Preventivka - pomalý PC

[Sirius]

Zdravím,

prosím o kontrolu PC mé sestry. Je značně zpomalený, disk ve správci úloh pracuje na 90+ % a včera jsem jí zbavoval nějaké havěti z facebooku. Možná tam toho tedy bude více. PC jsem čistil AdwCleanerem, MBAM ( Ten se choval podivně, hlásil 3 nálezy, nezobrazil ani 1 ale v seznamu je jich více ) a KVRT. Přikládám i logy. Havěti se zbavila ale na zpomalení to žádný efekt nemělo. Děkuji

RSIT:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Petr at 2015-12-21 17:26:59
Microsoft Windows 8.1
System drive C: has 1291 GB (68%) free of 1907 GB
Total RAM: 7648 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:27:03, on 21. 12. 2015
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.18123)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\trend micro\Petr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hal3000.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [mncbxnkSrv] C:\WINDOWS\system32\mncbxnk.vbe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [BitTorrent] "C:\Users\Petr\AppData\Roaming\BitTorrent\BitTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [Samsung Appstore] "C:\Users\Petr\AppData\Roaming\Mozila\autoit.exe" "C:\Users\Petr\AppData\Roaming\Mozila\up.au3"
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\WINDOWS\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7197 bytes

======Listing Processes======





wininit.exe


C:\WINDOWS\system32\lsass.exe
winlogon.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
"dwm.exe"
C:\WINDOWS\system32\atiesrxx.exe
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
atieclxx
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
taskeng.exe {B3F67B21-AB9E-428D-B8AE-6DB4E1093847}
taskhostex.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe -k utcsvc
dashost.exe {95e1ead6-95bb-408e-a76ead5cdeb56d17}
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe"
"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe"
"C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe"

"C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe" /starttray
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\skydrive.exe -Embedding
C:\WINDOWS\servicing\TrustedInstaller.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-966272d8-f2ef-4dac-9d63-27ccc1d0a32c -SystemEventPortName:HostProcess-525c3f97-673d-4c25-98b6-c33ca335cb92 -IoCancelEventPortName:HostProcess-a5a0d96b-7f5a-4559-9b39-133c172b18f1 -NonStateChangingEventPortName:HostProcess-a019dcfb-a89f-4877-9332-c20755e57035 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:848cdd68-3cc6-4b8a-8486-b55eb7d9428e -DeviceGroupId:WpdFsGroup
C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet
C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe -Embedding
"C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe"

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\Windows\System32\SettingSyncHost.exe" -Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-1562966e-490d-4ec1-abac-c9bbdb34502e -SystemEventPortName:HostProcess-b75424c4-6af5-47be-bd52-409b917e1640 -IoCancelEventPortName:HostProcess-22a211a0-18c2-4a09-835c-575e3ee03d20 -NonStateChangingEventPortName:HostProcess-85a0d2e2-6fa5-4f40-935c-09c1cf299ed0 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:fdfe866e-0c67-47a7-a0df-55fe0e6d345d -DeviceGroupId:WudfDefaultDevicePool
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
"C:\Program Files\Windows Defender\MpCmdRun.exe" SpyNetServiceDss -RestrictPrivileges -AccessKey 25F88536-C2CD-BB76-F9F1-57F37892C10C -Reinvoke

"C:\Users\Petr\Downloads\RSITx64.exe"
C:\WINDOWS\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2013-01-22 6964296]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-07-03 3673184]
"BitTorrent"=C:\Users\Petr\AppData\Roaming\BitTorrent\BitTorrent.exe [2015-05-23 1696104]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-02-19 7416088]
"Samsung Appstore"=C:\Users\Petr\AppData\Roaming\Mozila\autoit.exe [2015-12-20 934400]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-08-06 642216]
"PWRISOVM.EXE"=C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [2013-04-15 337432]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"mncbxnkSrv"=C:\WINDOWS\system32\mncbxnk.vbe []
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.yuy2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"vidc.yvyu"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"vidc.uyvy"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-12-21 17:26:59 ----D---- C:\rsit
2015-12-21 17:26:59 ----D---- C:\Program Files\trend micro
2015-12-21 14:48:45 ----D---- C:\KVRT_Data
2015-12-20 10:17:00 ----D---- C:\Users\Petr\AppData\Roaming\Mozila
2015-12-19 21:11:32 ----A---- C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
2015-12-19 21:11:02 ----D---- C:\ProgramData\Malwarebytes
2015-12-19 21:11:02 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-12-19 21:11:02 ----A---- C:\WINDOWS\system32\drivers\mwac.sys
2015-12-19 21:11:02 ----A---- C:\WINDOWS\system32\drivers\mbamchameleon.sys
2015-12-19 21:11:02 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2015-12-19 21:02:04 ----D---- C:\AdwCleaner
2015-12-18 16:33:47 ----A---- C:\WINDOWS\system32\aspnet_counters.dll
2015-12-18 16:33:45 ----A---- C:\WINDOWS\SYSWOW64\aspnet_counters.dll
2015-12-09 17:22:02 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2015-12-09 17:22:02 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2015-12-09 17:22:02 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2015-12-09 17:22:02 ----A---- C:\WINDOWS\system32\vbscript.dll
2015-12-09 17:22:01 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2015-12-09 17:22:01 ----A---- C:\WINDOWS\SYSWOW64\inetcomm.dll
2015-12-09 17:22:01 ----A---- C:\WINDOWS\SYSWOW64\ieapfltr.dll
2015-12-09 17:22:01 ----A---- C:\WINDOWS\system32\jscript9.dll
2015-12-09 17:22:01 ----A---- C:\WINDOWS\system32\jscript.dll
2015-12-09 17:22:00 ----A---- C:\WINDOWS\system32\wininet.dll
2015-12-09 17:22:00 ----A---- C:\WINDOWS\system32\inetcomm.dll
2015-12-09 17:22:00 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2015-12-09 17:21:59 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2015-12-09 17:21:59 ----A---- C:\WINDOWS\system32\mshtml.dll
2015-12-09 17:21:59 ----A---- C:\WINDOWS\system32\iertutil.dll
2015-12-09 17:21:58 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2015-12-09 17:21:57 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2015-12-09 17:21:57 ----A---- C:\WINDOWS\system32\msfeeds.dll
2015-12-09 17:21:56 ----A---- C:\WINDOWS\system32\ieframe.dll
2015-12-09 17:21:54 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2015-12-09 17:21:54 ----A---- C:\WINDOWS\system32\urlmon.dll
2015-12-09 17:21:53 ----A---- C:\WINDOWS\SYSWOW64\msfeeds.dll
2015-12-09 17:21:53 ----A---- C:\WINDOWS\SYSWOW64\ieui.dll
2015-12-09 17:21:53 ----A---- C:\WINDOWS\system32\ieui.dll
2015-12-09 17:21:53 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2015-12-09 17:21:52 ----A---- C:\WINDOWS\SYSWOW64\actxprxy.dll
2015-12-09 17:21:51 ----A---- C:\WINDOWS\SYSWOW64\iedkcs32.dll
2015-12-09 17:21:51 ----A---- C:\WINDOWS\system32\mshtmled.dll
2015-12-09 17:21:51 ----A---- C:\WINDOWS\system32\iepeers.dll
2015-12-09 17:21:51 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\SYSWOW64\webcheck.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\SYSWOW64\MshtmlDac.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\SYSWOW64\iepeers.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\SYSWOW64\dxtrans.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\system32\webcheck.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\system32\dxtrans.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\system32\actxprxy.dll
2015-12-09 17:20:55 ----A---- C:\WINDOWS\system32\drivers\rmcast.sys
2015-12-09 17:19:55 ----A---- C:\WINDOWS\system32\Windows.Globalization.dll
2015-12-09 17:19:54 ----A---- C:\WINDOWS\SYSWOW64\Windows.Globalization.dll
2015-12-09 17:19:53 ----A---- C:\WINDOWS\SYSWOW64\kbdgeoqw.dll
2015-12-09 17:19:53 ----A---- C:\WINDOWS\SYSWOW64\KBDAZST.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\SYSWOW64\KBDAZEL.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\SYSWOW64\KBDAZE.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\SYSWOW64\GlobCollationHost.dll
2015-12-09 17:19:53 ----A---- C:\WINDOWS\system32\kbdgeoqw.dll
2015-12-09 17:19:53 ----A---- C:\WINDOWS\system32\KBDAZST.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\system32\KBDAZEL.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\system32\KBDAZE.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\system32\GlobCollationHost.dll
2015-12-09 17:17:29 ----A---- C:\WINDOWS\system32\dpapisrv.dll
2015-12-09 17:17:07 ----A---- C:\WINDOWS\system32\winresume.exe
2015-12-09 17:17:07 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2015-12-09 17:17:06 ----A---- C:\WINDOWS\SYSWOW64\ntdll.dll
2015-12-09 17:17:06 ----A---- C:\WINDOWS\SYSWOW64\comsvcs.dll
2015-12-09 17:17:06 ----A---- C:\WINDOWS\SYSWOW64\catsrvut.dll
2015-12-09 17:17:06 ----A---- C:\WINDOWS\system32\winload.exe
2015-12-09 17:17:06 ----A---- C:\WINDOWS\system32\ntdll.dll
2015-12-09 17:17:06 ----A---- C:\WINDOWS\system32\comsvcs.dll
2015-12-09 17:17:05 ----A---- C:\WINDOWS\SYSWOW64\ntvdm64.dll
2015-12-09 17:17:05 ----A---- C:\WINDOWS\system32\ntvdm64.dll
2015-12-09 17:17:05 ----A---- C:\WINDOWS\system32\catsrvut.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\SYSWOW64\user32.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\SYSWOW64\GdiPlus.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\SYSWOW64\DWrite.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\system32\win32k.sys
2015-12-09 17:16:43 ----A---- C:\WINDOWS\system32\user32.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\system32\FntCache.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\system32\DWrite.dll
2015-12-09 17:16:42 ----A---- C:\WINDOWS\SYSWOW64\msctf.dll
2015-12-09 17:16:42 ----A---- C:\WINDOWS\system32\msctf.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\SYSWOW64\wuwebv.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\SYSWOW64\wuapi.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wuwebv.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\WUSettingsProvider.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wups2.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wucltux.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wuaueng.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wuauclt.exe
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wuapi.dll
2015-12-09 17:15:42 ----A---- C:\WINDOWS\system32\wudriver.dll
2015-12-09 17:15:41 ----A---- C:\WINDOWS\SYSWOW64\wudriver.dll
2015-12-09 17:15:41 ----A---- C:\WINDOWS\SYSWOW64\wuapp.exe
2015-12-09 17:15:41 ----A---- C:\WINDOWS\system32\wuapp.exe
2015-12-09 17:15:35 ----A---- C:\WINDOWS\SYSWOW64\authui.dll
2015-12-09 17:15:35 ----A---- C:\WINDOWS\system32\authui.dll
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbuhci.sys
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbport.sys
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbohci.sys
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\USBHUB3.SYS
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbhub.sys
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbehci.sys
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbd.sys
2015-12-09 17:15:05 ----A---- C:\WINDOWS\SYSWOW64\PCPKsp.dll
2015-12-09 17:15:05 ----A---- C:\WINDOWS\system32\PCPKsp.dll
2015-12-09 17:15:00 ----A---- C:\WINDOWS\system32\winlogon.exe
2015-12-09 17:14:59 ----A---- C:\WINDOWS\system32\wininit.exe

