Vytížení procesoru - Host Process - svchost.exe (netsvcs)

Zpráva

Kikos · #1 Příspěvek od **Kikos** » 14 pro 2015 09:15

Zdravím pánové prosím o pomoc - stále mi v sledování prostředků nabíhá při velkém vytížení procesoru - Host Process for Windows Services - svchost.exe (netsvcs)
po ukončení tohoto procesu výkon spadne na normál. V podstatě jsem musel tento proces ukončit abych mohl importovat log RSIT. Děkuji za pomoc.

RSIT LOG :
Logfile of random's system information tool 1.10 (written by random/random)
Run by Kirchner at 2015-12-14 09:04:25
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 430 GB (90%) free of 477 GB
Total RAM: 3328 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:04:31, on 14.12.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18098)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\MsSpellCheckingFacility.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Kirchner\Desktop\RSIT.exe
C:\Program Files\trend micro\Kirchner.exe
C:\Windows\system32\DllHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Nezapomen] C:\Program Files\Pamatuj\nezapomen.exe 42352
O4 - HKCU\..\Run: [ACDSeeCommander18] C:\Program Files\ACD Systems\ACDSee\18.0\ACDSeeCommander18.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: NitroPDFDriverCreatorReadSpool8 (NitroDriverReadSpool8) - Nitro PDF Software - C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe
O23 - Service: SAMSUNG Mobile Connectivity Service (ss_conn_service) - DEVGURU Co., LTD. - C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
O23 - Service: VRAID Log Service - Unknown owner - C:\Program Files\VIA\RAID\vialogsv.exe
O23 - Service: CryptoPlus XME Engine Service (xmengine service) - Monet+, a.s. - C:\Windows\system32\xmesrv.exe

--
End of file - 3819 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22 194504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22 194504]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2006-10-09 90191]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2006-10-09 7741440]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2006-10-09 81920]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2013-09-12 5110672]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"Nezapomen"=C:\Program Files\Pamatuj\nezapomen.exe [2000-12-11 458240]
"ACDSeeCommander18"=C:\Program Files\ACD Systems\ACDSee\18.0\ACDSeeCommander18.exe [2014-09-20 1964552]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2015-12-14 09:04:25 ----D---- C:\rsit
2015-11-23 08:19:56 ----D---- C:\ProgramData\CPInstall

======List of files/folders modified in the last 1 month======

2015-12-14 09:04:31 ----D---- C:\Program Files\trend micro
2015-12-14 09:04:28 ----D---- C:\Windows\temp
2015-12-14 08:53:20 ----D---- C:\Users\Kirchner\AppData\Roaming\Nitro PDF
2015-12-14 08:53:12 ----D---- C:\Windows\Prefetch
2015-12-14 07:53:03 ----D---- C:\Windows\system32\config
2015-12-14 07:52:18 ----D---- C:\Windows\Tasks
2015-12-14 07:52:18 ----D---- C:\Windows\system32\Tasks
2015-12-14 07:52:05 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2015-12-08 07:54:59 ----SHD---- C:\System Volume Information
2015-12-07 08:08:41 ----D---- C:\Windows\inf
2015-12-04 11:46:26 ----D---- C:\Users\Kirchner\AppData\Roaming\Skype
2015-12-02 07:54:15 ----D---- C:\Windows
2015-12-01 15:15:01 ----D---- C:\Windows\debug
2015-11-27 07:52:22 ----D---- C:\Windows\system32\wdi
2015-11-26 08:06:47 ----SHD---- C:\Windows\Installer
2015-11-26 08:06:44 ----D---- C:\Config.Msi
2015-11-26 08:06:06 ----D---- C:\Windows\System32
2015-11-23 08:19:56 ----D---- C:\ProgramData

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2013-09-17 49240]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 timounter;Acronis True Image Backup Archive Explorer; C:\Windows\system32\DRIVERS\timntr.sys [2014-10-30 441760]
R0 viamraid;viamraid; C:\Windows\system32\DRIVERS\viamraid.sys [2014-10-30 142448]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2013-09-17 188808]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2013-09-17 134248]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2013-09-17 37416]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2013-09-17 174400]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2009-07-14 96768]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 tifsfilter;Acronis True Image FS Filter; C:\Windows\system32\DRIVERS\tifsfilt.sys [2014-10-30 44384]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2014-04-07 412952]
R3 cmudax;C-Media High Definition Audio Interface; C:\Windows\system32\drivers\cmudax.sys [2004-10-21 1275584]
R3 GemCCID;GemCCID; C:\Windows\system32\DRIVERS\GemCCID.sys [2014-03-14 99840]
R3 irsir;Microsoft Serial Infrared Driver; C:\Windows\system32\DRIVERS\irsir.sys [2006-11-02 20992]
R3 usbscan;Ovladač skeneru USB; C:\Windows\system32\drivers\usbscan.sys [2013-07-03 36352]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 catchme;catchme; \??\C:\Users\Kirchner\AppData\Local\Temp\catchme.sys []
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2015-05-21 89984]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\LGBusEnum.sys [2009-11-24 19720]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver; C:\Windows\system32\drivers\LGVirHid.sys [2009-11-24 14856]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-05-13 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2011-05-13 114280]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2015-05-21 184192]
S3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 9216]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-02-12 15872]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S3 WSDPrintDevice;Podpora tisku WSD prostřednictvím funkce UMB; C:\Windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
S3 WSDScan;Podpora skenování WSD přes UMB; C:\Windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-10-28 82128]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2013-09-12 1337752]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8; C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe [2012-12-13 196616]
R2 ss_conn_service;SAMSUNG Mobile Connectivity Service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [2015-05-21 743688]
R2 VRAID Log Service;VRAID Log Service; C:\Program Files\VIA\RAID\vialogsv.exe [2014-10-30 55920]
R2 xmengine service;CryptoPlus XME Engine Service; C:\Windows\system32\xmesrv.exe [2014-10-31 34696]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-10-30 102912]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-10-30 1343400]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2014-04-11 45744]
S4 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S4 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S4 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2015-07-20 194032]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]

-----------------EOF-----------------

Kikos · #2 Příspěvek od **Kikos** » 15 pro 2015 09:10

OK shodil jsem svchost a log tady :

