41 virů, zpomalený PC

[Hank]

Dobrý den,
PC je hodně zpomalený a tak jsem provedl kontrolu AVASTem.
Bylo nalezeno 41 virů



PC je ale stálé pomalý.

Pomůžete mi prosím?

log:

Logfile of random's system information tool 1.10 (written by random/random)
Run by Administrator at 2016-07-23 20:07:28
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 19 GB (25%) free of 75 GB
Total RAM: 3072 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:07:40, on 23.7.2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18347)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\AVAST Software\Avast\avastui.exe
C:\Program Files\trend micro\Administrator.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId= ... kId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId= ... oxapp.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Pomocná služba pro přihlášení k účtu Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Network Service (NvStreamNetworkSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: TightVNC Server (tvnserver) - GlavSoft LLC. - C:\Program Files\TightVNC\tvnserver.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8239 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\TightVNC\tvnserver.exe" -service
"C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE"
WLIDSvcM.exe 2224
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\servicing\TrustedInstaller.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\TightVNC\tvnserver.exe" -controlservice -slave
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Program Files\AVAST Software\Avast\avastui.exe" /nogui
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1"
"C:\Windows\system32\GWX\GWX.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe" serviceapp
\??\C:\Windows\system32\conhost.exe "-2052790147-1537003062-212571219813287265881758396614-19424375991295594723-1542355738
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\sppsvc.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe18_ Global\UsGthrCtrlFltPipeMssGthrPipe18 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520

"D:\Users\education\Desktop\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

