 212736]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\windows\system32\DRIVERS\vwifimp.sys [2013-08-22 36864]
S0 mfeelamk;McAfee Inc. mfeelamk; C:\windows\system32\drivers\mfeelamk.sys [2015-07-02 80920]
S3 e1iexpress;@net1ic64.inf,%e1iExpress.Service.DispName%;Intel(R) PRO/1000 PCI Express Network Connection Driver I; C:\windows\system32\DRIVERS\e1i63x64.sys [2013-06-18 460288]
S3 intaud_WaveExtensible;@oem3.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\windows\system32\drivers\intelaud.sys [2013-12-27 38296]
S3 IntcDAud;@oem1.inf,%IntcDAud.SvcDesc%;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2014-01-22 450520]
S3 NETwNe64;@netwew02.inf,___ %NIC_Service_DispName_WIN8_64%;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit; C:\windows\system32\DRIVERS\NETwew02.sys [2013-06-18 4649440]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-10-18 146600]
R2 ClickToRunSvc;Služba Microsoft Office ClickToRun; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2015-10-07 2780856]
R2 Dashboard Service;Dashboard Service; C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe [2013-08-09 25184]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\windows\System32\svchost.exe [2014-10-29 38792]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-08-07 15720]
R2 IdeaTouch.LocalDataServer.Education;IdeaTouch.LocalDataServer.Education; C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe [2012-05-17 7680]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-05-12 733696]
R2 Intel(R) ME Service;Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2013-09-04 131544]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-09-04 169432]
R2 JME Keyboard;JME Keyboard Driver; C:\Windows\jmesoft\Service.exe [2011-08-17 32768]
R2 Lenovo System Agent Service;Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [2014-05-22 584960]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-09-04 390616]
R2 NitroDriverReadSpool9;NitroPDFDriverCreatorReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [2014-02-14 230920]
R2 nlsX86cc;Nalpeiron Licensing Service; C:\windows\SysWOW64\NLSSRV32.EXE [2014-02-14 69640]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2013-05-14 390632]
R3 AvastVBoxSvc;AvastVBox COM Service; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2015-10-18 4048280]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\windows\System32\svchost.exe [2014-10-29 38792]
S3 cphs;Intel(R) Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2014-01-29 279024]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2014-03-18 43696]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-05-12 822232]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-04-23 532224]
S3 LSCWinService;LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [2014-02-20 1662424]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2015-10-16 150600]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: PC odesílám spam :-(

#8 Příspěvek od Rudy »

Dvouklikem na soubor C:\Program Files\trend micro\Jan Beran.exe spusťte HijackThis. Klikněte na "Do a system scan only" a v otevřeném okně vlevo ve čtverečcích zaškrtněte:
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (file missing)
Klikněte na >FixChecked<. Pak znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
pavel15
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 17 lis 2015 14:08

Re: PC odesílám spam :-(

#9 Příspěvek od pavel15 »

Provedeno, tím je proces ukončen a problém vyřešen?
Děkuji za pomoc. Pro jistotu přidávám aktuální log po restartu:


Logfile of random's system information tool 1.10 (written by random/random)
Run by Jan Beran at 2015-11-21 10:25:05
Microsoft Windows 8.1
System drive C: has 380 GB (84%) free of 450 GB
Total RAM: 4009 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:25:09, on 21. 11. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)
Boot mode: Normal

Running processes:
C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe
C:\Windows\jmesoft\hotkey.exe
C:\Program Files\Lenovo\LVT\LJYZ.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\trend micro\Jan Beran.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL
O4 - HKLM\..\Run: [jmekey] C:\windows\jmesoft\hotkey.exe
O4 - HKLM\..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
O4 - HKLM\..\Run: [LVT] C:\Program Files\Lenovo\LVT\LJYZ.exe 1
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (file missing)
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra button: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: JME Keyboard Driver (JME Keyboard) - Unknown owner - C:\Windows\jmesoft\Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo System Agent Service - LENOVO INCORPORATED. - C:\Program Files\Lenovo\iMController\SystemAgentService.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: LSCWinService - Unknown owner - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFDriverCreatorReadSpool9 (NitroDriverReadSpool9) - Nitro PDF Software - C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\windows\SysWOW64\NLSSRV32.EXE
O23 - Service: Cyberlink RichVideo64 Service(CRVS) (RichVideo64) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10061 bytes

======Listing Processes======





wininit.exe


C:\windows\system32\lsass.exe
winlogon.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
"dwm.exe"
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\windows\system32\WLANExt.exe 170331649456
\??\C:\windows\system32\conhost.exe 0x4
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe" /service
"C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe"
C:\windows\System32\svchost.exe -k utcsvc
"C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
C:\Windows\jmesoft\Service.exe
"C:\Program Files\Lenovo\iMController\SystemAgentService.exe"
taskhostex.exe
taskhost.exe USER
"C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe" scan upload
"C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe"
C:\windows\Explorer.EXE
C:\windows\SysWOW64\NLSSRV32.EXE
"C:\Program Files\CyberLink\Shared files\RichVideo64.exe"
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\wbem\wmiprvse.exe
"C:\Program Files\Dolby Digital Plus\ddp.exe" -autostart
"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server
"C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe"
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-e8402287-e677-45ed-849c-42ca50058628 -SystemEventPortName:HostProcess-ad86a8df-c817-427f-bafb-f6ceb11cfa8d -IoCancelEventPortName:HostProcess-8abf9ca4-f471-47e7-b2a5-aa3e810bd20d -NonStateChangingEventPortName:HostProcess-01f512a8-10b2-4353-b2f9-09c46cc2d1b1 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:5122f979-c026-41b6-a2ef-889166ac8add -DeviceGroupId:WudfDefaultDevicePool
dashost.exe {049c820d-4bc7-49fd-8f1c8f703395c244}
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-064aebc5-8267-4e5e-8116-21d70bf6f39d -SystemEventPortName:HostProcess-3ff40874-88b7-48a9-a468-b3c05577b6f0 -IoCancelEventPortName:HostProcess-2f44abdd-e154-4590-957b-35a6abf6d5d1 -NonStateChangingEventPortName:HostProcess-4f779543-e95d-4add-b721-b3706aa3542a -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:490f919f-ccd7-4e00-970f-e5ef60c51fa6 -DeviceGroupId:WpdFsGroup
C:\windows\system32\SearchIndexer.exe /Embedding
"C:\windows\system32\GWX\GWX.exe"
C:\Windows\System32\skydrive.exe -Embedding
"C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\windows\system32\SearchFilterHost.exe" 0 556 560 568 65536 564
"C:\Windows\System32\igfxtray.exe"
"C:\windows\system32\igfxsrvc.exe" -Embedding
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
"C:\Program Files\Internet Explorer\iexplore.exe"
"C:\Windows\jmesoft\hotkey.exe"
"C:\Program Files\Lenovo\LVT\LJYZ.exe" 1
"C:\Windows\jmesoft\JME_LOAD.exe"
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4356 CREDAT:267521 /prefetch:2
"C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
"C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
C:\windows\system32\wbem\unsecapp.exe -Embedding
"C:\Windows\System32\SettingSyncHost.exe" -Embedding
C:\Windows\System32\RuntimeBroker.exe -Embedding
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"