Logfile of random's system information tool 1.10 (written by random/random)
Run by Kirchner at 2015-12-15 09:08:59
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 430 GB (90%) free of 477 GB
Total RAM: 3328 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:09:10, on 15.12.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18098)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\System32\perfmon.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Kirchner\Desktop\RSIT.exe
C:\Program Files\trend micro\Kirchner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Nezapomen] C:\Program Files\Pamatuj\nezapomen.exe 42353
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: NitroPDFDriverCreatorReadSpool8 (NitroDriverReadSpool8) - Nitro PDF Software - C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe
O23 - Service: SAMSUNG Mobile Connectivity Service (ss_conn_service) - DEVGURU Co., LTD. - C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
O23 - Service: VRAID Log Service - Unknown owner - C:\Program Files\VIA\RAID\vialogsv.exe
O23 - Service: CryptoPlus XME Engine Service (xmengine service) - Monet+, a.s. - C:\Windows\system32\xmesrv.exe

--
End of file - 3643 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22 194504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22 194504]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2006-10-09 90191]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2006-10-09 7741440]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2006-10-09 81920]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2013-09-12 5110672]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"Nezapomen"=C:\Program Files\Pamatuj\nezapomen.exe [2000-12-11 458240]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2015-12-14 09:04:25 ----D---- C:\rsit
2015-11-23 08:19:56 ----D---- C:\ProgramData\CPInstall

======List of files/folders modified in the last 1 month======

2015-12-15 09:09:06 ----D---- C:\Program Files\trend micro
2015-12-15 09:09:05 ----D---- C:\Windows\temp
2015-12-15 08:16:40 ----D---- C:\Windows\system32\config
2015-12-14 11:17:18 ----D---- C:\Windows\system32\Tasks
2015-12-14 08:53:20 ----D---- C:\Users\Kirchner\AppData\Roaming\Nitro PDF
2015-12-14 08:53:12 ----D---- C:\Windows\Prefetch
2015-12-14 07:52:18 ----D---- C:\Windows\Tasks
2015-12-14 07:52:05 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2015-12-08 07:54:59 ----SHD---- C:\System Volume Information
2015-12-07 08:08:41 ----D---- C:\Windows\inf
2015-12-04 11:46:26 ----D---- C:\Users\Kirchner\AppData\Roaming\Skype
2015-12-02 07:54:15 ----D---- C:\Windows
2015-12-01 15:15:01 ----D---- C:\Windows\debug
2015-11-27 07:52:22 ----D---- C:\Windows\system32\wdi
2015-11-26 08:06:47 ----SHD---- C:\Windows\Installer
2015-11-26 08:06:44 ----D---- C:\Config.Msi
2015-11-26 08:06:06 ----D---- C:\Windows\System32
2015-11-23 08:19:56 ----D---- C:\ProgramData

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2013-09-17 49240]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 timounter;Acronis True Image Backup Archive Explorer; C:\Windows\system32\DRIVERS\timntr.sys [2014-10-30 441760]
R0 viamraid;viamraid; C:\Windows\system32\DRIVERS\viamraid.sys [2014-10-30 142448]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2013-09-17 188808]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2013-09-17 134248]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2013-09-17 37416]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2013-09-17 174400]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2009-07-14 96768]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 tifsfilter;Acronis True Image FS Filter; C:\Windows\system32\DRIVERS\tifsfilt.sys [2014-10-30 44384]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2014-04-07 412952]
R3 cmudax;C-Media High Definition Audio Interface; C:\Windows\system32\drivers\cmudax.sys [2004-10-21 1275584]
R3 GemCCID;GemCCID; C:\Windows\system32\DRIVERS\GemCCID.sys [2014-03-14 99840]
R3 irsir;Microsoft Serial Infrared Driver; C:\Windows\system32\DRIVERS\irsir.sys [2006-11-02 20992]
R3 usbscan;Ovladač skeneru USB; C:\Windows\system32\drivers\usbscan.sys [2013-07-03 36352]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 catchme;catchme; \??\C:\Users\Kirchner\AppData\Local\Temp\catchme.sys []
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2015-05-21 89984]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\LGBusEnum.sys [2009-11-24 19720]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver; C:\Windows\system32\drivers\LGVirHid.sys [2009-11-24 14856]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-05-13 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2011-05-13 114280]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2015-05-21 184192]
S3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 9216]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-02-12 15872]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S3 WSDPrintDevice;Podpora tisku WSD prostřednictvím funkce UMB; C:\Windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
S3 WSDScan;Podpora skenování WSD přes UMB; C:\Windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-10-28 82128]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2013-09-12 1337752]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8; C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe [2012-12-13 196616]
R2 ss_conn_service;SAMSUNG Mobile Connectivity Service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [2015-05-21 743688]
R2 VRAID Log Service;VRAID Log Service; C:\Program Files\VIA\RAID\vialogsv.exe [2014-10-30 55920]
R2 xmengine service;CryptoPlus XME Engine Service; C:\Windows\system32\xmesrv.exe [2014-10-31 34696]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-10-30 102912]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-10-30 1343400]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2014-04-11 45744]
S4 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S4 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S4 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2015-07-20 194032]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]

-----------------EOF-----------------

Kikos · #3 Příspěvek od **Kikos** » 15 pro 2015 16:01

Jojda to se omlouvám nějak mi to v té předvánoční honce necvaklo náprava zde a díky moc za ochotu :
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:14-12-2015
Ran by Kirchner (administrator) on MK-PC (15-12-2015 15:58:24)
Running from C:\Users\Kirchner\Desktop
Loaded Profiles: Kirchner (Available Profiles: Kirchner)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(Nitro PDF Software) C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
() C:\Program Files\VIA\RAID\vialogsv.exe
(Monet+, a.s.) C:\Windows\System32\xmesrv.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvSvc] => RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5110672 2013-09-12] (ESET)
HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\...\Run: [Nezapomen] => C:\Program Files\Pamatuj\nezapomen.exe [458240 2000-12-11] ()
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-10-31] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 127.0.0.1 acdid.acdsystems.com
Tcpip\Parameters: [DhcpNameServer] 46.33.112.42 8.8.8.8 46.33.96.2
Tcpip\..\Interfaces\{D4364ADA-4982-4922-B11C-5CAE1FCBC4D3}: [DhcpNameServer] 46.33.112.42 8.8.8.8 46.33.96.2

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxps://www.google.com/search?q={searchTerms}&r ... EB_csCZ612
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22] (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22] (Google Inc.)
Toolbar: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22] (Google Inc.)