======List of files/folders modified in the last 1 month======

2015-12-21 17:27:03 ----D---- C:\WINDOWS\Prefetch
2015-12-21 17:26:59 ----RD---- C:\Program Files
2015-12-21 17:26:50 ----D---- C:\WINDOWS\Temp
2015-12-21 17:25:24 ----D---- C:\WINDOWS\system32\catroot
2015-12-21 17:25:21 ----D---- C:\WINDOWS\CbsTemp
2015-12-21 17:23:18 ----D---- C:\WINDOWS\system32\sru
2015-12-21 17:22:46 ----D---- C:\WINDOWS\system32\config
2015-12-21 17:18:37 ----D---- C:\WINDOWS\WinSxS
2015-12-21 17:18:33 ----RD---- C:\WINDOWS\System32
2015-12-21 17:18:33 ----D---- C:\WINDOWS\Logs
2015-12-21 17:17:53 ----D---- C:\Windows
2015-12-21 17:16:35 ----D---- C:\WINDOWS\SysWOW64
2015-12-21 17:15:44 ----SHD---- C:\System Volume Information
2015-12-21 16:59:50 ----D---- C:\WINDOWS\debug
2015-12-21 16:56:43 ----D---- C:\WINDOWS\AppReadiness
2015-12-21 16:55:02 ----SHD---- C:\WINDOWS\Installer
2015-12-21 16:51:14 ----RD---- C:\Program Files (x86)
2015-12-21 16:50:57 ----D---- C:\Program Files (x86)\Google
2015-12-21 16:50:42 ----D---- C:\WINDOWS\Tasks
2015-12-21 16:49:30 ----D---- C:\WINDOWS\system32\drivers
2015-12-21 13:32:14 ----D---- C:\WINDOWS\system32\catroot2
2015-12-21 13:29:11 ----D---- C:\WINDOWS\Microsoft.NET
2015-12-20 19:10:33 ----RD---- C:\WINDOWS\DesktopTileResources
2015-12-20 19:09:47 ----D---- C:\WINDOWS\Inf
2015-12-19 21:11:02 ----HD---- C:\ProgramData
2015-12-19 14:47:09 ----HD---- C:\Program Files\WindowsApps
2015-12-12 21:07:43 ----D---- C:\WINDOWS\rescache
2015-12-10 18:22:58 ----D---- C:\WINDOWS\system32\DriverStore
2015-12-10 18:18:47 ----RSD---- C:\WINDOWS\assembly
2015-12-09 20:27:58 ----RSD---- C:\WINDOWS\Fonts
2015-12-09 20:27:57 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2015-12-09 20:27:57 ----D---- C:\WINDOWS\system32\cs-CZ
2015-12-09 20:27:56 ----D---- C:\Program Files\Internet Explorer
2015-12-09 20:27:56 ----D---- C:\Program Files (x86)\Internet Explorer
2015-12-09 17:50:12 ----D---- C:\WINDOWS\system32\MRT
2015-12-09 17:46:24 ----A---- C:\WINDOWS\system32\MRT.exe
2015-12-09 04:39:31 ----N---- C:\WINDOWS\system32\MpSigStub.exe
2015-12-01 18:19:27 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2015-11-23 02:43:31 ----RD---- C:\FILM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amd_sata;amd_sata; C:\WINDOWS\System32\drivers\amd_sata.sys [2012-11-30 80552]
R0 amd_xata;amd_xata; C:\WINDOWS\System32\drivers\amd_xata.sys [2012-11-30 26280]
R0 Tpkd;Tpkd; C:\WINDOWS\system32\drivers\Tpkd.sys [2009-12-23 105592]
R0 Wof;Windows Overlay File System Filter Driver; C:\WINDOWS\system32\drivers\Wof.sys [2014-06-01 157016]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2013-04-15 127384]
R2 acedrv11;acedrv11; \??\C:\Windows\system32\drivers\acedrv11.sys [2010-02-24 191616]
R2 AODDriver4.1;AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\SysWOW64\drivers\Afc.sys [2006-11-14 22784]
R3 amdkmdag;amdkmdag; C:\WINDOWS\system32\DRIVERS\atikmdag.sys [2014-05-28 13209088]
R3 amdkmdap;amdkmdap; C:\WINDOWS\system32\DRIVERS\atikmpag.sys [2014-05-28 626688]
R3 AmUStor;@oem27.inf,%AmUStor.SvcDesc%;AM USB Stroage Driver; C:\WINDOWS\system32\drivers\AmUStor.SYS [2012-10-25 95744]
R3 AtiHDAudioService;@oem4.inf,%ATIHdAudioDriver.SvcDesc%;AMD Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdW86.sys [2013-02-14 94208]
R3 dtsoftbus01;@oem8.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\System32\drivers\dtsoftbus01.sys [2013-07-10 283064]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RTKVHD64.sys [2013-01-22 3305928]
R3 MBAMProtector;MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys [2015-10-05 25816]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [2015-12-21 192216]
R3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\WINDOWS\system32\drivers\mwac.sys [2015-10-05 64216]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\WINDOWS\system32\DRIVERS\Rt630x64.sys [2013-06-18 591360]
R3 usbfilter;AMD USB Filter Driver; C:\WINDOWS\system32\DRIVERS\usbfilter.sys [2012-06-18 57000]
R3 WUDFSensorLP;@locationprovider.inf,%WudfLocationProviderDisplayName%;Služba Reflektor UMDF pro zprostředkovatele umístění (LocationProvider); C:\WINDOWS\System32\drivers\WUDFRd.sys [2014-10-29 226304]
S0 amdkmafd;@oem29.inf,%AMDKMAFD_svcdesc%;AMD Audio Bus Lower Filter; C:\WINDOWS\System32\drivers\amdkmafd.sys [2013-03-14 21600]
S2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2015-06-02 303616]
S2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2015-06-02 35328]
S3 EagleX64;EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys []
S3 usbaudio;@wdma_usb.inf,%USBAudio.SvcDesc%;Ovladač zvuků USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2014-03-18 121088]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\WINDOWS\system32\atiesrxx.exe [2014-05-28 239616]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-08-06 361984]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\WINDOWS\System32\svchost.exe [2014-10-29 38792]
R2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2015-10-05 1135416]
R2 MBAMScheduler;MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2015-10-05 1513784]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-07-29 935208]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21 144200]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\WINDOWS\System32\svchost.exe [2014-10-29 38792]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2013-08-03 43696]
S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2013-02-17 137336]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21 144200]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-02-18 315488]
S4 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-07-26 563624]

-----------------EOF-----------------

AdwCleaner:

# AdwCleaner v5.025 - Logfile created 19/12/2015 at 21:03:38
# Updated 13/12/2015 by Xplode
# Database : 2015-12-13.2 [Server]
# Operating system : Windows 8.1 (x64)
# Username : Petr - JANDOVI
# Running from : C:\Users\Petr\Downloads\adwcleaner_5.025.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\DownLite
[-] Folder Deleted : C:\Program Files (x86)\SimilarSites
[-] Folder Deleted : C:\Program Files (x86)\WinZip Registry Optimizer
[-] Folder Deleted : C:\ProgramData\apn
[-] Folder Deleted : C:\ProgramData\Babylon
[-] Folder Deleted : C:\Users\Petr\AppData\Roaming\Babylon
[-] Folder Deleted : C:\Users\Petr\AppData\Roaming\DownLite
[-] Folder Deleted : C:\Users\Petr\AppData\Roaming\OpenCandy
[-] Folder Deleted : C:\Users\Petr\AppData\Roaming\SimilarSites

***** [ Files ] *****

[-] File Deleted : C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_olakgnkoldmagdblaalodobkmeokmgjj_0.localstorage
[-] File Deleted : C:\WINDOWS\SysNative\roboot64.exe

***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\Classes\pokki
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
[!] Key Not Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{FE69C007-C452-4D3E-86D2-1730DF8BC871}]
[-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{D8278076-BC68-4484-9233-6E7F1628B56C}]
[-] Key Deleted : HKCU\Software\1ClickDownload
[-] Key Deleted : HKCU\Software\BABSOLUTION
[-] Key Deleted : HKCU\Software\DataMngr
[-] Key Deleted : HKCU\Software\InstallCore
[-] Key Deleted : HKCU\Software\DownLite
[-] Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
[-] Key Deleted : HKLM\SOFTWARE\Babylon
[-] Key Deleted : HKLM\SOFTWARE\DataMngr
[-] Key Deleted : HKLM\SOFTWARE\PIP
[-] Key Deleted : HKLM\SOFTWARE\hosts
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DownLite
[-] Key Deleted : [x64] HKLM\SOFTWARE\Speedchecker Limited
[-] Data Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{A8A383B0-BF18-4135-886D-4F8CBB5C92CD}

