Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

Umierajúci NTB, prosím o pomoc

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zpráva
Autor
godfather13
Návštěvník
Návštěvník
Příspěvky: 81
Registrován: 26 lis 2008 10:42

Umierajúci NTB, prosím o pomoc

#1 Příspěvek od godfather13 »

Dobrý deň Vám prajem
Posledný mesiac môj NTB bežal takmer non-stop [ práca / záverečná práca-škola ] a v posledných dňoch badateľne upadá zo dňa na deň. Včera dokonca nezvládal ani mozzilu a dnes už sekal aj pri filme (iné procesy neboli spustené) . Myslím si že to pri procesore amd a6-3400m apu 1,4 a pamäti 6gb nie je normálne. Dnes so vyčistil všetky nepotrebné súbory, odinštaloval nepoužívaný softvér, prebehol cez CCleaner pamäť+registre, no stále mu niečo bolo, spustil som kontrolu cez ESET NOD32, našiel mi iba nejaký toolbar čo som odstránil, no potom pri 54% sekol . Rovnako aj pri ďalších pokusoch.
Prosím Vás veľmi pekne, pozrite sa na môj LOG a zachánte ma. Čakajú ma ešte štátnice a záverečné obhajoby, a bez NTB dopadnem veľmi zle.

Vopred Vám ďakujem za pomoc :)

LOG RSIT:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Keramont at 2016-06-03 20:06:58
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 6 GB (8%) free of 74 GB
Total RAM: 5611 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:07:02, on 3. 6. 2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18315)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Users\Keramont\AppData\Local\Facebook\Update\FacebookUpdate.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\trend micro\Keramont.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Magic Desktop for HP notification] "C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKUS\S-1-5-18\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - (no file)
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O18 - Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O18 - Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Nemetschek Allplan Updatelauncher Service 2015 (AllplanUpdateLauncher 2015) - Nemetschek Allplan Systems GmbH - C:\Program Files\Nemetschek\AllplanUpdateLauncher 2015\AllplanUpdateLauncher.exe
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Atheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: Easybits Services for Windows (ezSharedSvc) - EasyBits Software AS - C:\Windows\System32\ezSharedSvcHost.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Flexera Software, Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Sentinel LDK License Manager (hasplms) - Unknown owner - C:\Windows\system32\hasplms.exe (file missing)
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Client Services (HPClientSvc) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HPWMISVC - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lmadmin - Flexera Software, Inc. - C:\Program Files (x86)\Common Files\Scia\LicenceServer\FlexnetServer\lmadmin.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10122 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10542 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
winlogon.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files\IDT\WDM\STacSV64.exe"
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\Nemetschek\AllplanUpdateLauncher 2015\AllplanUpdateLauncher.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe"
"C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"
"C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe"
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
C:\Windows\SysWOW64\ezSharedSvcHost.exe
C:\Windows\system32\hasplms.exe -run
"C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe"
"C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe"
"C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe"
"C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe"
"C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe"
"C:\Program Files (x86)\Common Files\Scia\LicenceServer\FlexnetServer\lmadmin.exe"
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2852
C:\Windows\System32\alg.exe
"C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\servicing\TrustedInstaller.exe
"C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe"
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\IDT\WDM\sttray64.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
"C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe"
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Windows\system32\GWX\GWX.exe"
taskeng.exe {F10C40C7-8EE6-46AD-B47C-FAA9254F6E3D}
"C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
SCIA -T Metro-HP 11.10 -1 -c scia\SCIA_Software.lic -lmgrd_port 6978 -x lmremove --lmgrd_start 57513d51 -l logs/SCIA.log
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
taskeng.exe {7ADC7F2A-2FC7-4E44-943D-B20A957D1C66}
C:\Users\Keramont\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
C:\Windows\system32\sppsvc.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe16_ Global\UsGthrCtrlFltPipeMssGthrPipe16 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 524 528 536 65536 532
"C:\Users\Keramont\Desktop\RSITx64.exe"

C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\AutoUpdate Allplan 2015.job - H:\ALLPLAN2015\SOFT\prg\NemDownloadHandler.exe /f "H:\ALLPLAN2015\DATA\Std\AllplanUpdate.inf"
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\HPCeeScheduleForKeramont.job - C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe HPCeeScheduleForKeramont (null)
C:\Windows\tasks\WebContent AutoUpdate 2015.job - H:\ALLPLAN2015\SOFT\prg\NemDownloadHandler.exe /f "H:\ALLPLAN2015\DATA\Std\AllplanUpdate.inf" /one http://autoupdate.allplan.com/Updates/A ... ontent.upd

=========Mozilla firefox=========

ProfilePath - C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\8ra28ait.Tomáš

prefs.js - "browser.startup.homepage" - "https://www.google.sk/?gws_rd=ssl"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.73.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.73.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.8]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.17.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C680BAE-655C-4E3D-8FC4-E6A520C3D928}]
SteadyVideoBHO Class - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2011-06-07 81024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-06-14 51872]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-06-10 2799912]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray64.exe [2010-12-17 525312]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-01-12 2918656]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeBridge"= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AthBtTray]
C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [2011-06-14 795808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autodesk Sync]
C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [2013-02-05 1081224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easybits Recovery]
C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Quick Launch]
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [2011-04-08 586808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPOSD]
C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [2011-06-13 336440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPQuickWebProxy]
C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [2011-06-27 168504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iFunBox Price Watch]
C:\Program Files (x86)\iFunbox 2014\iFunBox2014.exe /tray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
C:\Windows\Samsung\PanelMgr\SSMMgr.exe [2010-10-28 618496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefault]
C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [2011-06-27 42808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-07-05 336384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Users\Keramont\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Virtual Router Manager.lnk]
C:\Windows\Installer\{BE905C46-2B34-4D73-AEE1-769ED138E0FF}\_118D1A4EFFA6998C3492EB.exe /min []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"AdobeCS4ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"Magic Desktop for HP notification"=C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [2015-11-20 1444880]
""= []
"Acrobat Assistant 8.0"=C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2008-10-01 640376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"= []
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableLockWorkstation"=0
"DisableChangePassword"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"HideFastUserSwitching"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0
""=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"EnableShellExecuteHooks"=1
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2016-06-03 20:06:58 ----D---- C:\rsit
2016-06-01 12:08:22 ----HD---- C:\$WINDOWS.~BT
2016-05-19 15:36:29 ----D---- C:\Users\Keramont\AppData\Roaming\ezvid
2016-05-16 13:46:48 ----D---- C:\Program Files (x86)\Mozilla Firefox
2016-05-11 04:58:59 ----A---- C:\Windows\system32\win32k.sys
2016-05-11 04:58:57 ----A---- C:\Windows\SYSWOW64\tzres.dll
2016-05-11 04:58:57 ----A---- C:\Windows\system32\tzres.dll
2016-05-11 04:58:55 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2016-05-11 04:58:54 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2016-05-11 04:58:54 ----A---- C:\Windows\system32\cdd.dll
2016-05-11 04:58:52 ----A---- C:\Windows\SYSWOW64\d3d10level9.dll
2016-05-11 04:58:52 ----A---- C:\Windows\system32\gdi32.dll
2016-05-11 04:58:52 ----A---- C:\Windows\system32\d3d10level9.dll
2016-05-11 04:58:51 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-05-11 04:58:49 ----A---- C:\Windows\SYSWOW64\InkEd.dll
2016-05-11 04:58:49 ----A---- C:\Windows\system32\InkEd.dll
2016-05-11 04:58:45 ----A---- C:\Windows\SYSWOW64\inseng.dll
2016-05-11 04:58:45 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2016-05-11 04:58:45 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2016-05-11 04:58:45 ----A---- C:\Windows\system32\iernonce.dll
2016-05-11 04:58:45 ----A---- C:\Windows\system32\ieetwproxystub.dll
2016-05-11 04:58:45 ----A---- C:\Windows\system32\ieetwcollector.exe
2016-05-11 04:58:44 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2016-05-11 04:58:44 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2016-05-11 04:58:43 ----A---- C:\Windows\SYSWOW64\occache.dll
2016-05-11 04:58:43 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2016-05-11 04:58:43 ----A---- C:\Windows\system32\inseng.dll
2016-05-11 04:58:43 ----A---- C:\Windows\system32\ie4uinit.exe
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2016-05-11 04:58:42 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-05-11 04:58:39 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-05-11 04:58:37 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2016-05-11 04:58:37 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-05-11 04:58:37 ----A---- C:\Windows\system32\occache.dll
2016-05-11 04:58:37 ----A---- C:\Windows\system32\iedkcs32.dll
2016-05-11 04:58:36 ----A---- C:\Windows\SYSWOW64\jscript.dll
2016-05-11 04:58:36 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-05-11 04:58:36 ----A---- C:\Windows\system32\urlmon.dll
2016-05-11 04:58:36 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2016-05-11 04:58:35 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2016-05-11 04:58:35 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2016-05-11 04:58:34 ----A---- C:\Windows\SYSWOW64\ieui.dll
2016-05-11 04:58:34 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2016-05-11 04:58:34 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2016-05-11 04:58:34 ----A---- C:\Windows\system32\msfeeds.dll
2016-05-11 04:58:34 ----A---- C:\Windows\system32\dxtrans.dll
2016-05-11 04:58:32 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-05-11 04:58:31 ----A---- C:\Windows\system32\iesetup.dll
2016-05-11 04:58:31 ----A---- C:\Windows\system32\ieapfltr.dll
2016-05-11 04:58:29 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2016-05-11 04:58:29 ----A---- C:\Windows\system32\iertutil.dll
2016-05-11 04:58:28 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2016-05-11 04:58:28 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-05-11 04:58:28 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2016-05-11 04:58:28 ----A---- C:\Windows\system32\vbscript.dll
2016-05-11 04:58:27 ----A---- C:\Windows\SYSWOW64\wininet.dll
2016-05-11 04:58:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2016-05-11 04:58:27 ----A---- C:\Windows\system32\jsproxy.dll
2016-05-11 04:58:26 ----A---- C:\Windows\system32\dxtmsft.dll
2016-05-11 04:58:25 ----A---- C:\Windows\system32\ieui.dll
2016-05-11 04:58:24 ----A---- C:\Windows\system32\mshtmled.dll
2016-05-11 04:58:24 ----A---- C:\Windows\system32\ieframe.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\webcheck.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\mshtmlmedia.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\jscript.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\ieUnatt.exe
2016-05-11 04:58:22 ----A---- C:\Windows\system32\jscript9diag.dll
2016-05-11 04:58:22 ----A---- C:\Windows\system32\jscript9.dll
2016-05-11 04:58:21 ----A---- C:\Windows\system32\wininet.dll
2016-05-11 04:58:20 ----A---- C:\Windows\system32\msrating.dll
2016-05-11 04:58:20 ----A---- C:\Windows\system32\MshtmlDac.dll
2016-05-11 04:58:17 ----A---- C:\Windows\system32\mshtml.dll
2016-05-11 04:58:00 ----A---- C:\Windows\system32\ntoskrnl.exe
2016-05-11 04:57:59 ----A---- C:\Windows\system32\rpcrt4.dll
2016-05-11 04:57:59 ----A---- C:\Windows\system32\lsasrv.dll
2016-05-11 04:57:58 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2016-05-11 04:57:58 ----A---- C:\Windows\system32\kerberos.dll
2016-05-11 04:57:57 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2016-05-11 04:57:56 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2016-05-11 04:57:55 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2016-05-11 04:57:55 ----A---- C:\Windows\system32\ntdll.dll
2016-05-11 04:57:54 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2016-05-11 04:57:54 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2016-05-11 04:57:54 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2016-05-11 04:57:53 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2016-05-11 04:57:53 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2016-05-11 04:57:53 ----A---- C:\Windows\SYSWOW64\certcli.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\wow64win.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\smss.exe
2016-05-11 04:57:53 ----A---- C:\Windows\system32\schannel.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\msv1_0.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\KernelBase.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\kernel32.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2016-05-11 04:57:53 ----A---- C:\Windows\system32\certcli.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\advapi32.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\schannel.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\wow64.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\winsrv.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\wdigest.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\TSpkg.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\sspicli.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\srcore.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\rpchttp.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\ncrypt.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2016-05-11 04:57:52 ----A---- C:\Windows\system32\csrsrv.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\conhost.exe
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\srclient.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\wow64cpu.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\sspisrv.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\srclient.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\setbcdlocale.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\secur32.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\rstrui.exe
2016-05-11 04:57:51 ----A---- C:\Windows\system32\ntvdm64.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\lsass.exe
2016-05-11 04:57:51 ----A---- C:\Windows\system32\drivers\appid.sys
2016-05-11 04:57:51 ----A---- C:\Windows\system32\cryptbase.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\credssp.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\appidsvc.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\appidapi.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\wow32.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\secur32.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\credssp.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2016-05-11 04:57:50 ----A---- C:\Windows\system32\auditpol.exe
2016-05-11 04:57:50 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2016-05-11 04:57:50 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\user.exe
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\setup16.exe
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\instnm.exe
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\msobjs.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\msaudite.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\apisetschema.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\adtschema.dll
2016-05-11 04:57:40 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2016-05-11 04:57:40 ----A---- C:\Windows\system32\WindowsCodecs.dll