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @nitropdf.com/NitroPDF -> C:\Program Files\Nitro\Pro 8\npnitromozilla.dll [2012-12-13] (Nitro PDF)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3565674240-4036518550-1107183558-1000: @servis24.cz/PKIComponent -> C:\Users\Kirchner\AppData\Roaming\CSAS\lib\x86\npPKIComponentNPAPI.dll [2015-02-16] (Česká spořitelna, a.s.)
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-11-03] [not signed]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Kirchner\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Kirchner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-13]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1337752 2013-09-12] (ESET)
R2 NitroDriverReadSpool8; C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe [196616 2012-12-13] (Nitro PDF Software)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
R2 VRAID Log Service; C:\Program Files\VIA\RAID\vialogsv.exe [55920 2014-10-30] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 xmengine service; C:\Windows\system32\xmesrv.exe [34696 2014-10-31] (Monet+, a.s.)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 cmudax; C:\Windows\System32\drivers\cmudax.sys [1275584 2004-10-21] (C-Media Inc.)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [188808 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [134248 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [174400 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [37416 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [49240 2013-09-17] (ESET)
R3 GemCCID; C:\Windows\System32\DRIVERS\GemCCID.sys [99840 2014-03-14] (Gemalto)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [20992 2006-11-02] (Microsoft Corporation)
S3 LGBusEnum; C:\Windows\System32\drivers\LGBusEnum.sys [19720 2009-11-24] (Logitech Inc.)
S3 LGVirHid; C:\Windows\System32\drivers\LGVirHid.sys [14856 2009-11-24] (Logitech Inc.)
R3 nvlddmkm; C:\Windows\System32\DRIVERS\nvlddmkm.sys [4428160 2006-10-09] (NVIDIA Corporation) [File not signed]
R2 tifsfilter; C:\Windows\System32\DRIVERS\tifsfilt.sys [44384 2014-10-30] (Acronis)
R0 viamraid; C:\Windows\System32\DRIVERS\viamraid.sys [142448 2014-10-30] (VIA Technologies Inc.,Ltd)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Kirchner\AppData\Local\Temp\catchme.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-15 15:58 - 2015-12-15 15:58 - 00008737 _____ C:\Users\Kirchner\Desktop\FRST.txt
2015-12-15 15:57 - 2015-12-15 15:58 - 00000000 ____D C:\FRST
2015-12-15 15:53 - 2015-12-15 15:53 - 01720832 _____ (Farbar) C:\Users\Kirchner\Desktop\FRST.exe
2015-12-15 15:44 - 2015-12-15 15:44 - 33882556 _____ C:\Users\Kirchner\Desktop\prani-k-vanocum.psd
2015-12-15 12:21 - 2015-12-15 12:21 - 00124340 _____ C:\Users\Kirchner\Desktop\Nádraží rozvod - AN1150605343.pdf
2015-12-14 09:04 - 2015-12-14 09:04 - 00000000 ____D C:\rsit
2015-12-14 09:04 - 2015-06-26 09:34 - 01107968 _____ C:\Users\Kirchner\Desktop\RSIT.exe
2015-12-14 08:06 - 2015-12-15 07:58 - 00000000 ____D C:\Users\Kirchner\Desktop\Nádraží demontáž
2015-12-07 08:23 - 2015-12-07 08:23 - 00000000 ____D C:\Users\Kirchner\Desktop\Vodoměry krapkova
2015-12-01 09:20 - 2015-12-01 09:20 - 00000000 ____D C:\Users\Kirchner\Desktop\ART Econ
2015-11-30 09:45 - 2015-11-30 09:46 - 00000000 ____D C:\Users\Kirchner\Desktop\Globe Servis - Cíl II.etapa
2015-11-23 08:19 - 2015-11-23 08:19 - 00000000 ____D C:\ProgramData\CPInstall
2015-11-19 09:58 - 2015-11-19 10:14 - 00000000 ___HD C:\Users\Kirchner\Desktop\[Původní]

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-15 15:57 - 2009-07-14 03:37 - 00000000 ____D C:\Windows
2015-12-15 14:52 - 2015-09-21 08:27 - 00000000 ____D C:\Users\Kirchner\AppData\Roaming\Nitro
2015-12-15 09:20 - 2014-11-04 08:22 - 00007633 _____ C:\Users\Kirchner\AppData\Local\Resmon.ResmonCfg
2015-12-15 09:13 - 2009-07-14 05:34 - 00022464 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-15 09:13 - 2009-07-14 05:34 - 00022464 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-15 09:09 - 2014-11-03 17:09 - 00000000 ____D C:\Program Files\trend micro
2015-12-15 09:09 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-15 09:08 - 2009-07-14 05:53 - 00032548 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-12-14 10:02 - 2014-10-31 11:12 - 00014857 _____ C:\Users\Kirchner\intlname.ols
2015-12-14 08:53 - 2015-09-24 10:56 - 00000000 ____D C:\Users\Kirchner\AppData\Roaming\Nitro PDF
2015-12-14 07:52 - 2014-11-24 10:13 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-12-14 07:52 - 2014-11-24 10:13 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-12-11 08:42 - 2015-07-27 07:18 - 00000000 ____D C:\Users\Kirchner\Desktop\RD Přerov Kosmákova 9
2015-12-07 08:08 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\inf
2015-12-04 11:46 - 2014-11-03 12:01 - 00000000 ____D C:\Users\Kirchner\AppData\Roaming\Skype
2015-12-03 16:35 - 2014-10-30 16:45 - 00000000 ____D C:\Users\Kirchner\Desktop\MyFiles
2015-12-01 15:18 - 2014-11-04 12:32 - 00000000 ____D C:\Users\Kirchner\Documents\CCleaner záloha
2015-11-26 08:06 - 2015-11-09 11:55 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-11-23 12:32 - 2014-10-30 15:40 - 00000000 ____D C:\Users\Kirchner\AppData\Local\ElevatedDiagnostics
2015-11-23 08:53 - 2015-09-07 09:56 - 00000128 _____ C:\Users\Kirchner\Desktop\Hotovost.txt
2015-11-20 15:21 - 2015-04-08 07:54 - 00000000 ____D C:\Users\Kirchner\Desktop\PU RD Dolany
2015-11-18 15:49 - 2015-10-22 10:27 - 00000000 ____D C:\Users\Kirchner\Desktop\Grunfoss OL

