Prosim o kontrolu logu...vse online se pomalu nacita

Zpráva

#16 Příspěvek od **altrok** » 14 kvě 2016 08:03

Nalezy neodstranujte. Je tam jeden zavazny false positive.

Ulozte na plochu aswMBR - http://files.avast.com/files/rootkit-scanner/aswmbr.exe

spustte jako spravce (v pripade XP obycejne dvojklikem)
souhlaste s aktualizaci virove databaze Yes - bude se stahovat cca 215 MB a nasledne se chvili bude instalovat
vse ponechte, jak je a kliknete na Scan - vezme cca 30 min
kliknete na Save log a ulozte vysledek skenu - obsah tohoto logu vlozte do sve pristi odpovedi

kallimka · #17 Příspěvek od **kallimka** » 14 kvě 2016 10:48

aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2016-05-14 10:58:42
-----------------------------
10:58:42.119 OS Version: Windows 6.2.9200
10:58:42.119 Number of processors: 2 586 0x170A
10:58:42.119 ComputerName: KAMILKA-PC UserName: Kamilka
10:59:30.394 Initialize success
10:59:30.596 VM: initialized successfully
10:59:30.596 VM: Intel CPU virtualization not supported
10:59:30.877 write error "aswEngin.dll". Proces nemá přístup k souboru, neboť jej právě využívá jiný proces.
11:02:06.104 AVAST engine defs: 16051301
11:02:18.050 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
11:02:18.050 Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
11:02:18.234 Disk 0 MBR read successfully
11:02:18.234 Disk 0 MBR scan
11:02:18.267 Disk 0 unknown MBR code
11:02:18.281 Disk 0 Partition 1 00 12 Compaq diag NTFS 20480 MB offset 2048
11:02:18.313 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 41945088
11:02:18.344 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 228178 MB offset 42149888
11:02:18.375 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 228180 MB offset 509458432
11:02:18.406 Disk 0 scanning sectors +976771072
11:02:18.656 Disk 0 scanning C:\WINDOWS\system32\drivers
11:02:39.516 Service scanning
11:02:48.431 Service eelam C:\WINDOWS\system32\DRIVERS\eelam.sys **LOCKED** 5
11:02:48.523 Service ehdrv C:\WINDOWS\system32\DRIVERS\ehdrv.sys **LOCKED** 5
11:02:48.649 Service ekbdflt C:\WINDOWS\system32\DRIVERS\ekbdflt.sys **LOCKED** 5
11:02:49.228 Service epfw C:\WINDOWS\system32\DRIVERS\epfw.sys **LOCKED** 5
11:02:49.281 Service EpfwLWF C:\WINDOWS\system32\DRIVERS\EpfwLWF.sys **LOCKED** 5
11:02:49.339 Service epfwwfp C:\WINDOWS\system32\DRIVERS\epfwwfp.sys **LOCKED** 5
11:03:16.797 Service TrueSight C:\Windows\System32\drivers\TrueSight.sys **LOCKED**
11:03:29.578 Modules scanning
11:03:29.594 Disk 0 trace - called modules:
11:03:29.594
11:03:31.518 AVAST engine scan C:\WINDOWS
11:03:36.071 AVAST engine scan C:\WINDOWS\system32
11:08:32.357 AVAST engine scan C:\WINDOWS\system32\drivers
11:09:09.073 AVAST engine scan C:\Users\Kamilka
11:22:34.128 File: C:\Users\Kamilka\Desktop\FRSTLauncher (2).exe **INFECTED** Win32:Malware-gen
11:25:11.171 AVAST engine scan C:\ProgramData
11:29:52.934 Disk 0 statistics 3585876/0/0 @ 1,46 MB/s
11:29:52.934 Scan finished successfully
11:46:02.865 Disk 0 MBR has been saved successfully to "C:\Users\Kamilka\Desktop\MBR.dat"
11:46:02.896 The log file has been saved successfully to "C:\Users\Kamilka\Desktop\aswMBR.txt"

#18 Příspěvek od **altrok** » 14 kvě 2016 10:50

Dejte logy FRST.txt a Addition.txt - http://forum.viry.cz/viewtopic.php?f=30&t=133101
Pozn. pri druhem a dalsim spusteni FRST je pro vytvoreni logu Addition.txt nutne tuto volbu explicitne zatrhnout pred zacatkem skenu.

kallimka · #19 Příspěvek od **kallimka** » 14 kvě 2016 11:09

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:07-05-2016
Ran by Kamilka (administrator) on KAMILKA-PC (14-05-2016 11:52:41)
Running from C:\Users\Kamilka\Desktop
Loaded Profiles: Kamilka (Available Profiles: Kamilka & Mcx1-KAMILKA-PC & DefaultAppPool)
Platform: Microsoft Windows 10 Home Version 1511 (X86) Language: Angličtina (Spojené státy)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX86\officeclicktorun.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_3.6.19761.0_x86__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Corporation) C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.168_none_1a39dfbc6dff3448\TiWorker.exe
(Microsoft Corporation) C:\Windows\System32\SystemSettingsAdminFlows.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x86__8wekyb3d8bbwe\Calculator.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\NetworkUXBroker.exe
(Facebook Inc.) C:\Users\Kamilka\AppData\Local\Facebook\Update\FacebookUpdate.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x86__8wekyb3d8bbwe\Microsoft.Photos.exe
(AVAST Software) C:\Users\Kamilka\Desktop\aswmbr.exe
(Google Inc.) C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor)
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)
HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\Run: [Google Update] => C:\Users\Kamilka\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-28] (Google Inc.)
HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [3576664 2015-06-18] (Disc Soft Ltd)
HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6602152 2015-11-16] (Piriform Ltd)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Kamilka\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Kamilka\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Kamilka\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileSyncShell.dll [2015-12-20] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-04-19] (Microsoft Corporation)
Startup: C:\Users\Kamilka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk [2016-01-31]
ShortcutTarget: RollerCoaster Tycoon 3 Registration.lnk -> C:\Users\Kamilka\AppData\Local\Temp\{2C3C9D34-F2FD-4EA1-8F25-5132A2D785FB}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe (No File)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-3219418776-4157282183-555089908-1000] => 88.146.243.17:8080
AutoConfigURL: [S-1-5-21-3219418776-4157282183-555089908-1000] => 88.146.243.17:8080
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{5c0f82ed-9437-467b-9291-8239ae187433}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{a01204e6-3498-4762-be85-5ae5592765bc}: [DhcpNameServer] 10.0.0.138