"C:\Users\Jan Beran\AppData\Local\Microsoft\Windows\INetCache\IE\J041WU40\RSITx64.exe"

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-10-25 219304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-10-18 655480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-25 2339032]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-10-25 153768]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-10-18 559624]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-25 1733240]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2014-01-29 391152]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2014-01-29 771568]
"Persistence"=C:\windows\system32\igfxpers.exe [2014-01-29 770544]
"IAStorIcon"=C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe [2013-08-07 36352]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-10-24 13662936]
"RtHDVBg_Dolby"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2013-10-29 1360600]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"jmekey"=C:\windows\jmesoft\hotkey.exe [2013-07-24 118784]
"jmesoft"=C:\Windows\jmesoft\ServiceLoader.exe [2011-08-17 28672]
"LVT"=C:\Program Files\Lenovo\LVT\LJYZ.exe [2011-11-24 886112]
"CLMLServer"=C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [2009-12-05 103720]
"UpdateP2GoShortCut"=C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [2011-12-07 214312]
"RemoteControl10"=C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [2013-03-09 95192]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-07 6133520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2014-01-22 624640]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McNaiAnn]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"SoftwareSASGeneration"=1
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoRun"=0
"NoFolderOptions"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-11-21 10:25:05 ----D---- C:\rsit
2015-11-18 17:14:28 ----D---- C:\AdwCleaner
2015-11-17 14:02:47 ----D---- C:\Program Files\trend micro
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\lsasrv.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\mrxsmb.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\ksecpkg.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\cng.sys
2015-11-11 03:43:39 ----A---- C:\windows\SYSWOW64\certcli.dll
2015-11-11 03:43:39 ----A---- C:\windows\system32\drivers\mrxsmb20.sys
2015-11-11 03:43:39 ----A---- C:\windows\system32\certcli.dll
2015-11-11 03:43:30 ----A---- C:\windows\SYSWOW64\untfs.dll
2015-11-11 03:43:30 ----A---- C:\windows\system32\untfs.dll
2015-11-11 03:43:29 ----A---- C:\windows\SYSWOW64\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tunnel.sys
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tpm.sys
2015-11-11 03:43:28 ----A---- C:\windows\SYSWOW64\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\tdx.sys
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\afd.sys
2015-11-11 03:43:26 ----A---- C:\windows\system32\win32k.sys
2015-11-11 03:43:25 ----A---- C:\windows\system32\AuthHost.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\winload.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\ntoskrnl.exe
2015-11-11 03:43:23 ----A---- C:\windows\system32\winresume.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapi.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\WUSettingsProvider.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wucltux.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuaueng.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuauclt.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapi.dll
2015-11-11 03:43:14 ----A---- C:\windows\SYSWOW64\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\localspl.dll
2015-11-11 03:43:06 ----A---- C:\windows\system32\mshtml.dll
2015-11-11 03:43:04 ----A---- C:\windows\SYSWOW64\mshtml.dll
2015-11-11 03:43:02 ----A---- C:\windows\system32\ieframe.dll
2015-11-11 03:43:00 ----A---- C:\windows\SYSWOW64\ieframe.dll
2015-11-11 03:42:59 ----A---- C:\windows\system32\jscript9.dll
2015-11-11 03:42:58 ----A---- C:\windows\SYSWOW64\iertutil.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\jscript.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\iertutil.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript9.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\ie4uinit.exe
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\ieapfltr.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\ieapfltr.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\system32\IKEEXT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\drivers\wfplwfs.sys
2015-11-11 03:42:53 ----A---- C:\windows\system32\BFE.DLL
2015-11-01 15:34:02 ----RHD---- C:\MSOCache
2015-10-25 14:15:26 ----D---- C:\Program Files\Microsoft Office 15

======List of files/folders modified in the last 1 month======

2015-11-21 10:24:22 ----D---- C:\windows\Prefetch
2015-11-21 10:23:31 ----D---- C:\windows\Temp
2015-11-20 16:00:00 ----D---- C:\windows\system32\sru
2015-11-20 07:36:58 ----RAD---- C:\windows\System32
2015-11-20 07:36:58 ----D---- C:\windows\Inf
2015-11-20 07:36:58 ----A---- C:\windows\system32\PerfStringBackup.INI
2015-11-20 07:29:57 ----D---- C:\Program Files (x86)\Microsoft
2015-11-20 07:03:42 ----SHD---- C:\System Volume Information
2015-11-20 07:03:20 ----D---- C:\windows\Microsoft.NET
2015-11-20 06:55:25 ----D---- C:\windows\system32\config
2015-11-18 17:17:45 ----RD---- C:\Program Files (x86)
2015-11-18 17:17:45 ----D---- C:\ProgramData\McAfee
2015-11-18 17:17:45 ----D---- C:\Program Files\Common Files
2015-11-18 17:17:45 ----D---- C:\Program Files (x86)\Common Files
2015-11-18 17:17:44 ----RD---- C:\Program Files
2015-11-18 17:15:45 ----D---- C:\Program Files (x86)\Amazon
2015-11-18 10:08:50 ----AD---- C:\Windows
2015-11-18 07:39:45 ----D---- C:\windows\system32\DriverStore
2015-11-17 14:42:31 ----D---- C:\windows\system32\drivers
2015-11-17 14:42:26 ----HD---- C:\windows\ELAMBKUP
2015-11-17 14:42:09 ----D---- C:\windows\system32\Tasks
2015-11-17 14:41:47 ----RSD---- C:\windows\assembly
2015-11-17 13:38:39 ----SHD---- C:\windows\Installer
2015-11-16 07:02:40 ----D---- C:\windows\rescache
2015-11-15 09:52:24 ----D---- C:\windows\WinSxS
2015-11-14 10:18:00 ----D---- C:\windows\system32\catroot
2015-11-14 10:17:36 ----RD---- C:\windows\ToastData
2015-11-14 10:17:36 ----D---- C:\windows\SysWOW64
2015-11-14 09:55:25 ----D---- C:\windows\AppReadiness
2015-11-13 10:28:50 ----D---- C:\windows\CbsTemp
2015-11-11 16:03:34 ----D---- C:\windows\apppatch
2015-11-11 07:07:45 ----HD---- C:\Program Files\WindowsApps
2015-11-11 07:04:00 ----A---- C:\windows\system32\MRT.exe
2015-11-11 07:02:58 ----D---- C:\windows\system32\catroot2
2015-11-06 08:48:21 ----D---- C:\windows\system32\NDF
2015-11-03 01:23:06 ----A---- C:\windows\SYSWOW64\FlashPlayerApp.exe
2015-10-30 09:16:19 ----SHD---- C:\$Recycle.Bin
2015-10-25 14:38:34 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2015-10-25 14:37:53 ----D---- C:\Program Files (x86)\Microsoft.NET
2015-10-25 14:22:24 ----D---- C:\Program Files (x86)\Microsoft Office
2015-10-25 14:17:18 ----RSD---- C:\windows\Fonts