==================== Files in the root of some directories =======

2014-11-04 08:22 - 2015-12-15 09:20 - 0007633 _____ () C:\Users\Kirchner\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-11-30 11:53

==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version:14-12-2015
Ran by Kirchner (2015-12-15 15:59:12)
Running from C:\Users\Kirchner\Desktop
Microsoft Windows 7 Home Premium Service Pack 1 (X86) (2014-10-30 13:08:20)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3565674240-4036518550-1107183558-500 - Administrator - Disabled)
Guest (S-1-5-21-3565674240-4036518550-1107183558-501 - Limited - Disabled)
Kirchner (S-1-5-21-3565674240-4036518550-1107183558-1000 - Administrator - Enabled) => C:\Users\Kirchner

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ESET Smart Security 7.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 7.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personální firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\...\uTorrent) (Version: 3.4.5.41202 - BitTorrent Inc.)
ACDSee 18 (HKLM\...\{6D0F6DF4-553E-43CD-AA95-69AB3644A8FF}) (Version: 18.0.0.225 - ACD Systems International Inc.)
ACDSee 18 Build 225 - odinstalovat češtinu (HKLM\...\ACDSee 18 Build 225) (Version: - Michellin & Cehos)
Adobe Acrobat Reader DC - Czech (HKLM\...\{AC76BA86-7AD7-1029-7B44-AC0F074E4100}) (Version: 15.009.20079 - Adobe Systems Incorporated)
Adobe Flash Player 20 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 20.0.0.228 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Balíček ovladače systému Windows - Hewlett-Packard Image (12/28/2006 8.0.0.0) (HKLM\...\4C806F98217A7FD4E853F458FF399F052625F21C) (Version: 12/28/2006 8.0.0.0 - Hewlett-Packard)
BS.Player PRO (HKLM\...\BSPlayerp) (Version: 2.66.1075 - AB Team, d.o.o.)
CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform)
C-Media High Definition Audio Driver (HKLM\...\C-Media Audio Driver) (Version: - )
CryptoPlus CS v1.0e (HKLM\...\CryptoPlus CS v1.0e) (Version: 2.0.9 - Monet+,a.s.)
DLL Suite 2014 (HKLM\...\{885843E7-6CAC-4791-B7BF-1CD516017954}_is1) (Version: - )
ESET Smart Security (HKLM\...\{1A8FE52B-983B-46B6-A2EF-9A75DDCAFCEF}) (Version: 7.0.302.26 - ESET, spol s r. o.)
Google Chrome (HKLM\...\Google Chrome) (Version: 45.0.2454.101 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.28.15 - Google Inc.) Hidden
LockHunter 3.1, 32/64 bit (HKLM\...\LockHunter_is1) (Version: - Crystal Rich Ltd)
Microsoft .NET Framework 4.5.2 (čeština) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1029) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110405-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM\...\MPE) (Version: 1.8.6 - F.J. Wechselberger)
Nero 7 Ultra Edition (HKLM\...\{4F2CE68F-EDBB-4592-BF07-5AC930A51029}) (Version: 7.02.6446 - Nero AG)
Nitro Pro 8 (HKLM\...\{8EEAF4C4-FCA7-4558-AF65-CCD3B9AD634D}) (Version: 8.0.10.7 - Nitro)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
PDF Settings CS6 (Version: 11.0 - Adobe Systems Incorporated) Hidden
Platform (Version: 1.34 - VIA Technologies, Inc.) Hidden
PrimoPDF -- by Nitro PDF Software (HKLM\...\PrimoPDF) (Version: 5.0.0.19 - Nitro PDF Software)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Sada Compatibility Pack pro systém Office 2007 (HKLM\...\{90120000-0020-0405-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.15075.2 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.3.15075.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.55.0 - Samsung Electronics Co., Ltd.)
Skype™ 6.22 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.104 - Skype Technologies S.A.)
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.50 RC1 - Ghisler Software GmbH)
VIA Platforma Ovladače zařízení (HKLM\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WinRAR 5.10 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000_Classes\CLSID\{6614FE97-812C-4B8B-AD6F-83D07279BF02}\InprocServer32 -> C:\Users\Kirchner\AppData\Roaming\CSAS\lib\x86\PKIComponentAX.dll (Česká spořitelna, a.s.)
CustomCLSID: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000_Classes\CLSID\{8616ED07-7CEA-47D2-912D-79BF20C02290}\InprocServer32 -> C:\Users\Kirchner\AppData\Roaming\CSAS\lib\x86\PKIComponentAX.dll (Česká spořitelna, a.s.)

==================== Restore Points =========================

12-11-2015 16:32:09 Windows Update
18-11-2015 07:58:27 Windows Update
24-11-2015 07:51:55 Windows Update
27-11-2015 07:53:30 Windows Update
01-12-2015 07:54:11 Windows Update
04-12-2015 16:05:34 Windows Update
08-12-2015 07:54:17 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2015-11-06 12:22 - 00000067 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 acdid.acdsystems.com