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3219418776-4157282183-555089908-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3219418776-4157282183-555089908-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.seznam.cz/
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={s ... lz=1I7SMSN
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2016-03-18] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_91\bin\ssv.dll [2016-05-01] (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-04-19] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-01] (Oracle Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_91-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0091-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_91-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_91-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2016-02-01] (Skype Technologies)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw.dll [2011-11-22] (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.91.2 -> C:\WINDOWS\system32\npdeployJava1.dll [2016-05-01] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-01] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-01] (Oracle Corporation)
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-11-03] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-02-23] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3219418776-4157282183-555089908-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Kamilka\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-3219418776-4157282183-555089908-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin HKU\S-1-5-21-3219418776-4157282183-555089908-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2012-06-23] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2012-06-23] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2012-06-23] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2012-06-23] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2012-06-23] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2012-06-23] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2012-06-23] (Apple Inc.)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.seznam.cz/
CHR StartupUrls: Default -> "hxxp://www.google.com"
CHR Plugin: (Native Client) - C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\gcswf32.dll => No File
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll => No File
CHR Plugin: (Skype Toolbars) - C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File
CHR Plugin: (Java Deployment Toolkit 6.0.320.5) - C:\windows\system32\npdeployJava1.dll (Oracle Corporation)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL => No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll => No File
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\Kamilka\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File
CHR Plugin: (Shockwave for Director) - C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Profile: C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-01]
CHR Extension: (Vyhledávání Google) - C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (hxxp://www.facebook.com/) - C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnknkgccldocdogpnhbaddbdhhjiindo [2012-11-23]
CHR Extension: (Dokumenty Google offline) - C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (AdBlock) - C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-04-16]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Gmail) - C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
StartMenuInternet: Google Chrome - C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe [1917680 2016-03-08] (Microsoft Corporation)
S3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1034584 2015-06-18] (Disc Soft Ltd)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1983264 2016-03-17] (ESET)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S3 Origin Client Service; C:\Program Files\Origin\OriginClientService.exe [1931632 2015-05-08] (Electronic Arts)
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [280376 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23256 2015-10-30] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\WINDOWS\System32\drivers\athr.sys [3346968 2015-05-12] (Qualcomm Atheros Communications, Inc.)
R2 atksgt; C:\WINDOWS\System32\DRIVERS\atksgt.sys [271360 2016-01-31] () [File not signed]
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [25016 2015-11-18] (Disc Soft Ltd)
R1 eamonm; C:\WINDOWS\System32\DRIVERS\eamonm.sys [206312 2016-03-17] (ESET)
S0 eelam; C:\WINDOWS\System32\DRIVERS\eelam.sys [14464 2015-09-23] (ESET)
R1 ehdrv; C:\WINDOWS\System32\DRIVERS\ehdrv.sys [146024 2016-01-15] (ESET)
R2 ekbdflt; C:\WINDOWS\system32\DRIVERS\ekbdflt.sys [111040 2016-01-15] (ESET)
R1 epfw; C:\WINDOWS\System32\DRIVERS\epfw.sys [152728 2016-03-17] (ESET)
R1 EpfwLWF; C:\WINDOWS\system32\DRIVERS\EpfwLWF.sys [44608 2016-03-17] (ESET)
R0 epfwwfp; C:\WINDOWS\System32\DRIVERS\epfwwfp.sys [71488 2016-03-17] (ESET)
R2 lirsgt; C:\WINDOWS\System32\DRIVERS\lirsgt.sys [18048 2016-01-31] () [File not signed]
S3 rtport; C:\windows\system32\drivers\rtport.sys [15656 2010-08-17] (Windows (R) 2003 DDK 3790 provider)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [37400 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [246104 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [98648 2015-10-30] (Microsoft Corporation)
S3 WUDFWpdMtp; C:\WINDOWS\system32\DRIVERS\WUDFRd.sys [163328 2015-10-30] (Microsoft Corporation)
R3 yukonw8; C:\WINDOWS\System32\drivers\yk63x86.sys [242688 2015-10-30] (Marvell)
U3 aswMBR; C:\Users\Kamilka\AppData\Local\Temp\aswMBR.sys [56704 2016-05-14] () [File not signed]
U3 aswVmm; C:\Users\Kamilka\AppData\Local\Temp\aswVmm.sys [192224 2016-05-14] ()
U3 idsvc; no ImagePath
U5 pccsmcfd; C:\Windows\System32\Drivers\pccsmcfd.sys [19072 2012-10-17] (Nokia)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-14 11:46 - 2016-05-14 11:46 - 00002754 _____ C:\Users\Kamilka\Desktop\aswMBR.txt
2016-05-14 11:46 - 2016-05-14 11:46 - 00000512 _____ C:\Users\Kamilka\Desktop\MBR.dat
2016-05-14 10:58 - 2016-05-14 10:58 - 05200384 _____ (AVAST Software) C:\Users\Kamilka\Desktop\aswmbr.exe
2016-05-14 07:21 - 2016-05-14 07:21 - 00006432 _____ C:\Users\Kamilka\Desktop\RK.txt
2016-05-14 06:47 - 2016-05-14 10:59 - 00000000 ____D C:\ProgramData\RogueKiller
2016-05-14 06:47 - 2016-05-14 06:47 - 00024688 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2016-05-14 06:46 - 2016-05-14 06:46 - 19837512 _____ C:\Users\Kamilka\Downloads\RogueKiller.exe
2016-05-13 15:37 - 2016-05-13 15:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune
2016-05-13 15:37 - 2016-05-13 15:37 - 00000000 ____D C:\Program Files\HD Tune
2016-05-13 15:32 - 2016-05-13 15:37 - 00642632 _____ (EFD Software ) C:\Users\Kamilka\Downloads\hdtune_255.exe
2016-05-11 21:13 - 2016-05-11 21:15 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-05-11 21:13 - 2016-05-11 21:13 - 00001129 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-05-11 21:13 - 2016-05-11 21:13 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-05-11 21:13 - 2016-03-10 14:09 - 00053120 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-05-11 21:13 - 2016-03-10 14:08 - 00126336 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-05-11 21:13 - 2016-03-10 14:08 - 00024448 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-05-11 21:12 - 2016-05-11 21:12 - 22851472 _____ (Malwarebytes ) C:\Users\Kamilka\Downloads\mbam-setup-2.2.1.1043.exe
2016-05-11 21:10 - 2016-05-11 21:10 - 00000000 ____D C:\Users\Kamilka\Desktop\Smart
2016-05-11 21:09 - 2016-05-11 21:12 - 00000292 _____ C:\Users\Kamilka\Desktop\DiskInfo.ini
2016-05-11 21:09 - 2016-02-10 22:04 - 00000000 ____D C:\Users\Kamilka\Desktop\CdiResource
2016-05-11 21:09 - 2016-02-10 22:00 - 03712720 _____ (Crystal Dew World) C:\Users\Kamilka\Desktop\DiskInfoX64.exe
2016-05-11 21:09 - 2016-02-10 22:00 - 02752720 _____ (Crystal Dew World) C:\Users\Kamilka\Desktop\DiskInfo.exe
2016-05-11 21:09 - 2016-01-17 20:13 - 00000000 ____D C:\Users\Kamilka\Desktop\License
2016-05-11 21:08 - 2016-05-11 21:08 - 04669119 _____ C:\Users\Kamilka\Desktop\CrystalDiskInfo6_7_5.zip
2016-05-11 20:29 - 2016-05-11 20:33 - 00000000 ____D C:\AdwCleaner
2016-05-11 20:27 - 2016-05-11 20:27 - 03640384 _____ C:\Users\Kamilka\Desktop\adwcleaner_5.116.exe
2016-05-10 22:29 - 2016-05-06 07:20 - 00077664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdport.sys
2016-05-10 22:29 - 2016-05-06 06:23 - 00498176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2016-05-10 22:29 - 2016-05-06 06:13 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnr.dll
2016-05-10 22:29 - 2016-05-06 06:05 - 00241664 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2016-05-10 22:29 - 2016-05-06 05:49 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcpopkeysrv.dll
2016-05-10 22:29 - 2016-04-30 08:53 - 01152000 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-05-10 22:29 - 2016-04-30 08:46 - 02974720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-05-10 22:29 - 2016-04-23 08:06 - 01232576 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-05-10 22:29 - 2016-04-23 08:06 - 00973504 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-05-10 22:29 - 2016-04-23 08:06 - 00576192 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-05-10 22:29 - 2016-04-23 08:06 - 00440512 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-05-10 22:29 - 2016-04-23 08:06 - 00248512 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-05-10 22:29 - 2016-04-23 08:06 - 00149696 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2016-05-10 22:29 - 2016-04-23 08:06 - 00081088 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-05-10 22:29 - 2016-04-23 08:06 - 00042688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-05-10 22:29 - 2016-04-23 07:28 - 05796704 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-05-10 22:29 - 2016-04-23 07:28 - 01561392 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2016-05-10 22:29 - 2016-04-23 07:28 - 01541792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-05-10 22:29 - 2016-04-23 07:28 - 00550240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2016-05-10 22:29 - 2016-04-23 07:28 - 00545432 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2016-05-10 22:29 - 2016-04-23 07:28 - 00278368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2016-05-10 22:29 - 2016-04-23 07:28 - 00083808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
2016-05-10 22:29 - 2016-04-23 07:26 - 00792328 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2016-05-10 22:29 - 2016-04-23 07:21 - 00023776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2016-05-10 22:29 - 2016-04-23 07:14 - 00310112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2016-05-10 22:29 - 2016-04-23 07:13 - 00502104 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-05-10 22:29 - 2016-04-23 07:13 - 00306832 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2016-05-10 22:29 - 2016-04-23 07:13 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-05-10 22:29 - 2016-04-23 07:12 - 00925064 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2016-05-10 22:29 - 2016-04-23 07:12 - 00451928 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2016-05-10 22:29 - 2016-04-23 07:12 - 00104800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ufxsynopsys.sys
2016-05-10 22:29 - 2016-04-23 07:11 - 00259424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2016-05-10 22:29 - 2016-04-23 07:10 - 02919832 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-05-10 22:29 - 2016-04-23 07:09 - 21123320 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-05-10 22:29 - 2016-04-23 07:09 - 05240960 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2016-05-10 22:29 - 2016-04-23 07:09 - 04074160 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-05-10 22:29 - 2016-04-23 07:09 - 00569744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
2016-05-10 22:29 - 2016-04-23 07:09 - 00465760 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2016-05-10 22:29 - 2016-04-23 07:09 - 00255168 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2016-05-10 22:29 - 2016-04-23 07:07 - 01536088 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2016-05-10 22:29 - 2016-04-23 07:07 - 00192704 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininit.exe
2016-05-10 22:29 - 2016-04-23 07:07 - 00183904 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2016-05-10 22:29 - 2016-04-23 07:02 - 00188256 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2016-05-10 22:29 - 2016-04-23 07:01 - 01714520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2016-05-10 22:29 - 2016-04-23 07:01 - 00522176 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2016-05-10 22:29 - 2016-04-23 07:01 - 00513368 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll
2016-05-10 22:29 - 2016-04-23 07:01 - 00484704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2016-05-10 22:29 - 2016-04-23 07:01 - 00336224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2016-05-10 22:29 - 2016-04-23 07:00 - 01522152 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2016-05-10 22:29 - 2016-04-23 07:00 - 01396584 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2016-05-10 22:29 - 2016-04-23 07:00 - 01273720 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2016-05-10 22:29 - 2016-04-23 07:00 - 00453472 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll
2016-05-10 22:29 - 2016-04-23 07:00 - 00049504 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwminit.dll
2016-05-10 22:29 - 2016-04-23 06:55 - 00430432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2016-05-10 22:29 - 2016-04-23 06:35 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsCSP.dll
2016-05-10 22:29 - 2016-04-23 06:31 - 13018112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-05-10 22:29 - 2016-04-23 06:30 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosHostClient.dll
2016-05-10 22:29 - 2016-04-23 06:29 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbser.sys
2016-05-10 22:29 - 2016-04-23 06:29 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\system32\hmkd.dll
2016-05-10 22:29 - 2016-04-23 06:29 - 00046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmCx.sys
2016-05-10 22:29 - 2016-04-23 06:27 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseDesktopAppMgmtCSP.dll
2016-05-10 22:29 - 2016-04-23 06:27 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapsupdatetask.dll
2016-05-10 22:29 - 2016-04-23 06:26 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosStorage.dll
2016-05-10 22:29 - 2016-04-23 06:25 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvc.dll
2016-05-10 22:29 - 2016-04-23 06:25 - 00070144 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe
2016-05-10 22:29 - 2016-04-23 06:24 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2016-05-10 22:29 - 2016-04-23 06:24 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\filecrypt.sys
2016-05-10 22:29 - 2016-04-23 06:24 - 00054784 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll
2016-05-10 22:29 - 2016-04-23 06:23 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys
2016-05-10 22:29 - 2016-04-23 06:23 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudDomainJoinDataModelServer.dll
2016-05-10 22:29 - 2016-04-23 06:23 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll
2016-05-10 22:29 - 2016-04-23 06:22 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-05-10 22:29 - 2016-04-23 06:22 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2016-05-10 22:29 - 2016-04-23 06:22 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2016-05-10 22:29 - 2016-04-23 06:21 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2016-05-10 22:29 - 2016-04-23 06:21 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2016-05-10 22:29 - 2016-04-23 06:21 - 00168448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2016-05-10 22:29 - 2016-04-23 06:20 - 19344384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-05-10 22:29 - 2016-04-23 06:20 - 18676224 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-05-10 22:29 - 2016-04-23 06:20 - 00307200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-05-10 22:29 - 2016-04-23 06:20 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2016-05-10 22:29 - 2016-04-23 06:20 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2016-05-10 22:29 - 2016-04-23 06:20 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll
2016-05-10 22:29 - 2016-04-23 06:20 - 00133120 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll
2016-05-10 22:29 - 2016-04-23 06:19 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll
2016-05-10 22:29 - 2016-04-23 06:18 - 00349696 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2016-05-10 22:29 - 2016-04-23 06:17 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2016-05-10 22:29 - 2016-04-23 06:17 - 00365056 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2016-05-10 22:29 - 2016-04-23 06:17 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2016-05-10 22:29 - 2016-04-23 06:16 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2016-05-10 22:29 - 2016-04-23 06:16 - 00484864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2016-05-10 22:29 - 2016-04-23 06:16 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2016-05-10 22:29 - 2016-04-23 06:16 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActivationManager.dll
2016-05-10 22:29 - 2016-04-23 06:15 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-05-10 22:29 - 2016-04-23 06:15 - 00784896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2016-05-10 22:29 - 2016-04-23 06:15 - 00612352 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2016-05-10 22:29 - 2016-04-23 06:15 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2016-05-10 22:29 - 2016-04-23 06:15 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2016-05-10 22:29 - 2016-04-23 06:14 - 00739328 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2016-05-10 22:29 - 2016-04-23 06:14 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2016-05-10 22:29 - 2016-04-23 06:14 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2016-05-10 22:29 - 2016-04-23 06:14 - 00647680 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-05-10 22:29 - 2016-04-23 06:14 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-05-10 22:29 - 2016-04-23 06:14 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2016-05-10 22:29 - 2016-04-23 06:14 - 00354304 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll
2016-05-10 22:29 - 2016-04-23 06:14 - 00342528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2016-05-10 22:29 - 2016-04-23 06:13 - 06295552 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2016-05-10 22:29 - 2016-04-23 06:13 - 01028608 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2016-05-10 22:29 - 2016-04-23 06:13 - 00951808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-05-10 22:29 - 2016-04-23 06:13 - 00705536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-05-10 22:29 - 2016-04-23 06:13 - 00489984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2016-05-10 22:29 - 2016-04-23 06:13 - 00434688 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2016-05-10 22:29 - 2016-04-23 06:12 - 00783872 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2016-05-10 22:29 - 2016-04-23 06:12 - 00667648 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2016-05-10 22:29 - 2016-04-23 06:11 - 00673280 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
2016-05-10 22:29 - 2016-04-23 06:10 - 12125696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-05-10 22:29 - 2016-04-23 06:10 - 00639488 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2016-05-10 22:29 - 2016-04-23 06:09 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-05-10 22:29 - 2016-04-23 06:08 - 05324288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-05-10 22:29 - 2016-04-23 06:08 - 02061824 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-05-10 22:29 - 2016-04-23 06:07 - 05205504 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2016-05-10 22:29 - 2016-04-23 06:07 - 01793024 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2016-05-10 22:29 - 2016-04-23 06:07 - 01500160 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-05-10 22:29 - 2016-04-23 06:05 - 01895936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-05-10 22:29 - 2016-04-23 06:05 - 01626624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2016-05-10 22:29 - 2016-04-23 06:04 - 04759040 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll
2016-05-10 22:29 - 2016-04-23 06:04 - 01733632 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-05-10 22:29 - 2016-04-23 06:03 - 05660160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-05-10 22:29 - 2016-04-23 06:03 - 02000896 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2016-05-10 22:29 - 2016-04-23 06:03 - 01899520 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-05-10 22:29 - 2016-04-23 06:03 - 00754176 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2016-05-10 22:29 - 2016-04-23 06:03 - 00704000 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-05-10 22:29 - 2016-04-23 06:03 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2016-05-10 22:29 - 2016-04-23 06:01 - 01075200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-05-10 22:29 - 2016-04-23 04:10 - 00177664 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2016-05-10 22:28 - 2016-05-06 06:10 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnrSvc.dll
2016-05-10 22:28 - 2016-05-06 06:05 - 00487936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll
2016-05-10 22:28 - 2016-04-23 06:29 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\ByteCodeGenerator.exe
2016-05-10 22:28 - 2016-04-23 06:29 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2016-05-10 22:28 - 2016-04-23 06:28 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\NFCProvisioningPlugin.dll
2016-05-10 22:28 - 2016-04-23 06:28 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshbth.dll
2016-05-10 22:28 - 2016-04-23 06:27 - 00103424 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2016-05-10 22:28 - 2016-04-23 06:24 - 00118784 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2016-05-10 22:28 - 2016-04-23 06:23 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-05-10 22:28 - 2016-04-23 06:21 - 00142336 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-05-10 22:28 - 2016-04-23 06:19 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-05-10 22:28 - 2016-04-23 06:19 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\BrowserSettingSync.dll
2016-05-10 22:28 - 2016-04-23 06:18 - 00219648 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2016-05-10 22:28 - 2016-04-23 06:05 - 00103936 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2016-05-10 22:28 - 2016-04-23 06:03 - 02193408 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2016-05-10 22:28 - 2016-04-19 00:30 - 00002186 _____ C:\WINDOWS\system32\AppxProvisioning.xml
2016-05-10 16:37 - 2016-05-10 16:37 - 00031232 _____ C:\Users\Kamilka\Downloads\cenik_rubeska.xls
2016-05-09 08:35 - 2016-05-09 08:37 - 00050896 _____ C:\Users\Kamilka\Desktop\Addition.txt
2016-05-09 08:33 - 2016-05-14 11:53 - 00019469 _____ C:\Users\Kamilka\Desktop\FRST.txt
2016-05-09 08:32 - 2016-05-09 08:32 - 00015327 _____ C:\Users\Kamilka\Desktop\LM.bat
2016-05-09 08:30 - 2016-05-09 08:30 - 02379264 _____ (Farbar) C:\Users\Kamilka\Downloads\FRST64.exe
2016-05-09 08:29 - 2016-05-09 08:32 - 00029696 _____ C:\Users\Kamilka\AppData\Local\MSGBOX.EXE
2016-05-09 08:29 - 2016-05-09 08:29 - 00112640 _____ (forum.viry.cz) C:\Users\Kamilka\Desktop\FRSTLauncher (2).exe
2016-05-09 08:24 - 2016-05-14 11:52 - 00000000 ____D C:\FRST
2016-05-09 08:24 - 2016-05-09 08:24 - 01730048 _____ (Farbar) C:\Users\Kamilka\Desktop\FRST.exe
2016-05-09 08:20 - 2016-05-09 08:21 - 00000000 ____D C:\rsit
2016-05-09 00:08 - 2016-05-09 00:08 - 00987728 _____ (Google Inc.) C:\Users\Kamilka\Downloads\ChromeSetup.exe
2016-05-07 13:11 - 2016-05-07 13:11 - 00000000 ____D C:\Users\Kamilka\AppData\Roaming\Light Developer
2016-05-07 13:11 - 2016-05-07 13:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stepok RAW Importer
2016-05-07 13:11 - 2016-05-07 13:11 - 00000000 ____D C:\Program Files\Stepok RAW Importer
2016-05-07 13:10 - 2016-05-07 13:10 - 04214880 _____ (Stepok Image Lab. ) C:\Users\Kamilka\Downloads\SRAWISetup.exe
2016-05-01 23:56 - 2016-05-01 23:56 - 00000017 _____ C:\Users\Kamilka\AppData\Local\resmon.resmoncfg
2016-05-01 23:53 - 2016-05-01 23:51 - 00905280 _____ (Oracle Corporation) C:\WINDOWS\system32\npdeployJava1.dll
2016-05-01 23:53 - 2016-05-01 23:51 - 00825408 _____ (Oracle Corporation) C:\WINDOWS\system32\deployJava1.dll
2016-05-01 23:52 - 2016-05-01 23:52 - 00000000 ____D C:\Program Files\Common Files\Java
2016-05-01 23:51 - 2016-05-01 23:51 - 00000000 ____D C:\Users\Kamilka\AppData\Roaming\Sun
2016-05-01 23:51 - 2016-05-01 23:51 - 00000000 ____D C:\Users\Kamilka\.oracle_jre_usage
2016-05-01 15:13 - 2016-05-01 15:13 - 53339518 _____ C:\Users\Kamilka\Downloads\The_Sims_3_fix.rar
2016-04-30 13:42 - 2016-04-30 13:42 - 00000016 _____ C:\ProgramData\mntemp
2016-04-30 13:42 - 2016-04-30 13:42 - 00000000 ____D C:\ProgramData\Martau
2016-04-30 13:41 - 2016-04-30 13:42 - 23049888 _____ (Gavrila Martau ) C:\Users\Kamilka\Downloads\Total-Uninstall-Setup-6.16.0.exe
2016-04-27 22:03 - 2016-04-27 22:03 - 00014891 _____ C:\Users\Kamilka\Downloads\[CzT]Bylo_nebylo_Once_Upon_a_Time_S05E04_The_Broken_Kingdom_2011_TVRip_.torrent
2016-04-27 22:03 - 2016-04-27 22:03 - 00014351 _____ C:\Users\Kamilka\Downloads\[CzT]Bylo_nebylo_Once_Upon_a_Time_S05E07_Nimue_2011_TvRip_.torrent
2016-04-27 22:03 - 2016-04-27 22:03 - 00014151 _____ C:\Users\Kamilka\Downloads\[CzT]Bylo_nebylo_Once_Upon_a_Time_S05E03_Siege_Perilous_TvRip_.torrent
2016-04-27 22:03 - 2016-04-27 22:03 - 00014130 _____ C:\Users\Kamilka\Downloads\[CzT]Bylo_nebylo_Once_Upon_a_Time_S05E06_The_Bear_and_the_Bow_TVRip_.torrent
2016-04-27 22:03 - 2016-04-27 22:03 - 00013370 _____ C:\Users\Kamilka\Downloads\[CzT]Bylo_nebylo_Once_Upon_a_Time_S05E05_Dreamcatcher_TvRip_.torrent
2016-04-27 22:03 - 2016-04-27 22:03 - 00013370 _____ C:\Users\Kamilka\Downloads\[CzT]Bylo_nebylo_Once_Upon_a_Time_S05E05_Dreamcatcher_TvRip_ (1).torrent
2016-04-27 22:02 - 2016-04-27 22:02 - 00017370 _____ C:\Users\Kamilka\Downloads\[CzT]Bylo_nebylo_Once_Upon_a_Time_S05E01_The_Dark_Swan_TvRip_.torrent
2016-04-27 22:02 - 2016-04-27 22:02 - 00014111 _____ C:\Users\Kamilka\Downloads\[CzT]Bylo_nebylo_Once_upon_a_time_S05E02_Cena_The_Price_TvRip_.torrent
2016-04-24 20:02 - 2016-04-24 20:04 - 221270226 _____ C:\Users\Kamilka\Downloads\zasilka-HZXE5LC57XTTAHPW.zip