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2015-10-18 65224]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2015-10-18 274808]
R0 iaStorA;iaStorA; C:\windows\System32\drivers\iaStorA.sys [2013-08-07 644968]
R0 ngvss;ngvss; C:\windows\system32\drivers\ngvss.sys [2015-10-18 132656]
R0 Wof;Windows Overlay File System Filter Driver; C:\windows\system32\drivers\Wof.sys [2014-11-08 157016]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr2.sys [2015-10-18 93528]
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys [2015-11-07 1059656]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2015-11-07 449992]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\windows\system32\DRIVERS\vwififlt.sys [2013-08-22 71680]
R2 aswHwid;avast! HardwareID; C:\windows\system32\drivers\aswHwid.sys [2015-10-18 28656]
R2 aswMonFlt;aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [2015-10-18 90968]
R2 aswStm;aswStm; C:\windows\system32\drivers\aswStm.sys [2015-10-18 153744]
R2 VBoxAswDrv;VBoxAsw Support Driver; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2015-10-18 274336]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2014-01-22 4221440]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2013-10-29 3698904]
R3 iwdbus;@oem4.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\windows\System32\drivers\iwdbus.sys [2013-12-27 27032]
R3 MEIx64;@oem12.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\windows\system32\DRIVERS\TeeDriverx64.sys [2013-09-04 99288]
R3 RSP2STOR;@oem7.inf,%Rts5229%;Realtek PCIE CardReader Driver - P2; C:\windows\system32\DRIVERS\RtsP2Stor.sys [2013-07-05 290008]
R3 RTL8168;@oem6.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\windows\system32\DRIVERS\Rt630x64.sys [2013-06-21 816344]
R3 RTWlanE;@oem11.inf,%RTWlanE.DeviceDesc.DispName%;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\windows\system32\DRIVERS\rtwlane.sys [2013-08-21 2944216]
R3 usbscan;@sti.inf,%usbscan.SvcDesc%;USB Scanner Driver; C:\windows\System32\drivers\usbscan.sys [2014-10-29 44544]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\windows\System32\Drivers\usbvideo.sys [2014-06-21 212736]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\windows\system32\DRIVERS\vwifimp.sys [2013-08-22 36864]
S0 mfeelamk;McAfee Inc. mfeelamk; C:\windows\system32\drivers\mfeelamk.sys [2015-07-02 80920]
S3 e1iexpress;@net1ic64.inf,%e1iExpress.Service.DispName%;Intel(R) PRO/1000 PCI Express Network Connection Driver I; C:\windows\system32\DRIVERS\e1i63x64.sys [2013-06-18 460288]
S3 intaud_WaveExtensible;@oem3.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\windows\system32\drivers\intelaud.sys [2013-12-27 38296]
S3 IntcDAud;@oem1.inf,%IntcDAud.SvcDesc%;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2014-01-22 450520]
S3 NETwNe64;@netwew02.inf,___ %NIC_Service_DispName_WIN8_64%;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit; C:\windows\system32\DRIVERS\NETwew02.sys [2013-06-18 4649440]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-10-18 146600]
R2 ClickToRunSvc;Služba Microsoft Office ClickToRun; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2015-10-07 2780856]
R2 Dashboard Service;Dashboard Service; C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe [2013-08-09 25184]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\windows\System32\svchost.exe [2014-10-29 38792]
R2 IdeaTouch.LocalDataServer.Education;IdeaTouch.LocalDataServer.Education; C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe [2012-05-17 7680]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-05-12 733696]
R2 JME Keyboard;JME Keyboard Driver; C:\Windows\jmesoft\Service.exe [2011-08-17 32768]
R2 Lenovo System Agent Service;Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [2014-05-22 584960]
R2 NitroDriverReadSpool9;NitroPDFDriverCreatorReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [2014-02-14 230920]
R2 nlsX86cc;Nalpeiron Licensing Service; C:\windows\SysWOW64\NLSSRV32.EXE [2014-02-14 69640]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2013-05-14 390632]
R3 AvastVBoxSvc;AvastVBox COM Service; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2015-10-18 4048280]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-08-07 15720]
S2 Intel(R) ME Service;Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2013-09-04 131544]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-09-04 169432]
S2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-09-04 390616]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\windows\System32\svchost.exe [2014-10-29 38792]
S3 cphs;Intel(R) Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2014-01-29 279024]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2014-03-18 43696]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-05-12 822232]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-04-23 532224]
S3 LSCWinService;LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [2014-02-20 1662424]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2015-10-16 150600]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: PC odesílám spam :-(

#10 Příspěvek od Rudy »

OK. Ještě doporučuji změnu hesla na mail.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
pavel15
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 17 lis 2015 14:08

Re: PC odesílám spam :-(

#11 Příspěvek od pavel15 »

Dobrý den,
přes předchozí čistící procedure se dnes opět objevil problem s rozesíláním spamu z mého mailového účtu :-(
Prosím opět o pomoc a přikládám log
Děkuji

Logfile of random's system information tool 1.10 (written by random/random)
Run by Jan Beran at 2015-12-03 13:17:03
Microsoft Windows 8.1
System drive C: has 378 GB (84%) free of 450 GB
Total RAM: 4009 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:17:06, on 3. 12. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)
Boot mode: Normal

Running processes:
C:\Windows\jmesoft\hotkey.exe
C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
C:\windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files\trend micro\Jan Beran.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL
O4 - HKLM\..\Run: [jmekey] C:\windows\jmesoft\hotkey.exe
O4 - HKLM\..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
O4 - HKLM\..\Run: [LVT] C:\Program Files\Lenovo\LVT\LJYZ.exe 1
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (file missing)
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra button: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: JME Keyboard Driver (JME Keyboard) - Unknown owner - C:\Windows\jmesoft\Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo System Agent Service - LENOVO INCORPORATED. - C:\Program Files\Lenovo\iMController\SystemAgentService.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: LSCWinService - Unknown owner - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFDriverCreatorReadSpool9 (NitroDriverReadSpool9) - Nitro PDF Software - C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\windows\SysWOW64\NLSSRV32.EXE
O23 - Service: Cyberlink RichVideo64 Service(CRVS) (RichVideo64) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10211 bytes