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1749B3E6-6982-4AEB-B6D9-02A75B1D3A08} - System32\Tasks\ESET Windows 10 upgrade – Refresh settings => C:\Program Files\Common Files\AV\ESET Smart Security 7.0\upgrade.exe [2015-11-23] (ESET)
Task: {2D975173-34EB-4F1A-A341-057472940CF2} - System32\Tasks\{8B3FA506-C56C-4D28-AB51-84CD6F8A9A84} => pcalua.exe -a C:\Users\Kirchner\Desktop\CMedia\Driver\Setup.exe -d C:\Users\Kirchner\Desktop\CMedia\Driver
Task: {2E927AD3-8778-4C77-AD7D-FCDA49BB5167} - System32\Tasks\GoogleUpdateTaskMachineUA1d0f20150d5e35d => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {395C9569-2AB9-4577-8A95-F82DFF060FA6} - System32\Tasks\{0019B8DE-8B4D-4F8B-BE62-BDDD1A1C3D4B} => pcalua.exe -a "E:\Install\Driver záloha\Driver\Audio\Setup.exe" -d "E:\Install\Driver záloha\Driver\Audio"
Task: {48167A34-9FED-4E86-A360-53B507633661} - System32\Tasks\GoogleUpdateTaskMachineCore1d0e47ba2a6d531 => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {5A498A90-EE68-4F58-853B-741F397E1678} - System32\Tasks\{F57F0CF3-5303-4B84-AA28-41AA8CC7900B} => pcalua.exe -a "E:\Install\Driver záloha\Zvukovka PC praceWIN9x_1096\Setup.exe" -d "E:\Install\Driver záloha\Zvukovka PC praceWIN9x_1096"
Task: {89CB926D-504E-495D-B833-F4A8C70CCF76} - System32\Tasks\GoogleUpdateTaskMachineCore1d0f2015016daf1 => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {A06B0565-5776-4680-A394-3DDB1193B167} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {A1C7A2B5-7E7F-47FB-B093-401303260E3C} - System32\Tasks\GoogleUpdateTaskMachineCore1d091f9452c46bb => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {B31746BF-E01B-4346-8A7F-2BEB9A6BB310} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd)
Task: {B5F2E1A3-A719-485C-8F2E-2D7C58D1267A} - System32\Tasks\GoogleUpdateTaskMachineUA1d091f945a5dea9 => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {BADF5A9E-19B8-4FDF-96F3-6045AEEC9293} - System32\Tasks\{7DFB258A-2FAF-4277-9CD2-13F57C27B321} => pcalua.exe -a "F:\Programy\ACDSee\ACDSee170build42_CZ\ACDSee.v17.0.42.Keymaker\ACDSee.v17.0.42.Keymaker\ACDSee 17.0 build 42 CZ.exe" -d F:\Programy\ACDSee\ACDSee170build42_CZ\ACDSee.v17.0.42.Keymaker\ACDSee.v17.0.42.Keymaker
Task: {F39B1E5E-192C-49E2-83B4-1E162379A1CB} - System32\Tasks\DriverNavigator Scheduled Scan => C:\Program Files\Easeware\DriverNavigator\DriverNavigator.exe
Task: {FB717B3A-E1FC-46ED-8967-950206836505} - System32\Tasks\GoogleUpdateTaskMachineUA1d0e47ba34ba3be => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2014-11-03 10:40 - 2009-07-31 02:44 - 00176235 _____ () C:\Windows\System32\Primomonnt.dll
2014-10-30 15:15 - 2014-10-30 15:14 - 00055920 _____ () C:\Program Files\VIA\RAID\vialogsv.exe
2014-10-30 15:15 - 2014-10-30 15:14 - 00200704 _____ () C:\Program Files\VIA\RAID\drvInterface.dll
2014-10-30 15:15 - 2011-02-14 10:53 - 00581632 ____R () C:\Program Files\VIA\RAID\language.dll
2003-07-15 06:44 - 2003-07-15 06:44 - 00102968 _____ () C:\Program Files\Microsoft Office\OFFICE11\OUTLCTL.DLL

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\...\business24.cz -> hxxps://www.business24.cz
IE trusted site: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\...\servis24.cz -> hxxps://www.servis24.cz

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Kirchner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 46.33.112.42 - 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{1D0ABF3E-8D02-4E0A-BE57-A34D38EA1434}] => (Allow) C:\Users\Kirchner\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{E678EEB9-9EBD-4C15-B30C-077BE3CC1392}] => (Allow) C:\Users\Kirchner\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{74ACEE00-E5B3-42C3-8774-B8EAFEE962A9}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{5510F6B6-D9E9-42E9-B00A-66716411C947}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{C9882147-3FA9-459C-9458-04DD6E4BB4EB}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{A7C66559-8818-4EB2-8CA1-3FE1ACBE877F}] => (Allow) C:\Users\Kirchner\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{D99DBC1B-9E37-4635-9814-90F30FA35054}] => (Allow) C:\Users\Kirchner\AppData\Roaming\uTorrent\uTorrent.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (12/15/2015 09:13:12 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 08:18:09 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 08:13:44 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: MK-PC)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 08:10:37 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 08:01:34 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: MK-PC)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 07:56:56 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: MK-PC)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 07:53:48 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: MK-PC)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 07:52:24 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/14/2015 09:19:12 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/14/2015 08:41:35 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

System errors:
=============
Error: (12/15/2015 09:13:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Správce služeb se pokusil o opravnou akci (Restartovat službu) po nečekaném ukončení služby Služba WMI, ale tato akce selhala kvůli následující chybě:
%%1056

Error: (12/15/2015 09:13:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Správce služeb se pokusil o opravnou akci (Restartovat službu) po nečekaném ukončení služby Služba IKE and AuthIP IPsec Keying Modules, ale tato akce selhala kvůli následující chybě:
%%1056

Error: (12/15/2015 09:13:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Správce služeb se pokusil o opravnou akci (Restartovat službu) po nečekaném ukončení služby Prohledávání počítačů, ale tato akce selhala kvůli následující chybě:
%%1056

Error: (12/15/2015 09:10:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Správce služeb se pokusil o opravnou akci (Restartovat službu) po nečekaném ukončení služby Služba Plánovač multimédií, ale tato akce selhala kvůli následující chybě:
%%1056

Error: (12/15/2015 09:10:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Správce služeb se pokusil o opravnou akci (Restartovat službu) po nečekaném ukončení služby Server, ale tato akce selhala kvůli následující chybě:
%%1056

Error: (12/15/2015 09:08:46 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba Windows Update byla neočekávaně ukončena. Tento stav nastal již 2krát.

Error: (12/15/2015 09:08:46 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Služba WMI byla nečekaně ukončena. Stalo se to 2 krát. Následující opravná akce bude spuštěna za 300000 milisekund: Restartovat službu.

Error: (12/15/2015 09:08:46 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Motivy byla nečekaně ukončena. Stalo se to 2 krát. Následující opravná akce bude spuštěna za 60000 milisekund: Restartovat službu.

Error: (12/15/2015 09:08:46 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Rozpoznávání hardwaru byla nečekaně ukončena. Stalo se to 2 krát. Následující opravná akce bude spuštěna za 60000 milisekund: Restartovat službu.

Error: (12/15/2015 09:08:46 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Služba oznamování událostí systému byla nečekaně ukončena. Stalo se to 2 krát. Následující opravná akce bude spuštěna za 300000 milisekund: Restartovat službu.