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-14 11:32 - 2015-10-30 07:39 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-05-14 11:12 - 2015-05-17 11:29 - 00000992 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000UA.job
2016-05-14 11:09 - 2015-12-20 05:13 - 00000000 ____D C:\Users\Kamilka
2016-05-14 10:55 - 2015-10-30 07:48 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-05-14 07:49 - 2016-01-09 13:05 - 00000000 ____D C:\Users\Kamilka\AppData\Local\Battle.net
2016-05-14 07:30 - 2016-01-09 13:04 - 00000000 ____D C:\Program Files\Battle.net
2016-05-13 15:45 - 2010-11-13 20:09 - 00000000 ____D C:\Users\Kamilka\AppData\Roaming\Skype
2016-05-13 11:42 - 2015-10-30 07:48 - 00000000 ____D C:\WINDOWS\rescache
2016-05-13 11:16 - 2012-02-27 22:22 - 00002503 _____ C:\Users\Kamilka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-13 10:38 - 2012-02-08 15:44 - 00000000 ____D C:\Users\Kamilka\AppData\Local\ElevatedDiagnostics
2016-05-13 10:22 - 2015-11-13 12:11 - 00000000 ____D C:\Users\Kamilka\AppData\Local\Packages
2016-05-13 10:22 - 2015-10-30 07:48 - 00000000 ___HD C:\Program Files\WindowsApps
2016-05-12 08:07 - 2010-11-06 19:10 - 00000000 ____D C:\Users\Kamilka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite
2016-05-12 08:05 - 2015-12-20 09:38 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-12 08:05 - 2015-10-30 07:48 - 00000000 ___RD C:\WINDOWS\DevicesFlow
2016-05-12 08:04 - 2015-10-30 07:13 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-05-12 00:20 - 2015-11-18 20:34 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-11 21:57 - 2015-10-30 07:49 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2016-05-11 21:57 - 2015-10-30 07:49 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2016-05-11 21:13 - 2015-10-30 07:47 - 00000000 ____D C:\WINDOWS\INF
2016-05-11 20:26 - 2012-12-14 18:03 - 00000000 ___RD C:\Program Files\Skype
2016-05-11 19:07 - 2015-05-17 11:29 - 00000940 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000Core.job
2016-05-11 07:11 - 2015-09-10 06:16 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-05-11 03:32 - 2015-10-30 08:58 - 00000000 ____D C:\Program Files\Windows Journal
2016-05-11 03:32 - 2015-10-30 07:48 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-05-11 03:32 - 2015-10-30 07:48 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-05-11 03:32 - 2015-10-30 07:48 - 00000000 ____D C:\WINDOWS\Provisioning
2016-05-11 03:32 - 2015-10-30 07:48 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-05-11 03:31 - 2015-10-30 07:48 - 00015703 _____ C:\WINDOWS\system32\OEMDefaultAssociations.xml
2016-05-10 22:45 - 2013-08-13 14:04 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-05-10 22:31 - 2010-11-06 20:54 - 136686448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-05-09 08:21 - 2015-05-09 15:46 - 00000000 ____D C:\Program Files\trend micro
2016-05-08 20:13 - 2010-11-06 22:22 - 00000000 ____D C:\Users\Kamilka\AppData\Roaming\DAEMON Tools Lite
2016-05-06 09:09 - 2010-11-06 20:07 - 00000000 ____D C:\Users\Kamilka\Documents\Youcam
2016-05-06 09:00 - 2015-10-30 07:48 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-05-06 08:58 - 2013-10-21 12:10 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-05-04 10:51 - 2011-01-03 16:59 - 00000000 ____D C:\Fotky
2016-05-04 10:47 - 2014-02-28 12:04 - 00000000 ____D C:\Hackovani & Siti
2016-05-01 23:53 - 2013-12-11 19:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-05-01 23:51 - 2014-10-04 15:01 - 00268352 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe
2016-05-01 23:51 - 2014-10-04 15:01 - 00095808 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll
2016-05-01 23:51 - 2013-12-11 19:10 - 00000000 ____D C:\ProgramData\Oracle
2016-05-01 23:50 - 2010-12-27 17:02 - 00000000 ____D C:\Program Files\Java
2016-05-01 18:55 - 2010-11-13 20:09 - 00000000 ____D C:\ProgramData\Skype
2016-04-30 13:49 - 2011-01-30 18:14 - 00000000 ____D C:\Program Files\SlySoft
2016-04-30 13:47 - 2010-06-14 00:39 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2016-04-30 13:45 - 2011-04-16 17:39 - 00000000 ____D C:\Program Files\Sierra
2016-04-30 13:29 - 2010-12-27 16:54 - 00000000 ____D C:\ProgramData\Sony Ericsson
2016-04-30 13:29 - 2010-12-27 16:54 - 00000000 ____D C:\Program Files\Sony Ericsson
2016-04-30 13:28 - 2016-01-31 13:36 - 00000000 ____D C:\Users\Kamilka\Documents\RCT3
2016-04-30 13:26 - 2014-10-17 17:33 - 00000000 ____D C:\Users\Kamilka\AppData\Roaming\WB Games
2016-04-30 13:26 - 2010-11-08 13:10 - 00000000 ____D C:\Users\Kamilka\AppData\Roaming\Atari
2016-04-30 13:25 - 2009-07-14 06:52 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-04-29 08:15 - 2015-05-16 00:17 - 00000000 ____D C:\Users\Kamilka\AppData\Roaming\uTorrent
2016-04-25 20:24 - 2010-12-01 15:18 - 00000000 ____D C:\Users\Kamilka\AppData\Roaming\vlc
2016-04-25 08:21 - 2016-01-09 13:06 - 00000000 ____D C:\Program Files\Hearthstone
2016-04-22 09:09 - 2015-12-20 13:57 - 00796720 _____ C:\WINDOWS\system32\perfh005.dat
2016-04-22 09:09 - 2015-12-20 13:56 - 00168116 _____ C:\WINDOWS\system32\perfc005.dat
2016-04-22 09:09 - 2015-12-20 05:12 - 01944164 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-04-16 03:05 - 2015-12-20 05:05 - 00409224 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-04-16 03:02 - 2015-10-30 07:48 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2016-04-16 03:02 - 2015-10-30 07:48 - 00000000 ____D C:\WINDOWS\PolicyDefinitions