======Scheduled tasks folder======

C:\Windows\tasks\iWebar-chromeinstaller.job - C:\Program Files (x86)\iWebar\iWebar-chromeinstaller.exe /rawdata=RAjnbZIXEiE6hdWECKCs7PdbbeR7rC+xmVHcJIIiVBXQN0sxVCYWMBX84uXtTY7cGpmKr10GFTYZxNvHx/Num8pMytL0ILTdJ7vS1ctAc4VCwhxwnyNgmA62lcuf4BJhIiwURBAU3Nd0zblKR6Ixzp/g7w3texKK3okC0HNhzQfHkcwuODZ9oRfQZfVyw5kMatg7RXM/IWxDGiK+B+9hXxUZ5ppt3x7Ct49wJ1AYfye+FBvO7E224c4ptppggOgzHRVQbc2HNTfXN86vfbo+OVaBadU2qETa4rLOqru6C+GwGZsNSMtzvHhP9/3qGN8uuL1J0+SuIukVhR9MnMymgrlclKs4p/LUL94KFG6Ib7tg6zvYAuwzI7dpVQYT6dcuoOq+a9XyMxqp5MFCEA/XfUZ4/qfhRfM3c1mv4GeOKPH24VQzfxiUm5AAWt78kb0oETaMUJEa5YTg+jX1wai0VUlHfNUFnLl7+WDIM4Il+6yEKJ0/bjKTCU8kUo3Ol8uYetBXWoMJh9Wh8WXAHPK6fb+EqEE/0sDAv+iTTcervvwj+l0bnp5TqSr4/gJE4zcJyXmEOn2yo4EM2hFHPzj/cE/ypXF9RJeddTLzx77BGbMBkygoLgxEHlinGOXvqbB1HOJHsXHBIMTXaRDrd7F2zgOZlNamp9jwvFvvl7a9f3AitVAjU45j5puPvqVtaMvv2WRwbAMSYw4wI7uBJdZq21pTfKw+RDjdpC5cWjuVuR6S3xGx0abLIby3PPJWoV4rDr/7H4+5nNVdKnL3mrGIuEg9nMjwK0JdbDdQD13BAOyvM5PX+/+z07Z+Unz+gFyhvDvSHiGF1+zvAaRXBFrdSbzTeaJ4pO+aUKzYV2LqELUk4BE9Xm7Mmn/anYYWvpIzFLXAyXjoUf6N0Mp9hX86sQVMFp2dPSI61Wt2enu2r9j7CbbZGYPTkovfT1uRAVs7/mZJ/DOK1lc/9mfZq0piJPxjzYbwtwEcVhtOa+uuLW+VIVXTiHzm0by3h+DQwzLVZe3Te8LQknlPIW+iy9/k8Py/5F8+sJfhhkQsJh/GbSMwcEP8v3S35Pf7j/P1kVqi+P34VZuDLM3He+oVKJZXoZWwaMa8zQMKtvenFXyJYDGa8PUYdloLe9vctGlkNZqiCSd6tLT5HXmIW6toJcqrg72f0ndM0fitgq9rrdgPR4p48mq+S57e/9btHcQp2DVD2V8GLSGhVOTzweoEPqtL0vhl0zXpvDaPAVug3HLG9GMZsJOjmlZbfVtRN0vWtv/L+2OJlVJoDKp+JA83+6vbsr+vWifZqKgCJ0rc7N3rvcXwqEcJfBIoMY5gOVWOn/HytsnRHJygrvx3ze7RpZ/CJ8erqRtlz4Y/2YaOD2geFD5lT8Hmo/kpfJlA8pLbllep56jChMFJe7TT9RKl3lcZ64A1pmD4skCELh0n8GlaNNm54LY3wJJpTyPp9tIy4OK9rV/21Nupn+PtAe0DeaUaRWoxoJ28wx+HxjBchCb+ZIFxoekhzxSuLQzGYQMQFwaT
C:\Windows\tasks\iWebar-codedownloader.job - C:\Program Files (x86)\iWebar\iWebar-codedownloader.exe /reinstallapp /runfrom=task /agentregpath='iWebar' /appid=35510 /srcid='000170' /subid='0' /zdata='eyJkYXRhIjp7ImRhdGUiOiJFM0Z6YWRrY0FnMCw5MDlhZDc4Yy0zNDNiLTQ2OTItYTAyMy0yZjdlZGE5YjcyYTEsIiwidW5xIjoiOTA5YWQ3OGMtMzQzYi00NjkyLWEwMjMtMmY3ZWRhOWI3MmExIn19' /bic=9F0DAB6B5E67432A9A93758EDB7782FBIE /verifier=2eb0611645e69ebf73c735adc7658e14 /installerversion=1_34_2_13 /installerfullversion=1.34.2.13 /installationtime=1394898445 /statsdomain=http://stats.srvstatsdata.com /errorsdomain=http://errors.srvstatsdata.com /codedownloaddomain=http://app-static.crossrider.com /defbro=ff /allusers /autoupdateulr='http://update.srvstatsdata.com/ie_code_ ... pdate.json' /runfrom='task' /externallog=''
C:\Windows\tasks\iWebar-enabler.job - C:\Program Files (x86)\iWebar\iWebar-enabler.exe /enablebho /agentregpath='iWebar' /appid=35510 /srcid='000170' /subid='0' /zdata='eyJkYXRhIjp7ImRhdGUiOiJFM0Z6YWRrY0FnMCw5MDlhZDc4Yy0zNDNiLTQ2OTItYTAyMy0yZjdlZGE5YjcyYTEsIiwidW5xIjoiOTA5YWQ3OGMtMzQzYi00NjkyLWEwMjMtMmY3ZWRhOWI3MmExIn19' /bic=9F0DAB6B5E67432A9A93758EDB7782FBIE /verifier=2eb0611645e69ebf73c735adc7658e14 /installerversion=1_34_2_13 /installationtime=1394898445 /statsdomain=http://stats.srvstatsdata.com /errorsdomain=http://errors.srvstatsdata.com /bhoguid=11111111-1111-1111-1111-110311551110 /defbro=ff /allusers /autoupdateulr='http://update.srvstatsdata.com/ie_enabl ... pdate.json' /runfrom='task' /externallog=''
C:\Windows\tasks\iWebar-firefoxinstaller.job - C:\Program Files (x86)\iWebar\iWebar-firefoxinstaller.exe /installxpi /agentregpath='iWebar' /extensionfilepath='C:\Program Files (x86)\iWebar\35510.xpi' /appid=35510 /srcid='000170' /subid='0' /zdata='eyJkYXRhIjp7ImRhdGUiOiJFM0Z6YWRrY0FnMCw5MDlhZDc4Yy0zNDNiLTQ2OTItYTAyMy0yZjdlZGE5YjcyYTEsIiwidW5xIjoiOTA5YWQ3OGMtMzQzYi00NjkyLWEwMjMtMmY3ZWRhOWI3MmExIn19' /bic=9F0DAB6B5E67432A9A93758EDB7782FBIE /verifier=2eb0611645e69ebf73c735adc7658e14 /installerversion=1_34_2_13 /installerfullversion=1.34.2.13 /installationtime=1394898445 /statsdomain=http://stats.srvstatsdata.com /errorsdomain=http://errors.srvstatsdata.com /waitforbrowser=300 /extensionid=2eb528f3-950d-48a3-be4b-5d7de6c8331e@a41e199b-6ca4-4d23-ab87-73f2d1973314.com /extensionversion=0.93 /prefsbranch=a2eb528f3950d48a3be4b5d7de6c8331ea41e199b6ca44d23ab8773f2d1973314com35510 /updateurl=https://w9u6a2p6.ssl.hwcdn.net/plugin/f ... /35510.rdf /extensionname='iWebar' /extensiondesc='iWebar' /publishername='iWebar' /defbro=ff /allusers /allprofiles /checkfflist /autoupdateulr='http://update.srvstatsdata.com/ff_agent ... pdate.json' /runfrom='task' /externallog=''
C:\Windows\tasks\iWebar-updater.job - C:\Program Files (x86)\iWebar\iWebar-updater.exe /runupdater /agentregpath='iWebar' /appid=35510 /srcid='000170' /subid='0' /zdata='eyJkYXRhIjp7ImRhdGUiOiJFM0Z6YWRrY0FnMCw5MDlhZDc4Yy0zNDNiLTQ2OTItYTAyMy0yZjdlZGE5YjcyYTEsIiwidW5xIjoiOTA5YWQ3OGMtMzQzYi00NjkyLWEwMjMtMmY3ZWRhOWI3MmExIn19' /bic=9F0DAB6B5E67432A9A93758EDB7782FBIE /verifier=2eb0611645e69ebf73c735adc7658e14 /installerversion=1_34_2_13 /installationtime=1394898445 /statsdomain=http://stats.srvstatsdata.com /errorsdomain=http://errors.srvstatsdata.com /geoserviceurl=http://ipgeoapi.com/ /updatejsondomain=http://update.srvstatsdata.com /updaterversion=2 /monetizationdomain=http://stats.mstatsserv.com /autoupdateulr='http://update.srvstatsdata.com/updater_ ... pdate.json' /runfrom='task' /externallog=''
C:\Windows\tasks\Object Browser-chromeinstaller.job - C:\Program Files (x86)\Object Browser\Object Browser-chromeinstaller.exe /rawdata=mxMazPAvDP8Mkk+MQIq6CaJ8nfhFj6kDYiuAUxoRmya78NsO6WWq8AuiWXzcWq8jW0EMAyfx5xcoaKI5obRTSfg9mzdPXYBw7+4uUacIJ+yR+QH0cam+1dMB9LJZ0u7nSNiSn665FThAqMJ8RpUt10YYPwqP5+ZQPb+h2ktFpkYgmOBRymTVsgdFPtRuLRASiN1kWSpFE/FYyFCZtYmk6n/dwKRsq1am24FULhb4xV0s5ftB5ZOBw9NKOURCXqbzIISP9zjk1dUeFep3WCWUl6LVNEbKer5fw1tg4jqUinJB1GqHYASyiQjQx+xp7lCOl99l4StmX0mPrbnWC6oomVmn/Ehnroorf4PYxjJvthpogUL5J/nj26MDmO79k0k5cqGEj8O1vUATq8X/ClrbXjMLIvJXP6qgHbRMA907clKIFZdK3fT9CtSBbhb3z3zvv4UzaDYZiNQyh4xELN4RhTF9/ysomL8s9Y1clVgrZGumnTJXKUsSmwXnmThMOviTUlvyO7Q8H7WvsGdx5ouIsCecozEdFKDEKlR8NVFJXIT+0R0KafS/y3IG4In5dgrly9eQGCHjvF6TrOBCtiwxTrCJLRFdG2Rcq1xC6cu0D5ZG/1N3y1ilJrEqZgekkx8FW+g0mnAOvfq/k+4zp1stoxoEZizz2D8HaAtIrdtNmVpcpeUGJuPLq96BbDDvgBbMm5t3MUqbIu0fk0j27KUuEUY9I1TnMEoxLXPOpU37Fak/JxRGqsYU1J4Odv08iR90Q/f+gATKsrIdvMtT321WknwpfhuD3ELiAjGmHcvgonAd8/2B0kCTtBw6mlwg9/wk5y5QodquANByeXiiBeYdzGqEZ21oDooM1QouNda7FFWJabEmwlwebjPuota4jN2dEfNG0bAJ9ra35FrRP8K0K1ulIBDsUnbbh5RgNfthRgB3RYxu0Hr0w+fVhNzzLu/ufiltyRWqrMjAOMB+anhpw1iOcWMWbmy/xl5YOPyg5mOwpdQm6fLCsgQgDa2j/B9nHYEFE2AhZqH9jtJqU5YLsht9W6XoXS2i71f/5WQkn25TXXjBvRknuGncY2nsr3RwRsQ7Vf/f/JL7f0XQI3Pl4AmLvPzg5ICGlCn7Fi4cv8Qt0Trpe43rAn7xmk0C9i7pM43nPki6FoUViTyymomK95DKRTlL3EjhBxlx72QqnVd3q9EVBdSyetc9zVhrif8k5lx2icl/0KlwaTso4a4JhrZE7OtStoSMTcOrArYPYZcKckk6V0am7uUP9Z2V0u83oivJRps+fGE6M69/wvBD7ydyAcXhPIxdjPpO2l7Q1yh3SBMcItoxWMKSgQEyhgh8clUw0BPW/T9hEQ9ws/qg2A==