======Listing Processes======





wininit.exe

C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\windows\system32\WLANExt.exe 170331649456
\??\C:\windows\system32\conhost.exe 0x4
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe"
C:\windows\System32\svchost.exe -k utcsvc
"C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
C:\Windows\jmesoft\Service.exe
"C:\Program Files\Lenovo\iMController\SystemAgentService.exe"
"C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe"
C:\windows\SysWOW64\NLSSRV32.EXE
"C:\Program Files\CyberLink\Shared files\RichVideo64.exe"
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\wbem\wmiprvse.exe
"C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe"
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-e8402287-e677-45ed-849c-42ca50058628 -SystemEventPortName:HostProcess-ad86a8df-c817-427f-bafb-f6ceb11cfa8d -IoCancelEventPortName:HostProcess-8abf9ca4-f471-47e7-b2a5-aa3e810bd20d -NonStateChangingEventPortName:HostProcess-01f512a8-10b2-4353-b2f9-09c46cc2d1b1 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:5122f979-c026-41b6-a2ef-889166ac8add -DeviceGroupId:WudfDefaultDevicePool
dashost.exe {049c820d-4bc7-49fd-8f1c8f703395c244}
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-064aebc5-8267-4e5e-8116-21d70bf6f39d -SystemEventPortName:HostProcess-3ff40874-88b7-48a9-a468-b3c05577b6f0 -IoCancelEventPortName:HostProcess-2f44abdd-e154-4590-957b-35a6abf6d5d1 -NonStateChangingEventPortName:HostProcess-4f779543-e95d-4add-b721-b3706aa3542a -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:490f919f-ccd7-4e00-970f-e5ef60c51fa6 -DeviceGroupId:WpdFsGroup
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\windows\system32\rundll32.exe C:\windows\system32\pla.dll,PlaHost "LSC Memory" "0x178c_0x1790_0x682c55af"
"C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe" /service
C:\windows\system32\SearchIndexer.exe /Embedding

C:\windows\System32\WinLogon.exe -SpecialSession
-hiberboot
C:\windows\Explorer.EXE
C:\Windows\System32\skydrive.exe -Embedding
taskhostex.exe
"C:\Program Files\Dolby Digital Plus\ddp.exe" -autostart
"C:\Windows\System32\igfxtray.exe"
"C:\windows\system32\igfxsrvc.exe" -Embedding
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
"C:\windows\system32\GWX\GWX.exe"
"C:\Windows\jmesoft\hotkey.exe"
"C:\Windows\jmesoft\JME_LOAD.exe"
"C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
"C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
C:\windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE"
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Windows\System32\SettingSyncHost.exe" -Embedding
"C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe" --domain-id 4e00205a-2ab1-4423-8f77-cc25b82cde1d
"C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe" --domain-id 4e00205a-2ab1-4423-8f77-cc25b82cde1d
"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\windows\SysWOW64\DllHost.exe /Processid:{45BA127D-10A8-46EA-8AB7-56EA9078943C}
"C:\windows\system32\wwahost.exe" -ServerName:Microsoft.WindowsLive.Mail.wwa
"C:\Program Files\Internet Explorer\iexplore.exe" http://forum.viry.cz/viewtopic.php?f=13&t=130786
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6004 CREDAT:267521 /prefetch:2

"C:\Users\Jan Beran\AppData\Local\Microsoft\Windows\INetCache\IE\J041WU40\RSITx64 (1).exe"

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-10-13 219304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-10-18 655480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13 2339032]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-10-13 153768]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-10-18 559624]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13 1731800]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2014-01-29 391152]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2014-01-29 771568]
"Persistence"=C:\windows\system32\igfxpers.exe [2014-01-29 770544]
"IAStorIcon"=C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe [2013-08-07 36352]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-10-24 13662936]
"RtHDVBg_Dolby"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2013-10-29 1360600]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"jmekey"=C:\windows\jmesoft\hotkey.exe [2013-07-24 118784]
"jmesoft"=C:\Windows\jmesoft\ServiceLoader.exe [2011-08-17 28672]
"LVT"=C:\Program Files\Lenovo\LVT\LJYZ.exe [2011-11-24 886112]
"CLMLServer"=C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [2009-12-05 103720]
"UpdateP2GoShortCut"=C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [2011-12-07 214312]
"RemoteControl10"=C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [2013-03-09 95192]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-07 6133520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2014-01-22 624640]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McNaiAnn]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"SoftwareSASGeneration"=1
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoRun"=0
"NoFolderOptions"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-11-21 10:25:05 ----D---- C:\rsit
2015-11-18 17:14:28 ----D---- C:\AdwCleaner
2015-11-17 14:02:47 ----D---- C:\Program Files\trend micro
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\lsasrv.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\mrxsmb.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\ksecpkg.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\cng.sys
2015-11-11 03:43:39 ----A---- C:\windows\SYSWOW64\certcli.dll
2015-11-11 03:43:39 ----A---- C:\windows\system32\drivers\mrxsmb20.sys
2015-11-11 03:43:39 ----A---- C:\windows\system32\certcli.dll
2015-11-11 03:43:30 ----A---- C:\windows\SYSWOW64\untfs.dll
2015-11-11 03:43:30 ----A---- C:\windows\system32\untfs.dll
2015-11-11 03:43:29 ----A---- C:\windows\SYSWOW64\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tunnel.sys
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tpm.sys
2015-11-11 03:43:28 ----A---- C:\windows\SYSWOW64\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\tdx.sys
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\afd.sys
2015-11-11 03:43:26 ----A---- C:\windows\system32\win32k.sys
2015-11-11 03:43:25 ----A---- C:\windows\system32\AuthHost.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\winload.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\ntoskrnl.exe
2015-11-11 03:43:23 ----A---- C:\windows\system32\winresume.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapi.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\WUSettingsProvider.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wucltux.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuaueng.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuauclt.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapi.dll
2015-11-11 03:43:14 ----A---- C:\windows\SYSWOW64\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\localspl.dll
2015-11-11 03:43:06 ----A---- C:\windows\system32\mshtml.dll
2015-11-11 03:43:04 ----A---- C:\windows\SYSWOW64\mshtml.dll
2015-11-11 03:43:02 ----A---- C:\windows\system32\ieframe.dll
2015-11-11 03:43:00 ----A---- C:\windows\SYSWOW64\ieframe.dll
2015-11-11 03:42:59 ----A---- C:\windows\system32\jscript9.dll
2015-11-11 03:42:58 ----A---- C:\windows\SYSWOW64\iertutil.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\jscript.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\iertutil.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript9.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\ie4uinit.exe
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\ieapfltr.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\ieapfltr.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\system32\IKEEXT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\drivers\wfplwfs.sys
2015-11-11 03:42:53 ----A---- C:\windows\system32\BFE.DLL