==================== Files in the root of some directories =======

2004-02-04 16:53 - 2004-02-04 16:53 - 0458752 ____H () C:\Program Files\Common Files\db.mdb
2004-02-04 15:54 - 2004-02-04 15:54 - 0000019 ____H () C:\Program Files\Common Files\General.txt
2004-02-04 16:53 - 2004-02-04 16:53 - 0458752 ____H () C:\Users\Kamilka\AppData\Roaming\db.mdb
2004-02-04 15:54 - 2004-02-04 15:54 - 0000019 ____H () C:\Users\Kamilka\AppData\Roaming\General.txt
2002-08-29 19:33 - 2002-08-29 19:33 - 0319488 ____R () C:\Users\Kamilka\AppData\Roaming\MafiaSetup.exe
2012-11-23 15:50 - 2012-11-23 15:50 - 0003584 _____ () C:\Users\Kamilka\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-05-09 08:29 - 2016-05-09 08:32 - 0029696 _____ () C:\Users\Kamilka\AppData\Local\MSGBOX.EXE
2016-05-01 23:56 - 2016-05-01 23:56 - 0000017 _____ () C:\Users\Kamilka\AppData\Local\resmon.resmoncfg
2011-01-30 18:15 - 2015-06-16 14:15 - 0000121 ___SH () C:\ProgramData\.zreglib
2010-11-13 20:12 - 2010-11-13 20:12 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-11-06 19:12 - 2010-01-16 09:18 - 0131368 _____ () C:\ProgramData\FullRemove.exe
2013-12-24 01:40 - 2013-12-24 01:41 - 0000348 _____ () C:\ProgramData\hpzinstall.log
2016-04-30 13:42 - 2016-04-30 13:42 - 0000016 _____ () C:\ProgramData\mntemp
2010-06-14 00:51 - 2010-06-14 00:51 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2010-06-14 00:49 - 2010-06-14 00:50 - 0000106 _____ () C:\ProgramData\{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}.log
2010-06-14 00:46 - 2010-06-14 00:47 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2010-06-14 00:50 - 2010-06-14 00:51 - 0000110 _____ () C:\ProgramData\{B7A0CE06-068E-11D6-97FD-0050BACBF861}.log
2010-06-14 00:45 - 2010-06-14 00:46 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2010-06-14 00:47 - 2010-06-14 00:49 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log

Files to move or delete:
====================
C:\Users\ArivaUpgrade\ArivaUpgrade.exe

Some files in TEMP:
====================
C:\Users\Kamilka\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Kamilka\AppData\Local\Temp\libeay32.dll
C:\Users\Kamilka\AppData\Local\Temp\msvcr120.dll
C:\Users\Kamilka\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-05-07 11:06

==================== End of FRST.txt ============================

kallimka · #20 Příspěvek od **kallimka** » 14 kvě 2016 11:10

Additional scan result of Farbar Recovery Scan Tool (x86) Version:07-05-2016
Ran by Kamilka (2016-05-14 11:54:53)
Running from C:\Users\Kamilka\Desktop
Microsoft Windows 10 Home Version 1511 (X86) (2015-12-20 07:43:02)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3219418776-4157282183-555089908-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3219418776-4157282183-555089908-503 - Limited - Disabled)
Guest (S-1-5-21-3219418776-4157282183-555089908-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3219418776-4157282183-555089908-1002 - Limited - Enabled)
Kamilka (S-1-5-21-3219418776-4157282183-555089908-1000 - Administrator - Enabled) => C:\Users\Kamilka
Mcx1-KAMILKA-PC (S-1-5-21-3219418776-4157282183-555089908-1003 - Limited - Enabled) => C:\Users\Mcx1-KAMILKA-PC