C:\Windows\tasks\Object Browser-codedownloader.job - C:\Program Files (x86)\Object Browser\Object Browser-codedownloader.exe /reinstallapp /runfrom=task /agentregpath='Object Browser' /appid=32850 /srcid='000037' /subid='0' /zdata='0' /bic=11B0305D18D84A27AB5E9D04C0757A75IE /verifier=b413e436387b7167c2560d6f40eab31d /installerversion=1_34_2_13 /installerfullversion=1.34.2.13 /installationtime=1395074852 /statsdomain=http://stats.srvstatsdata.com /errorsdomain=http://errors.srvstatsdata.com /codedownloaddomain=http://app-static.crossrider.com /defbro=ff /allusers /autoupdateulr='http://update.srvstatsdata.com/ie_code_ ... pdate.json' /runfrom='task' /externallog=''
C:\Windows\tasks\Object Browser-enabler.job - C:\Program Files (x86)\Object Browser\Object Browser-enabler.exe /enablebho /agentregpath='Object Browser' /appid=32850 /srcid='000037' /subid='0' /zdata='0' /bic=11B0305D18D84A27AB5E9D04C0757A75IE /verifier=b413e436387b7167c2560d6f40eab31d /installerversion=1_34_2_13 /installationtime=1395074852 /statsdomain=http://stats.srvstatsdata.com /errorsdomain=http://errors.srvstatsdata.com /bhoguid=11111111-1111-1111-1111-110311281150 /defbro=ff /allusers /autoupdateulr='http://update.srvstatsdata.com/ie_enabl ... pdate.json' /runfrom='task' /externallog=''
C:\Windows\tasks\Object Browser-firefoxinstaller.job - C:\Program Files (x86)\Object Browser\Object Browser-firefoxinstaller.exe /installxpi /agentregpath='Object Browser' /extensionfilepath='C:\Program Files (x86)\Object Browser\32850.xpi' /appid=32850 /srcid='000037' /subid='0' /zdata='0' /bic=11B0305D18D84A27AB5E9D04C0757A75IE /verifier=b413e436387b7167c2560d6f40eab31d /installerversion=1_34_2_13 /installerfullversion=1.34.2.13 /installationtime=1395074852 /statsdomain=http://stats.srvstatsdata.com /errorsdomain=http://errors.srvstatsdata.com /waitforbrowser=300 /extensionid=9321b276-2c2e-4c5f-bd04-b8118e512707@c0c8a2d6-3275-4cac-a0b2-52e936311db9.com /extensionversion=0.93 /prefsbranch=a9321b2762c2e4c5fbd04b8118e512707c0c8a2d632754caca0b252e936311db9com32850 /updateurl=https://w9u6a2p6.ssl.hwcdn.net/plugin/f ... /32850.rdf /extensionname='Object Browser' /extensiondesc='Browser enhancer' /publishername='Object Browser' /defbro=ff /allusers /allprofiles /checkfflist /autoupdateulr='http://update.srvstatsdata.com/ff_agent ... pdate.json' /runfrom='task' /externallog=''
C:\Windows\tasks\Object Browser-updater.job - C:\Program Files (x86)\Object Browser\Object Browser-updater.exe /runupdater /agentregpath='Object Browser' /appid=32850 /srcid='000037' /subid='0' /zdata='0' /bic=11B0305D18D84A27AB5E9D04C0757A75IE /verifier=b413e436387b7167c2560d6f40eab31d /installerversion=1_34_2_13 /installationtime=1395074852 /statsdomain=http://stats.srvstatsdata.com /errorsdomain=http://errors.srvstatsdata.com /geoserviceurl=http://ipgeoapi.com/ /updatejsondomain=http://update.srvstatsdata.com /updaterversion=2 /monetizationdomain=http://stats.mstatsserv.com /autoupdateulr='http://update.srvstatsdata.com/updater_ ... pdate.json' /runfrom='task' /externallog=''
C:\Windows\tasks\Sense-chromeinstaller.job - C:\Program Files (x86)\Sense\Sense-chromeinstaller.exe /rawdata=KVg+pTQ3BvicPoySzWa0gwaYthT6xfqQgUzGtKjkpoUEUZGlqgQQyKYK3LqVEJUM1isg9/zeZlZiK7dk1nKjVPrGym6PyUzzQTwufHTrVpa2ux0WV+5iXBCp3FuySLAXk6wz+s9yjKLqUOPzeBXnYyzdkt6BP3ue0q80JpCFm+IhBaC3YjZzIXcJ0EqvatJsfztFO6DazGrrIpaC0/1F/08wJSpXEllPAI6Uyf93IgAUAItuYUfHf20faQ8mnbBnQLDHXqiyFBpB9eW5beXreDkgGle4rZLEJRmgpj30S6FoNp9hMVanGQoJ19lRvDRWFnrxHRGsSLHTq/YntHWzKV92e7f9TOQl5zL1zmHI+WYc/QJzI3xFAL4+2Z5ClAmlBtwvZk9vuRUay7b1MRv3uxVmn/urxdDTIvYHQWVa+C4q9OH0KVKn+kY6ovSBCz00yNAvJin5hkIZVZewryYblXDbvrWDcndo071H3dzj6RRR+cM9pC6Yt5pjf8LvflnRi4V0jCtPf24n3EZf6ES1B4xAAAmk6tHJgAz3PQylJs7uY56F9k6PKpiGKyjgfWPOMOpTEo+WTfUjc2iphcwhLfv8Wa6CbOog+j2tDxB/MkWDI7gLDbZxdNy/RNfUXYdWlgdbDAMk6MdJ27NaaM4tl8FLc0Va5b8ATJkX+fyNC4GR4em51jpTWb4JMTc0GMweP99V/S0fZ5L7a+JWg3xwTHoXMka310H7v07yNmcYu0DMgWk/T1OowxxrpsdbM2PV8xNdIgCrJrx7n45eJXZEIBGyWrSLrAaF4Va5TxbfgDI09+/jcCpbeGNDLA+FV4Rrx+KTmybQbz3RKmFWZLSb2qiZrL5zPW93x02RFznAqlOLLJ5FaKL9NUFunxHp0/58T+Lxt8FBOkgYAzT5613R5QNFPj7qo8s+Qjv6h4HWY95q2UyuH6OaFY5b4ztRnlqCCP+aTyJqGou7v+hPy5qMkJWPfjsBIxEfSY8OZpK8OBg6kdpH8emljcIfQhbCiydoOHPV1PUIbewzldQxt7/0QbAPxFMuyxgsKCejrEBjpJilG17mHqvPGlY1UtBWvmhpbjh9mEU79j7+3efxPiMClsbaec8syw8Ar5MgLT8JLeudTUE7tiEKlHuggD3c0GVrBrDSDYCaCxTyXdkVjvZe2AN4/MT+2A4CW7LvfEJZuHer+bSE1YFjj79xjMhb/rl5zseLu/LBmskmBQgmxMHIf6+7jPyzB7gns8jR15qSOrR2ZupsnFFnVm0fm2tSPjkWa2+6+Cst5yXBY691QGlmqxLRiMbOoojmxG5y2MoHXcCIMSKmyFO7Bbm0XL+VuqLzNdO7eVxP1UU+qbNACLEZHwiQjjOrbKD80F1QFbkqqdXvMI1JoHI/y6qVqJq/FTXCbchtYd9LhZGeeQlp80ZuChKwl9fvqOBd5Ol07tTzHrxRgG3liCVeW/CD62RsXVhMsJ9rYIp15XeDmOrvtr8qtwJcdN2p28d13g+Oin334CwC8XRbgk1wo9tR79NybcID
C:\Windows\tasks\Sense-enabler.job - C:\Program Files (x86)\Sense\Sense-enabler.exe /enablebho /agentregpath='Sense' /appid=48292 /srcid='000803' /subid='0' /zdata='eyJkYXRhIjp7ImRhdGUiOiJFM0Z6YWRrYywyM2UzODRiYy02Y2IxLTQ3ODktYWE0YS04NjQ0YTU5ZDhkOTcsIiwidW5xIjoiMjNlMzg0YmMtNmNiMS00Nzg5LWFhNGEtODY0NGE1OWQ4ZDk3In19' /bic=C50DCC06052F49EB92AC2E39436044F3IE /verifier=749d441835d7d10a5115495346827de5 /installerversion=1_34_2_13 /installationtime=1394902047 /statsdomain=http://stats.srvstatsdata.com /errorsdomain=http://errors.srvstatsdata.com /bhoguid=11111111-1111-1111-1111-110411821192 /defbro=ff /allusers /autoupdateulr='http://update.srvstatsdata.com/ie_enabl ... pdate.json' /runfrom='task' /externallog=''