CodeIntegrity:
===================================
Date: 2014-10-31 11:42:11.062
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-31 11:42:10.328
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-31 11:41:59.359
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-31 11:41:59.343
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz
Percentage of memory in use: 40%
Total physical RAM: 3327.55 MB
Available physical RAM: 1990.1 MB
Total Virtual: 6651.35 MB
Available Virtual: 5256.28 MB

==================== Drives ================================

Drive c: (Disk 500 GB) (Fixed) (Total:465.66 GB) (Free:419.25 GB) NTFS
Drive e: (Kikos 160) (Fixed) (Total:152.66 GB) (Free:107.27 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: F510F510)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 152.7 GB) (Disk ID: C5F42EA5)
Partition 1: (Not Active) - (Size=152.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Kikos · #4 Příspěvek od **Kikos** » 16 pro 2015 08:56

: 001.jpg (59.1 KiB) Zobrazeno 6629 x

Vkládám log : tu zmíněnou službu musím 3 denně vypínat možná byla zrovna v dobu scanu vypnutá.

ComboFix 15-12-16.01 - Kirchner 16.12.2015 8:18.4.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3328.1789 [GMT 1:00]
Spuštěný z: c:\users\Kirchner\Desktop\ComboFix.exe
AV: ESET Smart Security 7.0 *Enabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
FW: ESET Personální firewall *Enabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
SP: ESET Smart Security 7.0 *Enabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý
.
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-11-16 do 2015-12-16 )))))))))))))))))))))))))))))))
.
.
2015-12-16 07:08 . 2015-10-29 09:46 8991856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4915F557-AA5D-49F7-88E7-5D949D25BB0A}\mpengine.dll
2015-12-15 14:57 . 2015-12-15 14:59 -------- d-----w- C:\FRST
2015-12-14 08:04 . 2015-12-14 08:04 -------- d-----w- C:\rsit
2015-11-23 07:19 . 2015-11-23 07:19 -------- d-----w- c:\programdata\CPInstall
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-12-14 06:52 . 2014-11-24 09:13 796864 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-12-14 06:52 . 2014-11-24 09:13 142528 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-12-02 12:25 . 2014-10-30 13:14 247976 ------w- c:\windows\system32\MpSigStub.exe
2015-11-03 17:46 . 2015-11-12 07:36 2386944 ----a-w- c:\windows\system32\win32k.sys
2015-10-30 22:58 . 2015-11-11 07:41 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2015-10-30 22:58 . 2015-11-11 07:41 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2015-10-30 22:47 . 2015-11-11 07:41 504832 ----a-w- c:\windows\system32\vbscript.dll
2015-10-30 22:46 . 2015-11-11 07:41 62464 ----a-w- c:\windows\system32\iesetup.dll
2015-10-30 22:45 . 2015-11-11 07:41 47616 ----a-w- c:\windows\system32\ieetwproxystub.dll
2015-10-30 22:45 . 2015-11-11 07:41 341504 ----a-w- c:\windows\system32\html.iec
2015-10-30 22:44 . 2015-11-11 07:41 64000 ----a-w- c:\windows\system32\MshtmlDac.dll
2015-10-30 22:36 . 2015-11-11 07:41 102912 ----a-w- c:\windows\system32\ieetwcollector.exe
2015-10-30 22:36 . 2015-11-11 07:41 115712 ----a-w- c:\windows\system32\ieUnatt.exe
2015-10-30 22:36 . 2015-11-11 07:41 620032 ----a-w- c:\windows\system32\jscript9diag.dll
2015-10-30 22:31 . 2015-11-11 07:41 667648 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2015-10-30 22:23 . 2015-11-11 07:41 60416 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2015-10-30 22:16 . 2015-11-11 07:41 4527616 ----a-w- c:\windows\system32\jscript9.dll
2015-10-30 22:09 . 2015-11-11 07:41 1155072 ----a-w- c:\windows\system32\mshtmlmedia.dll
2015-10-30 22:09 . 2015-11-11 07:41 2052608 ----a-w- c:\windows\system32\inetcpl.cpl
2015-10-30 21:51 . 2015-11-11 07:41 2011136 ----a-w- c:\windows\system32\wininet.dll
2015-10-29 17:50 . 2015-11-11 07:42 5120 ----a-w- c:\windows\system32\shimeng.dll
2015-10-29 17:49 . 2015-11-11 07:42 295936 ----a-w- c:\windows\system32\apphelp.dll
2015-10-29 17:49 . 2015-11-11 07:42 62464 ----a-w- c:\windows\system32\aelupsvc.dll
2015-10-29 17:49 . 2015-11-11 07:42 562176 ----a-w- c:\windows\apppatch\AcLayers.dll
2015-10-29 17:49 . 2015-11-11 07:42 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2015-10-29 17:49 . 2015-11-11 07:42 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll
2015-10-29 17:49 . 2015-11-11 07:42 211968 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2015-10-29 17:49 . 2015-11-11 07:42 20992 ----a-w- c:\windows\system32\sdbinst.exe
2015-10-29 17:39 . 2015-11-11 07:42 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2015-10-20 17:46 . 2015-11-11 07:39 93696 ----a-w- c:\windows\system32\wudriver.dll
2015-10-20 17:46 . 2015-11-11 07:39 35840 ----a-w- c:\windows\system32\wups2.dll
2015-10-20 17:46 . 2015-11-11 07:39 30208 ----a-w- c:\windows\system32\wups.dll
2015-10-20 17:46 . 2015-11-11 07:39 2955776 ----a-w- c:\windows\system32\wucltux.dll
2015-10-20 17:46 . 2015-11-11 07:39 2061824 ----a-w- c:\windows\system32\wuaueng.dll
2015-10-20 17:46 . 2015-11-11 07:39 174080 ----a-w- c:\windows\system32\wuwebv.dll
2015-10-20 17:46 . 2015-11-11 07:39 566784 ----a-w- c:\windows\system32\wuapi.dll
2015-10-20 17:45 . 2015-11-11 07:39 73728 ----a-w- c:\windows\system32\WinSetupUI.dll
2015-10-20 17:45 . 2015-11-11 07:39 11776 ----a-w- c:\windows\system32\wu.upgrade.ps.dll
2015-10-20 17:45 . 2015-11-11 07:39 35328 ----a-w- c:\windows\system32\wuapp.exe
2015-10-20 17:45 . 2015-11-11 07:39 136192 ----a-w- c:\windows\system32\wuauclt.exe
2015-10-20 00:52 . 2015-11-11 07:42 3991488 ----a-w- c:\windows\system32\ntkrnlpa.exe
2015-10-20 00:52 . 2015-11-11 07:42 3935680 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-10-20 00:52 . 2015-11-11 07:42 67520 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2015-10-20 00:52 . 2015-11-11 07:42 138176 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2015-10-20 00:48 . 2015-11-11 07:42 1308160 ----a-w- c:\windows\system32\ntdll.dll
2015-10-20 00:45 . 2015-11-11 07:42 172032 ----a-w- c:\windows\system32\wdigest.dll
2015-10-20 00:45 . 2015-11-11 07:42 65536 ----a-w- c:\windows\system32\TSpkg.dll
2015-10-20 00:45 . 2015-11-11 07:42 400896 ----a-w- c:\windows\system32\srcore.dll
2015-10-20 00:45 . 2015-11-11 07:42 100352 ----a-w- c:\windows\system32\sspicli.dll
2015-10-20 00:45 . 2015-11-11 07:42 43008 ----a-w- c:\windows\system32\srclient.dll
2015-10-20 00:45 . 2015-11-11 07:42 15872 ----a-w- c:\windows\system32\sspisrv.dll
2015-10-20 00:45 . 2015-11-11 07:42 251392 ----a-w- c:\windows\system32\schannel.dll
2015-10-20 00:45 . 2015-11-11 07:42 22016 ----a-w- c:\windows\system32\secur32.dll
2015-10-20 00:45 . 2015-11-11 07:42 655360 ----a-w- c:\windows\system32\rpcrt4.dll
2015-10-20 00:45 . 2015-11-11 07:42 223232 ----a-w- c:\windows\system32\ncrypt.dll
2015-10-20 00:45 . 2015-11-11 07:42 259584 ----a-w- c:\windows\system32\msv1_0.dll
2015-10-20 00:45 . 2015-11-11 07:42 1061376 ----a-w- c:\windows\system32\lsasrv.dll
2015-10-20 00:45 . 2015-11-11 07:42 552960 ----a-w- c:\windows\system32\kerberos.dll
2015-10-20 00:45 . 2015-11-11 07:42 38912 ----a-w- c:\windows\system32\csrsrv.dll
2015-10-20 00:45 . 2015-11-11 07:42 36864 ----a-w- c:\windows\system32\cryptbase.dll
2015-10-20 00:45 . 2015-11-11 07:42 17408 ----a-w- c:\windows\system32\credssp.dll
2015-10-20 00:45 . 2015-11-11 07:42 69632 ----a-w- c:\windows\system32\smss.exe
2015-10-20 00:45 . 2015-11-11 07:42 262656 ----a-w- c:\windows\system32\rstrui.exe
2015-10-20 00:44 . 2015-11-11 07:42 22528 ----a-w- c:\windows\system32\lsass.exe
2015-10-20 00:44 . 2015-11-11 07:42 50176 ----a-w- c:\windows\system32\auditpol.exe
2015-10-20 00:39 . 2015-11-11 07:42 60416 ----a-w- c:\windows\system32\msobjs.dll
2015-10-20 00:39 . 2015-11-11 07:42 146432 ----a-w- c:\windows\system32\msaudite.dll
2015-10-20 00:35 . 2015-11-11 07:42 6656 ----a-w- c:\windows\system32\apisetschema.dll
2015-10-20 00:35 . 2015-11-11 07:42 686080 ----a-w- c:\windows\system32\adtschema.dll
2015-10-19 23:29 . 2015-11-11 07:42 225792 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2015-10-19 23:28 . 2015-11-11 07:42 98304 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2015-10-19 23:28 . 2015-11-11 07:42 124416 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2015-10-13 16:31 . 2015-11-11 07:42 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2015-10-13 16:31 . 2015-11-11 07:42 74752 ----a-w- c:\windows\system32\drivers\tdx.sys
2015-10-13 04:50 . 2015-11-11 07:41 712640 ----a-w- c:\windows\system32\drivers\ndis.sys
2015-10-13 00:29 . 2015-10-13 00:29 875720 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2015-10-01 17:50 . 2015-10-14 05:52 50176 ----a-w- c:\windows\system32\setbcdlocale.dll
2015-10-01 17:50 . 2015-11-11 07:39 22528 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\jnwppr.dll
2015-10-01 17:50 . 2015-11-11 07:39 216064 ----a-w- c:\windows\system32\InkEd.dll
2015-10-01 17:50 . 2015-11-11 07:39 19968 ----a-w- c:\windows\system32\jnwmon.dll
2015-10-01 17:50 . 2015-10-14 05:52 50688 ----a-w- c:\windows\system32\appidapi.dll
2015-10-01 17:50 . 2015-10-14 05:52 28160 ----a-w- c:\windows\system32\appidsvc.dll
2015-10-01 17:50 . 2015-10-14 05:52 96768 ----a-w- c:\windows\system32\appidpolicyconverter.exe
2015-10-01 17:50 . 2015-10-14 05:52 16896 ----a-w- c:\windows\system32\appidcertstorecheck.exe
2015-10-01 16:53 . 2015-10-14 05:52 50176 ----a-w- c:\windows\system32\drivers\appid.sys
2015-09-23 13:09 . 2015-11-11 07:39 371920 ----a-w- c:\windows\system32\drivers\cng.sys
2015-09-23 13:09 . 2015-11-11 07:39 251000 ----a-w- c:\windows\system32\bcryptprimitives.dll
2015-09-18 17:47 . 2015-10-15 05:53 23384 ----a-w- c:\windows\system32\CompatTelRunner.exe
2015-09-18 17:44 . 2015-10-15 05:53 587776 ----a-w- c:\windows\system32\invagent.dll
2015-09-18 17:44 . 2015-10-15 05:53 615936 ----a-w- c:\windows\system32\generaltel.dll
2015-09-18 17:44 . 2015-10-15 05:53 423936 ----a-w- c:\windows\system32\devinv.dll
2015-09-18 17:44 . 2015-10-15 05:53 1120768 ----a-w- c:\windows\system32\appraiser.dll
2015-09-18 17:44 . 2015-10-15 05:53 62976 ----a-w- c:\windows\system32\acmigration.dll
2015-09-18 17:35 . 2015-10-15 05:53 999936 ----a-w- c:\windows\system32\aeinv.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Nezapomen"="c:\program files\Pamatuj\nezapomen.exe" [2000-12-11 458240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2006-10-09 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-09 7741440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-09 81920]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-09-12 5110672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2014-10-31 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2015-05-21 89984]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-10-30 102912]
R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 19720]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-24 14856]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 121064]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-05-13 114280]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2015-05-21 184192]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2014-10-30 1343400]