======List of files/folders modified in the last 1 month======

2015-12-03 13:00:00 ----D---- C:\windows\system32\sru
2015-12-03 11:31:05 ----D---- C:\windows\Prefetch
2015-12-03 08:49:59 ----D---- C:\windows\Temp
2015-12-03 07:00:27 ----D---- C:\windows\Microsoft.NET
2015-12-02 07:05:17 ----D---- C:\windows\system32\config
2015-12-02 07:03:09 ----D---- C:\windows\system32\DriverStore
2015-11-26 06:38:39 ----SHD---- C:\System Volume Information
2015-11-26 06:36:49 ----RSD---- C:\windows\assembly
2015-11-25 16:02:10 ----SHD---- C:\windows\Installer
2015-11-25 16:00:49 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2015-11-25 15:59:45 ----D---- C:\Program Files\Microsoft Office 15
2015-11-24 10:31:42 ----D---- C:\windows\Inf
2015-11-24 06:23:25 ----RAD---- C:\windows\System32
2015-11-24 06:23:24 ----A---- C:\windows\system32\PerfStringBackup.INI
2015-11-22 13:27:20 ----D---- C:\windows\AppReadiness
2015-11-20 07:29:57 ----D---- C:\Program Files (x86)\Microsoft
2015-11-18 17:17:45 ----RD---- C:\Program Files (x86)
2015-11-18 17:17:45 ----D---- C:\ProgramData\McAfee
2015-11-18 17:17:45 ----D---- C:\Program Files\Common Files
2015-11-18 17:17:45 ----D---- C:\Program Files (x86)\Common Files
2015-11-18 17:17:44 ----RD---- C:\Program Files
2015-11-18 17:15:45 ----D---- C:\Program Files (x86)\Amazon
2015-11-18 10:08:50 ----AD---- C:\Windows
2015-11-17 14:42:31 ----D---- C:\windows\system32\drivers
2015-11-17 14:42:26 ----HD---- C:\windows\ELAMBKUP
2015-11-17 14:42:09 ----D---- C:\windows\system32\Tasks
2015-11-16 07:02:40 ----D---- C:\windows\rescache
2015-11-15 09:52:24 ----D---- C:\windows\WinSxS
2015-11-14 10:18:00 ----D---- C:\windows\system32\catroot
2015-11-14 10:17:36 ----RD---- C:\windows\ToastData
2015-11-14 10:17:36 ----D---- C:\windows\SysWOW64
2015-11-13 10:28:50 ----D---- C:\windows\CbsTemp
2015-11-11 16:03:34 ----D---- C:\windows\apppatch
2015-11-11 07:07:45 ----HD---- C:\Program Files\WindowsApps
2015-11-11 07:04:00 ----A---- C:\windows\system32\MRT.exe
2015-11-11 07:02:58 ----D---- C:\windows\system32\catroot2
2015-11-06 08:48:21 ----D---- C:\windows\system32\NDF

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2015-10-18 65224]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2015-10-18 274808]
R0 iaStorA;iaStorA; C:\windows\System32\drivers\iaStorA.sys [2013-08-07 644968]
R0 ngvss;ngvss; C:\windows\system32\drivers\ngvss.sys [2015-10-18 132656]
R0 Wof;Windows Overlay File System Filter Driver; C:\windows\system32\drivers\Wof.sys [2014-11-08 157016]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr2.sys [2015-10-18 93528]
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys [2015-11-07 1059656]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2015-11-07 449992]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\windows\system32\DRIVERS\vwififlt.sys [2013-08-22 71680]
R2 aswHwid;avast! HardwareID; C:\windows\system32\drivers\aswHwid.sys [2015-10-18 28656]
R2 aswMonFlt;aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [2015-10-18 90968]
R2 aswStm;aswStm; C:\windows\system32\drivers\aswStm.sys [2015-10-18 153744]
R2 VBoxAswDrv;VBoxAsw Support Driver; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2015-10-18 274336]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2014-01-22 4221440]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2013-10-29 3698904]
R3 iwdbus;@oem4.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\windows\System32\drivers\iwdbus.sys [2013-12-27 27032]
R3 MEIx64;@oem12.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\windows\system32\DRIVERS\TeeDriverx64.sys [2013-09-04 99288]
R3 RSP2STOR;@oem7.inf,%Rts5229%;Realtek PCIE CardReader Driver - P2; C:\windows\system32\DRIVERS\RtsP2Stor.sys [2013-07-05 290008]
R3 RTL8168;@oem6.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\windows\system32\DRIVERS\Rt630x64.sys [2013-06-21 816344]
R3 RTWlanE;@oem11.inf,%RTWlanE.DeviceDesc.DispName%;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\windows\system32\DRIVERS\rtwlane.sys [2013-08-21 2944216]
R3 usbscan;@sti.inf,%usbscan.SvcDesc%;USB Scanner Driver; C:\windows\System32\drivers\usbscan.sys [2014-10-29 44544]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\windows\System32\Drivers\usbvideo.sys [2014-06-21 212736]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\windows\system32\DRIVERS\vwifimp.sys [2013-08-22 36864]
S0 mfeelamk;McAfee Inc. mfeelamk; C:\windows\system32\drivers\mfeelamk.sys [2015-07-02 80920]
S3 e1iexpress;@net1ic64.inf,%e1iExpress.Service.DispName%;Intel(R) PRO/1000 PCI Express Network Connection Driver I; C:\windows\system32\DRIVERS\e1i63x64.sys [2013-06-18 460288]
S3 intaud_WaveExtensible;@oem3.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\windows\system32\drivers\intelaud.sys [2013-12-27 38296]
S3 IntcDAud;@oem1.inf,%IntcDAud.SvcDesc%;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2014-01-22 450520]
S3 NETwNe64;@netwew02.inf,___ %NIC_Service_DispName_WIN8_64%;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit; C:\windows\system32\DRIVERS\NETwew02.sys [2013-06-18 4649440]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-10-18 146600]
R2 ClickToRunSvc;Služba Microsoft Office ClickToRun; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2015-10-13 2797752]
R2 Dashboard Service;Dashboard Service; C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe [2013-08-09 25184]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\windows\System32\svchost.exe [2014-10-29 38792]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-08-07 15720]
R2 IdeaTouch.LocalDataServer.Education;IdeaTouch.LocalDataServer.Education; C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe [2012-05-17 7680]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-05-12 733696]
R2 Intel(R) ME Service;Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2013-09-04 131544]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-09-04 169432]
R2 JME Keyboard;JME Keyboard Driver; C:\Windows\jmesoft\Service.exe [2011-08-17 32768]
R2 Lenovo System Agent Service;Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [2014-05-22 584960]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-09-04 390616]
R2 NitroDriverReadSpool9;NitroPDFDriverCreatorReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [2014-02-14 230920]
R2 nlsX86cc;Nalpeiron Licensing Service; C:\windows\SysWOW64\NLSSRV32.EXE [2014-02-14 69640]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2013-05-14 390632]
R3 AvastVBoxSvc;AvastVBox COM Service; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2015-10-18 4048280]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\windows\System32\svchost.exe [2014-10-29 38792]
S3 cphs;Intel(R) Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2014-01-29 279024]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2014-03-18 43696]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-05-12 822232]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-04-23 532224]
S3 LSCWinService;LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [2014-02-20 1662424]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2015-10-16 150600]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: PC odesílám spam :-(

#12 Příspěvek od Rudy »

Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte. Změnil jste si heslo?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
pavel15
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 17 lis 2015 14:08

Re: PC odesílám spam :-(

#13 Příspěvek od pavel15 »

sken proběhl, psalo to, že nic nenašlo
přikládám nový log

Logfile of random's system information tool 1.10 (written by random/random)
Run by Jan Beran at 2015-12-04 07:57:41
Microsoft Windows 8.1
System drive C: has 375 GB (83%) free of 450 GB
Total RAM: 4009 MB (45% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:57:44, on 4. 12. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)
Boot mode: Normal