***** [ Web browsers ] *****

[-] [C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : aaaajfocmnnhjaajccaelhippajhaeod
[-] [C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Homepage] Deleted : hxxp://www.search.ask.com/?l=dis&o=APN10026&gc ... 2013-05-22

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [3240 bytes] ##########

MBAM:

Malwarebytes Anti-Malware
http://www.malwarebytes.org

Datum skenování: 20. 12. 2015
Čas skenování: 19:00
Protokol:
Správce: Ano

Verze: 2.2.0.1024
Databáze malwaru: v2015.12.20.05
Databáze rootkitů: v2015.12.18.01
Licence: Zkušební verze
Ochrana proti malwaru: Zapnuto
Ochrana proti škodlivým webovým stránkám: Zapnuto
Ochrana programu: Vypnuto

OS: Windows 8.1
CPU: x64
Souborový systém: NTFS
Uživatel: Petr

Typ skenu: Sken hrozeb
Výsledek: Dokončeno
Prohledaných objektů: 354740
Uplynulý čas: 8 min, 32 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Vypnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 2
PUP.Optional.OpenCandy, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\OpenCandyHelperRunAsStandardUser29B733C6FF78488995466139256A7B82, Smazat při restartu, [68ed9f08cbc048ee088b307f0bf87e82],
PUP.Optional.OpenCandy, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\OpenCandyHelperRunOnceDA7B556215EA43EDA76FCE8701F4FC85, Smazat při restartu, [0055d5d2890267cf9cf7565955ae30d0],

Hodnoty registru: 2
Trojan.Agent.SCR, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|MSStp, C:\WINDOWS\inf\msstp.vbe, Do karantény, [fe574e59bccf8babe120a82029d92dd3]
Trojan.Agent.Trace, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|NtVdmSrv, C:\WINDOWS\inf\ntvdm.vbe, Do karantény, [2d28f5b2147784b21f4a0fcf9271db25]

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 5
PUP.Optional.BitCoinMiner, C:\Windows\SysWOW64\acumncbxnk.exe, Do karantény, [3421c4e31675c175f7d925e9c042ff01],
PUP.Optional.SpottyFiles, C:\Users\Petr\Downloads\Nymizmatika_i_Faleristika_downloader.exe, Do karantény, [97be1b8c3e4d171f7ef2614655afad53],
Trojan.Agent.SCR, C:\Windows\Inf\msstp.vbe, Do karantény, [fe574e59bccf8babe120a82029d92dd3],
Trojan.Agent.Trace, C:\Windows\Inf\ntvdm.inf, Do karantény, [381ddccbccbf9d99f96fac322ed5aa56],
Trojan.Agent.Trace, C:\Windows\Inf\ntvdm.vbe, Do karantény, [2d28f5b2147784b21f4a0fcf9271db25],

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

KVRT:

Bohužel jsem našel jen soubor typu ENC1

[Márty84]

Zdravim

Havet tam stale je.


Udelejte novou kontrolu s MBAM. Test nastavte podle tohoto navodu (cili Vlastni sken vsech disku) http://forum.viry.cz/viewtopic.php?f=29&t=144868 a dejte sem vysledky. Predem nic nemazte, miva obcas falesne detekce

[Sirius]

Omlouvám se, komunikace bude pomalejší, jelikož sestra bydlí sama

[Márty84]

To neni moc dobre, protoze kdyz se neco odstrani, nez provedeme dalsi krok, muze se to natahat zpatky No uvidime

[Sirius]

Mám jednu dobrou zprávu a to tu, že zítra jdu k sestře a nainstaluji jí Team Viewer, tudíž budu mít přístup k jejímu PC a budu s ním moci pracovat A přeji hodně štěstí do nového roku

[Márty84]

Tak to je fajn, aspon uz tu havet vyzenem do pryc

Dekuji, napodobne!

[Sirius]

Tak přikládám log MBAM. Prozatím jsem tedy nic nemazal

Malwarebytes Anti-Malware
http://www.malwarebytes.org

Datum skenování: 3. 1. 2016
Čas skenování: 14:21
Protokol: MBAM.txt
Správce: Ano

Verze: 2.2.0.1024
Databáze malwaru: v2016.01.03.03
Databáze rootkitů: v2015.12.26.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 8.1
CPU: x64
Souborový systém: NTFS
Uživatel: Petr

Typ skenu: Vlastní sken
Výsledek: Dokončeno
Prohledaných objektů: 598352
Uplynulý čas: 2 hod, 28 min, 26 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Zapnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 0
(Nenalezeny žádné škodlivé položky)

Hodnoty registru: 0
(Nenalezeny žádné škodlivé položky)

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 0
(Nenalezeny žádné škodlivé položky)

Soubory: 1
PUP.Optional.Delta.ShrtCln, C:\AdwCleaner\Quarantine\C\Users\Petr\AppData\Roaming\OpenCandy\FAFB734A3C4349ABA8C17E1D33DC2F85\DeltaTB.exe.vir, , [f44b0134dcbdcc6a0c9063359769fc04],

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

[Márty84]

A ani mazat nemusite, tohle uz je neskodne v karantene ADWCleaneru.


Dejte novy log z RSIT

a k tomu

Dejte logy podle tohoto navodu http://forum.viry.cz/viewtopic.php?f=13&t=133100 - vypnete na chvili antivir, je mozne, ze to bude blokovat jako skodnou, ale pouzivame to porad, jedna se o falesny poplach

[Sirius]

Pardon, zapomněl jsem jí vysvětlit, jak se s tím pracuje Teď to bude už v pořádku

RSIT:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Petr at 2016-01-08 23:17:03
Microsoft Windows 8.1
System drive C: has 1288 GB (68%) free of 1907 GB
Total RAM: 7648 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:17:05, on 8. 1. 2016
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.18123)
Boot mode: Normal

Running processes:
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\TeamViewer\TeamViewer.exe
C:\Program Files\trend micro\Petr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hal3000.cz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE -startup
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [BitTorrent] "C:\Users\Petr\AppData\Roaming\BitTorrent\BitTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [Samsung Appstore] "C:\Users\Petr\AppData\Roaming\Mozila\autoit.exe" "C:\Users\Petr\AppData\Roaming\Mozila\up.au3"
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\WINDOWS\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Avast Firewall (avast! Firewall) - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 11 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7395 bytes

======Listing Processes======





wininit.exe

C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k RPCSS
C:\WINDOWS\system32\atiesrxx.exe
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\AVAST Software\Avast\afwServ.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
C:\WINDOWS\System32\svchost.exe -k utcsvc
dashost.exe {476e9506-5bd6-4b24-9afa302e90493800}
"C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe"
C:\WINDOWS\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
C:\WINDOWS\system32\SearchIndexer.exe /Embedding
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-2a4cbd34-f895-43b9-8dcd-d5cb98998977 -SystemEventPortName:HostProcess-5b6ae261-0e9e-4939-8474-cad874132012 -IoCancelEventPortName:HostProcess-bc1e64f9-a465-4648-82ba-03d375c0c61e -NonStateChangingEventPortName:HostProcess-c3ca058a-3dd2-47ed-98c8-a3a9c650171b -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:99f02662-e9e6-4618-8d00-63ee1b6c2839 -DeviceGroupId:WpdFsGroup
C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet
C:\WINDOWS\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\NGenTask.exe" /RuntimeWide /StopEvent:852
\??\C:\WINDOWS\system32\conhost.exe 0x4

C:\WINDOWS\System32\WinLogon.exe -SpecialSession
-hiberboot
atieclxx
taskhostex.exe
C:\WINDOWS\Explorer.EXE
C:\Windows\System32\skydrive.exe -Embedding
"C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
"C:\WINDOWS\system32\GWX\GWX.exe"
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
"C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
C:\WINDOWS\system32\wbem\unsecapp.exe -Embedding
C:\WINDOWS\system32\wbem\wmiprvse.exe
"C:\Windows\System32\SettingSyncHost.exe" -Embedding
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe" 0

"C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
"C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer11_Logfile.log
"C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer11_Logfile.log
"c:\program files (x86)\teamviewer\TeamViewer_Desktop.exe" --IPCport 5939
"C:\WINDOWS\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe80_ Global\UsGthrCtrlFltPipeMssGthrPipe80 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-4e6462b6-698a-45b9-97dd-bf9314e8c407 -SystemEventPortName:HostProcess-60930058-1301-446e-99f7-2623f2971a06 -IoCancelEventPortName:HostProcess-8985599e-36f0-473a-9950-1ae18449a2b0 -NonStateChangingEventPortName:HostProcess-40c369b3-bbe4-4e6c-8644-f0547e775c39 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:a0103475-ff42-4a69-8fca-068c10d0f10d -DeviceGroupId:WudfDefaultDevicePool
"C:\WINDOWS\system32\SearchFilterHost.exe" 0 580 584 592 65536 588
"C:\Users\Petr\Desktop\RSITx64.exe"