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ESET Smart Security 9.0.318.22 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 9.0.374.1 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personální firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM\...\uTorrent) (Version: 2.2.1.25534 - emc, uTorrent.CZ)
Adobe Acrobat Reader DC - Czech (HKLM\...\{AC76BA86-7AD7-1029-7B44-AC0F074E4100}) (Version: 15.016.20039 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM\...\Adobe Shockwave Player) (Version: 11.6.3.633 - Adobe Systems, Inc.)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Atheros Client Installation Program (HKLM\...\{D1434266-0486-4469-B338-A60082CC04E1}) (Version: 1.0.2.1119 - Atheros)
BatteryLifeExtender (HKLM\...\{74A579FB-EB06-497D-B194-01590D6FE51A}) (Version: 1.0.5 - Samsung)
Battle.net (HKLM\...\Battle.net) (Version: - Blizzard Entertainment)
Bing Desktop (HKLM\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.4.167.0 - Microsoft Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.12 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.5.5571 - CDBurnerXP)
CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2806 - CyberLink Corp.)
CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1916 - CyberLink Corp.)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3108a - CyberLink Corp.)
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3213 - CyberLink Corp.)
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815b - CyberLink Corp.)
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1812 - CyberLink Corp.)
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3625 - CyberLink Corp.)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.1.0.0074 - Disc Soft Ltd)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM\...\{34B76DCB-BF7C-440F-B058-C84172C1E338}) (Version: 4.2.8 - Samsung)
Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 3.0.0.5 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM\...\{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}) (Version: 4.0.0.3 - Samsung)
ESET Smart Security (HKLM\...\{8F5A2A0B-1F5D-4114-8C24-790DBB0528C4}) (Version: 9.0.318.22 - ESET, spol. s r.o.)
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Far Cry (HKLM\...\InstallShield_{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC}) (Version: 1.00.0000 - Název společnosti:)
Far Cry (Version: 1.00.0000 - Název společnosti:) Hidden
Full Tilt Poker (HKLM\...\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}) (Version: 4.32.1.WIN.FullTilt.COM - )
Full Tilt UK (HKLM\...\{31967082-7E6A-42A3-9740-6F9065509BD6}) (Version: 5.22.51.WIN.FullTilt.UK - )
Google Chrome (HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\Google Chrome) (Version: 50.0.2661.102 - Google Inc.)
HD Tune 2.55 (HKLM\...\HD Tune_is1) (Version: - EFD Software)
Hearthstone (HKLM\...\Hearthstone) (Version: - Blizzard Entertainment)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.2302 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java 8 Update 91 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
JavaFX 2.1.0 (HKLM\...\{1111706F-666A-4037-7777-210328764D10}) (Version: 2.1.0 - Oracle Corporation)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Korean Fonts Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5670-0000-900000000003}) (Version: 9.0.0 - Adobe Systems Incorporated)
LEGO® Batman™ (Version: 1.00.0000 - Warner Bros. Interactive Entertainment) Hidden
Malwarebytes Anti-Malware verze 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 11.22.3.3 - Marvell)
Microsoft Office 365 - cs-cz (HKLM\...\O365HomePremRetail - cs-cz) (Version: 15.0.4815.1002 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 - cs-cz (HKLM\...\ProPlusRetail - cs-cz) (Version: 15.0.4815.1002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MySQL Connector/ODBC 3.51 (HKLM\...\{0CB3C535-1171-4A20-B549-E2CB5DEB9723}) (Version: 3.51.12 - MySQL AB)
Nokia Connectivity Cable Driver (HKLM\...\{6FE12C01-2FBC-42E2-AEB9-4CA2238C462F}) (Version: 7.1.101.0 - Nokia)
Office 15 Click-to-Run Extensibility Component (Version: 15.0.4815.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4815.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (Version: 15.0.4815.1002 - Microsoft Corporation) Hidden
Origin (HKLM\...\Origin) (Version: 9.4.1.116 - Electronic Arts, Inc.)
PC Connectivity Solution (HKLM\...\{6B722793-E77B-41F5-BAB3-6C9832274E75}) (Version: 12.0.76.0 - Nokia)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6003 - Realtek Semiconductor Corp.)
Samsung Kies3 (HKLM\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14013.45 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (Version: 3.2.14013.45 - Samsung Electronics Co., Ltd.) Hidden
Samsung Recovery Solution 4 (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 4.0.0.6 - Samsung)
Samsung Support Center (HKLM\...\{F687E657-F636-44DF-8125-9FEEA2C362F5}) (Version: 1.0.2 - Samsung)
Samsung Update Plus (HKLM\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.)
SamsungMovie (HKLM\...\{EFA6EF6A-9E0D-4CF0-91DD-B55D8632F65A}) (Version: 1.0.0 - Samsung)
Skype™ 7.22 (HKLM\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.22.109 - Skype Technologies S.A.)
SoftPerfect WiFi Guard version 1.0.3 (HKLM\...\{38AFD787-4D2E-4442-92D2-7739F5F92CF4}_is1) (Version: 1.0.3 - SoftPerfect Research)
SPORE™ (HKLM\...\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}) (Version: 1.00.0000 - Electronic Arts)
Stepok RAW Importer v2.8 (HKLM\...\Stepok RAW Importer_is1) (Version: - Stepok Image Lab.)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.10.0 - Synaptics Incorporated)
The Sims™ 3 (HKLM\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.67.2 - Electronic Arts)
The Sims™ 3 Ambitions (HKLM\...\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}) (Version: 4.0.87 - Electronic Arts)
The Sims™ 3 Generations (HKLM\...\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}) (Version: 8.0.152 - Electronic Arts)
The Sims™ 3 High-End Loft Stuff (HKLM\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)
The Sims™ 3 Late Night (HKLM\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.0.81 - Electronic Arts)
The Sims™ 3 Pets (HKLM\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)
The Sims™ 3 Seasons (HKLM\...\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts)
The Sims™ 3 Supernatural (HKLM\...\{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}) (Version: 15.0.135 - Electronic Arts)
The Sims™ 3 World Adventures (HKLM\...\{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}) (Version: 2.0.86 - Electronic Arts)
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
VLC media player 1.1.5 (HKLM\...\VLC media player) (Version: 1.1.5 - VideoLAN)
Windows Driver Package - Nokia pccsmcfd “LegacyDriver” (05/31/2012 7.1.2.0) (HKLM\...\17D063A0A9F5D5A225B76B1D9BCB5ADBE85C8382) (Version: 05/31/2012 7.1.2.0 - Nokia)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sign-in Assistant (HKLM\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Upload Tool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
Zeus & Poseidon (HKLM\...\{8043219B-D2C0-4561-90AB-3F1113ED5A87}) (Version: - )
Zoo Tycoon 2 - African Adventure (HKLM\...\InstallShield_{CE7062BD-BE6F-4153-9654-3D72D0C1CC17}) (Version: 1.00.0000 - Název spolecnosti:)
Zoo Tycoon 2 - African Adventure (Version: 1.00.0000 - Název společnosti:) Hidden
Zoo Tycoon 2 Endangered Species (HKLM\...\Zoo Tycoon 2) (Version: - )
ZTE_1.2059.0.8 (HKLM\...\ZTE_1.2059.0.8) (Version: - )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Kamilka\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Kamilka\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.30.3\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.30.3\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.30.3\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.30.3\psuser.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Kamilka\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.29.5\psuser.dll => No File
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Kamilka\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Kamilka\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.30.3\GoogleUpdateOnDemand.exe (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.30.3\psuser.dll (Google Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {00F40D33-69A1-419B-95A6-2B0D059EB914} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {018A75BE-050D-4401-8913-E3172651C927} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-10-30] (Microsoft Corporation)
Task: {0725DE1C-946B-4995-96AA-08DC622A177F} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {0B47D4E5-825F-47B1-9C94-E6D582FD77DB} - System32\Tasks\{4EC4783C-B875-4D40-A677-E047FEA0FD88} => pcalua.exe -a "C:\Program Files\Photodex\ProShow Gold\remove.exe"
Task: {134673E0-3AE7-4085-889F-4D62A0DB5EFA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {155E7C4E-388B-487D-ABEA-854ACC31FD0B} - System32\Tasks\{D5F44F69-3986-45D0-B447-77E22B338DD2} => pcalua.exe -a F:\LEGO2.part01.exe -d F:\
Task: {162A6817-B3DB-4886-803D-0E9E543B7DBD} - System32\Tasks\advSRS4 => C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe [2010-01-19] (SEC)
Task: {2215FE9F-B453-4376-A31F-3E5F7C6D8BC9} - System32\Tasks\SamsungSupportCenter => C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe [2010-05-06] (SAMSUNG Electronics)
Task: {232BEC77-B722-44F9-99E2-5439BB1B59FF} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {26BA0CF6-5E1D-4D63-A078-7D289ED2D96A} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-10-30] (Microsoft Corporation)
Task: {27466477-23A7-4F6B-BB85-AB89B67CCCDA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-11-16] (Piriform Ltd)
Task: {2C154169-7335-45BC-A0B4-A6019D9C9989} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {2CC58E73-6E0C-4BE2-8BAE-F5FC180D6750} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {2CE418B7-1996-4546-9D0C-957272A43B51} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {32EC5F8D-F387-43E3-913E-18BED4DF6E77} - System32\Tasks\{2A586BBF-9A38-4928-9E5E-3DF8D7C3E8A8} => D:\Stahnute\Zoo Tycoon 2\Čeština zootycoon2.exe
Task: {3463AB54-5314-4148-B89E-9FF1FE55F110} - System32\Tasks\Microsoft\Windows\Media Center\Extender\Update media permissions for Mcx1-KAMILKA-PC => C:\WINDOWS\ehome\McxTask.exe
Task: {3727246A-3948-4304-BCF9-330D904F47B6} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {382FDFEE-E88B-4F7F-B110-998A80EEBABF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-04-22] (Adobe Systems Incorporated)
Task: {3D9CBA2B-B000-4791-899C-A9F9BB2D64AE} - System32\Tasks\{5920A724-781E-4975-9033-5F83B4385B9D} => C:\Program Files\Skype\\Phone\Skype.exe [2016-04-08] (Skype Technologies S.A.)
Task: {4184A7AD-A7DE-4EA7-890A-7E59F0186F88} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {476B317E-C411-4FEB-B5DF-301599A580BA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {4929741B-D7DF-4DA6-AB97-23502BAFCF9C} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {4B1A2398-509B-49A8-AD92-6012EF4527F6} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {4EEEC0C8-B345-47B3-B614-B40A3460CFE1} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {524EF5DF-A30A-4319-BB88-EB94C64FE349} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {537FDBD7-C27A-414B-BDFF-E0D7B23CC793} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {53E4D469-ECAC-4638-A6B4-52D3E4519A71} - System32\Tasks\{6E1A49B2-4ED2-40D3-86FF-07CB5C98ACDF} => pcalua.exe -a E:\RM_Setup_DX8.exe -d E:\
Task: {544F91D9-F912-49A4-BCEA-EB7A252FBC1E} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe [2010-04-20] ()
Task: {612ED69C-95E1-44B2-B7A6-25CADB324DE5} - System32\Tasks\{2F59EA89-41AA-4DFB-A4CB-9AEEE771F9FB} => pcalua.exe -a C:\Windows\UbiSoft\SetupUbi.exe -d C:\windows\UbiSoft -c -http hxxp://www.raymanm.com
Task: {62DC15A4-ACD2-4D09-B5D0-9C77C5CA8934} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {670DA724-BA9D-4207-B660-39EF2A81916F} - System32\Tasks\{1F88FA98-3882-43CE-A708-E4946CD0B592} => pcalua.exe -a G:\Support\DrvSetup.exe -d G:\Support
Task: {6E0E3C6D-8783-46B5-9C53-9B18B5C70239} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {6F994398-5976-467F-8774-926967D9DDBA} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {7771CAAA-7388-4FF3-8193-21BBD3A33940} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000UA => C:\Users\Kamilka\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {7774D1B7-CC79-4013-A954-0018BC34BCE3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-05-10] (Microsoft Corporation)
Task: {7D1E7520-EECF-42A0-9549-AF82921A5C01} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {7E096918-C3B0-4ADB-AB24-A9D0C7235E4C} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {85F109FC-8478-496C-97AC-A7B87735EC9F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX86\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation)
Task: {88BFAAFA-16B1-4E5B-919A-44FD06D95017} - System32\Tasks\{588EFBBC-73C5-4990-82C1-9FDBF5412A4C} => pcalua.exe -a "C:\Program Files\Electronic Arts\The Godfather The Game\eauninstall.exe" -d "C:\Program Files\Electronic Arts\The Godfather The Game"
Task: {8F266852-3B76-4177-92F5-8C3583C63CF6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {9093FE45-F527-451B-B25C-44F469A2AA18} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2009-10-13] (Samsung Electronics Co., Ltd.)
Task: {90C134C6-0A60-4C83-83D5-3C428B714D7A} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {954F1EFE-6D14-43CD-88C6-E62648E6084F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000Core => C:\Users\Kamilka\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {9B853534-91CB-4A4E-A789-24674E67C4BA} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {9D1B39B5-AE0E-4145-9FA0-1637F6732348} - System32\Tasks\{C6EE5EB4-9AAC-4A1C-815E-B0B45CF91250} => C:\Windows\UbiSoft\SetupUbi.exe
Task: {A46ADC45-9CB9-4C70-B754-1F640184A981} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {A4DBC9DD-4097-4D11-AB77-F439AD64B783} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {AE31BEAB-2053-4F7B-9D12-5CFFFA853D86} - System32\Tasks\BatteryLifeExtender => C:\Program Files\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-06-01] (Samsung Electronics. Co. Ltd.)
Task: {B01854B7-E936-4810-98AF-D48AB1585A9F} - System32\Tasks\{9739F5E6-17A8-48B9-82EE-58B13E994148} => pcalua.exe -a "C:\Program Files\Ubi Soft\RaymanM\RM_Setup_DX8.exe" -d "C:\Program Files\Ubi Soft\RaymanM"
Task: {B5F7DC56-B69D-468F-8339-1C7E393457D8} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {B9540BDF-9C40-4E23-A0A2-566EE6E83F7B} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {BE4B7488-9B29-423C-82BE-49601CDFED9B} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000Core => C:\Users\Kamilka\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-19] (Facebook Inc.)
Task: {BEBA0598-2736-407A-851F-68F4478CD647} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2009-11-04] (Samsung Electronics Co., Ltd.)
Task: {C449A13A-922A-483B-AADF-EC80E45BB290} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {C74A93D7-E0AA-4AF5-88C4-2EF94D022AFF} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {CA676656-BB1E-428E-92DE-FB770E6F6BE0} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-03-18] (Microsoft Corporation)
Task: {CE7BE772-9952-4331-89DE-4093A8931424} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX86\OfficeC2RClient.exe [2016-02-09] (Microsoft Corporation)
Task: {CF425726-4D94-46C5-832F-DEFBF8906E71} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000UA => C:\Users\Kamilka\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-19] (Facebook Inc.)
Task: {D00F6D12-B958-429F-BAF1-D366AB6A233A} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2009-10-16] (SAMSUNG Electronics co., LTD.)
Task: {D7ED93E5-3A3F-48E4-9D82-636AE0BD087C} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {D99A8ABD-4271-48E1-AE68-CDF8EC090A00} - System32\Tasks\{32259922-2AF5-463E-ADEC-25AA01F38E9E} => C:\Program Files\Skype\\Phone\Skype.exe [2016-04-08] (Skype Technologies S.A.)
Task: {DC0A3DE5-1167-40A0-AB94-27AC4C42DDFE} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {E362E182-0FBB-40B3-8A07-860101D0D58A} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {E490CBF3-E309-4CF7-980A-BED1B6359A37} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {E5066F7D-09F9-4F0F-BFCD-D49AC4FB5E4D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {E57C2ADC-1413-4E60-91C5-E9A2BFC1E097} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {F07F3B06-00D7-46F6-8807-F28F3B6692F5} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe
Task: {FD08A5CB-7B64-43D5-A1D9-88BCF4C5E90F} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000Core.job => C:\Users\Kamilka\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000UA.job => C:\Users\Kamilka\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 07:44 - 2015-10-30 07:44 - 00149504 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2014-03-23 08:30 - 2015-10-13 03:43 - 00080040 _____ () C:\Program Files\Microsoft Office 15\ClientX86\ApiClient.dll
2010-06-14 00:49 - 2009-07-07 20:23 - 00247152 ____N () C:\Program Files\CyberLink\Shared files\RichVideo.exe
2016-04-13 14:26 - 2016-03-29 11:37 - 01862008 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-04-13 14:26 - 2016-03-29 11:37 - 01862008 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2010-11-21 12:09 - 2010-03-15 13:28 - 00141824 _____ () C:\Program Files\WinRAR\rarext.dll
2010-06-14 00:53 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2015-12-20 14:00 - 2015-12-20 14:00 - 00070656 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-05-10 22:28 - 2016-04-23 06:20 - 00316416 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-05-10 22:28 - 2016-04-23 06:21 - 00428032 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\MtcUvc.dll
2016-05-10 22:28 - 2016-04-23 06:05 - 05340672 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-05-10 22:28 - 2016-04-23 05:58 - 00471552 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-05-10 22:29 - 2016-04-23 05:58 - 02366976 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-05-10 22:29 - 2016-04-23 06:01 - 02656768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-04-19 08:30 - 2016-04-19 08:31 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-04-19 08:30 - 2016-04-19 08:31 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-19 08:30 - 2016-04-19 08:31 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2016-01-21 09:53 - 2016-01-21 09:54 - 03034624 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x86__8wekyb3d8bbwe\Calculator.exe
2015-12-15 10:09 - 2015-12-15 10:09 - 00169984 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x86__8wekyb3d8bbwe\StoreRatingPromotion.dll
2016-03-30 06:46 - 2016-03-30 06:47 - 00017408 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x86__8wekyb3d8bbwe\Microsoft.Photos.exe
2016-03-30 06:46 - 2016-03-30 06:47 - 14568448 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x86__8wekyb3d8bbwe\Microsoft.Photos.dll
2016-03-04 08:49 - 2016-03-04 08:49 - 00180224 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x86__8wekyb3d8bbwe\StoreRatingPromotion.dll
2016-05-13 11:16 - 2016-05-11 13:48 - 01738904 _____ () C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\libglesv2.dll
2016-05-13 11:16 - 2016-05-11 13:48 - 00086168 _____ () C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\123simsen.com -> www.123simsen.com