R3 WSDScan;Podpora skenování WSD přes UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2013-09-17 49240]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2013-09-17 188808]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2013-09-17 134248]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [2013-09-17 37416]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2013-09-12 1337752]
S2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8;c:\program files\Nitro\Pro 8\NitroPDFDriverService8.exe [2012-12-13 196616]
S2 ss_conn_service;SAMSUNG Mobile Connectivity Service;c:\program files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [2015-05-21 743688]
S2 VRAID Log Service;VRAID Log Service;c:\program files\VIA\RAID\vialogsv.exe [2014-10-30 55920]
S2 xmengine service;CryptoPlus XME Engine Service;c:\windows\system32\xmesrv.exe [2014-10-31 34696]
S3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2004-10-21 1275584]
S3 GemCCID;GemCCID;c:\windows\system32\DRIVERS\GemCCID.sys [2014-03-14 99840]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
utcsvc REG_MULTI_SZ DiagTrack
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-09-29 06:00 997704 ----a-w- c:\program files\Google\Chrome\Application\45.0.2454.101\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A6EADE66-0000-0000-484E-7E8A45000000}]
2015-11-18 16:22 286904 ----a-w- c:\program files\Adobe\Acrobat Reader DC\Esl\AiodLite.dll
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: business24.cz\www
Trusted Zone: servis24.cz\www
TCP: DhcpNameServer = 46.33.112.42 8.8.8.8 46.33.96.2
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.032"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.abr"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.acdc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.acdc"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ani"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.apd"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.arw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.bay"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.bmp"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cr2"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.crw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cs1"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cur"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dcr"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dcx"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dib"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.djv"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.djvu"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dng"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.emf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.eps"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.erf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.fff"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.gif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.hdr"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.icl"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.icn"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.iw4"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.j2c"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.j2k"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jbr"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jfif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jp2"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpc"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpe"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpeg"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpg"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpk"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpx"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.kdc"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mef"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mos"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mrw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.nef"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.nrw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.orf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pbr"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pct"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pcx"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pef"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pic"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pict"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.png"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.psd"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.psp"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pspbrush"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pspimage"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.raf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.raw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rle"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rw2"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rwl"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.sr2"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.srf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.srw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tga"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.thm"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tiff"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ttc"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ttf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v18o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.v18o"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v18p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.v18p"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v18pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.v18pf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wbm"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wbmp"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.webp"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wmf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.xif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.xmp"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.032"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.abr"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ani"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.apd"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.arw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.bay"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.bmp"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cr2"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.crw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cs1"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cur"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dcr"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dcx"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dib"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.djv"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.djvu"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dng"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.emf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.eps"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.erf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.fff"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.gif"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.hdr"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.icl"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.icn"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.iw4"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.j2c"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.j2k"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jbr"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jfif"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jif"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jp2"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpc"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpe"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpeg"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpg"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpk"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpx"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.kdc"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mef"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mos"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mrw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.nef"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.nrw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.orf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pbr"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pct"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pcx"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pef"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pic"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pict"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.png"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.psd"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.psp"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pspbrush"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pspimage"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.raf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.raw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rle"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rw2"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rwl"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.sr2"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.srf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.srw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tga"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.thm"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tif"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tiff"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ttc"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ttf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wbm"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wbmp"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webp\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.webp"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wmf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.xif"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_20_0_0_228_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_20_0_0_228_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2015-12-16 08:38:15
ComboFix-quarantined-files.txt 2015-12-16 07:38
.
Před spuštěním: Volných bajtů: 450 433 888 256
Po spuštění: Volných bajtů: 450 104 782 848
.
- - End Of File - - D29F4829F1FAF770E77F0D45A470E507
A36C5E4F47E84449FF07ED3517B43A31