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-01-03 885152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-01-03 664184]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2013-01-22 6964296]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-07-03 3673184]
"BitTorrent"=C:\Users\Petr\AppData\Roaming\BitTorrent\BitTorrent.exe [2015-05-23 1696104]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-02-19 7416088]
"Samsung Appstore"=C:\Users\Petr\AppData\Roaming\Mozila\autoit.exe [2015-12-20 934400]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"=C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2012-08-06 642216]
"PWRISOVM.EXE"=C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [2013-04-15 337432]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2016-01-03 7021880]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"SoftwareSASGeneration"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.yuy2"=msyuv.dll
"vidc.i420"=iyuv_32.dll
"msacm.msgsm610"=msgsm32.acm
"msacm.msg711"=msg711.acm
"vidc.yvyu"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"wavemapper"=msacm32.drv
"midimapper"=midimap.dll
"vidc.uyvy"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msadpcm"=msadp32.acm
"vidc.msvc"=msvidc32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2016-01-07 18:09:38 ----D---- C:\Program Files (x86)\1C
2016-01-03 15:15:02 ----D---- C:\Users\Petr\AppData\Roaming\Mozilla
2016-01-03 14:18:03 ----A---- C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
2016-01-03 14:15:59 ----D---- C:\Users\Petr\AppData\Roaming\TeamViewer
2016-01-03 14:15:44 ----A---- C:\WINDOWS\system32\drivers\aswKbd.sys
2016-01-03 14:15:43 ----D---- C:\Program Files (x86)\TeamViewer
2016-01-03 14:15:43 ----A---- C:\WINDOWS\system32\aswBoot.exe
2016-01-03 14:13:14 ----D---- C:\Users\Petr\AppData\Roaming\AVAST Software
2016-01-03 14:12:42 ----D---- C:\Program Files\Common Files\AV
2016-01-03 14:12:25 ----A---- C:\WINDOWS\system32\drivers\aswVmm.sys
2016-01-03 14:12:25 ----A---- C:\WINDOWS\system32\drivers\aswStm.sys
2016-01-03 14:12:25 ----A---- C:\WINDOWS\system32\drivers\aswSP.sys
2016-01-03 14:12:25 ----A---- C:\WINDOWS\system32\drivers\aswSnx.sys
2016-01-03 14:12:25 ----A---- C:\WINDOWS\system32\drivers\aswRvrt.sys
2016-01-03 14:12:25 ----A---- C:\WINDOWS\system32\drivers\aswRdr2.sys
2016-01-03 14:12:25 ----A---- C:\WINDOWS\system32\drivers\aswMonFlt.sys
2016-01-03 14:12:25 ----A---- C:\WINDOWS\system32\drivers\aswHwid.sys
2016-01-03 14:12:15 ----A---- C:\WINDOWS\avastSS.scr
2016-01-03 14:11:49 ----A---- C:\WINDOWS\system32\drivers\aswNdisFlt.sys
2016-01-03 14:11:24 ----D---- C:\Program Files\AVAST Software
2016-01-03 14:10:12 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-01-03 14:10:12 ----A---- C:\WINDOWS\system32\drivers\mwac.sys
2016-01-03 14:10:12 ----A---- C:\WINDOWS\system32\drivers\mbamchameleon.sys
2016-01-03 14:10:12 ----A---- C:\WINDOWS\system32\drivers\mbam.sys
2015-12-21 20:48:35 ----SD---- C:\WINDOWS\SYSWOW64\GWX
2015-12-21 20:48:35 ----SD---- C:\WINDOWS\system32\GWX
2015-12-21 17:26:59 ----D---- C:\rsit
2015-12-21 17:26:59 ----D---- C:\Program Files\trend micro
2015-12-21 14:48:45 ----D---- C:\KVRT_Data
2015-12-20 10:17:00 ----D---- C:\Users\Petr\AppData\Roaming\Mozila
2015-12-19 21:11:02 ----D---- C:\ProgramData\Malwarebytes
2015-12-19 21:02:04 ----D---- C:\AdwCleaner
2015-12-18 16:33:47 ----A---- C:\WINDOWS\system32\aspnet_counters.dll
2015-12-18 16:33:45 ----A---- C:\WINDOWS\SYSWOW64\aspnet_counters.dll
2015-12-09 17:22:02 ----A---- C:\WINDOWS\SYSWOW64\vbscript.dll
2015-12-09 17:22:02 ----A---- C:\WINDOWS\SYSWOW64\jscript9.dll
2015-12-09 17:22:02 ----A---- C:\WINDOWS\SYSWOW64\jscript.dll
2015-12-09 17:22:02 ----A---- C:\WINDOWS\system32\vbscript.dll
2015-12-09 17:22:01 ----A---- C:\WINDOWS\SYSWOW64\wininet.dll
2015-12-09 17:22:01 ----A---- C:\WINDOWS\SYSWOW64\inetcomm.dll
2015-12-09 17:22:01 ----A---- C:\WINDOWS\SYSWOW64\ieapfltr.dll
2015-12-09 17:22:01 ----A---- C:\WINDOWS\system32\jscript9.dll
2015-12-09 17:22:01 ----A---- C:\WINDOWS\system32\jscript.dll
2015-12-09 17:22:00 ----A---- C:\WINDOWS\system32\wininet.dll
2015-12-09 17:22:00 ----A---- C:\WINDOWS\system32\inetcomm.dll
2015-12-09 17:22:00 ----A---- C:\WINDOWS\system32\ieapfltr.dll
2015-12-09 17:21:59 ----A---- C:\WINDOWS\SYSWOW64\iertutil.dll
2015-12-09 17:21:59 ----A---- C:\WINDOWS\system32\mshtml.dll
2015-12-09 17:21:59 ----A---- C:\WINDOWS\system32\iertutil.dll
2015-12-09 17:21:58 ----A---- C:\WINDOWS\SYSWOW64\mshtml.dll
2015-12-09 17:21:57 ----A---- C:\WINDOWS\SYSWOW64\ieframe.dll
2015-12-09 17:21:57 ----A---- C:\WINDOWS\system32\msfeeds.dll
2015-12-09 17:21:56 ----A---- C:\WINDOWS\system32\ieframe.dll
2015-12-09 17:21:54 ----A---- C:\WINDOWS\SYSWOW64\urlmon.dll
2015-12-09 17:21:54 ----A---- C:\WINDOWS\system32\urlmon.dll
2015-12-09 17:21:53 ----A---- C:\WINDOWS\SYSWOW64\msfeeds.dll
2015-12-09 17:21:53 ----A---- C:\WINDOWS\SYSWOW64\ieui.dll
2015-12-09 17:21:53 ----A---- C:\WINDOWS\system32\ieui.dll
2015-12-09 17:21:53 ----A---- C:\WINDOWS\system32\ie4uinit.exe
2015-12-09 17:21:52 ----A---- C:\WINDOWS\SYSWOW64\actxprxy.dll
2015-12-09 17:21:51 ----A---- C:\WINDOWS\SYSWOW64\iedkcs32.dll
2015-12-09 17:21:51 ----A---- C:\WINDOWS\system32\mshtmled.dll
2015-12-09 17:21:51 ----A---- C:\WINDOWS\system32\iepeers.dll
2015-12-09 17:21:51 ----A---- C:\WINDOWS\system32\iedkcs32.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\SYSWOW64\webcheck.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\SYSWOW64\MshtmlDac.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\SYSWOW64\iepeers.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\SYSWOW64\dxtrans.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\system32\webcheck.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\system32\dxtrans.dll
2015-12-09 17:21:50 ----A---- C:\WINDOWS\system32\actxprxy.dll
2015-12-09 17:20:55 ----A---- C:\WINDOWS\system32\drivers\rmcast.sys
2015-12-09 17:19:55 ----A---- C:\WINDOWS\system32\Windows.Globalization.dll
2015-12-09 17:19:54 ----A---- C:\WINDOWS\SYSWOW64\Windows.Globalization.dll
2015-12-09 17:19:53 ----A---- C:\WINDOWS\SYSWOW64\kbdgeoqw.dll
2015-12-09 17:19:53 ----A---- C:\WINDOWS\SYSWOW64\KBDAZST.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\SYSWOW64\KBDAZEL.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\SYSWOW64\KBDAZE.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\SYSWOW64\GlobCollationHost.dll
2015-12-09 17:19:53 ----A---- C:\WINDOWS\system32\kbdgeoqw.dll
2015-12-09 17:19:53 ----A---- C:\WINDOWS\system32\KBDAZST.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\system32\KBDAZEL.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\system32\KBDAZE.DLL
2015-12-09 17:19:53 ----A---- C:\WINDOWS\system32\GlobCollationHost.dll
2015-12-09 17:17:29 ----A---- C:\WINDOWS\system32\dpapisrv.dll
2015-12-09 17:17:07 ----A---- C:\WINDOWS\system32\winresume.exe
2015-12-09 17:17:07 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2015-12-09 17:17:06 ----A---- C:\WINDOWS\SYSWOW64\ntdll.dll
2015-12-09 17:17:06 ----A---- C:\WINDOWS\SYSWOW64\comsvcs.dll
2015-12-09 17:17:06 ----A---- C:\WINDOWS\SYSWOW64\catsrvut.dll
2015-12-09 17:17:06 ----A---- C:\WINDOWS\system32\winload.exe
2015-12-09 17:17:06 ----A---- C:\WINDOWS\system32\ntdll.dll
2015-12-09 17:17:06 ----A---- C:\WINDOWS\system32\comsvcs.dll
2015-12-09 17:17:05 ----A---- C:\WINDOWS\SYSWOW64\ntvdm64.dll
2015-12-09 17:17:05 ----A---- C:\WINDOWS\system32\ntvdm64.dll
2015-12-09 17:17:05 ----A---- C:\WINDOWS\system32\catsrvut.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\SYSWOW64\user32.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\SYSWOW64\GdiPlus.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\SYSWOW64\DWrite.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\system32\win32k.sys
2015-12-09 17:16:43 ----A---- C:\WINDOWS\system32\user32.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\system32\FntCache.dll
2015-12-09 17:16:43 ----A---- C:\WINDOWS\system32\DWrite.dll
2015-12-09 17:16:42 ----A---- C:\WINDOWS\SYSWOW64\msctf.dll
2015-12-09 17:16:42 ----A---- C:\WINDOWS\system32\msctf.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\SYSWOW64\wuwebv.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\SYSWOW64\wuapi.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wuwebv.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\WUSettingsProvider.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wups2.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wucltux.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wuaueng.dll
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wuauclt.exe
2015-12-09 17:15:43 ----A---- C:\WINDOWS\system32\wuapi.dll
2015-12-09 17:15:42 ----A---- C:\WINDOWS\system32\wudriver.dll
2015-12-09 17:15:41 ----A---- C:\WINDOWS\SYSWOW64\wudriver.dll
2015-12-09 17:15:41 ----A---- C:\WINDOWS\SYSWOW64\wuapp.exe
2015-12-09 17:15:41 ----A---- C:\WINDOWS\system32\wuapp.exe
2015-12-09 17:15:35 ----A---- C:\WINDOWS\SYSWOW64\authui.dll
2015-12-09 17:15:35 ----A---- C:\WINDOWS\system32\authui.dll
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbuhci.sys
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbport.sys
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbohci.sys
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\USBHUB3.SYS
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbhub.sys
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbehci.sys
2015-12-09 17:15:05 ----AC---- C:\WINDOWS\system32\drivers\usbd.sys
2015-12-09 17:15:05 ----A---- C:\WINDOWS\SYSWOW64\PCPKsp.dll
2015-12-09 17:15:05 ----A---- C:\WINDOWS\system32\PCPKsp.dll
2015-12-09 17:15:00 ----A---- C:\WINDOWS\system32\winlogon.exe
2015-12-09 17:14:59 ----A---- C:\WINDOWS\system32\wininit.exe