Running processes:
C:\Windows\jmesoft\hotkey.exe
C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe
C:\windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE
C:\Program Files\trend micro\Jan Beran.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com/?pc=LCJB
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.seznam.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL
O4 - HKLM\..\Run: [jmekey] C:\windows\jmesoft\hotkey.exe
O4 - HKLM\..\Run: [jmesoft] C:\Windows\jmesoft\ServiceLoader.exe
O4 - HKLM\..\Run: [LVT] C:\Program Files\Lenovo\LVT\LJYZ.exe 1
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Lenovo\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (file missing)
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIE.dll
O9 - Extra button: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Skype for Business Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: JME Keyboard Driver (JME Keyboard) - Unknown owner - C:\Windows\jmesoft\Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo EasyPlus Hotspot - Lenovo - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe
O23 - Service: Lenovo System Agent Service - LENOVO INCORPORATED. - C:\Program Files\Lenovo\iMController\SystemAgentService.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: LSCWinService - Unknown owner - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe
O23 - Service: MBAMScheduler - Malwarebytes - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: NitroPDFDriverCreatorReadSpool9 (NitroDriverReadSpool9) - Nitro PDF Software - C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\windows\SysWOW64\NLSSRV32.EXE
O23 - Service: Cyberlink RichVideo64 Service(CRVS) (RichVideo64) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo64.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10548 bytes

======Listing Processes======





wininit.exe

C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\windows\system32\WLANExt.exe 170331649456
\??\C:\windows\system32\conhost.exe 0x4
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe"
"C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
C:\Windows\jmesoft\Service.exe
"C:\Program Files\Lenovo\iMController\SystemAgentService.exe"
"C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe"
C:\windows\SysWOW64\NLSSRV32.EXE
"C:\Program Files\CyberLink\Shared files\RichVideo64.exe"
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\wbem\wmiprvse.exe
"C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe"
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-e8402287-e677-45ed-849c-42ca50058628 -SystemEventPortName:HostProcess-ad86a8df-c817-427f-bafb-f6ceb11cfa8d -IoCancelEventPortName:HostProcess-8abf9ca4-f471-47e7-b2a5-aa3e810bd20d -NonStateChangingEventPortName:HostProcess-01f512a8-10b2-4353-b2f9-09c46cc2d1b1 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:5122f979-c026-41b6-a2ef-889166ac8add -DeviceGroupId:WudfDefaultDevicePool
dashost.exe {049c820d-4bc7-49fd-8f1c8f703395c244}
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-064aebc5-8267-4e5e-8116-21d70bf6f39d -SystemEventPortName:HostProcess-3ff40874-88b7-48a9-a468-b3c05577b6f0 -IoCancelEventPortName:HostProcess-2f44abdd-e154-4590-957b-35a6abf6d5d1 -NonStateChangingEventPortName:HostProcess-4f779543-e95d-4add-b721-b3706aa3542a -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:490f919f-ccd7-4e00-970f-e5ef60c51fa6 -DeviceGroupId:WpdFsGroup
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\windows\system32\rundll32.exe C:\windows\system32\pla.dll,PlaHost "LSC Memory" "0x178c_0x1790_0x682c55af"
"C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe" /service
C:\windows\system32\SearchIndexer.exe /Embedding

C:\windows\System32\WinLogon.exe -SpecialSession
-hiberboot
C:\windows\Explorer.EXE
C:\Windows\System32\skydrive.exe -Embedding
taskhostex.exe
"C:\Program Files\Dolby Digital Plus\ddp.exe" -autostart
"C:\Windows\System32\igfxtray.exe"
"C:\windows\system32\igfxsrvc.exe" -Embedding
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s
"C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /FORPCEE4
"C:\windows\system32\GWX\GWX.exe"
"C:\Windows\jmesoft\hotkey.exe"
"C:\Windows\jmesoft\JME_LOAD.exe"
"C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe"
"C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
C:\windows\system32\wbem\unsecapp.exe -Embedding
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Windows\System32\SettingSyncHost.exe" -Embedding
"C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe" --domain-id 4e00205a-2ab1-4423-8f77-cc25b82cde1d
"C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\updateui.exe" --domain-id 4e00205a-2ab1-4423-8f77-cc25b82cde1d
"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\LiveComm.exe" -ServerName:Microsoft.WindowsLive.Platform.Server
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\windows\SysWOW64\DllHost.exe /Processid:{45BA127D-10A8-46EA-8AB7-56EA9078943C}
"C:\windows\system32\wwahost.exe" -ServerName:Microsoft.WindowsLive.Mail.wwa
wimserv.exe 1249e9fd-e585-4743-b224-39c419af3529
C:\windows\System32\svchost.exe -k utcsvc
"C:\Program Files\Internet Explorer\iexplore.exe"
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5960 CREDAT:267521 /prefetch:2
"C:\windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe" -Embedding
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5960 CREDAT:3806528 /prefetch:2
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe"
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe"
"C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE"
taskhost.exe

"C:\Users\Jan Beran\AppData\Local\Microsoft\Windows\INetCache\IE\J041WU40\RSITx64.exe"