======List of files/folders modified in the last 1 month======

2016-06-03 20:07:00 ----D---- C:\Program Files\trend micro
2016-06-03 20:06:59 ----D---- C:\Windows\temp
2016-06-03 19:55:52 ----D---- C:\Program Files\IMPI
2016-06-03 19:29:49 ----D---- C:\Windows
2016-06-03 19:29:49 ----D---- C:\Program Files (x86)
2016-06-03 19:29:48 ----D---- C:\Windows\SysWOW64
2016-06-03 19:29:48 ----D---- C:\Windows\System32
2016-06-03 19:29:21 ----SHD---- C:\Windows\Installer
2016-06-03 19:28:37 ----SHD---- C:\System Volume Information
2016-06-03 19:26:41 ----D---- C:\Windows\system32\drivers
2016-06-03 19:24:40 ----D---- C:\Users\Keramont\AppData\Roaming\Skype
2016-06-03 15:16:26 ----D---- C:\Users\Keramont\AppData\Roaming\vlc
2016-06-03 14:50:18 ----D---- C:\Windows\inf
2016-06-03 14:50:18 ----D---- C:\Windows\debug
2016-06-03 09:26:43 ----D---- C:\Windows\Prefetch
2016-06-03 09:06:35 ----D---- C:\Windows\system32\config
2016-06-02 16:47:51 ----D---- C:\Windows\winsxs
2016-06-01 12:08:58 ----D---- C:\Windows\Panther
2016-05-31 14:09:34 ----D---- C:\Windows\system32\Tasks
2016-05-31 12:34:11 ----D---- C:\The KMPlayer
2016-05-27 00:35:13 ----SD---- C:\Windows\SYSWOW64\GWX
2016-05-27 00:35:13 ----SD---- C:\Windows\system32\GWX
2016-05-20 13:46:50 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-05-20 10:20:36 ----D---- C:\Windows\rescache
2016-05-16 15:54:47 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-12 03:00:48 ----D---- C:\Windows\system32\appraiser
2016-05-11 15:12:27 ----D---- C:\Windows\Microsoft.NET
2016-05-11 15:09:28 ----RSD---- C:\Windows\assembly
2016-05-11 10:56:58 ----D---- C:\Windows\SYSWOW64\sk-SK
2016-05-11 10:56:57 ----D---- C:\Windows\system32\sk-SK
2016-05-11 10:56:56 ----D---- C:\Windows\ehome
2016-05-11 10:56:51 ----D---- C:\Program Files\Internet Explorer
2016-05-11 10:56:48 ----D---- C:\Windows\SYSWOW64\en-US
2016-05-11 10:56:43 ----D---- C:\Windows\system32\en-US
2016-05-11 10:56:39 ----D---- C:\Program Files (x86)\Internet Explorer
2016-05-11 10:56:15 ----D---- C:\Windows\AppPatch
2016-05-11 10:56:13 ----D---- C:\Windows\system32\Boot
2016-05-11 07:13:18 ----D---- C:\ProgramData\Microsoft Help
2016-05-11 06:45:18 ----D---- C:\Windows\system32\MRT
2016-05-11 06:45:15 ----A---- C:\Windows\system32\MRT.exe
2016-05-11 04:55:38 ----D---- C:\Windows\system32\catroot2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amd_sata;amd_sata; C:\Windows\system32\DRIVERS\amd_sata.sys [2011-04-16 79488]
R0 amd_xata;amd_xata; C:\Windows\system32\DRIVERS\amd_xata.sys [2011-04-16 40064]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 snapman;Acronis Snapshots Manager; C:\Windows\system32\DRIVERS\snapman.sys [2012-07-03 198944]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2013-03-02 834544]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-07-07 283200]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-12-21 141264]
R1 vpcnfltr;Virtual PC Network Filter Driver; C:\Windows\system32\DRIVERS\vpcnfltr.sys [2010-11-20 59392]
R1 vpcvmm;@%SystemRoot%\system32\drivers\vpcvmm.sys,-100; C:\Windows\system32\drivers\vpcvmm.sys [2010-11-20 360832]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-06-27 88632]
R2 aksdf;aksdf; \??\C:\Windows\system32\drivers\aksdf.sys [2014-07-17 91784]
R2 aksfridge;aksfridge; \??\C:\Windows\system32\drivers\aksfridge.sys [2014-07-17 162136]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-12-21 170640]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-12-21 125296]
R2 hardlock;hardlock; \??\C:\Windows\system32\drivers\hardlock.sys [2014-07-17 331608]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2009-11-17 11576]
R3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-07-06 9359872]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-07-06 309760]
R3 athr;Qualcomm Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2012-06-20 3678720]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2011-06-14 30368]
R3 clwvd;CyberLink WebCam Virtual Driver; C:\Windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver; C:\Windows\system32\DRIVERS\RtsPStor.sys [2011-01-13 333928]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-12-01 412264]
R3 STHDA;@%SystemRoot%\system32\stlang64.dll,-10322; C:\Windows\system32\DRIVERS\stwrt64.sys [2010-12-17 520192]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-06-10 1451056]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2010-12-16 47232]
R3 vpcbus;Virtual PC Host Bus Service; C:\Windows\system32\DRIVERS\vpchbus.sys [2010-11-20 194944]
R3 vpcusb;USB Virtualization Connector Service; C:\Windows\system32\DRIVERS\vpcusb.sys [2010-11-20 95232]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys []
S3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2011-06-14 36000]
S3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl664.sys [2009-06-10 1311232]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2011-06-14 330400]
S3 btath_avdt;Atheros Bluetooth AVDT Service; C:\Windows\system32\drivers\btath_avdt.sys [2011-06-14 110240]
S3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2011-06-14 167072]
S3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2011-06-14 68256]
S3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2011-06-14 280992]
S3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2011-06-14 496800]
S3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 dgderdrv;dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [2010-05-01 20568]
S3 EagleX64;EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys []
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\Windows\system32\DRIVERS\ew_hwusbdev.sys []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
S3 huawei_enumerator;huawei_enumerator; C:\Windows\system32\DRIVERS\ew_jubusenum.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys []
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-21 109056]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver; C:\Windows\system32\DRIVERS\silabenm.sys [2011-08-08 27336]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver; C:\Windows\system32\DRIVERS\silabser.sys [2011-08-08 70656]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 taphss6;Anchorfree HSS VPN Adapter; C:\Windows\system32\DRIVERS\taphss6.sys []
S3 TFsExDisk;TFsExDisk; \??\C:\Windows\System32\Drivers\TFsExDisk.sys [2010-05-01 16392]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\Windows\system32\DRIVERS\wdcsam64.sys [2015-04-30 23200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-04-22 82128]
R2 AllplanUpdateLauncher 2015;Nemetschek Allplan Updatelauncher Service 2015; C:\Program Files\Nemetschek\AllplanUpdateLauncher 2015\AllplanUpdateLauncher.exe [2014-10-30 16680]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-07-06 204288]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-05 365568]
R2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-06-14 138400]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [2011-06-14 97952]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-12-13 12288]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-01-12 810144]
R2 ezSharedSvc;Easybits Services for Windows; C:\Windows\syswow64\ezSharedSvcHost.exe [2010-04-23 514232]
R2 hasplms;Sentinel LDK License Manager; C:\Windows\system32\hasplms.exe [2014-07-17 4683144]
R2 HP Support Assistant Service;HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560]
R2 HPClientSvc;HP Client Services; C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service; C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-03-14 197504]
R2 HPWMISVC;HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-04-08 26680]
R2 IconMan_R;IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-01-14 1751656]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [2011-06-20 73728]
R2 lmadmin;lmadmin; C:\Program Files (x86)\Common Files\Scia\LicenceServer\FlexnetServer\lmadmin.exe [2011-08-05 6587728]
R2 STacSV;@%SystemRoot%\system32\stlang64.dll,-10122; C:\Program Files\IDT\WDM\STacSV64.exe [2010-12-17 276992]
R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2015-02-25 1044816]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2015-11-05 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2015-11-05 125112]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-02 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-02-18 315488]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2015-11-05 51376]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2011-01-12 42360]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-05-08 1471352]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-02 116648]
S3 hpqwmiex;HP Software Framework Service; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [2012-03-14 994176]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2016-04-23 114688]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2013-12-19 30814400]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2016-05-16 146888]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\syswow64\GameMon.des [2015-07-22 3611808]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-07-06 1255736]
S4 AcronisOSSReinstallSvc;Acronis OS Selector Reinstall Service; C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2007-02-22 2217416]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Umierajúci NTB, prosím o pomoc