======List of files/folders modified in the last 1 month======

2016-01-08 23:12:54 ----D---- C:\WINDOWS\Prefetch
2016-01-08 23:03:43 ----D---- C:\WINDOWS\Temp
2016-01-08 23:02:00 ----D---- C:\WINDOWS\system32\sru
2016-01-08 12:20:15 ----D---- C:\WINDOWS\Microsoft.NET
2016-01-07 19:12:02 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2016-01-07 18:09:38 ----RD---- C:\Program Files (x86)
2016-01-07 18:09:32 ----SHD---- C:\System Volume Information
2016-01-05 19:23:24 ----RD---- C:\WINDOWS\System32
2016-01-05 19:23:24 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2016-01-05 19:23:23 ----D---- C:\WINDOWS\Inf
2016-01-03 19:46:34 ----D---- C:\WINDOWS\AppReadiness
2016-01-03 19:28:09 ----D---- C:\WINDOWS\system32\drivers
2016-01-03 16:06:48 ----D---- C:\WINDOWS\SysWOW64
2016-01-03 14:16:24 ----D---- C:\WINDOWS\system32\Tasks
2016-01-03 14:16:13 ----D---- C:\WINDOWS\system32\DriverStore
2016-01-03 14:16:00 ----RSD---- C:\WINDOWS\Fonts
2016-01-03 14:15:43 ----D---- C:\ProgramData\AVAST Software
2016-01-03 14:15:42 ----D---- C:\Windows
2016-01-03 14:13:07 ----D---- C:\WINDOWS\system32\catroot
2016-01-03 14:12:42 ----D---- C:\Program Files\Common Files
2016-01-03 14:12:42 ----D---- C:\Program Files (x86)\Common Files
2016-01-03 14:11:24 ----RD---- C:\Program Files
2016-01-01 11:56:10 ----D---- C:\WINDOWS\system32\config
2015-12-30 15:52:42 ----D---- C:\WINDOWS\CbsTemp
2015-12-30 15:52:03 ----D---- C:\WINDOWS\WinSxS
2015-12-26 09:48:43 ----A---- C:\WINDOWS\SYSWOW64\FlashPlayerApp.exe
2015-12-23 21:22:20 ----HD---- C:\Program Files\WindowsApps
2015-12-22 00:59:59 ----D---- C:\WINDOWS\rescache
2015-12-21 20:49:54 ----D---- C:\WINDOWS\Logs
2015-12-21 20:48:11 ----D---- C:\WINDOWS\debug
2015-12-21 16:55:02 ----SHD---- C:\WINDOWS\Installer
2015-12-21 16:50:57 ----D---- C:\Program Files (x86)\Google
2015-12-21 16:50:42 ----D---- C:\WINDOWS\Tasks
2015-12-21 13:32:14 ----D---- C:\WINDOWS\system32\catroot2
2015-12-20 19:10:33 ----RD---- C:\WINDOWS\DesktopTileResources
2015-12-19 21:11:02 ----HD---- C:\ProgramData
2015-12-10 18:18:47 ----RSD---- C:\WINDOWS\assembly
2015-12-09 20:27:57 ----D---- C:\WINDOWS\SYSWOW64\cs-CZ
2015-12-09 20:27:57 ----D---- C:\WINDOWS\system32\cs-CZ
2015-12-09 20:27:56 ----D---- C:\Program Files\Internet Explorer
2015-12-09 20:27:56 ----D---- C:\Program Files (x86)\Internet Explorer
2015-12-09 17:50:12 ----D---- C:\WINDOWS\system32\MRT
2015-12-09 17:46:24 ----A---- C:\WINDOWS\system32\MRT.exe
2015-12-09 04:39:31 ----N---- C:\WINDOWS\system32\MpSigStub.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amd_sata;amd_sata; C:\WINDOWS\System32\drivers\amd_sata.sys [2012-11-30 80552]
R0 amd_xata;amd_xata; C:\WINDOWS\System32\drivers\amd_xata.sys [2012-11-30 26280]
R0 aswNdisFlt;@oem1.inf,%AfwDescriptionFree%;Avast! Firewall Driver; C:\WINDOWS\system32\DRIVERS\aswNdisFlt.sys [2016-01-03 466400]
R0 aswRvrt;avast! Revert; C:\WINDOWS\system32\drivers\aswRvrt.sys [2016-01-03 65224]
R0 aswVmm;avast! VM Monitor; C:\WINDOWS\system32\drivers\aswVmm.sys [2016-01-03 273784]
R0 Tpkd;Tpkd; C:\WINDOWS\system32\drivers\Tpkd.sys [2009-12-23 105592]
R0 Wof;Windows Overlay File System Filter Driver; C:\WINDOWS\system32\drivers\Wof.sys [2014-06-01 157016]
R1 aswKbd;aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [2016-01-03 28144]
R1 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [2016-01-03 93528]
R1 aswSnx;aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [2016-01-03 1055560]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2016-01-03 451040]
R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2013-04-15 127384]
R2 acedrv11;acedrv11; \??\C:\Windows\system32\drivers\acedrv11.sys [2010-02-24 191616]
R2 AODDriver4.1;AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]
R2 aswHwid;avast! HardwareID; C:\WINDOWS\system32\drivers\aswHwid.sys [2016-01-03 28656]
R2 aswMonFlt;aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [2016-01-03 97648]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\SysWOW64\drivers\Afc.sys [2006-11-14 22784]
R3 amdkmdag;amdkmdag; C:\WINDOWS\system32\DRIVERS\atikmdag.sys [2014-05-28 13209088]
R3 amdkmdap;amdkmdap; C:\WINDOWS\system32\DRIVERS\atikmpag.sys [2014-05-28 626688]
R3 AmUStor;@oem27.inf,%AmUStor.SvcDesc%;AM USB Stroage Driver; C:\WINDOWS\system32\drivers\AmUStor.SYS [2012-10-25 95744]
R3 AtiHDAudioService;@oem4.inf,%ATIHdAudioDriver.SvcDesc%;AMD Function Driver for HD Audio Service; C:\WINDOWS\system32\drivers\AtihdW86.sys [2013-02-14 94208]
R3 dtsoftbus01;@oem8.inf,%DTSoftBus.SVCDESC%;DAEMON Tools Virtual Bus Driver; C:\WINDOWS\System32\drivers\dtsoftbus01.sys [2013-07-10 283064]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RTKVHD64.sys [2013-01-22 3305928]
R3 RTL8168;@netrt630x64.inf,%rtl8168.Service.DispName%;Realtek 8168 NT Driver; C:\WINDOWS\system32\DRIVERS\Rt630x64.sys [2013-06-18 591360]
R3 usbfilter;AMD USB Filter Driver; C:\WINDOWS\system32\DRIVERS\usbfilter.sys [2012-06-18 57000]
S0 amdkmafd;@oem29.inf,%AMDKMAFD_svcdesc%;AMD Audio Bus Lower Filter; C:\WINDOWS\System32\drivers\amdkmafd.sys [2013-03-14 21600]
S2 aswStm;aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [2016-01-03 155304]
S2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2015-06-02 303616]
S2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2015-06-02 35328]
S3 EagleX64;EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys []
S3 usbaudio;@wdma_usb.inf,%USBAudio.SvcDesc%;Ovladač zvuků USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2014-03-18 121088]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\WINDOWS\system32\atiesrxx.exe [2014-05-28 239616]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-08-06 361984]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2016-01-03 226440]
R2 avast! Firewall;Avast Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [2016-01-03 109520]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\WINDOWS\System32\svchost.exe [2014-10-29 38792]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-07-29 935208]
R2 TeamViewer;TeamViewer 11; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2015-12-14 6889232]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21 144200]
S3 BthHFSrv;@%SystemRoot%\System32\BthHFSrv.dll,-103; C:\WINDOWS\System32\svchost.exe [2014-10-29 38792]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2013-08-03 43696]
S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2013-02-17 137336]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21 144200]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-02-18 315488]
S4 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2013-07-26 563624]

-----------------EOF-----------------

[Sirius]