There are 7729 more sites.

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-05-03 15:36 - 2015-05-09 20:49 - 00000035 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3219418776-4157282183-555089908-1000\Control Panel\Desktop\\Wallpaper -> C:\Fotky\20151004_151834.jpg
DNS Servers: 10.0.0.138
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: CanonQuickMenu => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE /logon
MSCONFIG\startupreg: CloneCDTray => "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
MSCONFIG\startupreg: OneDrive => "C:\Users\Kamilka\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
HKLM\...\StartupApproved\Run: => "APSDaemon"
HKLM\...\StartupApproved\Run: => "CLMLServer"
HKLM\...\StartupApproved\Run: => "QuickTime Task"
HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\StartupApproved\Run: => "DAEMON Tools Lite Automount"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-32bit] => (Allow) LPort=808
FirewallRules: [{56994D27-3539-4DC3-A207-A5022EE274D3}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{F412CAE7-C0C5-4945-92F4-50C39C3E607A}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{1A8D25BA-A8A2-42E1-AF0A-4B3EC2A2A3B2}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{3D2F8511-53FD-4026-915D-C701CD8ED2F4}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{C9CEFD72-2F45-476F-A366-5B82D307437B}] => (Allow) C:\Program Files\CyberLink\PowerDirector\PDR.EXE
FirewallRules: [{C908CCA4-D05F-4FF5-9825-F6B0AD143D48}] => (Allow) C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.EXE
FirewallRules: [{B36137A6-AD71-4628-B58B-36E382489824}] => (Allow) C:\Program Files\Windows Live\Messenger\wlcsdk.exe
FirewallRules: [{EFF9CA49-4765-4B0E-ACA7-C579D5B2544B}] => (Allow) svchost.exe
FirewallRules: [{BE081235-9574-46D8-8B1F-CBAD7EE5CEDB}] => (Allow) C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{7F3DC2F2-F83A-49A9-8D84-DE829D2D380A}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{E712C80A-58CB-42E4-8B4D-429A3765370B}] => (Allow) C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{BE65866B-CF32-4607-A08F-C41202D68CB2}] => (Allow) C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe
FirewallRules: [{8926BBB0-F3FE-4BFA-9806-7C9E37B37012}] => (Allow) C:\Program Files\Microsoft Games\Zoo Tycoon 2\zt.exe
FirewallRules: [{D97F2A30-0683-4A9F-879E-A12431DC9697}] => (Allow) C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{B28A2A21-969D-4D3F-AB25-946079FF2885}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{56254BBC-D643-40CC-9FD6-2CE44B3C8C8A}] => (Allow) C:\Users\Kamilka\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [{701FF157-70CB-4CFF-9F05-3F5B62007E93}] => (Allow) C:\Users\Kamilka\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{B5B6CAA4-94DA-452F-A17B-8226023A0F0F}] => (Allow) C:\Users\Kamilka\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{FF166E1A-C8A1-4038-B726-B5A33928A5FC}] => (Allow) C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

30-04-2016 13:17:08 Odstraněno LEGO® Batman™
30-04-2016 13:44:06 Odinstalovat s Total Uninstall "Caesar IV"
30-04-2016 13:46:31 Odinstalovat s Total Uninstall "LEGO® Batman™"
30-04-2016 13:46:58 Odstraněno LEGO® Batman™
30-04-2016 13:49:12 Odinstalovat s Total Uninstall "CloneCD"
01-05-2016 14:46:25 Instalováno The Sims 3
10-05-2016 12:34:53 Scheduled Checkpoint
11-05-2016 20:17:21 Removed QuickTime 7
11-05-2016 20:20:13 Removed Skype Click to Call
11-05-2016 20:25:43 Removed Skype Click to Call

==================== Faulty Device Manager Devices =============

Name: TSSTcorp CDDVDW TS-L633C
Description: Jednotka CD-ROM
Class Guid: {4d36e965-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardní jednotky CD-ROM)
Service: cdrom
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.

==================== Event log errors: =========================

Application errors:
==================
Error: (05/14/2016 11:32:48 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: CompatTelRunner.exe, verze: 10.0.14275.1000, časové razítko: 0x56f0ef43
Název chybujícího modulu: invagent.dll, verze: 10.0.14275.1000, časové razítko: 0x56f0e905
Kód výjimky: 0xc0000005
Posun chyby: 0x000303f1
ID chybujícího procesu: 0x1450
Čas spuštění chybující aplikace: 0xCompatTelRunner.exe0
Cesta k chybující aplikaci: CompatTelRunner.exe1
Cesta k chybujícímu modulu: CompatTelRunner.exe2
ID zprávy: CompatTelRunner.exe3
Úplný název chybujícího balíčku: CompatTelRunner.exe4
ID aplikace související s chybujícím balíčkem: CompatTelRunner.exe5

Error: (05/14/2016 11:21:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: CompatTelRunner.exe, verze: 10.0.14275.1000, časové razítko: 0x56f0ef43
Název chybujícího modulu: invagent.dll, verze: 10.0.14275.1000, časové razítko: 0x56f0e905
Kód výjimky: 0xc0000005
Posun chyby: 0x000303f1
ID chybujícího procesu: 0x18f0
Čas spuštění chybující aplikace: 0xCompatTelRunner.exe0
Cesta k chybující aplikaci: CompatTelRunner.exe1
Cesta k chybujícímu modulu: CompatTelRunner.exe2
ID zprávy: CompatTelRunner.exe3
Úplný název chybujícího balíčku: CompatTelRunner.exe4
ID aplikace související s chybujícím balíčkem: CompatTelRunner.exe5

Error: (05/13/2016 06:05:27 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (05/13/2016 10:33:10 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: CompatTelRunner.exe, verze: 10.0.14275.1000, časové razítko: 0x56f0ef43
Název chybujícího modulu: invagent.dll, verze: 10.0.14275.1000, časové razítko: 0x56f0e905
Kód výjimky: 0xc0000005
Posun chyby: 0x000303f1
ID chybujícího procesu: 0x18c4
Čas spuštění chybující aplikace: 0xCompatTelRunner.exe0
Cesta k chybující aplikaci: CompatTelRunner.exe1
Cesta k chybujícímu modulu: CompatTelRunner.exe2
ID zprávy: CompatTelRunner.exe3
Úplný název chybujícího balíčku: CompatTelRunner.exe4
ID aplikace související s chybujícím balíčkem: CompatTelRunner.exe5

Error: (05/12/2016 06:03:14 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073422302

Error: (05/12/2016 10:20:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Název chybující aplikace: CompatTelRunner.exe, verze: 10.0.14275.1000, časové razítko: 0x56f0ef43
Název chybujícího modulu: invagent.dll, verze: 10.0.14275.1000, časové razítko: 0x56f0e905
Kód výjimky: 0xc0000005
Posun chyby: 0x000303f1
ID chybujícího procesu: 0x1cf8
Čas spuštění chybující aplikace: 0xCompatTelRunner.exe0
Cesta k chybující aplikaci: CompatTelRunner.exe1
Cesta k chybujícímu modulu: CompatTelRunner.exe2
ID zprávy: CompatTelRunner.exe3
Úplný název chybujícího balíčku: CompatTelRunner.exe4
ID aplikace související s chybujícím balíčkem: CompatTelRunner.exe5

Error: (05/11/2016 09:09:42 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Generování kontextu aktivace pro Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1 se nezdařilo.
Závislé sestavení Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" nelze najít.
Podrobnější diagnostické údaje získáte pomocí programu sxstrace.exe.

Error: (05/11/2016 08:25:45 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (05/11/2016 08:20:15 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (05/11/2016 08:17:33 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Služba Šifrování selhala při volání OnIdentity() v objektu System Writer.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

System errors:
=============
Error: (05/14/2016 11:11:12 AM) (Source: DCOM) (EventID: 10016) (User: Kamilka-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}Kamilka-PCKamilkaS-1-5-21-3219418776-4157282183-555089908-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742

Error: (05/14/2016 11:11:12 AM) (Source: DCOM) (EventID: 10016) (User: Kamilka-PC)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}Kamilka-PCKamilkaS-1-5-21-3219418776-4157282183-555089908-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742

Error: (05/13/2016 11:31:23 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (05/13/2016 12:05:17 AM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (05/12/2016 10:06:22 AM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (05/12/2016 08:05:46 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Služba NetTcpActivator závisí na službě NetTcpPortSharing, která neuspěla při spuštění v důsledku následující chyby:
%%1058

Error: (05/12/2016 08:04:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba User Data Access_36fc7 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restart the service.

Error: (05/12/2016 08:04:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba User Data Storage_36fc7 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restart the service.

Error: (05/12/2016 08:04:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Contact Data_36fc7 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restart the service.

Error: (05/12/2016 08:04:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Sync Host_36fc7 byla nečekaně ukončena. Stalo se to 1 krát. Následující opravná akce bude spuštěna za 10000 milisekund: Restart the service.

CodeIntegrity:
===================================
Date: 2016-05-12 08:06:17.341
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-12 08:06:17.226
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-12 08:06:17.113
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-12 08:06:16.996
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-12 08:06:16.882
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\eelam\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-12 08:06:16.765
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\eelam\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-11 20:36:09.775
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-11 20:36:09.663
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\ESET\ESET Smart Security\Drivers\ehdrv\ehdrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-11 20:36:09.552
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-05-11 20:36:09.433
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\eelam.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU T4400 @ 2.20GHz
Percentage of memory in use: 73%
Total physical RAM: 3004.61 MB
Available physical RAM: 781.46 MB
Total Virtual: 6076.61 MB
Available Virtual: 3777.17 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:222.83 GB) (Free:107.87 GB) NTFS
Drive d: () (Fixed) (Total:222.83 GB) (Free:110.84 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 6261FA1C)
Partition 1: (Not Active) - (Size=20 GB) - (Type=12)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=222.8 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=222.8 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

kallimka · #21 Příspěvek od **kallimka** » 14 kvě 2016 11:20

Po te kontrole aswMBR mam neco delat nebo jen zavrit?