#2 Příspěvek od Rudy »

Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

godfather13
Návštěvník
Návštěvník
Příspěvky: 81
Registrován: 26 lis 2008 10:42

Re: Umierajúci NTB, prosím o pomoc

#3 Příspěvek od godfather13 »

Rudy, ďakujem Vám veľmi pekne za pomoc

Tu je Log z AdwCleaner:

# AdwCleaner v5.119 - Log vytvorený 03/06/2016 v 21:30:56
# Aktualizované 30/05/2016 by Xplode
# Databáza : 2016-05-30.3 [Server]
# Operačný systém : Windows 7 Home Premium Service Pack 1 (X64)
# Užívateľské meno : Keramont - METRO-HP
# Spustené z : C:\Users\Keramont\Desktop\adwcleaner_5.119.exe
# Nastavenie : Čistenie
# Podpora : http://toolslib.net/forum

***** [ Služby ] *****


***** [ Priečinky ] *****

[-] Priečinok Zmazané : C:\Users\Keramont\AppData\Local\Google\Chrome\User Data\Default\Extensions\bobgnmijljonenlachekpkgikohcghon
[-] Priečinok Zmazané : C:\Users\Keramont\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppmjceoiaemcohnikoniifdmoemkegej

***** [ Súbory ] *****

[-] Súbor Zmazané : C:\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT\bprotector_extensions.sqlite
[-] Súbor Zmazané : C:\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT\bprotector_prefs.js

***** [ DLLs ] *****


***** [ WMI ] *****


***** [ Zástupcovia ] *****


***** [ Naplánované úlohy ] *****


***** [ Registre ] *****

[-] Kľúč registra Zmazané : HKCU\Software\Classes\AppID\npPokkiDownloadHelper.dll
[-] Kľúč registra Zmazané : HKCU\Software\Classes\MIME\Database\Content Type\application/x-pokkidownloadhelper
[-] Kľúč registra Zmazané : HKCU\Software\MozillaPlugins\pokki.com/PokkiDownloadHelper
[-] Kľúč registra Zmazané : HKLM\SOFTWARE\Classes\CLSID\{D879A501-50A7-BEFC-A4C5-32DC6E0CB208}
[-] Kľúč registra Zmazané : HKCU\Software\Classes\TypeLib\{39B1EC90-428D-4033-9E32-ED28D02FF588}
[-] Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{22848257-6A2D-4D2A-8D56-C886D25B8B58}
[-] Kľúč registra Zmazané : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{22848257-6A2D-4D2A-8D56-C886D25B8B58}
[-] Kľúč registra Zmazané : HKCU\Software\Pokki
[-] Kľúč registra Zmazané : HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
[-] Kľúč registra Zmazané : HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Kľúč registra Zmazané : HKU\S-1-5-19\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Kľúč registra Zmazané : HKU\S-1-5-20\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
[-] Kľúč registra Zmazané : HKU\S-1-5-20\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}

***** [ Webové prehliadače ] *****

[-] [C:\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT\prefs.js] Zmazané : user_pref("browser.newtab.url", "hxxp://mixidj.delta-search.com/?affID=121125&babsrc=NT_ss&mntrId=86cd0f0600000000000016de2b1bb74b");

*************************

:: "Tracing" kľúče zmazané
:: Nastavenia Winsock resetované.

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [2870 bajtov] - [03/06/2016 21:30:56]
C:\AdwCleaner\AdwCleaner[R3].txt - [3019 bajtov] - [25/10/2014 13:10:38]
C:\AdwCleaner\AdwCleaner[R4].txt - [1948 bajtov] - [18/01/2015 23:10:20]
C:\AdwCleaner\AdwCleaner[S1].txt - [3466 bajtov] - [03/06/2016 21:28:56]
C:\AdwCleaner\AdwCleaner[S2].txt - [2958 bajtov] - [25/10/2014 13:13:34]
C:\AdwCleaner\AdwCleaner[S3].txt - [2034 bajtov] - [18/01/2015 23:12:22]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [3314 bajtov] ##########

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Umierajúci NTB, prosím o pomoc

#4 Příspěvek od Rudy »

Zatím není za co. Teď dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

godfather13
Návštěvník
Návštěvník
Příspěvky: 81
Registrován: 26 lis 2008 10:42

Re: Umierajúci NTB, prosím o pomoc

#5 Příspěvek od godfather13 »

Nový Log z RSIT:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Keramont at 2016-06-03 22:28:45
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 6 GB (8%) free of 74 GB
Total RAM: 5611 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:28:48, on 3. 6. 2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18315)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files\trend micro\Keramont.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Magic Desktop for HP notification] "C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKUS\S-1-5-18\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - (no file)
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O18 - Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O18 - Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Nemetschek Allplan Updatelauncher Service 2015 (AllplanUpdateLauncher 2015) - Nemetschek Allplan Systems GmbH - C:\Program Files\Nemetschek\AllplanUpdateLauncher 2015\AllplanUpdateLauncher.exe
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Atheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: Easybits Services for Windows (ezSharedSvc) - EasyBits Software AS - C:\Windows\System32\ezSharedSvcHost.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Flexera Software, Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Sentinel LDK License Manager (hasplms) - Unknown owner - C:\Windows\system32\hasplms.exe (file missing)
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Client Services (HPClientSvc) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HPWMISVC - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lmadmin - Flexera Software, Inc. - C:\Program Files (x86)\Common Files\Scia\LicenceServer\FlexnetServer\lmadmin.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10122 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10422 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files\IDT\WDM\STacSV64.exe"

atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
taskeng.exe {FCA25E93-836F-4B71-AC32-F811F1B25CCA}
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\Nemetschek\AllplanUpdateLauncher 2015\AllplanUpdateLauncher.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe"
"C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"
"C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe"
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
C:\Windows\SysWOW64\ezSharedSvcHost.exe
C:\Windows\system32\hasplms.exe -run
"C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe"
"C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe"
"C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe"
"C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe"
"C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe"
"C:\Program Files (x86)\Common Files\Scia\LicenceServer\FlexnetServer\lmadmin.exe"
C:\Windows\system32\svchost.exe -k imgsvc
SCIA -T Metro-HP 11.10 -1 -c scia\SCIA_Software.lic -lmgrd_port 6978 -x lmremove --lmgrd_start 5751db98 -l logs/SCIA.log
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2744
"C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"
C:\Windows\System32\alg.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\servicing\TrustedInstaller.exe
"C:\Windows\system32\Dwm.exe"
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"taskhost.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe"
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\IDT\WDM\sttray64.exe"
"C:\Windows\system32\GWX\GWX.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
taskeng.exe {E74FE690-5C04-4E72-900C-397E5AFD41B0}
"C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe"
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\Keramont\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\AutoUpdate Allplan 2015.job - H:\ALLPLAN2015\SOFT\prg\NemDownloadHandler.exe /f "H:\ALLPLAN2015\DATA\Std\AllplanUpdate.inf"
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\HPCeeScheduleForKeramont.job - C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe HPCeeScheduleForKeramont (null)
C:\Windows\tasks\WebContent AutoUpdate 2015.job - H:\ALLPLAN2015\SOFT\prg\NemDownloadHandler.exe /f "H:\ALLPLAN2015\DATA\Std\AllplanUpdate.inf" /one http://autoupdate.allplan.com/Updates/A ... ontent.upd

=========Mozilla firefox=========

ProfilePath - C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\8ra28ait.Tomáš