FRST:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-01-2015
Ran by Petr (administrator) on JANDOVI (08-01-2016 23:19:31)
Running from C:\Users\Petr\Desktop
Loaded Profiles: Petr (Available Profiles: Petr)
Platform: Windows 8.1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe
(forum.viry.cz) C:\Users\Petr\Desktop\FRSTLauncher.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6964296 2013-01-22] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [337432 2013-04-15] (Power Software Ltd)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7021880 2016-01-03] (AVAST Software)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673184 2013-07-03] (Disc Soft Ltd)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [BitTorrent] => C:\Users\Petr\AppData\Roaming\BitTorrent\BitTorrent.exe [1696104 2015-05-23] (BitTorrent Inc.)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [Samsung Appstore] => C:\Users\Petr\AppData\Roaming\Mozila\autoit.exe [934400 2015-12-20] (AutoIt Team)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-01-03] (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Petr\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Petr\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Petr\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Petr\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Petr\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Petr\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll [2013-09-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Petr\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll [2013-09-11] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 94.74.192.252 94.74.192.244
Tcpip\..\Interfaces\{D7F42D9B-6E22-4C56-BCBA-ACCB4A8ABD00}: [DhcpNameServer] 94.74.192.252 94.74.192.244

Internet Explorer:
==================
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.hal3000.cz
SearchScopes: HKU\S-1-5-21-122543139-3393781554-3739171832-1002 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-21-122543139-3393781554-3739171832-1002 -> {484C2BAE-FEA8-471F-BEC7-824412B54602} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-01-03] (AVAST Software)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11] (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-01-03] (AVAST Software)
Toolbar: HKU\S-1-5-21-122543139-3393781554-3739171832-1002 -> No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File

FireFox:
========
FF ProfilePath: C:\Users\Petr\AppData\Roaming\Mozilla\Firefox\Profiles\9lcg5dcb.default
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-21] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-21] (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-01-03]
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-01-03]