Kikos · #5 Příspěvek od **Kikos** » 16 pro 2015 10:37

Provedeno ..... jen pro info dnes jsem již 5x vypínal Host Process - svchost.exe (netsvcs)

Kikos · #6 Příspěvek od **Kikos** » 16 pro 2015 12:07

Zasílám v TXT mělo to moc znaků ...jinak program nezapomeň je OK je to připomínač událostí.

Kikos · #7 Příspěvek od **Kikos** » 17 pro 2015 11:13

Zdá se že neovlivnil po ránu naskakuje a vytěžuje procesor na 100% musím 2-3x vypínat. Pokusím se udělat znovu při max.zatížení. Děkuji za ochotu.

Kikos · #8 Příspěvek od **Kikos** » 17 pro 2015 17:03

Tak teď nevím je tam spuštěný několikrát

Kikos · #9 Příspěvek od **Kikos** » 21 pro 2015 08:28

OK podařilo se vkládám.

Kikos · #10 Příspěvek od **Kikos** » 22 pro 2015 12:23

Tak zdá se že win update po tom výkon spadl rychle dolů.

Kikos · #11 Příspěvek od **Kikos** » 04 led 2016 11:34

Tak se zdá že po aktualizovaní a vypnutí se to zlepšilo budu pozorovat a dam report.

Kikos · #12 Příspěvek od **Kikos** » 08 led 2016 08:53

Takže od tohoto problému již klid, ale zase se mi objevil starý známy několikrát řešený DeviceDisplayObjectProvider jež vytěžuje procesor na 100% po vypnutí jede normálně

Kikos · #13 Příspěvek od **Kikos** » 12 led 2016 09:16

Většinou to 1-2x za den vypnu ve správci někdy je pokoj i na pár dní tady jsem se s tím trápil velmi často ( http://forum.viry.cz//viewtopic.php?f=13&t=142525) pokoušeli jsme se to i smazat a nahradit

začínám přemýšlet o novém PC

Kikos · #14 Příspěvek od **Kikos** » 13 led 2016 09:59

Jojo tam je všechno cajk

Kikos · #15 Příspěvek od **Kikos** » 14 led 2016 09:18

Myslíš jako win znova všechno smáznout ... no asi budu muset ač jsem se chtěl tomu vyhnout

VIRY.CZ

Vytížení procesoru - Host Process - svchost.exe (netsvcs)

Vytížení procesoru - Host Process - svchost.exe (netsvcs)

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc

Re: Vytížení procesoru - Host Process - svchost.exe (netsvc