prefs.js - "browser.startup.homepage" - "https://www.google.sk/?gws_rd=ssl"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.73.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.73.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.8]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.17.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C680BAE-655C-4E3D-8FC4-E6A520C3D928}]
SteadyVideoBHO Class - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2011-06-07 81024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-06-14 51872]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-06-10 2799912]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray64.exe [2010-12-17 525312]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-01-12 2918656]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeBridge"= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AthBtTray]
C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [2011-06-14 795808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autodesk Sync]
C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [2013-02-05 1081224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easybits Recovery]
C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Quick Launch]
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [2011-04-08 586808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPOSD]
C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [2011-06-13 336440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPQuickWebProxy]
C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [2011-06-27 168504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iFunBox Price Watch]
C:\Program Files (x86)\iFunbox 2014\iFunBox2014.exe /tray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
C:\Windows\Samsung\PanelMgr\SSMMgr.exe [2010-10-28 618496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefault]
C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [2011-06-27 42808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-07-05 336384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Users\Keramont\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Virtual Router Manager.lnk]
C:\Windows\Installer\{BE905C46-2B34-4D73-AEE1-769ED138E0FF}\_118D1A4EFFA6998C3492EB.exe /min []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"AdobeCS4ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"Magic Desktop for HP notification"=C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [2015-11-20 1444880]
""= []
"Acrobat Assistant 8.0"=C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2008-10-01 640376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"= []
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableLockWorkstation"=0
"DisableChangePassword"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"HideFastUserSwitching"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0
""=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"EnableShellExecuteHooks"=1
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2016-06-03 20:06:58 ----D---- C:\rsit
2016-06-01 12:08:22 ----HD---- C:\$WINDOWS.~BT
2016-05-19 15:36:29 ----D---- C:\Users\Keramont\AppData\Roaming\ezvid
2016-05-16 13:46:48 ----D---- C:\Program Files (x86)\Mozilla Firefox
2016-05-11 04:58:59 ----A---- C:\Windows\system32\win32k.sys
2016-05-11 04:58:57 ----A---- C:\Windows\SYSWOW64\tzres.dll
2016-05-11 04:58:57 ----A---- C:\Windows\system32\tzres.dll
2016-05-11 04:58:55 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2016-05-11 04:58:54 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2016-05-11 04:58:54 ----A---- C:\Windows\system32\cdd.dll
2016-05-11 04:58:52 ----A---- C:\Windows\SYSWOW64\d3d10level9.dll
2016-05-11 04:58:52 ----A---- C:\Windows\system32\gdi32.dll
2016-05-11 04:58:52 ----A---- C:\Windows\system32\d3d10level9.dll
2016-05-11 04:58:51 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-05-11 04:58:49 ----A---- C:\Windows\SYSWOW64\InkEd.dll
2016-05-11 04:58:49 ----A---- C:\Windows\system32\InkEd.dll
2016-05-11 04:58:45 ----A---- C:\Windows\SYSWOW64\inseng.dll
2016-05-11 04:58:45 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2016-05-11 04:58:45 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2016-05-11 04:58:45 ----A---- C:\Windows\system32\iernonce.dll
2016-05-11 04:58:45 ----A---- C:\Windows\system32\ieetwproxystub.dll
2016-05-11 04:58:45 ----A---- C:\Windows\system32\ieetwcollector.exe
2016-05-11 04:58:44 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2016-05-11 04:58:44 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2016-05-11 04:58:43 ----A---- C:\Windows\SYSWOW64\occache.dll
2016-05-11 04:58:43 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2016-05-11 04:58:43 ----A---- C:\Windows\system32\inseng.dll
2016-05-11 04:58:43 ----A---- C:\Windows\system32\ie4uinit.exe
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2016-05-11 04:58:42 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-05-11 04:58:39 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-05-11 04:58:37 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2016-05-11 04:58:37 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-05-11 04:58:37 ----A---- C:\Windows\system32\occache.dll
2016-05-11 04:58:37 ----A---- C:\Windows\system32\iedkcs32.dll
2016-05-11 04:58:36 ----A---- C:\Windows\SYSWOW64\jscript.dll
2016-05-11 04:58:36 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-05-11 04:58:36 ----A---- C:\Windows\system32\urlmon.dll
2016-05-11 04:58:36 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2016-05-11 04:58:35 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2016-05-11 04:58:35 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2016-05-11 04:58:34 ----A---- C:\Windows\SYSWOW64\ieui.dll
2016-05-11 04:58:34 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2016-05-11 04:58:34 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2016-05-11 04:58:34 ----A---- C:\Windows\system32\msfeeds.dll
2016-05-11 04:58:34 ----A---- C:\Windows\system32\dxtrans.dll
2016-05-11 04:58:32 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-05-11 04:58:31 ----A---- C:\Windows\system32\iesetup.dll
2016-05-11 04:58:31 ----A---- C:\Windows\system32\ieapfltr.dll
2016-05-11 04:58:29 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2016-05-11 04:58:29 ----A---- C:\Windows\system32\iertutil.dll
2016-05-11 04:58:28 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2016-05-11 04:58:28 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-05-11 04:58:28 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2016-05-11 04:58:28 ----A---- C:\Windows\system32\vbscript.dll
2016-05-11 04:58:27 ----A---- C:\Windows\SYSWOW64\wininet.dll
2016-05-11 04:58:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2016-05-11 04:58:27 ----A---- C:\Windows\system32\jsproxy.dll
2016-05-11 04:58:26 ----A---- C:\Windows\system32\dxtmsft.dll
2016-05-11 04:58:25 ----A---- C:\Windows\system32\ieui.dll
2016-05-11 04:58:24 ----A---- C:\Windows\system32\mshtmled.dll
2016-05-11 04:58:24 ----A---- C:\Windows\system32\ieframe.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\webcheck.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\mshtmlmedia.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\jscript.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\ieUnatt.exe
2016-05-11 04:58:22 ----A---- C:\Windows\system32\jscript9diag.dll
2016-05-11 04:58:22 ----A---- C:\Windows\system32\jscript9.dll
2016-05-11 04:58:21 ----A---- C:\Windows\system32\wininet.dll
2016-05-11 04:58:20 ----A---- C:\Windows\system32\msrating.dll
2016-05-11 04:58:20 ----A---- C:\Windows\system32\MshtmlDac.dll
2016-05-11 04:58:17 ----A---- C:\Windows\system32\mshtml.dll
2016-05-11 04:58:00 ----A---- C:\Windows\system32\ntoskrnl.exe
2016-05-11 04:57:59 ----A---- C:\Windows\system32\rpcrt4.dll
2016-05-11 04:57:59 ----A---- C:\Windows\system32\lsasrv.dll
2016-05-11 04:57:58 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2016-05-11 04:57:58 ----A---- C:\Windows\system32\kerberos.dll
2016-05-11 04:57:57 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2016-05-11 04:57:56 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2016-05-11 04:57:55 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2016-05-11 04:57:55 ----A---- C:\Windows\system32\ntdll.dll
2016-05-11 04:57:54 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2016-05-11 04:57:54 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2016-05-11 04:57:54 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2016-05-11 04:57:53 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2016-05-11 04:57:53 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2016-05-11 04:57:53 ----A---- C:\Windows\SYSWOW64\certcli.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\wow64win.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\smss.exe
2016-05-11 04:57:53 ----A---- C:\Windows\system32\schannel.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\msv1_0.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\KernelBase.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\kernel32.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2016-05-11 04:57:53 ----A---- C:\Windows\system32\certcli.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\advapi32.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\schannel.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\wow64.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\winsrv.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\wdigest.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\TSpkg.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\sspicli.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\srcore.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\rpchttp.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\ncrypt.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2016-05-11 04:57:52 ----A---- C:\Windows\system32\csrsrv.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\conhost.exe
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\srclient.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\wow64cpu.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\sspisrv.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\srclient.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\setbcdlocale.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\secur32.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\rstrui.exe
2016-05-11 04:57:51 ----A---- C:\Windows\system32\ntvdm64.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\lsass.exe
2016-05-11 04:57:51 ----A---- C:\Windows\system32\drivers\appid.sys
2016-05-11 04:57:51 ----A---- C:\Windows\system32\cryptbase.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\credssp.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\appidsvc.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\appidapi.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\wow32.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\secur32.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\credssp.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2016-05-11 04:57:50 ----A---- C:\Windows\system32\auditpol.exe
2016-05-11 04:57:50 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2016-05-11 04:57:50 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\user.exe
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\setup16.exe
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\instnm.exe
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\msobjs.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\msaudite.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\apisetschema.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\adtschema.dll
2016-05-11 04:57:40 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2016-05-11 04:57:40 ----A---- C:\Windows\system32\WindowsCodecs.dll