=========Mozilla firefox=========

ProfilePath - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\4ny6wqyw.default

"wrc@avast.com"=C:\Program Files\AVAST Software\Avast\WebRep\FF
"sp@avast.com"=C:\Program Files\AVAST Software\Avast\SafePrice\FF


[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331]
"Description"=WLPG Install MIME type
"Path"=C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision]
"Description"=NVIDIA stereo images plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming]
"Description"=NVIDIA 3D Vision Streaming plugin for Mozilla browsers
"Path"=C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL


C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\4ny6wqyw.default\extensions\
staged

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-06-30 952952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live ID Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 529664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]
avast! Online Security - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-06-30 716632]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Pomocná služba pro přihlášení k účtu Microsoft - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17 441592]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"tvncontrol"=C:\Program Files\TightVNC\tvnserver.exe [2013-07-19 2179056]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2016-05-02 2398776]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2012-11-05 89184]
"AvastUI.exe"=C:\Program Files\AVAST Software\Avast\AvastUI.exe [2016-07-11 8900328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"LogonHoursAction"=2
"DontDisplayLogonHoursWarnings"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"SoftwareSASGeneration"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2016-07-23 20:07:28 ----D---- C:\rsit
2016-07-23 20:07:28 ----D---- C:\Program Files\trend micro
2016-07-23 07:51:20 ----D---- C:\Program Files (x86)\Adobe
2016-07-23 07:50:25 ----D---- C:\ProgramData\Adobe
2016-07-23 07:12:40 ----D---- C:\Program Files (x86)\Mozilla Firefox
2016-07-22 22:50:10 ----D---- C:\Program Files\7-Zip
2016-07-14 19:29:24 ----D---- C:\ProgramData\PlayFirst
2016-07-13 20:11:53 ----D---- C:\Program Files (x86)\Serif Standa
2016-06-30 19:06:17 ----A---- C:\Windows\system32\aswBoot.exe
2016-06-30 19:05:57 ----A---- C:\Windows\avastSS.scr
2016-06-26 18:39:05 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-06-26 18:39:05 ----A---- C:\Windows\system32\gdi32.dll
2016-06-26 18:39:04 ----A---- C:\Windows\system32\appraiser.dll
2016-06-26 18:39:04 ----A---- C:\Windows\system32\aeinv.dll
2016-06-26 18:39:03 ----A---- C:\Windows\system32\invagent.dll
2016-06-26 18:39:03 ----A---- C:\Windows\system32\generaltel.dll
2016-06-26 18:39:03 ----A---- C:\Windows\system32\devinv.dll
2016-06-26 18:39:03 ----A---- C:\Windows\system32\CompatTelRunner.exe
2016-06-26 18:39:03 ----A---- C:\Windows\system32\centel.dll
2016-06-26 18:39:03 ----A---- C:\Windows\system32\acmigration.dll
2016-06-26 18:38:59 ----A---- C:\Windows\system32\drivers\srv2.sys
2016-06-26 18:38:58 ----A---- C:\Windows\SYSWOW64\bcryptprimitives.dll
2016-06-26 18:38:58 ----A---- C:\Windows\system32\wdigest.dll
2016-06-26 18:38:58 ----A---- C:\Windows\system32\ncrypt.dll
2016-06-26 18:38:58 ----A---- C:\Windows\system32\drivers\srvnet.sys
2016-06-26 18:38:58 ----A---- C:\Windows\system32\drivers\srv.sys
2016-06-26 18:38:58 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2016-06-26 18:38:58 ----A---- C:\Windows\system32\drivers\cng.sys
2016-06-26 18:38:58 ----A---- C:\Windows\system32\bcryptprimitives.dll
2016-06-26 18:38:57 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2016-06-26 18:38:57 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2016-06-26 18:38:57 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2016-06-26 18:38:57 ----A---- C:\Windows\SYSWOW64\certcli.dll
2016-06-26 18:38:57 ----A---- C:\Windows\system32\rpcrt4.dll
2016-06-26 18:38:57 ----A---- C:\Windows\system32\lsasrv.dll
2016-06-26 18:38:57 ----A---- C:\Windows\system32\kerberos.dll
2016-06-26 18:38:57 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2016-06-26 18:38:57 ----A---- C:\Windows\system32\certcli.dll
2016-06-26 18:38:56 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2016-06-26 18:38:56 ----A---- C:\Windows\SYSWOW64\schannel.dll
2016-06-26 18:38:56 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2016-06-26 18:38:56 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2016-06-26 18:38:56 ----A---- C:\Windows\system32\TSpkg.dll
2016-06-26 18:38:56 ----A---- C:\Windows\system32\sspicli.dll
2016-06-26 18:38:56 ----A---- C:\Windows\system32\schannel.dll
2016-06-26 18:38:56 ----A---- C:\Windows\system32\rpchttp.dll
2016-06-26 18:38:56 ----A---- C:\Windows\system32\msv1_0.dll
2016-06-26 18:38:56 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2016-06-26 18:38:56 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2016-06-26 18:38:55 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2016-06-26 18:38:55 ----A---- C:\Windows\SYSWOW64\secur32.dll
2016-06-26 18:38:55 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2016-06-26 18:38:55 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2016-06-26 18:38:55 ----A---- C:\Windows\SYSWOW64\credssp.dll
2016-06-26 18:38:55 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2016-06-26 18:38:55 ----A---- C:\Windows\system32\sspisrv.dll
2016-06-26 18:38:55 ----A---- C:\Windows\system32\secur32.dll
2016-06-26 18:38:55 ----A---- C:\Windows\system32\lsass.exe
2016-06-26 18:38:55 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2016-06-26 18:38:55 ----A---- C:\Windows\system32\cryptbase.dll
2016-06-26 18:38:55 ----A---- C:\Windows\system32\credssp.dll
2016-06-26 18:38:55 ----A---- C:\Windows\system32\auditpol.exe
2016-06-26 18:38:54 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2016-06-26 18:38:54 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2016-06-26 18:38:54 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2016-06-26 18:38:54 ----A---- C:\Windows\system32\msobjs.dll
2016-06-26 18:38:54 ----A---- C:\Windows\system32\msaudite.dll
2016-06-26 18:38:54 ----A---- C:\Windows\system32\adtschema.dll
2016-06-26 18:38:47 ----A---- C:\Windows\SYSWOW64\tzres.dll
2016-06-26 18:38:47 ----A---- C:\Windows\system32\tzres.dll
2016-06-26 18:38:43 ----A---- C:\Windows\SYSWOW64\lpk.dll
2016-06-26 18:38:43 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2016-06-26 18:38:43 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2016-06-26 18:38:43 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2016-06-26 18:38:43 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2016-06-26 18:38:43 ----A---- C:\Windows\system32\StructuredQuery.dll
2016-06-26 18:38:43 ----A---- C:\Windows\system32\lpk.dll
2016-06-26 18:38:43 ----A---- C:\Windows\system32\fontsub.dll
2016-06-26 18:38:43 ----A---- C:\Windows\system32\dciman32.dll
2016-06-26 18:38:43 ----A---- C:\Windows\system32\atmlib.dll
2016-06-26 18:38:43 ----A---- C:\Windows\system32\atmfd.dll
2016-06-26 18:38:42 ----A---- C:\Windows\SYSWOW64\StructuredQuery.dll
2016-06-26 18:38:41 ----A---- C:\Windows\system32\win32k.sys
2016-06-26 18:38:40 ----A---- C:\Windows\system32\mswsock.dll
2016-06-26 18:38:39 ----A---- C:\Windows\SYSWOW64\ws2_32.dll
2016-06-26 18:38:39 ----A---- C:\Windows\SYSWOW64\winhttp.dll
2016-06-26 18:38:39 ----A---- C:\Windows\SYSWOW64\netbtugc.exe
2016-06-26 18:38:39 ----A---- C:\Windows\SYSWOW64\mswsock.dll
2016-06-26 18:38:39 ----A---- C:\Windows\system32\ws2_32.dll
2016-06-26 18:38:39 ----A---- C:\Windows\system32\winhttp.dll
2016-06-26 18:38:39 ----A---- C:\Windows\system32\netbtugc.exe
2016-06-26 18:38:39 ----A---- C:\Windows\system32\drivers\netbt.sys
2016-06-26 18:38:36 ----A---- C:\Windows\SYSWOW64\winipsec.dll
2016-06-26 18:38:36 ----A---- C:\Windows\SYSWOW64\polstore.dll
2016-06-26 18:38:36 ----A---- C:\Windows\SYSWOW64\gpscript.exe
2016-06-26 18:38:36 ----A---- C:\Windows\SYSWOW64\gpscript.dll
2016-06-26 18:38:36 ----A---- C:\Windows\SYSWOW64\gpprefcl.dll
2016-06-26 18:38:36 ----A---- C:\Windows\SYSWOW64\gpapi.dll
2016-06-26 18:38:36 ----A---- C:\Windows\SYSWOW64\FwRemoteSvr.dll
2016-06-26 18:38:36 ----A---- C:\Windows\system32\winipsec.dll
2016-06-26 18:38:36 ----A---- C:\Windows\system32\polstore.dll
2016-06-26 18:38:36 ----A---- C:\Windows\system32\IPSECSVC.DLL
2016-06-26 18:38:36 ----A---- C:\Windows\system32\gpsvc.dll
2016-06-26 18:38:36 ----A---- C:\Windows\system32\gpscript.exe
2016-06-26 18:38:36 ----A---- C:\Windows\system32\gpscript.dll
2016-06-26 18:38:36 ----A---- C:\Windows\system32\gpprefcl.dll
2016-06-26 18:38:36 ----A---- C:\Windows\system32\gpapi.dll
2016-06-26 18:38:36 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2016-06-26 18:38:33 ----A---- C:\Windows\SYSWOW64\webio.dll
2016-06-26 18:38:33 ----A---- C:\Windows\system32\webio.dll
2016-06-26 18:38:27 ----A---- C:\Windows\system32\shell32.dll
2016-06-26 18:38:25 ----A---- C:\Windows\explorer.exe
2016-06-26 18:38:24 ----A---- C:\Windows\SYSWOW64\shell32.dll
2016-06-26 18:38:24 ----A---- C:\Windows\SYSWOW64\ExplorerFrame.dll
2016-06-26 18:38:24 ----A---- C:\Windows\SYSWOW64\explorer.exe
2016-06-26 18:38:24 ----A---- C:\Windows\system32\ExplorerFrame.dll
2016-06-26 18:38:17 ----A---- C:\Windows\SYSWOW64\msimsg.dll
2016-06-26 18:38:17 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2016-06-26 18:38:17 ----A---- C:\Windows\SYSWOW64\msiexec.exe
2016-06-26 18:38:17 ----A---- C:\Windows\SYSWOW64\msi.dll
2016-06-26 18:38:17 ----A---- C:\Windows\SYSWOW64\authui.dll
2016-06-26 18:38:17 ----A---- C:\Windows\system32\msimsg.dll
2016-06-26 18:38:17 ----A---- C:\Windows\system32\msihnd.dll
2016-06-26 18:38:17 ----A---- C:\Windows\system32\msiexec.exe
2016-06-26 18:38:17 ----A---- C:\Windows\system32\msi.dll
2016-06-26 18:38:17 ----A---- C:\Windows\system32\consent.exe
2016-06-26 18:38:17 ----A---- C:\Windows\system32\authui.dll
2016-06-26 18:38:17 ----A---- C:\Windows\system32\appinfo.dll
2016-06-26 18:37:49 ----A---- C:\Windows\SYSWOW64\inseng.dll
2016-06-26 18:37:49 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2016-06-26 18:37:49 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2016-06-26 18:37:49 ----A---- C:\Windows\system32\iernonce.dll
2016-06-26 18:37:48 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2016-06-26 18:37:48 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2016-06-26 18:37:48 ----A---- C:\Windows\system32\ieetwproxystub.dll
2016-06-26 18:37:48 ----A---- C:\Windows\system32\ieetwcollector.exe
2016-06-26 18:37:47 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2016-06-26 18:37:47 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-06-26 18:37:47 ----A---- C:\Windows\SYSWOW64\occache.dll
2016-06-26 18:37:47 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-06-26 18:37:47 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2016-06-26 18:37:47 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2016-06-26 18:37:47 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2016-06-26 18:37:47 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-06-26 18:37:47 ----A---- C:\Windows\system32\inseng.dll
2016-06-26 18:37:47 ----A---- C:\Windows\system32\ie4uinit.exe
2016-06-26 18:37:46 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-06-26 18:37:45 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2016-06-26 18:37:45 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-06-26 18:37:44 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2016-06-26 18:37:44 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2016-06-26 18:37:44 ----A---- C:\Windows\SYSWOW64\jscript.dll
2016-06-26 18:37:44 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-06-26 18:37:44 ----A---- C:\Windows\system32\urlmon.dll
2016-06-26 18:37:44 ----A---- C:\Windows\system32\occache.dll
2016-06-26 18:37:44 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2016-06-26 18:37:44 ----A---- C:\Windows\system32\iedkcs32.dll
2016-06-26 18:37:43 ----A---- C:\Windows\SYSWOW64\ieui.dll
2016-06-26 18:37:43 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-06-26 18:37:43 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2016-06-26 18:37:43 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2016-06-26 18:37:43 ----A---- C:\Windows\system32\msfeeds.dll
2016-06-26 18:37:43 ----A---- C:\Windows\system32\dxtrans.dll
2016-06-26 18:37:42 ----A---- C:\Windows\system32\iesetup.dll
2016-06-26 18:37:42 ----A---- C:\Windows\system32\ieapfltr.dll
2016-06-26 18:37:40 ----A---- C:\Windows\system32\iertutil.dll
2016-06-26 18:37:39 ----A---- C:\Windows\SYSWOW64\wininet.dll
2016-06-26 18:37:39 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2016-06-26 18:37:39 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2016-06-26 18:37:39 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-06-26 18:37:39 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2016-06-26 18:37:39 ----A---- C:\Windows\system32\vbscript.dll
2016-06-26 18:37:38 ----A---- C:\Windows\SYSWOW64\msrating.dll
2016-06-26 18:37:38 ----A---- C:\Windows\system32\jsproxy.dll
2016-06-26 18:37:37 ----A---- C:\Windows\system32\ieui.dll
2016-06-26 18:37:37 ----A---- C:\Windows\system32\ieframe.dll
2016-06-26 18:37:37 ----A---- C:\Windows\system32\dxtmsft.dll
2016-06-26 18:37:36 ----A---- C:\Windows\system32\mshtmlmedia.dll
2016-06-26 18:37:36 ----A---- C:\Windows\system32\mshtmled.dll
2016-06-26 18:37:35 ----A---- C:\Windows\system32\webcheck.dll
2016-06-26 18:37:35 ----A---- C:\Windows\system32\jscript9diag.dll
2016-06-26 18:37:35 ----A---- C:\Windows\system32\jscript.dll
2016-06-26 18:37:35 ----A---- C:\Windows\system32\ieUnatt.exe
2016-06-26 18:37:34 ----A---- C:\Windows\system32\wininet.dll
2016-06-26 18:37:34 ----A---- C:\Windows\system32\jscript9.dll
2016-06-26 18:37:33 ----A---- C:\Windows\system32\MshtmlDac.dll
2016-06-26 18:37:32 ----A---- C:\Windows\system32\msrating.dll
2016-06-26 18:37:32 ----A---- C:\Windows\system32\mshtml.dll