#22 Příspěvek od **altrok** » 14 kvě 2016 11:25

AswMBR zavrete.

Do Poznamkoveho bloku (Start -> spustit -> notepad) zkopirujte obsah bileho pole
ulozte na plochu jako fixlist (Typ souboru: Textovy dokument)
znovu spustte FRST a kliknete na Fix

po restartu bude na plose ulozen fixlog, jehoz obsah vlozte do pristi odpovedi

Kód: Vybrat vše

Start
CreateRestorePoint:
CloseProcesses:
DeleteKey: HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{4254522D-5350-006A-76A7-A75C790C1B00}
File: C:\Windows\system32\drivers\WudfRd.sys
HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [3576664 2015-06-18] (Disc Soft Ltd)
Startup: C:\Users\Kamilka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk [2016-01-31]
CHR Plugin: (Native Client) - C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\gcswf32.dll => No File
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll => No File
CHR Plugin: (Skype Toolbars) - C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL => No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll => No File
CHR Plugin: (Google Update) - C:\Users\Kamilka\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File
2016-05-14 11:46 - 2016-05-14 11:46 - 00002754 _____ C:\Users\Kamilka\Desktop\aswMBR.txt
2016-05-14 11:46 - 2016-05-14 11:46 - 00000512 _____ C:\Users\Kamilka\Desktop\MBR.dat
2016-05-14 10:58 - 2016-05-14 10:58 - 05200384 _____ (AVAST Software) C:\Users\Kamilka\Desktop\aswmbr.exe
2016-05-14 07:21 - 2016-05-14 07:21 - 00006432 _____ C:\Users\Kamilka\Desktop\RK.txt
2016-05-14 06:47 - 2016-05-14 10:59 - 00000000 ____D C:\ProgramData\RogueKiller
2016-05-14 06:47 - 2016-05-14 06:47 - 00024688 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2016-05-14 06:46 - 2016-05-14 06:46 - 19837512 _____ C:\Users\Kamilka\Downloads\RogueKiller.exe
2016-05-13 15:32 - 2016-05-13 15:37 - 00642632 _____ (EFD Software ) C:\Users\Kamilka\Downloads\hdtune_255.exe
2016-05-11 21:12 - 2016-05-11 21:12 - 22851472 _____ (Malwarebytes ) C:\Users\Kamilka\Downloads\mbam-setup-2.2.1.1043.exe
2016-05-11 21:10 - 2016-05-11 21:10 - 00000000 ____D C:\Users\Kamilka\Desktop\Smart
2016-05-11 21:09 - 2016-05-11 21:12 - 00000292 _____ C:\Users\Kamilka\Desktop\DiskInfo.ini
2016-05-11 21:09 - 2016-02-10 22:04 - 00000000 ____D C:\Users\Kamilka\Desktop\CdiResource
2016-05-11 21:09 - 2016-02-10 22:00 - 03712720 _____ (Crystal Dew World) C:\Users\Kamilka\Desktop\DiskInfoX64.exe
2016-05-11 21:09 - 2016-02-10 22:00 - 02752720 _____ (Crystal Dew World) C:\Users\Kamilka\Desktop\DiskInfo.exe
2016-05-11 21:09 - 2016-01-17 20:13 - 00000000 ____D C:\Users\Kamilka\Desktop\License
2016-05-11 21:08 - 2016-05-11 21:08 - 04669119 _____ C:\Users\Kamilka\Desktop\CrystalDiskInfo6_7_5.zip
2016-05-11 20:29 - 2016-05-11 20:33 - 00000000 ____D C:\AdwCleaner
2016-05-11 20:27 - 2016-05-11 20:27 - 03640384 _____ C:\Users\Kamilka\Desktop\adwcleaner_5.116.exe
2016-05-09 08:35 - 2016-05-09 08:37 - 00050896 _____ C:\Users\Kamilka\Desktop\Addition.txt
2016-05-09 08:33 - 2016-05-14 11:53 - 00019469 _____ C:\Users\Kamilka\Desktop\FRST.txt
2016-05-09 08:32 - 2016-05-09 08:32 - 00015327 _____ C:\Users\Kamilka\Desktop\LM.bat
2016-05-09 08:29 - 2016-05-09 08:32 - 00029696 _____ C:\Users\Kamilka\AppData\Local\MSGBOX.EXE
2016-05-09 08:20 - 2016-05-09 08:21 - 00000000 ____D C:\rsit
2016-05-09 08:21 - 2015-05-09 15:46 - 00000000 ____D C:\Program Files\trend micro
2010-11-13 20:12 - 2010-11-13 20:12 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-11-06 19:12 - 2010-01-16 09:18 - 0131368 _____ () C:\ProgramData\FullRemove.exe
File: C:\ProgramData\mntemp
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.29.5\psuser.dll => No File
Task: {134673E0-3AE7-4085-889F-4D62A0DB5EFA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {155E7C4E-388B-487D-ABEA-854ACC31FD0B} - System32\Tasks\{D5F44F69-3986-45D0-B447-77E22B338DD2} => pcalua.exe -a F:\LEGO2.part01.exe -d F:\
Task: {232BEC77-B722-44F9-99E2-5439BB1B59FF} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {32EC5F8D-F387-43E3-913E-18BED4DF6E77} - System32\Tasks\{2A586BBF-9A38-4928-9E5E-3DF8D7C3E8A8} => D:\Stahnute\Zoo Tycoon 2\Čeština zootycoon2.exe
Task: {4184A7AD-A7DE-4EA7-890A-7E59F0186F88} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {476B317E-C411-4FEB-B5DF-301599A580BA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {53E4D469-ECAC-4638-A6B4-52D3E4519A71} - System32\Tasks\{6E1A49B2-4ED2-40D3-86FF-07CB5C98ACDF} => pcalua.exe -a E:\RM_Setup_DX8.exe -d E:\
Task: {6E0E3C6D-8783-46B5-9C53-9B18B5C70239} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {88BFAAFA-16B1-4E5B-919A-44FD06D95017} - System32\Tasks\{588EFBBC-73C5-4990-82C1-9FDBF5412A4C} => pcalua.exe -a "C:\Program Files\Electronic Arts\The Godfather The Game\eauninstall.exe" -d "C:\Program Files\Electronic Arts\The Godfather The Game"
Task: {8F266852-3B76-4177-92F5-8C3583C63CF6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {90C134C6-0A60-4C83-83D5-3C428B714D7A} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {D7ED93E5-3A3F-48E4-9D82-636AE0BD087C} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {DC0A3DE5-1167-40A0-AB94-27AC4C42DDFE} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {E490CBF3-E309-4CF7-980A-BED1B6359A37} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {E5066F7D-09F9-4F0F-BFCD-D49AC4FB5E4D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000Core.job => C:\Users\Kamilka\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000UA.job => C:\Users\Kamilka\AppData\Local\Google\Update\GoogleUpdate.exe
Hosts:
EmptyTemp:
End

kallimka · #23 Příspěvek od **kallimka** » 14 kvě 2016 11:42

Fix result of Farbar Recovery Scan Tool (x86) Version:07-05-2016
Ran by Kamilka (2016-05-14 12:31:39) Run:1
Running from C:\Users\Kamilka\Desktop
Loaded Profiles: Kamilka (Available Profiles: Kamilka & Mcx1-KAMILKA-PC & DefaultAppPool)
Boot Mode: Normal

==============================================

fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
DeleteKey: HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{4254522D-5350-006A-76A7-A75C790C1B00}
File: C:\Windows\system32\drivers\WudfRd.sys
HKU\S-1-5-21-3219418776-4157282183-555089908-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [3576664 2015-06-18] (Disc Soft Ltd)
Startup: C:\Users\Kamilka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk [2016-01-31]
CHR Plugin: (Native Client) - C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\pdf.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\gcswf32.dll => No File
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll => No File
CHR Plugin: (Skype Toolbars) - C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL => No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll => No File
CHR Plugin: (Google Update) - C:\Users\Kamilka\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll => No File
2016-05-14 11:46 - 2016-05-14 11:46 - 00002754 _____ C:\Users\Kamilka\Desktop\aswMBR.txt
2016-05-14 11:46 - 2016-05-14 11:46 - 00000512 _____ C:\Users\Kamilka\Desktop\MBR.dat
2016-05-14 10:58 - 2016-05-14 10:58 - 05200384 _____ (AVAST Software) C:\Users\Kamilka\Desktop\aswmbr.exe
2016-05-14 07:21 - 2016-05-14 07:21 - 00006432 _____ C:\Users\Kamilka\Desktop\RK.txt
2016-05-14 06:47 - 2016-05-14 10:59 - 00000000 ____D C:\ProgramData\RogueKiller
2016-05-14 06:47 - 2016-05-14 06:47 - 00024688 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2016-05-14 06:46 - 2016-05-14 06:46 - 19837512 _____ C:\Users\Kamilka\Downloads\RogueKiller.exe
2016-05-13 15:32 - 2016-05-13 15:37 - 00642632 _____ (EFD Software ) C:\Users\Kamilka\Downloads\hdtune_255.exe
2016-05-11 21:12 - 2016-05-11 21:12 - 22851472 _____ (Malwarebytes ) C:\Users\Kamilka\Downloads\mbam-setup-2.2.1.1043.exe
2016-05-11 21:10 - 2016-05-11 21:10 - 00000000 ____D C:\Users\Kamilka\Desktop\Smart
2016-05-11 21:09 - 2016-05-11 21:12 - 00000292 _____ C:\Users\Kamilka\Desktop\DiskInfo.ini
2016-05-11 21:09 - 2016-02-10 22:04 - 00000000 ____D C:\Users\Kamilka\Desktop\CdiResource
2016-05-11 21:09 - 2016-02-10 22:00 - 03712720 _____ (Crystal Dew World) C:\Users\Kamilka\Desktop\DiskInfoX64.exe
2016-05-11 21:09 - 2016-02-10 22:00 - 02752720 _____ (Crystal Dew World) C:\Users\Kamilka\Desktop\DiskInfo.exe
2016-05-11 21:09 - 2016-01-17 20:13 - 00000000 ____D C:\Users\Kamilka\Desktop\License
2016-05-11 21:08 - 2016-05-11 21:08 - 04669119 _____ C:\Users\Kamilka\Desktop\CrystalDiskInfo6_7_5.zip
2016-05-11 20:29 - 2016-05-11 20:33 - 00000000 ____D C:\AdwCleaner
2016-05-11 20:27 - 2016-05-11 20:27 - 03640384 _____ C:\Users\Kamilka\Desktop\adwcleaner_5.116.exe
2016-05-09 08:35 - 2016-05-09 08:37 - 00050896 _____ C:\Users\Kamilka\Desktop\Addition.txt
2016-05-09 08:33 - 2016-05-14 11:53 - 00019469 _____ C:\Users\Kamilka\Desktop\FRST.txt
2016-05-09 08:32 - 2016-05-09 08:32 - 00015327 _____ C:\Users\Kamilka\Desktop\LM.bat
2016-05-09 08:29 - 2016-05-09 08:32 - 00029696 _____ C:\Users\Kamilka\AppData\Local\MSGBOX.EXE
2016-05-09 08:20 - 2016-05-09 08:21 - 00000000 ____D C:\rsit
2016-05-09 08:21 - 2015-05-09 15:46 - 00000000 ____D C:\Program Files\trend micro
2010-11-13 20:12 - 2010-11-13 20:12 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-11-06 19:12 - 2010-01-16 09:18 - 0131368 _____ () C:\ProgramData\FullRemove.exe
File: C:\ProgramData\mntemp
CustomCLSID: HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Kamilka\AppData\Local\Google\Update\1.3.29.5\psuser.dll => No File
Task: {134673E0-3AE7-4085-889F-4D62A0DB5EFA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {155E7C4E-388B-487D-ABEA-854ACC31FD0B} - System32\Tasks\{D5F44F69-3986-45D0-B447-77E22B338DD2} => pcalua.exe -a F:\LEGO2.part01.exe -d F:\
Task: {232BEC77-B722-44F9-99E2-5439BB1B59FF} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {32EC5F8D-F387-43E3-913E-18BED4DF6E77} - System32\Tasks\{2A586BBF-9A38-4928-9E5E-3DF8D7C3E8A8} => D:\Stahnute\Zoo Tycoon 2\Čeština zootycoon2.exe
Task: {4184A7AD-A7DE-4EA7-890A-7E59F0186F88} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {476B317E-C411-4FEB-B5DF-301599A580BA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {53E4D469-ECAC-4638-A6B4-52D3E4519A71} - System32\Tasks\{6E1A49B2-4ED2-40D3-86FF-07CB5C98ACDF} => pcalua.exe -a E:\RM_Setup_DX8.exe -d E:\
Task: {6E0E3C6D-8783-46B5-9C53-9B18B5C70239} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {88BFAAFA-16B1-4E5B-919A-44FD06D95017} - System32\Tasks\{588EFBBC-73C5-4990-82C1-9FDBF5412A4C} => pcalua.exe -a "C:\Program Files\Electronic Arts\The Godfather The Game\eauninstall.exe" -d "C:\Program Files\Electronic Arts\The Godfather The Game"
Task: {8F266852-3B76-4177-92F5-8C3583C63CF6} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {90C134C6-0A60-4C83-83D5-3C428B714D7A} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {D7ED93E5-3A3F-48E4-9D82-636AE0BD087C} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {DC0A3DE5-1167-40A0-AB94-27AC4C42DDFE} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {E490CBF3-E309-4CF7-980A-BED1B6359A37} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {E5066F7D-09F9-4F0F-BFCD-D49AC4FB5E4D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000Core.job => C:\Users\Kamilka\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000UA.job => C:\Users\Kamilka\AppData\Local\Google\Update\GoogleUpdate.exe
Hosts:
EmptyTemp:
End
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{4254522D-5350-006A-76A7-A75C790C1B00} => key not found.