======List of files/folders modified in the last 1 month======

2016-06-03 22:28:47 ----D---- C:\Program Files\trend micro
2016-06-03 22:28:46 ----D---- C:\Windows\temp
2016-06-03 22:28:32 ----D---- C:\Users\Keramont\AppData\Roaming\vlc
2016-06-03 21:34:36 ----D---- C:\Windows\inf
2016-06-03 21:34:03 ----D---- C:\Windows\system32\config
2016-06-03 21:33:30 ----D---- C:\Windows
2016-06-03 21:30:56 ----D---- C:\AdwCleaner
2016-06-03 19:55:52 ----D---- C:\Program Files\IMPI
2016-06-03 19:29:49 ----D---- C:\Program Files (x86)
2016-06-03 19:29:48 ----D---- C:\Windows\SysWOW64
2016-06-03 19:29:48 ----D---- C:\Windows\System32
2016-06-03 19:29:21 ----SHD---- C:\Windows\Installer
2016-06-03 19:28:37 ----SHD---- C:\System Volume Information
2016-06-03 19:26:41 ----D---- C:\Windows\system32\drivers
2016-06-03 19:24:40 ----D---- C:\Users\Keramont\AppData\Roaming\Skype
2016-06-03 14:50:18 ----D---- C:\Windows\debug
2016-06-03 09:26:43 ----D---- C:\Windows\Prefetch
2016-06-02 16:47:51 ----D---- C:\Windows\winsxs
2016-06-01 12:08:58 ----D---- C:\Windows\Panther
2016-05-31 14:09:34 ----D---- C:\Windows\system32\Tasks
2016-05-31 12:34:11 ----D---- C:\The KMPlayer
2016-05-27 00:35:13 ----SD---- C:\Windows\SYSWOW64\GWX
2016-05-27 00:35:13 ----SD---- C:\Windows\system32\GWX
2016-05-20 13:46:50 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-05-20 10:20:36 ----D---- C:\Windows\rescache
2016-05-16 15:54:47 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-12 03:00:48 ----D---- C:\Windows\system32\appraiser
2016-05-11 15:12:27 ----D---- C:\Windows\Microsoft.NET
2016-05-11 15:09:28 ----RSD---- C:\Windows\assembly
2016-05-11 10:56:58 ----D---- C:\Windows\SYSWOW64\sk-SK
2016-05-11 10:56:57 ----D---- C:\Windows\system32\sk-SK
2016-05-11 10:56:56 ----D---- C:\Windows\ehome
2016-05-11 10:56:51 ----D---- C:\Program Files\Internet Explorer
2016-05-11 10:56:48 ----D---- C:\Windows\SYSWOW64\en-US
2016-05-11 10:56:43 ----D---- C:\Windows\system32\en-US
2016-05-11 10:56:39 ----D---- C:\Program Files (x86)\Internet Explorer
2016-05-11 10:56:15 ----D---- C:\Windows\AppPatch
2016-05-11 10:56:13 ----D---- C:\Windows\system32\Boot
2016-05-11 07:13:18 ----D---- C:\ProgramData\Microsoft Help
2016-05-11 06:45:18 ----D---- C:\Windows\system32\MRT
2016-05-11 06:45:15 ----A---- C:\Windows\system32\MRT.exe
2016-05-11 04:55:38 ----D---- C:\Windows\system32\catroot2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amd_sata;amd_sata; C:\Windows\system32\DRIVERS\amd_sata.sys [2011-04-16 79488]
R0 amd_xata;amd_xata; C:\Windows\system32\DRIVERS\amd_xata.sys [2011-04-16 40064]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 snapman;Acronis Snapshots Manager; C:\Windows\system32\DRIVERS\snapman.sys [2012-07-03 198944]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2013-03-02 834544]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-07-07 283200]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-12-21 141264]
R1 vpcnfltr;Virtual PC Network Filter Driver; C:\Windows\system32\DRIVERS\vpcnfltr.sys [2010-11-20 59392]
R1 vpcvmm;@%SystemRoot%\system32\drivers\vpcvmm.sys,-100; C:\Windows\system32\drivers\vpcvmm.sys [2010-11-20 360832]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-06-27 88632]
R2 aksdf;aksdf; \??\C:\Windows\system32\drivers\aksdf.sys [2014-07-17 91784]
R2 aksfridge;aksfridge; \??\C:\Windows\system32\drivers\aksfridge.sys [2014-07-17 162136]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-12-21 170640]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-12-21 125296]
R2 hardlock;hardlock; \??\C:\Windows\system32\drivers\hardlock.sys [2014-07-17 331608]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2009-11-17 11576]
R3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-07-06 9359872]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-07-06 309760]
R3 athr;Qualcomm Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2012-06-20 3678720]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2011-06-14 30368]
R3 clwvd;CyberLink WebCam Virtual Driver; C:\Windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver; C:\Windows\system32\DRIVERS\RtsPStor.sys [2011-01-13 333928]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-12-01 412264]
R3 STHDA;@%SystemRoot%\system32\stlang64.dll,-10322; C:\Windows\system32\DRIVERS\stwrt64.sys [2010-12-17 520192]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-06-10 1451056]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2010-12-16 47232]
R3 vpcbus;Virtual PC Host Bus Service; C:\Windows\system32\DRIVERS\vpchbus.sys [2010-11-20 194944]
R3 vpcusb;USB Virtualization Connector Service; C:\Windows\system32\DRIVERS\vpcusb.sys [2010-11-20 95232]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys []
S3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2011-06-14 36000]
S3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl664.sys [2009-06-10 1311232]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2011-06-14 330400]
S3 btath_avdt;Atheros Bluetooth AVDT Service; C:\Windows\system32\drivers\btath_avdt.sys [2011-06-14 110240]
S3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2011-06-14 167072]
S3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2011-06-14 68256]
S3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2011-06-14 280992]
S3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2011-06-14 496800]
S3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 dgderdrv;dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [2010-05-01 20568]
S3 EagleX64;EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys []
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\Windows\system32\DRIVERS\ew_hwusbdev.sys []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
S3 huawei_enumerator;huawei_enumerator; C:\Windows\system32\DRIVERS\ew_jubusenum.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys []
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-21 109056]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver; C:\Windows\system32\DRIVERS\silabenm.sys [2011-08-08 27336]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver; C:\Windows\system32\DRIVERS\silabser.sys [2011-08-08 70656]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 taphss6;Anchorfree HSS VPN Adapter; C:\Windows\system32\DRIVERS\taphss6.sys []
S3 TFsExDisk;TFsExDisk; \??\C:\Windows\System32\Drivers\TFsExDisk.sys [2010-05-01 16392]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\Windows\system32\DRIVERS\wdcsam64.sys [2015-04-30 23200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-04-22 82128]
R2 AllplanUpdateLauncher 2015;Nemetschek Allplan Updatelauncher Service 2015; C:\Program Files\Nemetschek\AllplanUpdateLauncher 2015\AllplanUpdateLauncher.exe [2014-10-30 16680]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-07-06 204288]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-05 365568]
R2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-06-14 138400]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [2011-06-14 97952]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-12-13 12288]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-01-12 810144]
R2 ezSharedSvc;Easybits Services for Windows; C:\Windows\syswow64\ezSharedSvcHost.exe [2010-04-23 514232]
R2 hasplms;Sentinel LDK License Manager; C:\Windows\system32\hasplms.exe [2014-07-17 4683144]
R2 HP Support Assistant Service;HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560]
R2 HPClientSvc;HP Client Services; C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service; C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-03-14 197504]
R2 HPWMISVC;HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-04-08 26680]
R2 IconMan_R;IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-01-14 1751656]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [2011-06-20 73728]
R2 lmadmin;lmadmin; C:\Program Files (x86)\Common Files\Scia\LicenceServer\FlexnetServer\lmadmin.exe [2011-08-05 6587728]
R2 STacSV;@%SystemRoot%\system32\stlang64.dll,-10122; C:\Program Files\IDT\WDM\STacSV64.exe [2010-12-17 276992]
R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2015-02-25 1044816]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2015-11-05 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2015-11-05 125112]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-02 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-02-18 315488]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2015-11-05 51376]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2011-01-12 42360]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-05-08 1471352]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-02 116648]
S3 hpqwmiex;HP Software Framework Service; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [2012-03-14 994176]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2016-04-23 114688]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2013-12-19 30814400]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2016-05-16 146888]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\syswow64\GameMon.des [2015-07-22 3611808]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-07-06 1255736]
S4 AcronisOSSReinstallSvc;Acronis OS Selector Reinstall Service; C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2007-02-22 2217416]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Umierajúci NTB, prosím o pomoc

#6 Příspěvek od Rudy »

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

godfather13
Návštěvník
Návštěvník
Příspěvky: 81
Registrován: 26 lis 2008 10:42

Re: Umierajúci NTB, prosím o pomoc

#7 Příspěvek od godfather13 »

Nový Log z RSIT:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Keramont at 2016-06-04 11:46:16
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 7 GB (9%) free of 74 GB
Total RAM: 5611 MB (74% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:46:29, on 4. 6. 2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18315)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\AcroDist.exe
C:\Program Files\trend micro\Keramont.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.sk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Magic Desktop for HP notification] "C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKUS\S-1-5-18\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - (no file)
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O18 - Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O18 - Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Nemetschek Allplan Updatelauncher Service 2015 (AllplanUpdateLauncher 2015) - Nemetschek Allplan Systems GmbH - C:\Program Files\Nemetschek\AllplanUpdateLauncher 2015\AllplanUpdateLauncher.exe
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Atheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: Easybits Services for Windows (ezSharedSvc) - EasyBits Software AS - C:\Windows\System32\ezSharedSvcHost.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Flexera Software, Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Sentinel LDK License Manager (hasplms) - Unknown owner - C:\Windows\system32\hasplms.exe (file missing)
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Client Services (HPClientSvc) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HPWMISVC - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lmadmin - Flexera Software, Inc. - C:\Program Files (x86)\Common Files\Scia\LicenceServer\FlexnetServer\lmadmin.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10122 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10543 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
winlogon.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files\IDT\WDM\STacSV64.exe"

atieclxx
C:\Windows\system32\svchost.exe -k NetworkService
taskeng.exe {976EC034-8584-4258-A591-701E87DD9450}
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files\Nemetschek\AllplanUpdateLauncher 2015\AllplanUpdateLauncher.exe"
"C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe" /launchService
"C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe"
"C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"
"C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe"
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe"
C:\Windows\SysWOW64\ezSharedSvcHost.exe
C:\Windows\system32\hasplms.exe -run
"C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe"
"C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe"
"C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe"
"C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe"
"C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe"
"C:\Program Files (x86)\Common Files\Scia\LicenceServer\FlexnetServer\lmadmin.exe"
C:\Windows\system32\svchost.exe -k imgsvc
SCIA -T Metro-HP 11.10 -1 -c scia\SCIA_Software.lic -lmgrd_port 6978 -x lmremove --lmgrd_start 5752a2a7 -l logs/SCIA.log
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2716
C:\Windows\system32\wbem\wmiprvse.exe
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe"
"C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe"
"C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"
C:\Windows\System32\alg.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Windows\system32\GWX\GWX.exe"
C:\Windows\system32\sppsvc.exe
taskeng.exe {C378E91E-A806-4773-9B22-C438313A859F}
"C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"
"C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\PrintIsolationHost.exe -Embedding
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files\IDT\WDM\sttray64.exe"
"C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
"C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe"
"C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe"
/N /P --UseSystemFonts /Q:15
"C:\Program Files\Synaptics\SynTP\SynTPHelper.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 524 528 536 65536 532
"C:\Users\Keramont\Desktop\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe /Processid:{30D49246-D217-465F-B00B-AC9DDD652EB7}

======Scheduled tasks folder======

C:\Windows\tasks\AutoUpdate Allplan 2015.job - H:\ALLPLAN2015\SOFT\prg\NemDownloadHandler.exe /f "H:\ALLPLAN2015\DATA\Std\AllplanUpdate.inf"
C:\Windows\tasks\HPCeeScheduleForKeramont.job - C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe HPCeeScheduleForKeramont (null)
C:\Windows\tasks\WebContent AutoUpdate 2015.job - H:\ALLPLAN2015\SOFT\prg\NemDownloadHandler.exe /f "H:\ALLPLAN2015\DATA\Std\AllplanUpdate.inf" /one http://autoupdate.allplan.com/Updates/A ... ontent.upd