Chrome:
=======
CHR Profile: C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentace Google) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-12-21]
CHR Extension: (Dokumenty Google) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-12-21]
CHR Extension: (Disk Google) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-21]
CHR Extension: (YouTube) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-21]
CHR Extension: (Vyhledávání Google) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-21]
CHR Extension: (Tabulky Google) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-12-21]
CHR Extension: (Dokumenty Google offline) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-21]
CHR Extension: (AdBlock) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-01-03]
CHR Extension: (Avast Online Security) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-01-03]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-12-21]
CHR Extension: (Gmail) - C:\Users\Petr\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-21]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-01-03]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-08-06] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [226440 2016-01-03] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [109520 2016-01-03] (AVAST Software)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [6889232 2015-12-14] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21600 2013-03-14] (Advanced Micro Devices, Inc.)
R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2016-01-03] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28144 2016-01-03] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [97648 2016-01-03] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [466400 2016-01-03] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2016-01-03] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2016-01-03] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1055560 2016-01-03] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [451040 2016-01-03] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [155304 2016-01-03] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [273784 2016-01-03] (AVAST Software)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-14] (Advanced Micro Devices)
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2015-06-02] () [File not signed]
R3 dtsoftbus01; C:\Windows\System32\drivers\dtsoftbus01.sys [283064 2013-07-10] (Disc Soft Ltd)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2015-06-02] () [File not signed]
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-08 23:19 - 2016-01-08 23:19 - 00013662 _____ C:\Users\Petr\Desktop\FRST.txt
2016-01-08 23:19 - 2016-01-08 23:19 - 00000000 ____D C:\FRST
2016-01-08 23:15 - 2016-01-08 23:15 - 00112640 _____ (forum.viry.cz) C:\Users\Petr\Desktop\FRSTLauncher.exe
2016-01-08 23:13 - 2016-01-08 23:14 - 02370560 _____ (Farbar) C:\Users\Petr\Desktop\FRST64.exe
2016-01-07 18:09 - 2016-01-07 18:09 - 00000000 ____D C:\Program Files (x86)\1C
2016-01-05 19:20 - 2016-01-05 19:21 - 00000000 ____D C:\Users\Petr\Desktop\Nová složka (6)
2016-01-03 16:51 - 2016-01-03 16:51 - 00001289 _____ C:\Users\Petr\Desktop\MBAM.txt
2016-01-03 15:15 - 2016-01-03 15:15 - 00000000 ____D C:\Users\Petr\AppData\Roaming\Mozilla
2016-01-03 15:15 - 2016-01-03 15:15 - 00000000 ____D C:\Users\Petr\AppData\Local\Mozilla
2016-01-03 15:13 - 2016-01-03 15:13 - 00248752 _____ C:\Users\Petr\Downloads\Firefox Setup Stub 43.0.3.exe
2016-01-03 14:18 - 2016-01-03 14:22 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-01-03 14:16 - 2016-01-03 14:16 - 00003030 _____ C:\WINDOWS\System32\Tasks\SafeZone scheduled Autoupdate 1451826982
2016-01-03 14:16 - 2016-01-03 14:16 - 00001060 _____ C:\Users\Public\Desktop\Avast SafeZone Browser.lnk
2016-01-03 14:16 - 2016-01-03 14:16 - 00001060 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2016-01-03 14:15 - 2016-01-03 14:16 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-01-03 14:15 - 2016-01-03 14:15 - 00028144 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys
2016-01-03 14:15 - 2016-01-03 14:15 - 00001062 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-01-03 14:15 - 2016-01-03 14:15 - 00001050 _____ C:\Users\Public\Desktop\TeamViewer 11.lnk
2016-01-03 14:15 - 2016-01-03 14:15 - 00000000 ____D C:\Users\Petr\AppData\Roaming\TeamViewer
2016-01-03 14:15 - 2016-01-03 14:12 - 00386096 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2016-01-03 14:13 - 2016-01-03 14:13 - 00001945 _____ C:\Users\Public\Desktop\Avast Premier.lnk
2016-01-03 14:13 - 2016-01-03 14:13 - 00000000 ____D C:\Users\Petr\AppData\Roaming\AVAST Software
2016-01-03 14:13 - 2016-01-03 14:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2016-01-03 14:12 - 2016-01-03 14:15 - 00003924 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2016-01-03 14:12 - 2016-01-03 14:12 - 00451040 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2016-01-03 14:12 - 2016-01-03 14:12 - 00273784 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2016-01-03 14:12 - 2016-01-03 14:12 - 00155304 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2016-01-03 14:12 - 2016-01-03 14:12 - 00097648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2016-01-03 14:12 - 2016-01-03 14:12 - 00093528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2016-01-03 14:12 - 2016-01-03 14:12 - 00065224 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2016-01-03 14:12 - 2016-01-03 14:12 - 00043112 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2016-01-03 14:12 - 2016-01-03 14:12 - 00028656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2016-01-03 14:12 - 2016-01-03 14:12 - 00000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2016-01-03 14:12 - 2016-01-03 14:12 - 00000000 ____D C:\Program Files\Common Files\AV
2016-01-03 14:12 - 2016-01-03 14:11 - 01055560 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2016-01-03 14:11 - 2016-01-03 14:15 - 00000000 ____D C:\Program Files\AVAST Software
2016-01-03 14:11 - 2016-01-03 14:11 - 05037264 _____ (AVAST Software) C:\Users\Petr\Downloads\avast_premier_antivirus_setup_online.exe
2016-01-03 14:11 - 2016-01-03 14:11 - 00466400 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNdisFlt.sys
2016-01-03 14:10 - 2016-01-03 14:10 - 00001121 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-01-03 14:10 - 2016-01-03 14:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-01-03 14:10 - 2016-01-03 14:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-01-03 14:10 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-01-03 14:10 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-01-03 14:10 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-01-03 14:09 - 2016-01-03 14:09 - 22908888 _____ (Malwarebytes ) C:\Users\Petr\Downloads\mbam-setup-2.2.0.1024.exe
2016-01-03 12:44 - 2016-01-03 13:27 - 735043584 _____ C:\Users\Petr\Downloads\Beetlejuice-cz.avi
2016-01-03 11:45 - 2016-01-03 11:45 - 00000000 ____D C:\Users\Petr\Desktop\Nová složka (4)
2016-01-01 16:50 - 2016-01-01 16:51 - 00000000 ____D C:\Users\Petr\Desktop\Nová složka (2)
2016-01-01 12:28 - 2016-01-01 13:17 - 861400452 _____ C:\Users\Petr\Downloads\Hvezdny-prach-cz.avi
2015-12-31 12:56 - 2015-12-31 12:56 - 00000000 ____D C:\Users\Petr\Desktop\nevím
2015-12-30 15:55 - 2015-12-30 15:56 - 00000000 ____D C:\Users\Petr\Desktop\konec
2015-12-27 18:52 - 2015-12-27 18:53 - 00000000 ____D C:\Users\Petr\Desktop\Nová složka
2015-12-24 11:17 - 2015-12-24 11:18 - 00000000 ____D C:\Users\Petr\Desktop\objev
2015-12-24 11:16 - 2015-12-24 11:17 - 00000000 ____D C:\Users\Petr\Desktop\puštička
2015-12-23 22:22 - 2015-12-23 23:00 - 688367530 _____ C:\Users\Petr\Downloads\Dařbuján-a-Pandrhola---CZ-(A).avi
2015-12-21 20:48 - 2015-12-21 20:49 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-12-21 20:48 - 2015-12-21 20:48 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-12-21 17:26 - 2016-01-08 23:17 - 00000000 ____D C:\Program Files\trend micro
2015-12-21 17:26 - 2015-12-21 17:27 - 00000000 ____D C:\rsit
2015-12-21 17:26 - 2015-12-21 17:26 - 01222144 _____ C:\Users\Petr\Desktop\RSITx64.exe
2015-12-21 16:51 - 2015-12-21 16:51 - 00002282 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-21 16:51 - 2015-12-21 16:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-21 16:50 - 2015-12-21 20:05 - 00000000 ____D C:\Users\Petr\AppData\Local\Google
2015-12-21 16:50 - 2015-12-21 16:50 - 00000000 ____D C:\Users\Petr\AppData\Local\Deployment
2015-12-21 14:48 - 2015-12-21 16:47 - 00000000 ____D C:\KVRT_Data
2015-12-20 10:17 - 2015-12-21 16:48 - 00000000 ____D C:\Users\Petr\AppData\Roaming\Mozila
2015-12-19 22:29 - 2015-12-19 23:12 - 782530560 _____ C:\Users\Petr\Downloads\Beowulf-Král-Barbarů=2005-Dobrodružný-G.Butler-DVDrip-CZ.avi
2015-12-19 21:11 - 2015-12-19 21:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-12-19 21:02 - 2015-12-20 19:46 - 00000000 ____D C:\AdwCleaner
2015-12-18 16:33 - 2014-04-16 00:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll
2015-12-18 16:33 - 2014-04-16 00:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll
2015-12-17 23:43 - 2015-12-18 00:21 - 687936944 _____ C:\Users\Petr\Downloads\Asterix-a-Obelix-sidliste-bohu-2015-cz.avi
2015-12-17 22:09 - 2015-12-17 23:03 - 979236396 _____ C:\Users\Petr\Downloads\Dračí-srdce-3-Čarodějova-kletba-2015-cz-dabing.avi
2015-12-16 22:58 - 2015-12-17 00:52 - 1091749888 _____ C:\Users\Petr\Downloads\HOBIT-BITVA-PĚTI-ARMÁD-2014-CZ-dabing.avi
2015-12-16 01:11 - 2015-12-16 01:11 - 00001753 _____ C:\Users\Petr\Downloads\Konverzace.txt
2015-12-09 17:22 - 2015-11-10 01:13 - 00496640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-12-09 17:22 - 2015-11-10 01:02 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-12-09 17:22 - 2015-11-10 00:46 - 04514816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-12-09 17:22 - 2015-11-10 00:41 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-12-09 17:22 - 2015-11-10 00:17 - 02011136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-12-09 17:22 - 2015-11-10 00:12 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-12-09 17:22 - 2015-11-08 23:15 - 00571392 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-12-09 17:22 - 2015-11-08 23:04 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-12-09 17:22 - 2015-11-08 23:01 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-12-09 17:22 - 2015-11-08 22:25 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-12-09 17:22 - 2015-11-08 21:53 - 02487808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-12-09 17:22 - 2015-11-08 21:30 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-12-09 17:21 - 2015-11-11 17:21 - 25837568 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-12-09 17:21 - 2015-11-11 17:00 - 12856832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-12-09 17:21 - 2015-11-11 16:44 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-12-09 17:21 - 2015-11-11 16:44 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-12-09 17:21 - 2015-11-11 16:41 - 20366848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-12-09 17:21 - 2015-11-11 16:12 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-12-09 17:21 - 2015-11-10 01:11 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-12-09 17:21 - 2015-11-10 01:08 - 02280448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-12-09 17:21 - 2015-11-10 01:04 - 00476160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2015-12-09 17:21 - 2015-11-10 00:37 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-12-09 17:21 - 2015-11-10 00:36 - 02050560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-12-09 17:21 - 2015-11-10 00:36 - 00687104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-12-09 17:21 - 2015-11-10 00:36 - 00325632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-12-09 17:21 - 2015-11-10 00:25 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-12-09 17:21 - 2015-11-10 00:14 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-12-09 17:21 - 2015-11-08 23:15 - 02887168 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-12-09 17:21 - 2015-11-08 23:02 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-12-09 17:21 - 2015-11-08 22:32 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-12-09 17:21 - 2015-11-08 22:32 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-12-09 17:21 - 2015-11-08 22:18 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-12-09 17:21 - 2015-11-08 22:16 - 00372224 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-12-09 17:21 - 2015-11-08 22:15 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-12-09 17:21 - 2015-11-08 22:15 - 00718336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-12-09 17:21 - 2015-11-08 22:14 - 14456832 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-12-09 17:21 - 2015-11-08 22:13 - 02123264 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-12-09 17:21 - 2015-11-08 21:53 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-12-09 17:21 - 2015-11-08 21:41 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-12-09 17:20 - 2015-11-05 09:59 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rmcast.sys
2015-12-09 17:19 - 2015-10-22 18:43 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\kbdgeoqw.dll
2015-12-09 17:19 - 2015-10-22 18:43 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDAZST.DLL
2015-12-09 17:19 - 2015-10-22 18:43 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDAZEL.DLL
2015-12-09 17:19 - 2015-10-22 18:43 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDAZE.DLL
2015-12-09 17:19 - 2015-10-22 17:59 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kbdgeoqw.dll
2015-12-09 17:19 - 2015-10-22 17:59 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDAZST.DLL
2015-12-09 17:19 - 2015-10-22 17:59 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDAZEL.DLL
2015-12-09 17:19 - 2015-10-22 17:59 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDAZE.DLL
2015-12-09 17:19 - 2015-10-22 17:21 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2015-12-09 17:19 - 2015-10-22 17:21 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2015-12-09 17:19 - 2015-10-22 16:58 - 00868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2015-12-09 17:19 - 2015-10-22 16:58 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2015-12-09 17:19 - 2015-10-22 15:08 - 00513456 _____ C:\WINDOWS\SysWOW64\locale.nls
2015-12-09 17:19 - 2015-10-22 15:08 - 00513456 _____ C:\WINDOWS\system32\locale.nls
2015-12-09 17:17 - 2015-11-22 07:59 - 07455064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-12-09 17:17 - 2015-11-22 07:59 - 01735000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-12-09 17:17 - 2015-11-22 07:59 - 01659568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-12-09 17:17 - 2015-11-22 07:59 - 01519592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-12-09 17:17 - 2015-11-22 07:59 - 01487008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-12-09 17:17 - 2015-11-22 07:59 - 01355848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-12-09 17:17 - 2015-11-22 07:58 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-12-09 17:17 - 2015-11-21 19:32 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntvdm64.dll
2015-12-09 17:17 - 2015-11-21 18:50 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntvdm64.dll
2015-12-09 17:17 - 2015-11-21 17:59 - 01706496 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2015-12-09 17:17 - 2015-11-21 17:49 - 01344000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2015-12-09 17:17 - 2015-11-21 17:47 - 00522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\catsrvut.dll
2015-12-09 17:17 - 2015-11-21 17:40 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\catsrvut.dll
2015-12-09 17:17 - 2015-10-10 18:20 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2015-12-09 17:16 - 2015-11-09 01:41 - 01540728 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2015-12-09 17:16 - 2015-11-08 23:30 - 04176384 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-12-09 17:16 - 2015-11-08 22:23 - 01994752 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-12-09 17:16 - 2015-11-08 22:13 - 01383936 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-12-09 17:16 - 2015-11-08 22:01 - 01753600 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2015-12-09 17:16 - 2015-11-08 21:52 - 01559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-12-09 17:16 - 2015-11-08 21:48 - 01376256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2015-12-09 17:16 - 2015-11-08 21:42 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2015-12-09 17:16 - 2015-10-03 20:41 - 01385280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2015-12-09 17:16 - 2015-10-03 20:41 - 01124384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2015-12-09 17:15 - 2015-11-20 23:47 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-12-09 17:15 - 2015-11-20 19:18 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-12-09 17:15 - 2015-11-20 17:58 - 03706880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-12-09 17:15 - 2015-11-20 17:47 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-12-09 17:15 - 2015-11-20 17:46 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-12-09 17:15 - 2015-11-20 17:44 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-12-09 17:15 - 2015-11-20 17:44 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-12-09 17:15 - 2015-11-20 17:43 - 00897024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-12-09 17:15 - 2015-11-20 17:42 - 02243584 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-12-09 17:15 - 2015-11-20 17:30 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-12-09 17:15 - 2015-11-20 17:29 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-12-09 17:15 - 2015-11-20 17:28 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-12-09 17:15 - 2015-11-20 17:27 - 00726528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-12-09 17:15 - 2015-10-28 16:49 - 02775552 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-12-09 17:15 - 2015-10-28 16:29 - 02462720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-12-09 17:15 - 2015-10-11 07:34 - 00468824 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-12-09 17:15 - 2015-10-11 07:34 - 00462168 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2015-12-09 17:15 - 2015-10-11 07:34 - 00443224 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbport.sys
2015-12-09 17:15 - 2015-10-11 07:34 - 00092504 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbehci.sys
2015-12-09 17:15 - 2015-10-11 07:34 - 00027992 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbd.sys
2015-12-09 17:15 - 2015-10-10 19:41 - 00037376 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbuhci.sys
2015-12-09 17:15 - 2015-10-10 19:41 - 00030208 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbohci.sys
2015-12-09 17:15 - 2015-10-08 17:11 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2015-12-09 17:15 - 2015-10-08 16:50 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2015-12-09 17:15 - 2015-10-05 19:25 - 00572928 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-12-09 17:14 - 2015-10-05 19:28 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininit.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-08 23:19 - 2013-08-22 14:36 - 00000000 ____D C:\Windows
2016-01-08 23:16 - 2014-06-02 20:47 - 01345536 ___SH C:\Users\Petr\Downloads\Thumbs.db
2016-01-08 23:02 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-01-08 22:55 - 2013-06-14 23:28 - 00000964 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-08 22:51 - 2014-06-01 10:56 - 00000000 __RDO C:\Users\Petr\OneDrive
2016-01-08 22:51 - 2013-06-14 23:28 - 00000960 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-08 18:30 - 2014-09-22 08:09 - 00003962 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{9AD39CFA-89C2-4E69-9695-79508AC3CB7D}
2016-01-07 22:36 - 2013-05-21 17:20 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-122543139-3393781554-3739171832-1002
2016-01-07 19:12 - 2013-05-15 18:38 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-01-05 19:23 - 2014-03-18 16:33 - 01745984 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-01-05 19:23 - 2014-03-18 15:54 - 00738682 _____ C:\WINDOWS\system32\perfh005.dat
2016-01-05 19:23 - 2014-03-18 15:54 - 00151404 _____ C:\WINDOWS\system32\perfc005.dat
2016-01-05 19:23 - 2013-08-22 14:36 - 00000000 ____D C:\WINDOWS\Inf
2016-01-03 19:34 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-01-03 19:33 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-01-03 19:28 - 2013-08-22 15:44 - 00486544 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-01-03 14:15 - 2013-06-21 06:02 - 00000000 ____D C:\ProgramData\AVAST Software
2016-01-03 11:46 - 2014-09-22 08:11 - 00000003 _____ C:\Users\Petr\stut
2015-12-30 15:52 - 2012-07-26 08:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-12-30 03:55 - 2014-01-05 20:05 - 00000000 ___RD C:\Users\Petr\Desktop\MÁMI BORDEL
2015-12-26 09:48 - 2013-08-22 16:38 - 00826872 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-12-26 09:48 - 2013-08-22 16:38 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-23 21:22 - 2013-08-22 16:36 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-22 00:59 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache
2015-12-21 17:04 - 2014-06-01 15:11 - 01073664 ___SH C:\Users\Petr\Desktop\Thumbs.db
2015-12-21 17:00 - 2014-09-20 21:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\company of heroes 2 cestina
2015-12-21 17:00 - 2014-09-20 21:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Company of Heroes 2 - etina
2015-12-21 17:00 - 2013-05-25 10:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Virtual DJ
2015-12-21 16:50 - 2013-06-14 23:28 - 00003936 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-21 16:50 - 2013-06-14 23:28 - 00003700 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-21 16:50 - 2013-05-22 21:35 - 00000000 ____D C:\Program Files (x86)\Google
2015-12-20 19:10 - 2013-08-22 16:36 - 00000000 ___RD C:\WINDOWS\DesktopTileResources
2015-12-19 21:52 - 2014-09-22 08:09 - 00000829 _____ C:\Users\Petr\rgut
2015-12-19 21:35 - 2015-09-13 19:52 - 00000000 ____D C:\Users\Petr\Desktop\Máma foto
2015-12-19 20:15 - 2014-07-28 21:03 - 00000000 ____D C:\Users\Petr\Desktop\Taneční Liga 159 (2014)
2015-12-09 17:50 - 2013-08-14 14:23 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-12-09 17:46 - 2013-04-15 15:28 - 140158008 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-12-09 04:39 - 2013-04-15 15:31 - 00301728 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe

==================== Files in the root of some directories =======

2013-06-12 23:37 - 2015-01-29 22:34 - 0000168 _____ () C:\Users\Petr\AppData\Roaming\default.rss
2013-07-27 10:07 - 2015-11-01 10:31 - 0012800 _____ () C:\Users\Petr\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-18 11:41 - 2015-05-17 11:03 - 0007597 _____ () C:\Users\Petr\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Disabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Petr\Desktop" je 50783 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000000
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================

[Márty84]

***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Petr\Desktop" je 50783 MB.

Velikost plochy by nemela presahovat 200 - 300 MB! Brzdi to chod pc. Cili ji trosku uklidte a na plochu dejte jen zastupce. Jen pozor na obcasnou chybu, ze uzivatele maji na plose slozku, v ni dalsi a v ni dalsi a do te to schovaji. To je sice hezke, ale plochu to nezmensi, jen je to v jinem supliku




Otevrete si poznamkovy blok a zkopirujte do nej tento skript

Kód: Vybrat vše

Start
CloseProcesses:
CreateRestorePoint:

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673184 2013-07-03] (Disc Soft Ltd)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [BitTorrent] => C:\Users\Petr\AppData\Roaming\BitTorrent\BitTorrent.exe [1696104 2015-05-23] (BitTorrent Inc.)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [Samsung Appstore] => C:\Users\Petr\AppData\Roaming\Mozila\autoit.exe [934400 2015-12-20] (AutoIt Team)

HKU\S-1-5-21-122543139-3393781554-3739171832-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.hal3000.cz
SearchScopes: HKU\S-1-5-21-122543139-3393781554-3739171832-1002 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-21-122543139-3393781554-3739171832-1002 -> {484C2BAE-FEA8-471F-BEC7-824412B54602} URL = hxxp://www.google.com/search?q={searchTerms}
Toolbar: HKU\S-1-5-21-122543139-3393781554-3739171832-1002 -> No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File

S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-07-29 935208]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21 144200]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21 144200]
S4 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-02-18 315488]

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Hosts:
EmptyTemp:
Reboot:
End

Vlevo nahore kliknete na napis Soubor
Kliknete na napis Ulozit jako...
Napiste spravne ten cerveny nazev fixlist a ulozte na plochu.
Vypnete antivir i dalsi pripadne zabezpeceni.
Spustte FRST jako spravce, kliknete na napis Fix a program vykona prikazy.
Po restartu pc by se mel objevit novy log - s nazvem fixlog, ten mi sem zase zkopirujte.

[Sirius]

Fixlog
Plochu jsem pročistil jak se dalo. Všude byly složky, jedna z nich měla i 15 GB.

Fix result of Farbar Recovery Scan Tool (x64) Version:07-01-2015
Ran by Petr (2016-01-13 15:10:12) Run:1
Running from C:\Users\Petr\Desktop
Loaded Profiles: Petr (Available Profiles: Petr)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673184 2013-07-03] (Disc Soft Ltd)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [BitTorrent] => C:\Users\Petr\AppData\Roaming\BitTorrent\BitTorrent.exe [1696104 2015-05-23] (BitTorrent Inc.)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd)
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\...\Run: [Samsung Appstore] => C:\Users\Petr\AppData\Roaming\Mozila\autoit.exe [934400 2015-12-20] (AutoIt Team)

HKU\S-1-5-21-122543139-3393781554-3739171832-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hal3000.cz
SearchScopes: HKU\S-1-5-21-122543139-3393781554-3739171832-1002 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-21-122543139-3393781554-3739171832-1002 -> {484C2BAE-FEA8-471F-BEC7-824412B54602} URL = hxxp://www.google.com/search?q={searchTerms}
Toolbar: HKU\S-1-5-21-122543139-3393781554-3739171832-1002 -> No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File

S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
R2 Nero BackItUp Scheduler 4.0;Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [2009-07-29 935208]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21 144200]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21 144200]
S4 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-02-18 315488]

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Hosts:
EmptyTemp:
Reboot:
End
*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\GrooveMonitor => value removed successfully
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher => value removed successfully
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite => value removed successfully
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\Software\Microsoft\Windows\CurrentVersion\Run\\BitTorrent => value removed successfully
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\Software\Microsoft\Windows\CurrentVersion\Run\\CCleaner Monitoring => value removed successfully
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\Software\Microsoft\Windows\CurrentVersion\Run\\Samsung Appstore => value removed successfully
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
"HKU\S-1-5-21-122543139-3393781554-3739171832-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4b71-B0A3-3D82E62A6909}" => key removed successfully
HKCR\CLSID\{483830EE-A4CD-4b71-B0A3-3D82E62A6909} => key not found.
"HKU\S-1-5-21-122543139-3393781554-3739171832-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{484C2BAE-FEA8-471F-BEC7-824412B54602}" => key removed successfully
HKCR\CLSID\{484C2BAE-FEA8-471F-BEC7-824412B54602} => key not found.
HKU\S-1-5-21-122543139-3393781554-3739171832-1002\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A13C2648-91D4-4BF3-BC6D-0079707C4389} => value removed successfully
HKCR\CLSID\{A13C2648-91D4-4BF3-BC6D-0079707C4389} => key not found.
EagleX64 => service removed successfully
Nero BackItUp Scheduler 4.0 => Unable to stop service.
Nero BackItUp Scheduler 4.0 => service removed successfully
gupdate => service removed successfully
gupdatem => service removed successfully
SkypeUpdate => service removed successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 965.4 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 15:11:40 ====

[Márty84]

A kolik ma plocha ted?



Vsechny tyto programy - vcetne pripadne instalace - spoustejte jako spravce (kliknete na ne pravym mysidlem a zvolte - Spustit jako spravce)

DelFix https://toolslib.net/downloads/finish/2/

• Stahnete a spustte
• Ponechte zatrzitkou pouze u volby Remove disinfection tools
• Kliknete na Run

Stahnete Ccleaner http://www.filehippo.com/download_ccleaner a spustte.
Pri instalaci pozor na toolbar (ci jine doplnky), jestli vam nabidne jeho instalaci, tak zruste zatrzitko.
Po spusteni se ocitnete ve funkci Cistic. Vlevo je spousta zatrzitek. Pozor dejte hlavne na kos, pokud nechate zatrzene, vzdy ho vysype.
Dale, podle toho jak je nastaven, smaze vsechna hesla ulozena na netu!!! Takze jestli mate nastavene, at si pocitac hesla pamatuje (coz neni pro bezpecnost dobre), budete je muset pak napsat znova rucne (napr mail, facebook, ruzna fora atd.)
Kliknete na Analyzovat a az dokonci analyzu, kliknete na Spustit Cleaner.
Potom kliknete vlevo na funkci Registry
Kliknete na Hledej problemy, kdyz najde, kliknete na Opravit problemy. Nabidne Vam zalohu, tu udelejte a ulozte ji tak, at ji v pripade potreby najdete.
Funkce Nastroje umoznuje odinstalovani programu. Je dukladnejsi nez samotny windows!
(Pokud je v pc vice uzivatelskych uctu, pouzijte program i v nich)

Defragmentujte disk(y) (SSD Disky ne!)
Stahnete program Defraggler https://www.piriform.com/defraggler/download/standard
Pri instalaci opet pozor na toolbar a dalsi nesmysly.
Po nainstalovani program spustte a kliknete na Analyzovat, po analyze kliknete na Defragmentovat a programek odvede svou praci.




Pak napiste, jak to s pc vypada.




20.2. pro neaktivitu http://forum.viry.cz/viewtopic.php?f=12&t=123975