========================= File: C:\Windows\system32\drivers\WudfRd.sys ========================

File is digitally signed
MD5: EB34555DC8E1A35054499D43C727B99F
Creation and modification date: 2015-10-30 07:45 - 2015-10-30 07:45
Size: 0163328
Attributes: ----A
Company Name: Microsoft Corporation
Internal Name: WUDFRd.sys
Original Name: WUDFRd.sys
Product: Microsoft® Windows® Operating System
Description: Windows Driver Foundation - User-mode Driver Framework Reflector
Version: 10.0.10586.0 (th2_release.151029-1700)
Copyright: © Microsoft Corporation. All rights reserved.

====== End of File: ======

HKU\S-1-5-21-3219418776-4157282183-555089908-1000\Software\Microsoft\Windows\CurrentVersion\Run\\DAEMON Tools Lite Automount => value removed successfully.
C:\Users\Kamilka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RollerCoaster Tycoon 3 Registration.lnk => moved successfully
C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\ppGoogleNaClPluginChrome.dll => not found.
C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\pdf.dll => not found.
C:\Users\Kamilka\AppData\Local\Google\Chrome\Application\50.0.2661.102\gcswf32.dll => not found.
C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll => not found.
C:\Users\Kamilka\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll => not found.
C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => not found.
C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL => not found.
C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll => not found.
C:\Users\Kamilka\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll => not found.
C:\Users\Kamilka\Desktop\aswMBR.txt => moved successfully
C:\Users\Kamilka\Desktop\MBR.dat => moved successfully
C:\Users\Kamilka\Desktop\aswmbr.exe => moved successfully
C:\Users\Kamilka\Desktop\RK.txt => moved successfully
C:\ProgramData\RogueKiller => moved successfully
C:\WINDOWS\system32\Drivers\TrueSight.sys => moved successfully
C:\Users\Kamilka\Downloads\RogueKiller.exe => moved successfully
C:\Users\Kamilka\Downloads\hdtune_255.exe => moved successfully
C:\Users\Kamilka\Downloads\mbam-setup-2.2.1.1043.exe => moved successfully
C:\Users\Kamilka\Desktop\Smart => moved successfully
C:\Users\Kamilka\Desktop\DiskInfo.ini => moved successfully
C:\Users\Kamilka\Desktop\CdiResource => moved successfully
C:\Users\Kamilka\Desktop\DiskInfoX64.exe => moved successfully
C:\Users\Kamilka\Desktop\DiskInfo.exe => moved successfully
C:\Users\Kamilka\Desktop\License => moved successfully
C:\Users\Kamilka\Desktop\CrystalDiskInfo6_7_5.zip => moved successfully
C:\AdwCleaner => moved successfully
C:\Users\Kamilka\Desktop\adwcleaner_5.116.exe => moved successfully
C:\Users\Kamilka\Desktop\Addition.txt => moved successfully
C:\Users\Kamilka\Desktop\FRST.txt => moved successfully
C:\Users\Kamilka\Desktop\LM.bat => moved successfully
C:\Users\Kamilka\AppData\Local\MSGBOX.EXE => moved successfully
C:\rsit => moved successfully
C:\Program Files\trend micro => moved successfully
C:\ProgramData\ezsidmv.dat => moved successfully
C:\ProgramData\FullRemove.exe => moved successfully

========================= File: C:\ProgramData\mntemp ========================

File not signed
MD5: AB8050F918896B1BAED6261BBF1E5A32
Creation and modification date: 2016-04-30 13:42 - 2016-04-30 13:42
Size: 0000016
Attributes: ----A
Company Name:
Internal Name:
Original Name:
Product:
Description:
Version:
Copyright:

====== End of File: ======

"HKU\S-1-5-21-3219418776-4157282183-555089908-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{134673E0-3AE7-4085-889F-4D62A0DB5EFA}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{134673E0-3AE7-4085-889F-4D62A0DB5EFA}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{155E7C4E-388B-487D-ABEA-854ACC31FD0B}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{155E7C4E-388B-487D-ABEA-854ACC31FD0B}" => key removed successfully.
C:\Windows\System32\Tasks\{D5F44F69-3986-45D0-B447-77E22B338DD2} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{D5F44F69-3986-45D0-B447-77E22B338DD2}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{232BEC77-B722-44F9-99E2-5439BB1B59FF}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{232BEC77-B722-44F9-99E2-5439BB1B59FF}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{32EC5F8D-F387-43E3-913E-18BED4DF6E77}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{32EC5F8D-F387-43E3-913E-18BED4DF6E77}" => key removed successfully.
C:\Windows\System32\Tasks\{2A586BBF-9A38-4928-9E5E-3DF8D7C3E8A8} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{2A586BBF-9A38-4928-9E5E-3DF8D7C3E8A8}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4184A7AD-A7DE-4EA7-890A-7E59F0186F88}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4184A7AD-A7DE-4EA7-890A-7E59F0186F88}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{476B317E-C411-4FEB-B5DF-301599A580BA}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{476B317E-C411-4FEB-B5DF-301599A580BA}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{53E4D469-ECAC-4638-A6B4-52D3E4519A71}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{53E4D469-ECAC-4638-A6B4-52D3E4519A71}" => key removed successfully.
C:\Windows\System32\Tasks\{6E1A49B2-4ED2-40D3-86FF-07CB5C98ACDF} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{6E1A49B2-4ED2-40D3-86FF-07CB5C98ACDF}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6E0E3C6D-8783-46B5-9C53-9B18B5C70239}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6E0E3C6D-8783-46B5-9C53-9B18B5C70239}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{88BFAAFA-16B1-4E5B-919A-44FD06D95017}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{88BFAAFA-16B1-4E5B-919A-44FD06D95017}" => key removed successfully.
C:\Windows\System32\Tasks\{588EFBBC-73C5-4990-82C1-9FDBF5412A4C} => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{588EFBBC-73C5-4990-82C1-9FDBF5412A4C}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8F266852-3B76-4177-92F5-8C3583C63CF6}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8F266852-3B76-4177-92F5-8C3583C63CF6}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{90C134C6-0A60-4C83-83D5-3C428B714D7A}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{90C134C6-0A60-4C83-83D5-3C428B714D7A}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D7ED93E5-3A3F-48E4-9D82-636AE0BD087C}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D7ED93E5-3A3F-48E4-9D82-636AE0BD087C}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DC0A3DE5-1167-40A0-AB94-27AC4C42DDFE}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DC0A3DE5-1167-40A0-AB94-27AC4C42DDFE}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E490CBF3-E309-4CF7-980A-BED1B6359A37}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E490CBF3-E309-4CF7-980A-BED1B6359A37}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E5066F7D-09F9-4F0F-BFCD-D49AC4FB5E4D}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E5066F7D-09F9-4F0F-BFCD-D49AC4FB5E4D}" => key removed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => key removed successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000Core.job => moved successfully
C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-3219418776-4157282183-555089908-1000UA.job => moved successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 1.4 GB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 12:33:42 ====

#24 Příspěvek od **altrok** » 14 kvě 2016 11:55

Vice malwaru jiz v PC nevidim. Otestujte prosim, jak se PC chova ted.

kallimka · #25 Příspěvek od **kallimka** » 14 kvě 2016 12:02

Vypada to, ze vse slape jako predtim, muzete mi prosim napsat (jestli vite) odkud se to mohlo vzit a co to vlastne bylo?

#26 Příspěvek od **altrok** » 14 kvě 2016 12:25

Vylozene zavirovany pocitac nebyl, ale pro jistotu jsme jej vycistili a zkontrolovali nekolika ruznymi nastroji. Pricinou je dle meho obycejne pouzivani. Jednou za cas je dobre pocitac dukladneji procistit a zbavit jej docasnych souboru. Takze jeste uklidime.

Stahnete a spustte DelFix - https://toolslib.net/downloads/viewdownload/2-delfix/
Oznacte jen moznost "Remove disinfection tools"
kliknete na Run

A pokud nejsou dotazy ci jine problemy, je to ode mne vse.

kallimka · #27 Příspěvek od **kallimka** » 14 kvě 2016 13:08

Hotovo, moc Vam dekuji za pomoc. Jsem moc rada, ze toto forum funguje a uz ponekolikate mi tu lide vytahli trn z paty...hezky vikend

Ps: jdu poslat nejakou tu korunu na podporu fora

#28 Příspěvek od **altrok** » 14 kvě 2016 13:36

Nemate zac, rad jsem pomohl

Za podporu na provoz fora vam jmenem celeho tymu dekuji. I vam prijemny vikend

Mejte se krasne a treba zase nekdy

VIRY.CZ

Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita

Re: Prosim o kontrolu logu...vse online se pomalu nacita