=========Mozilla firefox=========

ProfilePath - C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\8ra28ait.Tomáš

prefs.js - "browser.startup.homepage" - "https://www.google.sk/?gws_rd=ssl"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer]
"Description"=Adobe Shockwave Player
"Path"=C:\Windows\system32\Adobe\Director\np32dsw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.73.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.73.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.0.8]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@videolan.org/vlc,version=2.1.2]
"Description"=VLC Multimedia Plugin
"Path"=C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@adobe.com/FlashPlayer]
"Description"=Adobe® Flash® Player 19.0.0.245 Plugin
"Path"=C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@java.com/DTPlugin,version=10.17.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Windows\system32\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C680BAE-655C-4E3D-8FC4-E6A520C3D928}]
SteadyVideoBHO Class - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2011-06-07 81024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21 529280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8D10F6C4-0E01-4BD4-8601-11AC1FDF8126}]
CIESpeechBHO Class - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-06-14 51872]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2011-06-10 2799912]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray64.exe [2010-12-17 525312]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2011-01-12 2918656]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeBridge"= []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AthBtTray]
C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [2011-06-14 795808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autodesk Sync]
C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [2013-02-05 1081224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easybits Recovery]
C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Quick Launch]
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [2011-04-08 586808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPOSD]
C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [2011-06-13 336440]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPQuickWebProxy]
C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [2011-06-27 168504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iFunBox Price Watch]
C:\Program Files (x86)\iFunbox 2014\iFunBox2014.exe /tray []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung PanelMgr]
C:\Windows\Samsung\PanelMgr\SSMMgr.exe [2010-10-28 618496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefault]
C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [2011-06-27 42808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2011-07-05 336384]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Users\Keramont\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Virtual Router Manager.lnk]
C:\Windows\Installer\{BE905C46-2B34-4D73-AEE1-769ED138E0FF}\_118D1A4EFFA6998C3492EB.exe /min []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"AdobeCS4ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"Magic Desktop for HP notification"=C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [2015-11-20 1444880]
""= []
"Acrobat Assistant 8.0"=C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2008-10-01 640376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"= []
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableLockWorkstation"=0
"DisableChangePassword"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"HideFastUserSwitching"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0
""=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"EnableShellExecuteHooks"=1
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"wave2"=wdmaud.drv
"mixer2"=wdmaud.drv
"midi2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2016-06-04 11:32:00 ----D---- C:\_OTM
2016-06-03 20:06:58 ----D---- C:\rsit
2016-06-01 12:08:22 ----HD---- C:\$WINDOWS.~BT
2016-05-19 15:36:29 ----D---- C:\Users\Keramont\AppData\Roaming\ezvid
2016-05-16 13:46:48 ----D---- C:\Program Files (x86)\Mozilla Firefox
2016-05-11 04:58:59 ----A---- C:\Windows\system32\win32k.sys
2016-05-11 04:58:57 ----A---- C:\Windows\SYSWOW64\tzres.dll
2016-05-11 04:58:57 ----A---- C:\Windows\system32\tzres.dll
2016-05-11 04:58:55 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2016-05-11 04:58:54 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2016-05-11 04:58:54 ----A---- C:\Windows\system32\cdd.dll
2016-05-11 04:58:52 ----A---- C:\Windows\SYSWOW64\d3d10level9.dll
2016-05-11 04:58:52 ----A---- C:\Windows\system32\gdi32.dll
2016-05-11 04:58:52 ----A---- C:\Windows\system32\d3d10level9.dll
2016-05-11 04:58:51 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-05-11 04:58:49 ----A---- C:\Windows\SYSWOW64\InkEd.dll
2016-05-11 04:58:49 ----A---- C:\Windows\system32\InkEd.dll
2016-05-11 04:58:45 ----A---- C:\Windows\SYSWOW64\inseng.dll
2016-05-11 04:58:45 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2016-05-11 04:58:45 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2016-05-11 04:58:45 ----A---- C:\Windows\system32\iernonce.dll
2016-05-11 04:58:45 ----A---- C:\Windows\system32\ieetwproxystub.dll
2016-05-11 04:58:45 ----A---- C:\Windows\system32\ieetwcollector.exe
2016-05-11 04:58:44 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2016-05-11 04:58:44 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2016-05-11 04:58:43 ----A---- C:\Windows\SYSWOW64\occache.dll
2016-05-11 04:58:43 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2016-05-11 04:58:43 ----A---- C:\Windows\system32\inseng.dll
2016-05-11 04:58:43 ----A---- C:\Windows\system32\ie4uinit.exe
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2016-05-11 04:58:42 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2016-05-11 04:58:42 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-05-11 04:58:39 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-05-11 04:58:37 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2016-05-11 04:58:37 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-05-11 04:58:37 ----A---- C:\Windows\system32\occache.dll
2016-05-11 04:58:37 ----A---- C:\Windows\system32\iedkcs32.dll
2016-05-11 04:58:36 ----A---- C:\Windows\SYSWOW64\jscript.dll
2016-05-11 04:58:36 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-05-11 04:58:36 ----A---- C:\Windows\system32\urlmon.dll
2016-05-11 04:58:36 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2016-05-11 04:58:35 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2016-05-11 04:58:35 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2016-05-11 04:58:34 ----A---- C:\Windows\SYSWOW64\ieui.dll
2016-05-11 04:58:34 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2016-05-11 04:58:34 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2016-05-11 04:58:34 ----A---- C:\Windows\system32\msfeeds.dll
2016-05-11 04:58:34 ----A---- C:\Windows\system32\dxtrans.dll
2016-05-11 04:58:32 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-05-11 04:58:31 ----A---- C:\Windows\system32\iesetup.dll
2016-05-11 04:58:31 ----A---- C:\Windows\system32\ieapfltr.dll
2016-05-11 04:58:29 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2016-05-11 04:58:29 ----A---- C:\Windows\system32\iertutil.dll
2016-05-11 04:58:28 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2016-05-11 04:58:28 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-05-11 04:58:28 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2016-05-11 04:58:28 ----A---- C:\Windows\system32\vbscript.dll
2016-05-11 04:58:27 ----A---- C:\Windows\SYSWOW64\wininet.dll
2016-05-11 04:58:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2016-05-11 04:58:27 ----A---- C:\Windows\system32\jsproxy.dll
2016-05-11 04:58:26 ----A---- C:\Windows\system32\dxtmsft.dll
2016-05-11 04:58:25 ----A---- C:\Windows\system32\ieui.dll
2016-05-11 04:58:24 ----A---- C:\Windows\system32\mshtmled.dll
2016-05-11 04:58:24 ----A---- C:\Windows\system32\ieframe.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\webcheck.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\mshtmlmedia.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\jscript.dll
2016-05-11 04:58:23 ----A---- C:\Windows\system32\ieUnatt.exe
2016-05-11 04:58:22 ----A---- C:\Windows\system32\jscript9diag.dll
2016-05-11 04:58:22 ----A---- C:\Windows\system32\jscript9.dll
2016-05-11 04:58:21 ----A---- C:\Windows\system32\wininet.dll
2016-05-11 04:58:20 ----A---- C:\Windows\system32\msrating.dll
2016-05-11 04:58:20 ----A---- C:\Windows\system32\MshtmlDac.dll
2016-05-11 04:58:17 ----A---- C:\Windows\system32\mshtml.dll
2016-05-11 04:58:00 ----A---- C:\Windows\system32\ntoskrnl.exe
2016-05-11 04:57:59 ----A---- C:\Windows\system32\rpcrt4.dll
2016-05-11 04:57:59 ----A---- C:\Windows\system32\lsasrv.dll
2016-05-11 04:57:58 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2016-05-11 04:57:58 ----A---- C:\Windows\system32\kerberos.dll
2016-05-11 04:57:57 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2016-05-11 04:57:56 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2016-05-11 04:57:55 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2016-05-11 04:57:55 ----A---- C:\Windows\system32\ntdll.dll
2016-05-11 04:57:54 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2016-05-11 04:57:54 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2016-05-11 04:57:54 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2016-05-11 04:57:53 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2016-05-11 04:57:53 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2016-05-11 04:57:53 ----A---- C:\Windows\SYSWOW64\certcli.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\wow64win.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\smss.exe
2016-05-11 04:57:53 ----A---- C:\Windows\system32\schannel.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\msv1_0.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\KernelBase.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\kernel32.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2016-05-11 04:57:53 ----A---- C:\Windows\system32\certcli.dll
2016-05-11 04:57:53 ----A---- C:\Windows\system32\advapi32.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\schannel.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2016-05-11 04:57:52 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\wow64.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\winsrv.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\wdigest.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\TSpkg.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\sspicli.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\srcore.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\rpchttp.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\ncrypt.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2016-05-11 04:57:52 ----A---- C:\Windows\system32\csrsrv.dll
2016-05-11 04:57:52 ----A---- C:\Windows\system32\conhost.exe
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\srclient.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2016-05-11 04:57:51 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\wow64cpu.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\sspisrv.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\srclient.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\setbcdlocale.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\secur32.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\rstrui.exe
2016-05-11 04:57:51 ----A---- C:\Windows\system32\ntvdm64.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\lsass.exe
2016-05-11 04:57:51 ----A---- C:\Windows\system32\drivers\appid.sys
2016-05-11 04:57:51 ----A---- C:\Windows\system32\cryptbase.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\credssp.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\appidsvc.dll
2016-05-11 04:57:51 ----A---- C:\Windows\system32\appidapi.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-05-11 04:57:50 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\wow32.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\secur32.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\credssp.dll
2016-05-11 04:57:50 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2016-05-11 04:57:50 ----A---- C:\Windows\system32\auditpol.exe
2016-05-11 04:57:50 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2016-05-11 04:57:50 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-05-11 04:57:49 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-05-11 04:57:48 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\user.exe
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\setup16.exe
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\instnm.exe
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2016-05-11 04:57:48 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\msobjs.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\msaudite.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\apisetschema.dll
2016-05-11 04:57:48 ----A---- C:\Windows\system32\adtschema.dll
2016-05-11 04:57:40 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2016-05-11 04:57:40 ----A---- C:\Windows\system32\WindowsCodecs.dll