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-10-13 219304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-10-18 655480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-10-13 2339032]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}]
Skype for Business Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-10-13 153768]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-10-18 559624]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}]
Microsoft SkyDrive Pro Browser Helper - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-10-13 1731800]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\windows\system32\igfxtray.exe [2014-01-29 391152]
"HotKeysCmds"=C:\windows\system32\hkcmd.exe [2014-01-29 771568]
"Persistence"=C:\windows\system32\igfxpers.exe [2014-01-29 770544]
"IAStorIcon"=C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe [2013-08-07 36352]
"RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-10-24 13662936]
"RtHDVBg_Dolby"=C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2013-10-29 1360600]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"jmekey"=C:\windows\jmesoft\hotkey.exe [2013-07-24 118784]
"jmesoft"=C:\Windows\jmesoft\ServiceLoader.exe [2011-08-17 28672]
"LVT"=C:\Program Files\Lenovo\LVT\LJYZ.exe [2011-11-24 886112]
"CLMLServer"=C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe [2009-12-05 103720]
"UpdateP2GoShortCut"=C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [2011-12-07 214312]
"RemoteControl10"=C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [2013-03-09 95192]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2015-11-07 6133520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\windows\system32\igfxdev.dll [2014-01-22 624640]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McMPFSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\McNaiAnn]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"SoftwareSASGeneration"=1
"DisableTaskMgr"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoRun"=0
"NoFolderOptions"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"VIDC.YUY2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"VIDC.YVYU"=msyuv.dll
"VIDC.YVU9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"VIDC.UYVY"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-12-04 07:40:39 ----A---- C:\windows\system32\drivers\MBAMSwissArmy.sys
2015-12-04 07:40:20 ----D---- C:\ProgramData\Malwarebytes
2015-12-04 07:40:20 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-12-04 07:40:20 ----A---- C:\windows\system32\drivers\mwac.sys
2015-12-04 07:40:20 ----A---- C:\windows\system32\drivers\mbamchameleon.sys
2015-12-04 07:40:20 ----A---- C:\windows\system32\drivers\mbam.sys
2015-12-03 13:37:07 ----D---- C:\Program Files\Common Files\AV
2015-11-21 10:25:05 ----D---- C:\rsit
2015-11-18 17:14:28 ----D---- C:\AdwCleaner
2015-11-17 14:02:47 ----D---- C:\Program Files\trend micro
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\SYSWOW64\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\schannel.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\ncryptsslp.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\lsasrv.dll
2015-11-11 03:43:41 ----A---- C:\windows\system32\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\SYSWOW64\bcryptprimitives.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\ncrypt.dll
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\mrxsmb.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\ksecpkg.sys
2015-11-11 03:43:40 ----A---- C:\windows\system32\drivers\cng.sys
2015-11-11 03:43:39 ----A---- C:\windows\SYSWOW64\certcli.dll
2015-11-11 03:43:39 ----A---- C:\windows\system32\drivers\mrxsmb20.sys
2015-11-11 03:43:39 ----A---- C:\windows\system32\certcli.dll
2015-11-11 03:43:30 ----A---- C:\windows\SYSWOW64\untfs.dll
2015-11-11 03:43:30 ----A---- C:\windows\system32\untfs.dll
2015-11-11 03:43:29 ----A---- C:\windows\SYSWOW64\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\gdi32.dll
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tunnel.sys
2015-11-11 03:43:29 ----A---- C:\windows\system32\drivers\tpm.sys
2015-11-11 03:43:28 ----A---- C:\windows\SYSWOW64\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\kerberos.dll
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\tdx.sys
2015-11-11 03:43:28 ----A---- C:\windows\system32\drivers\afd.sys
2015-11-11 03:43:26 ----A---- C:\windows\system32\win32k.sys
2015-11-11 03:43:25 ----A---- C:\windows\system32\AuthHost.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\winload.exe
2015-11-11 03:43:24 ----A---- C:\windows\system32\ntoskrnl.exe
2015-11-11 03:43:23 ----A---- C:\windows\system32\winresume.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\SYSWOW64\wuapi.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuwebv.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\WUSettingsProvider.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wudriver.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wucltux.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuaueng.dll
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuauclt.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapp.exe
2015-11-11 03:43:19 ----A---- C:\windows\system32\wuapi.dll
2015-11-11 03:43:14 ----A---- C:\windows\SYSWOW64\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\puiobj.dll
2015-11-11 03:43:14 ----A---- C:\windows\system32\localspl.dll
2015-11-11 03:43:06 ----A---- C:\windows\system32\mshtml.dll
2015-11-11 03:43:04 ----A---- C:\windows\SYSWOW64\mshtml.dll
2015-11-11 03:43:02 ----A---- C:\windows\system32\ieframe.dll
2015-11-11 03:43:00 ----A---- C:\windows\SYSWOW64\ieframe.dll
2015-11-11 03:42:59 ----A---- C:\windows\system32\jscript9.dll
2015-11-11 03:42:58 ----A---- C:\windows\SYSWOW64\iertutil.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\jscript.dll
2015-11-11 03:42:58 ----A---- C:\windows\system32\iertutil.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript9.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\jscript.dll
2015-11-11 03:42:57 ----A---- C:\windows\SYSWOW64\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\wininet.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\urlmon.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\msfeeds.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\inetcomm.dll
2015-11-11 03:42:57 ----A---- C:\windows\system32\ie4uinit.exe
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\SYSWOW64\ieapfltr.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\vbscript.dll
2015-11-11 03:42:56 ----A---- C:\windows\system32\ieapfltr.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\SYSWOW64\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\nshwfp.dll
2015-11-11 03:42:53 ----A---- C:\windows\system32\IKEEXT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\FWPUCLNT.DLL
2015-11-11 03:42:53 ----A---- C:\windows\system32\drivers\wfplwfs.sys
2015-11-11 03:42:53 ----A---- C:\windows\system32\BFE.DLL

======List of files/folders modified in the last 1 month======

2015-12-04 07:41:13 ----D---- C:\windows\Prefetch
2015-12-04 07:40:41 ----D---- C:\windows\Temp
2015-12-04 07:40:39 ----D---- C:\windows\system32\drivers
2015-12-04 07:40:20 ----RD---- C:\Program Files (x86)
2015-12-04 07:40:20 ----HD---- C:\ProgramData
2015-12-04 06:02:00 ----D---- C:\windows\system32\sru
2015-12-04 02:42:43 ----SHD---- C:\System Volume Information
2015-12-04 02:41:01 ----D---- C:\windows\Microsoft.NET
2015-12-03 16:37:41 ----D---- C:\windows\Panther
2015-12-03 16:33:38 ----HD---- C:\$WINDOWS.~BT
2015-12-03 15:19:45 ----HD---- C:\Program Files\WindowsApps
2015-12-03 15:19:43 ----D---- C:\windows\AppReadiness
2015-12-03 15:19:33 ----D---- C:\windows\Logs
2015-12-03 15:02:59 ----RAD---- C:\windows\System32
2015-12-03 15:02:59 ----D---- C:\windows\Inf
2015-12-03 15:02:59 ----A---- C:\windows\system32\PerfStringBackup.INI
2015-12-03 13:37:08 ----D---- C:\windows\system32\Tasks
2015-12-03 13:37:07 ----D---- C:\Program Files\Common Files
2015-12-03 13:37:07 ----D---- C:\Program Files (x86)\Common Files
2015-12-02 07:05:17 ----D---- C:\windows\system32\config
2015-12-02 07:03:09 ----D---- C:\windows\system32\DriverStore
2015-11-26 06:36:49 ----RSD---- C:\windows\assembly
2015-11-25 16:02:10 ----SHD---- C:\windows\Installer
2015-11-25 16:00:49 ----D---- C:\ProgramData\regid.1991-06.com.microsoft
2015-11-25 15:59:45 ----D---- C:\Program Files\Microsoft Office 15
2015-11-20 07:29:57 ----D---- C:\Program Files (x86)\Microsoft
2015-11-18 17:17:45 ----D---- C:\ProgramData\McAfee
2015-11-18 17:17:44 ----RD---- C:\Program Files
2015-11-18 17:15:45 ----D---- C:\Program Files (x86)\Amazon
2015-11-18 10:08:50 ----AD---- C:\Windows
2015-11-17 14:42:26 ----HD---- C:\windows\ELAMBKUP
2015-11-16 07:02:40 ----D---- C:\windows\rescache
2015-11-15 09:52:24 ----D---- C:\windows\WinSxS
2015-11-14 10:18:00 ----D---- C:\windows\system32\catroot
2015-11-14 10:17:36 ----RD---- C:\windows\ToastData
2015-11-14 10:17:36 ----D---- C:\windows\SysWOW64
2015-11-13 10:28:50 ----D---- C:\windows\CbsTemp
2015-11-11 16:03:34 ----D---- C:\windows\apppatch
2015-11-11 07:04:00 ----A---- C:\windows\system32\MRT.exe
2015-11-11 07:02:58 ----D---- C:\windows\system32\catroot2
2015-11-06 08:48:21 ----D---- C:\windows\system32\NDF