======List of files/folders modified in the last 1 month======

2016-07-23 20:07:33 ----D---- C:\Windows\Temp
2016-07-23 20:07:28 ----RD---- C:\Program Files
2016-07-23 19:51:01 ----D---- C:\Program Files (x86)\iWebar
2016-07-23 19:51:00 ----D---- C:\Program Files (x86)\Object Browser
2016-07-23 19:50:54 ----D---- C:\ProgramData\AlLSavvER
2016-07-23 19:50:52 ----D---- C:\Windows\system32\Tasks
2016-07-23 19:50:52 ----D---- C:\Program Files\Common Files\System
2016-07-23 14:33:51 ----D---- C:\Program Files (x86)\Google
2016-07-23 14:33:49 ----D---- C:\Windows\Tasks
2016-07-23 14:33:48 ----SHD---- C:\Windows\Installer
2016-07-23 12:35:06 ----D---- C:\Windows\system32\config
2016-07-23 12:31:12 ----D---- C:\ProgramData\NVIDIA
2016-07-23 12:22:02 ----D---- C:\Windows\system32\drivers
2016-07-23 10:51:27 ----D---- C:\Windows
2016-07-23 10:51:27 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2016-07-23 08:00:00 ----D---- C:\Windows\SysWOW64
2016-07-23 07:51:21 ----D---- C:\Program Files (x86)\Common Files
2016-07-23 07:51:20 ----RD---- C:\Program Files (x86)
2016-07-23 07:50:25 ----HD---- C:\ProgramData
2016-07-23 01:02:23 ----D---- C:\Program Files (x86)\WinRAR
2016-07-22 23:01:44 ----D---- C:\Windows\system32\catroot
2016-07-22 23:01:04 ----D---- C:\Windows\Prefetch
2016-07-22 22:56:54 ----D---- C:\Program Files (x86)\K-Lite Codec Pack
2016-07-22 22:31:49 ----D---- C:\ProgramData\Skype
2016-07-22 22:31:06 ----SHD---- C:\System Volume Information
2016-07-22 22:27:06 ----D---- C:\KMPlayer
2016-07-22 22:24:40 ----D---- C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2016-07-22 22:24:39 ----D---- C:\Program Files\iPod
2016-07-22 22:21:36 ----D---- C:\Program Files\Common Files
2016-07-22 22:21:34 ----D---- C:\Windows\System32
2016-07-22 22:21:33 ----DC---- C:\Windows\system32\DRVSTORE
2016-07-22 22:12:17 ----D---- C:\ProgramData\Apple
2016-07-22 22:04:43 ----D---- C:\Windows\system32\DriverStore
2016-07-22 22:04:42 ----D---- C:\Windows\inf
2016-07-22 13:43:24 ----A---- C:\Windows\system32\PerfStringBackup.INI
2016-07-14 18:41:06 ----D---- C:\Windows\Minidump
2016-07-14 18:41:06 ----D---- C:\Windows\Logs
2016-07-11 21:01:24 ----D---- C:\ProgramData\Microsoft Help
2016-07-01 15:58:48 ----D---- C:\Windows\rescache
2016-06-27 19:45:17 ----D---- C:\Windows\system32\catroot2
2016-06-27 11:15:49 ----D---- C:\Windows\winsxs
2016-06-27 11:10:54 ----D---- C:\Windows\SYSWOW64\cs-CZ
2016-06-27 11:10:54 ----D---- C:\Windows\system32\cs-CZ
2016-06-27 11:10:49 ----D---- C:\Windows\system32\wbem
2016-06-27 11:10:49 ----D---- C:\Windows\system32\appraiser
2016-06-27 11:10:48 ----D---- C:\Windows\AppPatch
2016-06-27 11:10:43 ----D---- C:\Windows\cs-CZ
2016-06-27 11:10:38 ----D---- C:\Program Files\Internet Explorer
2016-06-27 11:10:37 ----D---- C:\Windows\SYSWOW64\en-US
2016-06-27 11:10:35 ----D---- C:\Windows\system32\en-US
2016-06-27 11:10:32 ----D---- C:\Program Files (x86)\Internet Explorer

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 aswRvrt;avast! Revert; C:\Windows\system32\drivers\aswRvrt.sys [2016-06-30 74544]
R0 aswVmm;avast! VM Monitor; C:\Windows\system32\drivers\aswVmm.sys [2016-06-30 290088]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sfdrv01;StarForce Protection Environment Driver (version 1.x); C:\Windows\System32\drivers\sfdrv01.sys [2009-02-03 75384]
R0 sfhlp02;StarForce Protection Helper Driver (version 2.x); C:\Windows\System32\drivers\sfhlp02.sys [2006-06-14 14192]
R0 sfvfs02;StarForce Protection VFS Driver (version 2.x); C:\Windows\System32\drivers\sfvfs02.sys [2007-02-08 107384]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 aswKbd;aswKbd; C:\Windows\system32\drivers\aswKbd.sys [2016-06-30 37144]
R1 aswRdr;aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [2016-06-30 103064]
R1 aswSnx;aswSnx; C:\Windows\system32\drivers\aswSnx.sys [2016-06-30 1070904]
R1 aswSP;aswSP; C:\Windows\system32\drivers\aswSP.sys [2016-07-13 473592]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R2 aswHwid;avast! HardwareID; C:\Windows\system32\drivers\aswHwid.sys [2016-06-30 37656]
R2 aswMonFlt;aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [2016-06-30 108304]
R2 aswStm;aswStm; C:\Windows\system32\drivers\aswStm.sys [2016-06-30 162904]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2016-05-10 205456]
R3 NvStreamKms;NvStreamKms; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2016-05-02 28216]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad64v.sys [2016-04-14 56384]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 ss_bbus;SAMSUNG USB Mobile Device (WDM); C:\Windows\system32\DRIVERS\ss_bbus.sys [2009-09-19 127488]
S3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter); C:\Windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-19 18944]
S3 ss_bmdm;SAMSUNG USB Mobile Modem; C:\Windows\system32\DRIVERS\ss_bmdm.sys [2009-09-19 161280]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-02-12 19968]
S3 USBAAPL64;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl64.sys [2014-08-16 54784]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-06-25 82128]
R2 avast! Antivirus;Avast Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2016-06-30 197128]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 GfExperienceService;NVIDIA GeForce Experience Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [2016-05-02 1165368]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2016-05-02 1881144]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2016-05-02 2522680]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2016-05-10 1201600]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2016-05-10 426040]
R2 tvnserver;TightVNC Server; C:\Program Files\TightVNC\tvnserver.exe [2013-07-19 2179056]
R2 wlidsvc;Windows Live ID Sign-in Assistant; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [2012-07-17 2292480]
R3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
R3 NvStreamNetworkSvc;NVIDIA Streamer Network Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [2016-05-02 3634232]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2015-11-05 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2015-11-05 125112]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2016-05-20 114688]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2013-12-19 30814400]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2016-07-23 146888]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-03-08 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2015-11-05 51376]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2015-11-05 135848]

-----------------EOF-----------------

[Márty84]

Zdravim

Stahnete crystal disk info http://www.slunecnice.cz/sw/crystaldiskinfo/
Nainstalujte (pozor na pripadne doplnky, ty odmitnete zrusenim zatrzitka) a spustte jako spravce. Za chvili se zobrazi vysledek.
Kliknete nahore na napis Úpravy a pak na napis Kopírovat. To co se zkopiruje (ulozi se to do pameti) mi sem vlozte (ctrl + V)

Stahnete AdwCleaner https://toolslib.net/downloads/finish/1/ a ulozte ho na plochu.
Ukoncete vsechny programy, jinak to AdwCleaner udela za vas.
Kliknete na nej pravym mysidlem a levym na Spustit jako spravce.
Kliknete na Scan a pockejte, az kontrola dobehne.
Pak kliknete na Cleaning
Program zacne pracovat (muze dojit k restartu pc) a vyplivne log (pripadne bude zde C:\AdwCleaner\AdwCleaner[C?].txt ). Ten mi sem zkopirujte.

Udelejte kontrolu s MBAM. Test nastavte podle tohoto navodu (cili Vlastni sken vsech disku) http://forum.viry.cz/viewtopic.php?f=29&t=144868 a dejte sem vysledky. Predem nic nemazte, miva obcas falesne detekce

[Hank]

----------------------------------------------------------------------------
CrystalDiskInfo 7.0.0 (C) 2008-2016 hiyohiyo
Crystal Dew World : http://crystalmark.info/
----------------------------------------------------------------------------

OS : Windows 7 Professional SP1 [6.1 Build 7601] (x64)
Date : 2016/07/23 21:18:12

-- Controller Map ----------------------------------------------------------
+ ATA Channel 0 (0) [ATA]
- WDC WD2500JB-00REA0 ATA Device
- HL-DT-ST DVDRAM GSA-4163B ATA Device
- ATA Channel 1 (1) [ATA]
+ Řadiče úložiště Intel(R) 82801G (řada ICH7) v režimu Ultra ATA - 27DF [ATA]
- ATA Channel 0 (0)
- ATA Channel 1 (1)

-- Disk List ---------------------------------------------------------------
(1) WDC WD2500JB-00REA0 : 250,0 GB [0/0/0, pd1] - wd

----------------------------------------------------------------------------
(1) WDC WD2500JB-00REA0
----------------------------------------------------------------------------
Model : WDC WD2500JB-00REA0
Firmware : 20.00K20
Serial Number : WD-WCANK4146555
Disk Size : 250,0 GB (8,4/137,4/250,0/250,0)
Buffer Size : 8192 KB
Queue Depth : 1
# of Sectors : 488395055
Rotation Rate : Neznámy údaj
Interface : Parallel ATA
Major Version : ATA/ATAPI-7
Minor Version : ----
Transfer Mode : UDMA/100 | UDMA/100
Power On Hours : 15605 hod.
Power On Count : 3312 krát
Temperature : 45 C (113 F)
Health Status : Dobrý
Features : S.M.A.R.T., AAM, 48bit LBA
APM Level : ----
AAM Level : 80FEh [ON]
Drive Letter : C: D: E:

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 200 200 _51 000000000000 Počet chyb čtení
03 186 101 _21 000000001644 Čas na roztočení ploten
04 _91 _91 __0 0000000025B7 Počet spuštění/zastavení
05 200 200 140 000000000000 Počet přemapovaných sektorů
07 200 200 _51 000000000000 Počet chybných hledání
09 _79 _79 __0 000000003CF5 Hodin v činnosti
0A 100 100 _51 000000000000 Počet opakovaných pokusů o roztočení ploten
0B 100 100 _51 000000000000 Počet pokusů o překalibrování
0C _97 _97 __0 000000000CF0 Počet cyklů zapnutí zařízení
C2 105 _82 __0 00000000002D Teplota
C4 200 200 __0 000000000000 Počet udalostí s číslem realokování sektorů
C5 200 200 __0 000000000000 Počet podezřelých sektorů
C6 200 200 __0 000000000000 Počet neopravitelných sektorů
C7 200 200 __0 000000000000 Počet chyb v kontrolním součtu UltraDMA
C8 200 200 _51 000000000000 Počet chyb při zápisu sektorů

-- IDENTIFY_DEVICE ---------------------------------------------------------
0 1 2 3 4 5 6 7 8 9
000: 427A 3FFF C837 0010 0000 0000 003F 0000 0000 0000
010: 2020 2020 2057 442D 5743 414E 4B34 3134 3635 3535
020: 0000 4000 0032 3230 2E30 304B 3230 5744 4320 5744
030: 3235 3030 4A42 2D30 3052 4541 3020 2020 2020 2020
040: 2020 2020 2020 2020 2020 2020 2020 8010 0000 2F00
050: 4001 0000 0000 0007 3FFF 0010 003F FC10 00FB 0110
060: FFFF 0FFF 0000 0007 0003 0078 0078 0078 0078 0000
070: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
080: 00FE 0000 746B 7F01 4633 7469 3E01 4623 203F 0000
090: 0000 0000 FFFE 603B 80FE 0008 0000 0000 86A0 0001
100: 512F 1D1C 0000 0000 0000 0000 0000 0000 0000 0000
110: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
120: 0000 0000 0000 0000 0000 0000 0000 0000 0009 0000
130: 0000 0000 0000 1276 0000 0000 0000 0000 0000 0000
140: 0000 0000 0004 0000 0000 0000 0000 0000 0000 0000
150: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
160: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
170: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
180: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
190: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
200: 0000 0000 0000 0000 0000 0000 003F 0000 0000 0000
210: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
220: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
230: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
240: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000
250: 0000 0000 0000 0000 0000 6BA5

-- SMART_READ_DATA ---------------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 0F 00 C8 C8 00 00 00 00 00 00 00 03 03
010: 00 BA 65 44 16 00 00 00 00 00 04 32 00 5B 5B B7
020: 25 00 00 00 00 00 05 33 00 C8 C8 00 00 00 00 00
030: 00 00 07 0F 00 C8 C8 00 00 00 00 00 00 00 09 32
040: 00 4F 4F F5 3C 00 00 00 00 00 0A 13 00 64 64 00
050: 00 00 00 00 00 00 0B 12 00 64 64 00 00 00 00 00
060: 00 00 0C 32 00 61 61 F0 0C 00 00 00 00 00 C2 22
070: 00 69 52 2D 00 00 00 00 00 00 C4 32 00 C8 C8 00
080: 00 00 00 00 00 00 C5 12 00 C8 C8 00 00 00 00 00
090: 00 00 C6 10 00 C8 C8 00 00 00 00 00 00 00 C7 3E
0A0: 00 C8 C8 00 00 00 00 00 00 00 C8 09 00 C8 C8 00
0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 84 00 00 1E 01 7B
170: 03 00 01 00 02 5A 06 00 00 00 00 00 00 00 00 00
180: 00 00 01 06 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2B

-- SMART_READ_THRESHOLD ----------------------------------------------------
+0 +1 +2 +3 +4 +5 +6 +7 +8 +9 +A +B +C +D +E +F
000: 10 00 01 33 C8 C8 C8 C8 C8 C8 00 00 00 00 03 15
010: 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00
020: 00 00 00 00 00 00 05 8C 00 00 00 00 00 00 00 00
030: 00 00 07 33 C8 C8 C8 C8 C8 C8 00 00 00 00 09 00
040: 00 00 00 00 00 00 00 00 00 00 0A 33 00 00 00 00
050: 00 00 00 00 00 00 0B 33 00 00 00 00 00 00 00 00
060: 00 00 0C 00 00 00 00 00 00 00 00 00 00 00 C2 00
070: 00 00 00 00 00 00 00 00 00 00 C4 00 00 00 00 00
080: 00 00 00 00 00 00 C5 00 00 00 00 00 00 00 00 00
090: 00 00 C6 00 00 00 00 00 00 00 00 00 00 00 C7 00
0A0: 00 00 00 00 00 00 00 00 00 00 C8 33 C8 C8 C8 C8
0B0: C8 C8 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 62

[Hank]

# AdwCleaner v5.201 - Log vytvořen 23/07/2016 v 21:32:28
# Aktualizováno 30/06/2016 by ToolsLib
# Databáze : 2016-07-21.2 [Server]
# Operační system : Windows 7 Professional Service Pack 1 (X64)
# Uživatelské jméno : Administrator - TOMAS
# Spuštěno z : D:\Users\education\Desktop\adwcleaner_5.201.exe
# Nastavení : Čištění
# Podpora : https://toolslib.net/forum

***** [ Služby ] *****


***** [ Složky ] *****

[-] Složka Smazáno : C:\ProgramData\topapp software
[-] Složka Smazáno : C:\ProgramData\save net
[-] Složka Smazáno : C:\ProgramData\YoutubeAdblocker
[-] Složka Smazáno : C:\ProgramData\29e705ceca8ee26e
[-] Složka Smazáno : C:\ProgramData\AlLSavvER
[-] Složka Smazáno : C:\ProgramData\BitSavEr
[-] Složka Smazáno : C:\ProgramData\DDealExpreussS
[-] Složka Smazáno : C:\ProgramData\JoniCouPPon
[#] Složka Smazáno : C:\ProgramData\save net
[#] Složka Smazáno : C:\ProgramData\YoutubeAdblocker
[#] Složka Smazáno : C:\ProgramData\Application Data\topapp software
[#] Složka Smazáno : C:\ProgramData\Application Data\save net
[#] Složka Smazáno : C:\ProgramData\Application Data\YoutubeAdblocker
[#] Složka Smazáno : C:\ProgramData\Application Data\29e705ceca8ee26e
[#] Složka Smazáno : C:\ProgramData\Application Data\AlLSavvER
[#] Složka Smazáno : C:\ProgramData\Application Data\BitSavEr
[#] Složka Smazáno : C:\ProgramData\Application Data\DDealExpreussS
[#] Složka Smazáno : C:\ProgramData\Application Data\JoniCouPPon
[#] Složka Smazáno : C:\ProgramData\Application Data\save net
[#] Složka Smazáno : C:\ProgramData\Application Data\YoutubeAdblocker
[-] Složka Smazáno : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retro PC Calculator
[-] Složka Smazáno : C:\Users\Public\Documents\ShopperPro
[-] Složka Smazáno : C:\Program Files (x86)\iWebar
[-] Složka Smazáno : C:\Program Files (x86)\Object Browser
[-] Složka Smazáno : C:\Program Files (x86)\Sense
[-] Složka Smazáno : C:\Program Files (x86)\SpeedItup Free
[#] Složka Smazáno : C:\Program Files (x86)\iWebar
[#] Složka Smazáno : C:\Program Files (x86)\Object Browser
[-] Složka Smazáno : C:\Program Files (x86)\save net
[#] Složka Smazáno : C:\Program Files (x86)\SpeedItup Free
[-] Složka Smazáno : C:\Program Files (x86)\YoutubeAdblocker
[#] Složka Smazáno : C:\Program Files (x86)\save net
[#] Složka Smazáno : C:\Program Files (x86)\YoutubeAdblocker
[-] Složka Smazáno : C:\Users\education\AppData\Local\Chromatic Browser
[-] Složka Smazáno : C:\Users\education\AppData\Local\torch
[-] Složka Smazáno : C:\Users\education\AppData\Local\VirtualStore\Program Files\Retro PC Calculator
[-] Složka Smazáno : C:\Users\education\AppData\Local\Installer\Install_19075
[-] Složka Smazáno : C:\Users\education\AppData\Local\Installer\Install_21671
[-] Složka Smazáno : C:\Users\education\AppData\LocalLow\iWebar
[-] Složka Smazáno : C:\Users\education\AppData\LocalLow\Object Browser
[-] Složka Smazáno : C:\Users\education\AppData\LocalLow\Sense
[#] Složka Smazáno : C:\Users\education\AppData\LocalLow\iWebar
[#] Složka Smazáno : C:\Users\education\AppData\LocalLow\Object Browser
[-] Složka Smazáno : C:\Users\education\AppData\Roaming\DownLite
[-] Složka Smazáno : C:\Users\Administrator\AppData\Local\Chromatic Browser
[-] Složka Smazáno : C:\Users\Administrator\AppData\Local\torch
[-] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\cigiagpbkapepgklncnajbakkpkopmam
[-] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\dfohdbmjdkfijghgklbickfnaepghgba
[-] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\kfgaibfbmkjgmimhbbaikfnpkkjkpoan
[-] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje
[-] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc
[-] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno
[#] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje
[#] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc
[#] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno
[#] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje
[#] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc
[#] Složka Smazáno : C:\Users\education\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno
[-] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\cigiagpbkapepgklncnajbakkpkopmam
[-] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\dfohdbmjdkfijghgklbickfnaepghgba
[-] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje
[-] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc
[-] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno
[-] Složka Smazáno : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje
[-] Složka Smazáno : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc
[-] Složka Smazáno : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc
[#] Složka Smazáno : C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno
[-] Složka Smazáno : C:\Program Files\Retro PC Calculator