======List of files/folders modified in the last 1 month======

2016-06-04 11:46:25 ----D---- C:\Windows\temp
2016-06-04 11:46:22 ----D---- C:\Program Files\trend micro
2016-06-04 11:43:21 ----D---- C:\Windows\system32\config
2016-06-04 11:34:35 ----SHD---- C:\System Volume Information
2016-06-04 11:32:00 ----D---- C:\Windows\Tasks
2016-06-04 11:31:12 ----D---- C:\Users\Keramont\AppData\Roaming\vlc
2016-06-03 21:34:36 ----D---- C:\Windows\inf
2016-06-03 21:33:30 ----D---- C:\Windows
2016-06-03 21:30:56 ----D---- C:\AdwCleaner
2016-06-03 19:55:52 ----D---- C:\Program Files\IMPI
2016-06-03 19:29:49 ----D---- C:\Program Files (x86)
2016-06-03 19:29:48 ----D---- C:\Windows\SysWOW64
2016-06-03 19:29:48 ----D---- C:\Windows\System32
2016-06-03 19:29:21 ----SHD---- C:\Windows\Installer
2016-06-03 19:26:41 ----D---- C:\Windows\system32\drivers
2016-06-03 19:24:40 ----D---- C:\Users\Keramont\AppData\Roaming\Skype
2016-06-03 14:50:18 ----D---- C:\Windows\debug
2016-06-03 09:26:43 ----D---- C:\Windows\Prefetch
2016-06-02 16:47:51 ----D---- C:\Windows\winsxs
2016-06-01 12:08:58 ----D---- C:\Windows\Panther
2016-05-31 14:09:34 ----D---- C:\Windows\system32\Tasks
2016-05-31 12:34:11 ----D---- C:\The KMPlayer
2016-05-27 00:35:13 ----SD---- C:\Windows\SYSWOW64\GWX
2016-05-27 00:35:13 ----SD---- C:\Windows\system32\GWX
2016-05-20 13:46:50 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-05-20 10:20:36 ----D---- C:\Windows\rescache
2016-05-16 15:54:47 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-12 03:00:48 ----D---- C:\Windows\system32\appraiser
2016-05-11 15:12:27 ----D---- C:\Windows\Microsoft.NET
2016-05-11 15:09:28 ----RSD---- C:\Windows\assembly
2016-05-11 10:56:58 ----D---- C:\Windows\SYSWOW64\sk-SK
2016-05-11 10:56:57 ----D---- C:\Windows\system32\sk-SK
2016-05-11 10:56:56 ----D---- C:\Windows\ehome
2016-05-11 10:56:51 ----D---- C:\Program Files\Internet Explorer
2016-05-11 10:56:48 ----D---- C:\Windows\SYSWOW64\en-US
2016-05-11 10:56:43 ----D---- C:\Windows\system32\en-US
2016-05-11 10:56:39 ----D---- C:\Program Files (x86)\Internet Explorer
2016-05-11 10:56:15 ----D---- C:\Windows\AppPatch
2016-05-11 10:56:13 ----D---- C:\Windows\system32\Boot
2016-05-11 07:13:18 ----D---- C:\ProgramData\Microsoft Help
2016-05-11 06:45:18 ----D---- C:\Windows\system32\MRT
2016-05-11 06:45:15 ----A---- C:\Windows\system32\MRT.exe
2016-05-11 04:55:38 ----D---- C:\Windows\system32\catroot2

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amd_sata;amd_sata; C:\Windows\system32\DRIVERS\amd_sata.sys [2011-04-16 79488]
R0 amd_xata;amd_xata; C:\Windows\system32\DRIVERS\amd_xata.sys [2011-04-16 40064]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 snapman;Acronis Snapshots Manager; C:\Windows\system32\DRIVERS\snapman.sys [2012-07-03 198944]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2013-03-02 834544]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2012-07-07 283200]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2010-12-21 141264]
R1 vpcnfltr;Virtual PC Network Filter Driver; C:\Windows\system32\DRIVERS\vpcnfltr.sys [2010-11-20 59392]
R1 vpcvmm;@%SystemRoot%\system32\drivers\vpcvmm.sys,-100; C:\Windows\system32\drivers\vpcvmm.sys [2010-11-20 360832]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-06-27 88632]
R2 aksdf;aksdf; \??\C:\Windows\system32\drivers\aksdf.sys [2014-07-17 91784]
R2 aksfridge;aksfridge; \??\C:\Windows\system32\drivers\aksfridge.sys [2014-07-17 162136]
R2 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2010-12-21 170640]
R2 epfwwfpr;epfwwfpr; C:\Windows\system32\DRIVERS\epfwwfpr.sys [2010-12-21 125296]
R2 hardlock;hardlock; \??\C:\Windows\system32\drivers\hardlock.sys [2014-07-17 331608]
R2 SSPORT;SSPORT; \??\C:\Windows\system32\Drivers\SSPORT.sys [2009-11-17 11576]
R3 amdiox64;AMD IO Driver; C:\Windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2011-07-06 9359872]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2011-07-06 309760]
R3 athr;Qualcomm Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athrx.sys [2012-06-20 3678720]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2010-11-17 115216]
R3 BTATH_BUS;Atheros Bluetooth Bus; C:\Windows\system32\DRIVERS\btath_bus.sys [2011-06-14 30368]
R3 clwvd;CyberLink WebCam Virtual Driver; C:\Windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver; C:\Windows\system32\DRIVERS\RtsPStor.sys [2011-01-13 333928]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2010-12-01 412264]
R3 STHDA;@%SystemRoot%\system32\stlang64.dll,-10322; C:\Windows\system32\DRIVERS\stwrt64.sys [2010-12-17 520192]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2011-06-10 1451056]
R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2010-12-16 47232]
R3 vpcbus;Virtual PC Host Bus Service; C:\Windows\system32\DRIVERS\vpchbus.sys [2010-11-20 194944]
R3 vpcusb;USB Virtualization Connector Service; C:\Windows\system32\DRIVERS\vpcusb.sys [2010-11-20 95232]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S2 DgiVecp;DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys []
S3 AthBTPort;Atheros Virtual Bluetooth Class; C:\Windows\system32\DRIVERS\btath_flt.sys [2011-06-14 36000]
S3 BCM43XX;Broadcom 802.11 Network Adapter Driver; C:\Windows\system32\DRIVERS\bcmwl664.sys [2009-06-10 1311232]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver; C:\Windows\system32\drivers\btath_a2dp.sys [2011-06-14 330400]
S3 btath_avdt;Atheros Bluetooth AVDT Service; C:\Windows\system32\drivers\btath_avdt.sys [2011-06-14 110240]
S3 BTATH_HCRP;Bluetooth HCRP Server driver; C:\Windows\system32\DRIVERS\btath_hcrp.sys [2011-06-14 167072]
S3 BTATH_LWFLT;Bluetooth LWFLT Device; C:\Windows\system32\DRIVERS\btath_lwflt.sys [2011-06-14 68256]
S3 BTATH_RCP;Bluetooth AVRCP Device; C:\Windows\system32\DRIVERS\btath_rcp.sys [2011-06-14 280992]
S3 BtFilter;BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [2011-06-14 496800]
S3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\drivers\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 dgderdrv;dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [2010-05-01 20568]
S3 EagleX64;EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys []
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device; C:\Windows\system32\DRIVERS\ew_hwusbdev.sys []
S3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [2009-03-18 33856]
S3 huawei_enumerator;huawei_enumerator; C:\Windows\system32\DRIVERS\ew_jubusenum.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys []
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm62x64.sys [2009-06-10 408960]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-21 109056]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver; C:\Windows\system32\DRIVERS\silabenm.sys [2011-08-08 27336]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver; C:\Windows\system32\DRIVERS\silabser.sys [2011-08-08 70656]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 taphss6;Anchorfree HSS VPN Adapter; C:\Windows\system32\DRIVERS\taphss6.sys []
S3 TFsExDisk;TFsExDisk; \??\C:\Windows\System32\Drivers\TFsExDisk.sys [2010-05-01 16392]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 WDC_SAM;WD SCSI Pass Thru driver; C:\Windows\system32\DRIVERS\wdcsam64.sys [2015-04-30 23200]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-04-22 82128]
R2 AllplanUpdateLauncher 2015;Nemetschek Allplan Updatelauncher Service 2015; C:\Program Files\Nemetschek\AllplanUpdateLauncher 2015\AllplanUpdateLauncher.exe [2014-10-30 16680]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2011-07-06 204288]
R2 AMD FUEL Service;AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-05 365568]
R2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-06-14 138400]
R2 AtherosSvc;AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [2011-06-14 97952]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-12-13 12288]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2011-01-12 810144]
R2 ezSharedSvc;Easybits Services for Windows; C:\Windows\syswow64\ezSharedSvcHost.exe [2010-04-23 514232]
R2 hasplms;Sentinel LDK License Manager; C:\Windows\system32\hasplms.exe [2014-07-17 4683144]
R2 HP Support Assistant Service;HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560]
R2 HPClientSvc;HP Client Services; C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service; C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-03-14 197504]
R2 HPWMISVC;HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-04-08 26680]
R2 IconMan_R;IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-01-14 1751656]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [2011-06-20 73728]
R2 lmadmin;lmadmin; C:\Program Files (x86)\Common Files\Scia\LicenceServer\FlexnetServer\lmadmin.exe [2011-08-05 6587728]
R2 STacSV;@%SystemRoot%\system32\stlang64.dll,-10122; C:\Program Files\IDT\WDM\STacSV64.exe [2010-12-17 276992]
R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2015-02-25 1044816]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2015-11-05 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2015-11-05 125112]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-02 116648]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2015-02-18 315488]
S3 aspnet_state;ASP.NET State Service; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2015-11-05 51376]
S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2011-01-12 42360]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-05-08 1471352]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-02 116648]
S3 hpqwmiex;HP Software Framework Service; C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe [2012-03-14 994176]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2016-04-23 114688]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2013-12-19 30814400]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2016-05-16 146888]
S3 npggsvc;nProtect GameGuard Service; C:\Windows\syswow64\GameMon.des [2015-07-22 3611808]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2012-07-06 1255736]
S4 AcronisOSSReinstallSvc;Acronis OS Selector Reinstall Service; C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2007-02-22 2217416]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Umierajúci NTB, prosím o pomoc

#8 Příspěvek od Rudy »

Smazáno. Znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

godfather13
Návštěvník
Návštěvník
Příspěvky: 81
Registrován: 26 lis 2008 10:42

Re: Umierajúci NTB, prosím o pomoc

#9 Příspěvek od godfather13 »

PC vyzerá byť v poriadku, Chrome šlape, ale Mozzila mi stále žere veľa výkonu ( 1gb pamäte / 40% procesor) a seká aj pri videách. Mám ju preinštalovať? Resp. máte pre mňa nejakú radu ? :)

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Umierajúci NTB, prosím o pomoc

#10 Příspěvek od Rudy »

Zkusíme ještě tyto skeny:

1. Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize




autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;





Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem.

a

2. Junkware removal tool: http://thisisudax.org/downloads/JRT.exe
•Ulozte nejlepe na plochu
•Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
•Probehne vytvoreni zalohy a nasledne prohledavani
•Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

godfather13
Návštěvník
Návštěvník
Příspěvky: 81
Registrován: 26 lis 2008 10:42

Re: Umierajúci NTB, prosím o pomoc

#11 Příspěvek od godfather13 »