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\windows\system32\drivers\aswRvrt.sys [2015-10-18 65224]
R0 aswVmm;avast! VM Monitor; C:\windows\system32\drivers\aswVmm.sys [2015-10-18 274808]
R0 iaStorA;iaStorA; C:\windows\System32\drivers\iaStorA.sys [2013-08-07 644968]
R0 ngvss;ngvss; C:\windows\system32\drivers\ngvss.sys [2015-10-18 132656]
R1 aswRdr;aswRdr; C:\windows\system32\drivers\aswRdr2.sys [2015-10-18 93528]
R1 aswSnx;aswSnx; C:\windows\system32\drivers\aswSnx.sys [2015-11-07 1059656]
R1 aswSP;aswSP; C:\windows\system32\drivers\aswSP.sys [2015-11-07 449992]
R1 vwififlt;@%SystemRoot%\System32\drivers\vwififlt.sys,-259; C:\windows\system32\DRIVERS\vwififlt.sys [2013-08-22 71680]
R2 aswHwid;avast! HardwareID; C:\windows\system32\drivers\aswHwid.sys [2015-10-18 28656]
R2 aswMonFlt;aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [2015-10-18 90968]
R2 aswStm;aswStm; C:\windows\system32\drivers\aswStm.sys [2015-10-18 153744]
R2 VBoxAswDrv;VBoxAsw Support Driver; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2015-10-18 274336]
R3 igfx;igfx; C:\windows\system32\DRIVERS\igdkmd64.sys [2014-01-22 4221440]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\windows\system32\drivers\RTKVHD64.sys [2013-10-29 3698904]
R3 iwdbus;@oem4.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\windows\System32\drivers\iwdbus.sys [2013-12-27 27032]
R3 MBAMProtector;MBAMProtector; \??\C:\windows\system32\drivers\mbam.sys [2015-10-05 25816]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\windows\system32\drivers\MBAMSwissArmy.sys [2015-12-04 192216]
R3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\windows\system32\drivers\mwac.sys [2015-10-05 64216]
R3 MEIx64;@oem12.inf,%TEE_SvcDesc%;Intel(R) Management Engine Interface ; C:\windows\system32\DRIVERS\TeeDriverx64.sys [2013-09-04 99288]
R3 RSP2STOR;@oem7.inf,%Rts5229%;Realtek PCIE CardReader Driver - P2; C:\windows\system32\DRIVERS\RtsP2Stor.sys [2013-07-05 290008]
R3 RTL8168;@oem6.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\windows\system32\DRIVERS\Rt630x64.sys [2013-06-21 816344]
R3 RTWlanE;@oem11.inf,%RTWlanE.DeviceDesc.DispName%;Realtek Wireless LAN 802.11n PCI-E Network Adapter; C:\windows\system32\DRIVERS\rtwlane.sys [2013-08-21 2944216]
R3 usbscan;@sti.inf,%usbscan.SvcDesc%;USB Scanner Driver; C:\windows\System32\drivers\usbscan.sys [2014-10-29 44544]
R3 usbvideo;@usbvideo.inf,%USBVideo.SvcDesc%;USB Video Device (WDM); C:\windows\System32\Drivers\usbvideo.sys [2014-06-21 212736]
R3 vwifimp;@%SystemRoot%\System32\drivers\vwifimp.sys,-261; C:\windows\system32\DRIVERS\vwifimp.sys [2013-08-22 36864]
S0 mfeelamk;McAfee Inc. mfeelamk; C:\windows\system32\drivers\mfeelamk.sys [2015-07-02 80920]
S3 e1iexpress;@net1ic64.inf,%e1iExpress.Service.DispName%;Intel(R) PRO/1000 PCI Express Network Connection Driver I; C:\windows\system32\DRIVERS\e1i63x64.sys [2013-06-18 460288]
S3 intaud_WaveExtensible;@oem3.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\windows\system32\drivers\intelaud.sys [2013-12-27 38296]
S3 IntcDAud;@oem1.inf,%IntcDAud.SvcDesc%;Intel(R) Display Audio; C:\windows\system32\DRIVERS\IntcDAud.sys [2014-01-22 450520]
S3 NETwNe64;@netwew02.inf,___ %NIC_Service_DispName_WIN8_64%;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit; C:\windows\system32\DRIVERS\NETwew02.sys [2013-06-18 4649440]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2015-10-18 146600]
R2 ClickToRunSvc;Služba Microsoft Office ClickToRun; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2015-10-13 2797752]
R2 Dashboard Service;Dashboard Service; C:\Program Files (x86)\Lenovo\Lenovo Dashboard\DdMgr.exe [2013-08-09 25184]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\windows\System32\svchost.exe [2014-10-29 38792]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-08-07 15720]
R2 IdeaTouch.LocalDataServer.Education;IdeaTouch.LocalDataServer.Education; C:\Program Files (x86)\Lenovo\EducationPortal\Services\IdeaTouch.LocalDataServer.Education.exe [2012-05-17 7680]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-05-12 733696]
R2 Intel(R) ME Service;Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2013-09-04 131544]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-09-04 169432]
R2 JME Keyboard;JME Keyboard Driver; C:\Windows\jmesoft\Service.exe [2011-08-17 32768]
R2 Lenovo System Agent Service;Lenovo System Agent Service; C:\Program Files\Lenovo\iMController\SystemAgentService.exe [2014-05-22 584960]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-09-04 390616]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2015-10-05 1513784]
R2 NitroDriverReadSpool9;NitroPDFDriverCreatorReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [2014-02-14 230920]
R2 nlsX86cc;Nalpeiron Licensing Service; C:\windows\SysWOW64\NLSSRV32.EXE [2014-02-14 69640]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2013-05-14 390632]
R3 AvastVBoxSvc;AvastVBox COM Service; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2015-10-18 4048280]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\windows\System32\svchost.exe [2014-10-29 38792]
S3 cphs;Intel(R) Content Protection HECI Service; C:\windows\SysWow64\IntelCpHeciSvc.exe [2014-01-29 279024]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2014-03-18 43696]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-05-12 822232]
S3 Lenovo EasyPlus Hotspot;Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe [2014-04-23 532224]
S3 LSCWinService;LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [2014-02-20 1662424]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2015-10-16 150600]
S4 wlcrasvc;Windows Live Mesh remote connections service; C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: PC odesílám spam :-(

#14 Příspěvek od Rudy »

Rudy píše: Změnil jste si heslo?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
pavel15
Návštěvník
Návštěvník
Příspěvky: 12
Registrován: 17 lis 2015 14:08

Re: PC odesílám spam :-(

#15 Příspěvek od pavel15 »

po té první čistce, jsem heslo měnil. Nyní ještě ne
Nahoru
Odpovědět

Zpět na „Řešení problémů, logy“