***** [ Soubory ] *****


***** [ DLLs ] *****


***** [ WMI ] *****


***** [ Zástupci ] *****


***** [ Naplánované úlohy ] *****

[-] Úloha Smazáno : iWebar-chromeinstaller
[-] Úloha Smazáno : iWebar-codedownloader
[-] Úloha Smazáno : iWebar-enabler
[-] Úloha Smazáno : iWebar-firefoxinstaller
[-] Úloha Smazáno : iWebar-updater
[-] Úloha Smazáno : Object Browser-chromeinstaller
[-] Úloha Smazáno : Object Browser-codedownloader
[-] Úloha Smazáno : Object Browser-enabler
[-] Úloha Smazáno : Object Browser-firefoxinstaller
[-] Úloha Smazáno : Object Browser-updater
[-] Úloha Smazáno : Sense-chromeinstaller
[-] Úloha Smazáno : Sense-enabler
[-] Úloha Smazáno : UNELEVATE_1161
[-] Úloha Smazáno : UNELEVATE_15111
[-] Úloha Smazáno : UNELEVATE_20295
[-] Úloha Smazáno : UNELEVATE_2691
[-] Úloha Smazáno : UNELEVATE_360

***** [ Registry ] *****

[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\AppID\SysMenu.DLL
[-] Klíč Smazáno : HKLM\SYSTEM\CurrentControlSet\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}
[-] Klíč Smazáno : HKLM\SYSTEM\CurrentControlSet\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}
[-] Hodnota Smazáno : HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION [iWebar-bg.exe]
[-] Hodnota Smazáno : HKLM\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION [Object Browser-bg.exe]
[-] Klíč Smazáno : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CrossriderApp0032850.Sandbox
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CrossriderApp0032850.Sandbox.1
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CrossriderApp0035510.Sandbox
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CrossriderApp0035510.Sandbox.1
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CrossriderApp0048292.Sandbox
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CrossriderApp0048292.Sandbox.1
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\AniGIFPpg.AniGIFPpg
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\AniGIFPpg2.AniGIFPpg2
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\AppID\{D813D5BB-EBC7-45F9-B8A4-36A305168069}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322282250}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220322552210}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{0142D788-C4FC-4ED8-2222-D654E27AF7F8}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355285550}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355555510}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366286650}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366556610}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{A1843388-EFC2-49C9-2222-FC0C403B0EBB}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\Interface\{A1D87888-DEAA-4971-2222-5D5046F2B3BB}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344284450}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440344554410}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\TypeLib\{A1011E88-B997-11CF-2222-0080C7B2D6BB}
[-] Klíč Smazáno : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
[-] Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
[-] Klíč Smazáno : HKCU\Software\AppDataLow\Software\Crossrider
[-] Klíč Smazáno : HKCU\Software\AppDataLow\Software\iWebar
[-] Klíč Smazáno : HKCU\Software\AppDataLow\Software\Object Browser
[-] Klíč Smazáno : HKCU\Software\AppDataLow\Software\Sense
[-] Klíč Smazáno : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
[-] Klíč Smazáno : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Klíč Smazáno : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
[-] Klíč Smazáno : HKLM\SOFTWARE\iWebar
[-] Klíč Smazáno : HKLM\SOFTWARE\Object Browser
[-] Klíč Smazáno : HKLM\SOFTWARE\Sense
[-] Klíč Smazáno : HKLM\SOFTWARE\SN.Booster
[-] Klíč Smazáno : HKLM\SOFTWARE\YTDownloader
[-] Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7DD5E91C-3864-77EC-7635-D14910C2A03E}
[-] Klíč Smazáno : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}
[-] Klíč Smazáno : [x64] HKLM\SOFTWARE\ShopperPro
[-] Klíč Smazáno : [x64] HKLM\SOFTWARE\YTDownloader
[-] Klíč Smazáno : HKU\.DEFAULT\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Klíč Smazáno : HKU\.DEFAULT\Software\AppDataLow\Software\iWebar
[-] Klíč Smazáno : HKU\.DEFAULT\Software\AppDataLow\Software\Object Browser
[-] Klíč Smazáno : HKU\.DEFAULT\Software\AppDataLow\Software\Sense
[-] Klíč Smazáno : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\iWebar
[-] Klíč Smazáno : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\Object Browser
[-] Klíč Smazáno : HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\Sense
[-] Klíč Smazáno : HKU\S-1-5-19\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Klíč Smazáno : HKU\S-1-5-20\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Klíč Smazáno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\DownLite
[-] Klíč Smazáno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\InstalledBrowserExtensions
[-] Klíč Smazáno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
[-] Klíč Smazáno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\AppDataLow\Software\Crossrider
[-] Klíč Smazáno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\AppDataLow\Software\iWebar
[-] Klíč Smazáno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\AppDataLow\Software\Object Browser
[-] Klíč Smazáno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\AppDataLow\Software\Sense
[-] Klíč Smazáno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\iWebar
[-] Klíč Smazáno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\Object Browser
[-] Klíč Smazáno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Software\Sense
[-] Data Obnoveno : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Obnoveno : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
[-] Data Obnoveno : HKU\S-1-5-21-2757460864-126524720-2486629684-1000\Software\Microsoft\Internet Explorer\Main [Start Page]

***** [ Prohlížeče ] *****


*************************

:: "Tracing" klíče smazány
:: Nastavení Winsock vyčištěno

*************************

\AdwCleaner\AdwCleaner[C1].txt - [15963 bytů] - [23/07/2016 21:32:28]
\AdwCleaner\AdwCleaner[S1].txt - [20193 bytů] - [23/07/2016 21:24:17]

########## EOF - \AdwCleaner\AdwCleaner[C1].txt - [16107 bytů] ##########

[Márty84]

Fajn, jeste MBAM a podle vysledku zvolim dalsi postup.

[Hank]

"Vaše zpráva obsahuje 1305460 znaků. Maximální povolený počet znaků je 100000."
log je zde:
http://leteckaposta.cz/192473171

[Márty84]

Vsechny nalezy nechte odstranit. Po odstraneni a restartu pc test s MBAM zopakujte, at vime, jestli se to nevraci. Napiste vysledek testu a podle nej zvolim dalsi postup.

[Hank]

Už jsem mezitím bohužel MBAM s výsledky zavřel. Musím dělat sken znovu? Nebo to jde vrátit? Našel jsem akorát "historie → Záznamy aplikace", ale tam s tím nejde nic dělat

[Márty84]

Už jsem mezitím bohužel MBAM s výsledky zavřel. Musím dělat sken znovu?

Bohuzel ano. Vysledky jdou sice zobrazit, ale jak jste psal, neda se uz s tim pracovat.

[Hank]

Z 5432 nálezů to kleslo na 144
všechno jsou to už jenom "Potencionálně nežádoucí program"

log:

Malwarebytes Anti-Malware
http://www.malwarebytes.org

Datum skenování: 27.7.2016
Čas skenování: 14:21
Protokol: 3.txt
Správce: Ne

Verze: 2.2.1.1043
Databáze malwaru: v2016.07.27.05
Databáze rootkitů: v2016.05.27.01
Licence: Bezplatná verze
Ochrana proti malwaru: Vypnuto
Ochrana proti škodlivým webovým stránkám: Vypnuto
Ochrana programu: Vypnuto

OS: Windows 7 Service Pack 1
CPU: x64
Souborový systém: NTFS
Uživatel: education

Typ skenu: Vlastní sken
Výsledek: Dokončeno
Prohledaných objektů: 517287
Uplynulý čas: 2 hod, 38 min, 19 sek

Paměť: Zapnuto
Po spuštění: Zapnuto
Souborový systém: Zapnuto
Archivy: Zapnuto
Rootkity: Zapnuto
Heuristika: Zapnuto
PUP: Zapnuto
PUM: Zapnuto

Procesy: 0
(Nenalezeny žádné škodlivé položky)

Moduly: 0
(Nenalezeny žádné škodlivé položky)

Klíče registru: 27
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\INTERFACE\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}, , [a65b2009603a63d3995ea7ed748e9769],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}, , [80811d0c9cfeff379b5c60347092d52b],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\INTERFACE\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}, , [80811d0c9cfeff379b5c60347092d52b],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\INTERFACE\{9B41579A-1996-42F9-8F84-7B7786818CEF}, , [80811d0c9cfeff379b5c60347092d52b],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\INTERFACE\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}, , [80811d0c9cfeff379b5c60347092d52b],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\INTERFACE\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}, , [80811d0c9cfeff379b5c60347092d52b],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{038E4452-7271-41BD-B8F9-858313463C27}, , [aa5712173a60c86e3b22099690737888],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{146D0CF6-F35B-47FD-93A7-D328192A75B8}, , [60a1f831d3c779bd5ffe3a655da61ce4],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{17CF391A-AA4C-46CF-9711-DAB2A014D242}, , [7d8431f84357d264f16d306f768dd22e],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2543CB57-D8AC-4546-B64E-E6FDA9DB70CB}, , [46bbe2479dfd4fe72b311e81ec17b24e],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{4630493E-F12F-43C5-8599-D300CF1C39D0}, , [2bd683a65f3b3cfa5c002b74b94acd33],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{93AE9682-5D9E-4901-B6CD-46BAD6B88771}, , [a9583dec0991e452b9a5950aa45f27d9],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{9F0E6CB6-0022-435D-9B4C-95A405AE04BD}, , [a85933f6326841f5104d7e21956ed12f],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{9FA28836-270D-482F-81AF-43543E3AA15C}, , [7b866abfe7b35bdbf666b0efdc2719e7],
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{EE082214-CCE5-46C0-9DD4-599542EDE1EB}, , [8879cd5cacee42f42638b6e90102639d],
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE, , [cd34c5640694bb7bceb1e0f9f112d52b],
PUP.Optional.VideoAdBlocker.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\bknbnapaddjdnbilpmlacdkjdkjmbjhd, , [aa5728012d6dcf679ec4d8d67f8535cb],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{038E4452-7271-41BD-B8F9-858313463C27}, , [36cb13166238d264f568aef155aed828],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{146D0CF6-F35B-47FD-93A7-D328192A75B8}, , [3cc589a0c3d789ad71ec356aee15af51],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{17CF391A-AA4C-46CF-9711-DAB2A014D242}, , [b44d13164b4f8fa72c32415edd26e51b],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2543CB57-D8AC-4546-B64E-E6FDA9DB70CB}, , [fd04b6737b1f8aacb9a3c2dd0df65ea2],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{4630493E-F12F-43C5-8599-D300CF1C39D0}, , [8978ff2a8f0b9e98b4a8e8b7c241d927],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{93AE9682-5D9E-4901-B6CD-46BAD6B88771}, , [4fb243e64951bf77b0aec0dfee151ae6],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{9F0E6CB6-0022-435D-9B4C-95A405AE04BD}, , [f20f72b72a7046f0f5680a95857ea15f],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{9FA28836-270D-482F-81AF-43543E3AA15C}, , [4eb32efbcbcfa3935c00920d23e049b7],
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{EE082214-CCE5-46C0-9DD4-599542EDE1EB}, , [46bb1712e9b12f07e5799b0446bd41bf],
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE, , [4fb2f7320a9038fe90ef4396cb383dc3],