LOG zo Zoek:


Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by Keramont on so 04. 06. 2016 at 20:20:24.51.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Keramont\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

4. 6. 2016 20:22:29 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\HP Games deleted successfully
C:\PROGRA~2\MarkAny deleted successfully
C:\PROGRA~2\mozilla.org deleted successfully
C:\PROGRA~2\MSXML 4.0 deleted successfully
C:\PROGRA~2\PC Connectivity Solution deleted successfully
C:\PROGRA~2\COMMON~1\Symantec Shared deleted successfully
C:\Users\Keramont\AppData\Roaming\EurekaLog deleted successfully
C:\Users\Keramont\AppData\Roaming\ezvid deleted successfully
C:\Users\Keramont\AppData\Roaming\Malwarebytes deleted successfully
C:\Users\Keramont\AppData\Roaming\Opera deleted successfully
C:\Users\Keramont\AppData\Roaming\Windows Live Writer deleted successfully
C:\Users\Keramont\AppData\Local\CrashDumps deleted successfully
C:\Users\Keramont\AppData\Local\EmieBrowserModeList deleted successfully
C:\Users\Keramont\AppData\Local\EmieSiteList deleted successfully
C:\Users\Keramont\AppData\Local\EmieUserList deleted successfully
C:\Users\Keramont\AppData\Local\GHISLER deleted successfully
C:\Users\Keramont\AppData\Local\Opera deleted successfully
C:\Users\Keramont\AppData\Local\Samsung deleted successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\CrashDumps deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1200702374-1131186070-1473926133-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} deleted successfully
HKEY_USERS\S-1-5-21-1200702374-1131186070-1473926133-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4eb3fc20-7158-4dd5-a08e-707541e9341c} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT\prefs.js:
user_pref("browser.startup.homepage", "https://www.google.sk/");
user_pref("browser.search.defaultEngineName", "Centrum.cz");
user_pref("browser.search.defaultenginename", "Centrum.cz");
user_pref("browser.search.selectedEngine", "Centrum.cz");
user_pref("keyword.URL", "http://search.centrum.cz/?charset=UTF-8 ... archbox&q=");

Added to C:\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Deleted from C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\djp3617c.default-1391271935482\prefs.js:

Added to C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\djp3617c.default-1391271935482\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Deleted from C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\C\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT\prefs.js:

Added to C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\C\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

Deleted from C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT\prefs.js:

Added to C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT

user.js not found
---- Lines {17E113E6-CD0E-4045-B154-65F0E57959EF} removed from prefs.js ----
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.extensionFirstRun", false);
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.lastExtensionVersion", "2.0.0.429");
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.ScriptData_IMPI_dailyPing", "true|||1391357314056");
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.ScriptData_IMPI_Installed", "true|||8641364069387223");
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.ScriptData_impi_user_country", "SK|||8641364069687759");
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.ScriptData_installer_name", "ImpiSetup.exe");
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.ScriptData_product_name", "IMPI");
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.ScriptData_product_version", "2.0.0.429");
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.ScriptData_pxl_IMPI_dailyPing", "dailyPing|||1391357314077");
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.ScriptData_toolbarID", "ea00e4def88e428385d9df7de1ffb7bd");
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.ScriptData_whitespace_installation_date", "1364069387168|||8641364069387168");
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.setdefaultsearch_2.0.0.429", false);
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.setdnscatch_2.0.0.429", false);
user_pref("{17E113E6-CD0E-4045-B154-65F0E57959EF}.sethomepage_2.0.0.429", false);
---- Lines {17E113E6-CD0E-4045-B154-65F0E57959EF} modified from prefs.js ----

user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"{17E113E6-CD0E-4045-B154-65F0E57959EF}\":{\"descriptor\":\"C:\\\\
---- FireFox user.js and prefs.js backups ----

prefs_201604.06._2046_.backup

ProfilePath: C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\djp3617c.default-1391271935482

user.js not found
---- FireFox user.js and prefs.js backups ----

prefs_201604.06._2046_.backup

ProfilePath: C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\C\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT

user.js not found
---- FireFox user.js and prefs.js backups ----


ProfilePath: C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT

---- Lines mixidj removed from user.js ----

user_pref("extensions.mixidj.tlbrSrchUrl", "");
user_pref("extensions.mixidj.id", "86cd0f0600000000000016de2b1bb74b");
user_pref("extensions.mixidj.appId", "{A2773ED4-83BD-488A-A186-73590706C916}");
user_pref("extensions.mixidj.instlDay", "15766");
user_pref("extensions.mixidj.vrsn", "1.8.4.1");
user_pref("extensions.mixidj.vrsni", "1.8.4.1");
user_pref("extensions.mixidj_i.vrsnTs", "1.8.4.115:55:43");
user_pref("extensions.mixidj.prtnrId", "mixidj");
user_pref("extensions.mixidj.prdct", "mixidj");
user_pref("extensions.mixidj.aflt", "babsst");
user_pref("extensions.mixidj_i.smplGrp", "none");
user_pref("extensions.mixidj.tlbrId", "mdelta");
user_pref("extensions.mixidj.instlRef", "sst");
user_pref("extensions.mixidj.dfltLng", "en");
user_pref("extensions.mixidj_i.excTlbr", false);
user_pref("extensions.mixidj.excTlbr", false);
user_pref("extensions.mixidj.admin", false);
user_pref("extensions.mixidj.autoRvrt", "false");
user_pref("extensions.mixidj.rvrt", "false");
user_pref("extensions.mixidj_i.newTab", false);

---- FireFox user.js and prefs.js backups ----

user_201604.06._2046_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~2\HP Games not found
C:\PROGRA~2\MarkAny not found
C:\PROGRA~2\mozilla.org not found
C:\PROGRA~2\PC Connectivity Solution not found
C:\PROGRA~2\SystemRequirementsLab deleted
C:\Users\Keramont\AppData\Roaming\droid4xinstaller.log deleted
C:\PROGRA~3\kjhy64.txt deleted
C:\PROGRA~3\ir2of7.reg deleted
C:\PROGRA~3\{9BF4D58B-C6D6-467B-BC5A-FD0C1278F4AF} deleted
C:\PROGRA~3\{D3B41B92-9BC2-43EB-916A-4FA9E8191837} deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Keramont\AppData\Local\Unity deleted
C:\Users\Keramont\AppData\Local\cache deleted
C:\Users\Keramont\AppData\LocalLow\Unity deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\AVG Secure Search deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\gpt.ini deleted
C:\Windows\SysWow64\AI_RecycleBin deleted
C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\djp3617c.default-1391271935482\extensions\staged deleted
"C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT\searchplugins\mixidj.xml" deleted

==== Orphaned Tasks deleted from Registry ======================

ESET Windows 10 upgrade - Refresh settings deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\djp3617c.default-1391271935482
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\C\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\Keramont\AppData\Roaming\Mozilla\Firefox\Profiles\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

ProfilePath: C:\Users\Keramont\AppData\Roaming\Mozilla\Profiles\f1e7uxgr.KERAMONT
- Undetermined - C:\Program Files\IMPI\Firefox
- Lita Centrum.cz - %ProfilePath%\extensions\toolbar@centrumholdings.com

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi
- Undetermined - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi

==== Firefox Plugins ======================


==== Chromium Look ======================

Google Chrome Version: 35.0.1916.114

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[]

MaskMe - Keramont\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpkiidbpeijnaaacjlfnijncdlkicejg
Autodesk ForceEffect - Keramont\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekbaidcchahkpedbhdenlmleimihkcim

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://google.sk/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://google.sk/"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTer ... ORM=IE8SRC

==== Reset Google Chrome ======================

C:\Users\Keramont\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Keramont\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl deleted successfully
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\UnityWebPlayer deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easybits Recovery deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iFunBox Price Watch deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Keramont\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\Keramont\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=209 folders=89 119180006 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Keramont\AppData\Local\Temp will be emptied at reboot
C:\Users\Metro\AppData\Local\temp emptied successfully
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Keramont\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on so 04. 06. 2016 at 21:04:59.88 ======================


LOG z JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows 7 Home Premium x64
Ran by Keramont (Administrator) on so 04. 06. 2016 at 21:07:05.44
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 3

Failed to delete: C:\Program Files (x86)\GUTDFD4.tmp (File)
Successfully deleted: C:\ProgramData\thunder network (Folder)
Successfully deleted: C:\Users\Public\thunder network (Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on so 04. 06. 2016 at 21:11:35.55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Umierajúci NTB, prosím o pomoc

#12 Příspěvek od Rudy »

Jak to vypadá nyní?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

godfather13
Návštěvník
Návštěvník
Příspěvky: 81
Registrován: 26 lis 2008 10:42

Re: Umierajúci NTB, prosím o pomoc

#13 Příspěvek od godfather13 »

Mozzilu zrazilo z 40% procesoru na max.5% a 1GB RAM na 600MB RAM. Video stream stále seká, ale teraz už aspoň viem , že na vine je kodek. a PC celkovo neseká, ide plynule, akurát sa dlho štaruje. Aj po načítaní plochy ešte 2 minúty "drieme", kým sa rozbehne.
Jednoznačné zlepšenie oproti pôvodnému stavu. Po štátniciach zálohujem dokumenty, naformátujem, naninštalujem nanovo win a hádam sa spamätá.

Ďakujem veľmi pekne za pomoc Rudy!

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119673
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: Umierajúci NTB, prosím o pomoc

#14 Příspěvek od Rudy »

Zkuste startmenu>přík. řádek>(napsat) msconfig>Enter. Na záložkách "po spuštění" a "služby" odstraňte zatržítka u všech položek, které nemusí automaticky startovat. Tj. u takových, které lze v případě potřeby spustit ručně. Nemáte zač! :)
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

godfather13
Návštěvník
Návštěvník
Příspěvky: 81
Registrován: 26 lis 2008 10:42

Re: Umierajúci NTB, prosím o pomoc

#15 Příspěvek od godfather13 »

Rudy ďakujem veľmi pekne za pomoc :)
Z mojej strany všetko. Príspevok sa môže uzamknúť :)

Majte sa pekne a ešte raz, ďakujem :)

Zamčeno