Hodnoty registru: 21
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{038e4452-7271-41bd-b8f9-858313463c27}|AppName, Object Browser-buttonutil.exe, , [aa5712173a60c86e3b22099690737888]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{146d0cf6-f35b-47fd-93a7-d328192a75b8}|AppName, iWebar-buttonutil.exe, , [60a1f831d3c779bd5ffe3a655da61ce4]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{17cf391a-aa4c-46cf-9711-dab2a014d242}|AppName, iWebar-codedownloader.exe, , [7d8431f84357d264f16d306f768dd22e]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2543cb57-d8ac-4546-b64e-e6fda9db70cb}|AppName, iWebar-bg.exe, , [46bbe2479dfd4fe72b311e81ec17b24e]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{4630493e-f12f-43c5-8599-d300cf1c39d0}|AppName, Sense-bg.exe, , [2bd683a65f3b3cfa5c002b74b94acd33]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{93ae9682-5d9e-4901-b6cd-46bad6b88771}|AppName, Object Browser-codedownloader.exe, , [a9583dec0991e452b9a5950aa45f27d9]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{9f0e6cb6-0022-435d-9b4c-95a405ae04bd}|AppName, Sense-buttonutil.exe, , [a85933f6326841f5104d7e21956ed12f]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{9fa28836-270d-482f-81af-43543e3aa15c}|AppName, Object Browser-bg.exe, , [7b866abfe7b35bdbf666b0efdc2719e7]
PUP.Optional.CrossRider, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{ee082214-cce5-46c0-9dd4-599542ede1eb}|AppName, Sense-codedownloader.exe, , [8879cd5cacee42f42638b6e90102639d]
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, , [cd34c5640694bb7bceb1e0f9f112d52b]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{038e4452-7271-41bd-b8f9-858313463c27}|AppName, Object Browser-buttonutil.exe, , [36cb13166238d264f568aef155aed828]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{146d0cf6-f35b-47fd-93a7-d328192a75b8}|AppName, iWebar-buttonutil.exe, , [3cc589a0c3d789ad71ec356aee15af51]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{17cf391a-aa4c-46cf-9711-dab2a014d242}|AppName, iWebar-codedownloader.exe, , [b44d13164b4f8fa72c32415edd26e51b]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{2543cb57-d8ac-4546-b64e-e6fda9db70cb}|AppName, iWebar-bg.exe, , [fd04b6737b1f8aacb9a3c2dd0df65ea2]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{4630493e-f12f-43c5-8599-d300cf1c39d0}|AppName, Sense-bg.exe, , [8978ff2a8f0b9e98b4a8e8b7c241d927]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{93ae9682-5d9e-4901-b6cd-46bad6b88771}|AppName, Object Browser-codedownloader.exe, , [4fb243e64951bf77b0aec0dfee151ae6]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{9f0e6cb6-0022-435d-9b4c-95a405ae04bd}|AppName, Sense-buttonutil.exe, , [f20f72b72a7046f0f5680a95857ea15f]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{9fa28836-270d-482f-81af-43543e3aa15c}|AppName, Object Browser-bg.exe, , [4eb32efbcbcfa3935c00920d23e049b7]
PUP.Optional.CrossRider, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{ee082214-cce5-46c0-9dd4-599542ede1eb}|AppName, Sense-codedownloader.exe, , [46bb1712e9b12f07e5799b0446bd41bf]
PUP.Optional.CrossRider.Generic, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|Sense-bg.exe, 8000, , [6e939693abefea4cd7b6b047956e11ef]
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, , [4fb2f7320a9038fe90ef4396cb383dc3]

Data registru: 0
(Nenalezeny žádné škodlivé položky)

Složky: 35
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0, , [ef1278b17a20c76f3b9b2aac0ff3fc04],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje, , [ef1278b17a20c76f3b9b2aac0ff3fc04],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154, , [3fc20c1df0aa6fc78f47637349b925db],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc, , [3fc20c1df0aa6fc78f47637349b925db],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14, , [7889cb5e4555bd79cf074195a260d030],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno, , [7889cb5e4555bd79cf074195a260d030],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0, , [f20f38f1b1e93501cb0c2da932d0f907],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje, , [f20f38f1b1e93501cb0c2da932d0f907],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154, , [e41da881722826104c8bdbfb669c05fb],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc, , [e41da881722826104c8bdbfb669c05fb],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14, , [a45d9594e4b656e01dbac610f60cdc24],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno, , [a45d9594e4b656e01dbac610f60cdc24],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0, , [41c0fb2e5f3b191ddefa18be679b8b75],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje, , [41c0fb2e5f3b191ddefa18be679b8b75],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154, , [bc451019584276c095436b6bd131cb35],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc, , [bc451019584276c095436b6bd131cb35],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14, , [c23f93961585e94dae2a8f4732d014ec],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno, , [c23f93961585e94dae2a8f4732d014ec],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0, , [45bca386e3b77eb8bd105458e51e8c74],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje, , [45bca386e3b77eb8bd105458e51e8c74],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154, , [0100a584306ab3831cb11d8f6f94a957],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc, , [0100a584306ab3831cb11d8f6f94a957],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14, , [fe03161364369b9b0fbe7d2f62a19769],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno, , [fe03161364369b9b0fbe7d2f62a19769],
PUP.Optional.UpdateSoftware, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Update Software, , [3cc5fd2c35651a1cb878d6e4a1627090],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14, , [9d64c06908922c0ae0c4a61c1ce608f8],

Soubory: 61
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\lsdb.js, , [ef1278b17a20c76f3b9b2aac0ff3fc04],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\background.html, , [ef1278b17a20c76f3b9b2aac0ff3fc04],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\content.js, , [ef1278b17a20c76f3b9b2aac0ff3fc04],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\manifest.json, , [ef1278b17a20c76f3b9b2aac0ff3fc04],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\lsdb.js, , [3fc20c1df0aa6fc78f47637349b925db],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\background.html, , [3fc20c1df0aa6fc78f47637349b925db],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\content.js, , [3fc20c1df0aa6fc78f47637349b925db],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\manifest.json, , [3fc20c1df0aa6fc78f47637349b925db],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\lsdb.js, , [7889cb5e4555bd79cf074195a260d030],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\background.html, , [7889cb5e4555bd79cf074195a260d030],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\content.js, , [7889cb5e4555bd79cf074195a260d030],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\manifest.json, , [7889cb5e4555bd79cf074195a260d030],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\lsdb.js, , [f20f38f1b1e93501cb0c2da932d0f907],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\background.html, , [f20f38f1b1e93501cb0c2da932d0f907],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\content.js, , [f20f38f1b1e93501cb0c2da932d0f907],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\manifest.json, , [f20f38f1b1e93501cb0c2da932d0f907],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\lsdb.js, , [e41da881722826104c8bdbfb669c05fb],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\background.html, , [e41da881722826104c8bdbfb669c05fb],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\content.js, , [e41da881722826104c8bdbfb669c05fb],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\manifest.json, , [e41da881722826104c8bdbfb669c05fb],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\lsdb.js, , [a45d9594e4b656e01dbac610f60cdc24],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\background.html, , [a45d9594e4b656e01dbac610f60cdc24],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\content.js, , [a45d9594e4b656e01dbac610f60cdc24],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\manifest.json, , [a45d9594e4b656e01dbac610f60cdc24],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\lsdb.js, , [41c0fb2e5f3b191ddefa18be679b8b75],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\background.html, , [41c0fb2e5f3b191ddefa18be679b8b75],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\content.js, , [41c0fb2e5f3b191ddefa18be679b8b75],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\manifest.json, , [41c0fb2e5f3b191ddefa18be679b8b75],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\lsdb.js, , [bc451019584276c095436b6bd131cb35],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\background.html, , [bc451019584276c095436b6bd131cb35],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\content.js, , [bc451019584276c095436b6bd131cb35],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\manifest.json, , [bc451019584276c095436b6bd131cb35],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\lsdb.js, , [c23f93961585e94dae2a8f4732d014ec],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\background.html, , [c23f93961585e94dae2a8f4732d014ec],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\content.js, , [c23f93961585e94dae2a8f4732d014ec],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\manifest.json, , [c23f93961585e94dae2a8f4732d014ec],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\lsdb.js, , [45bca386e3b77eb8bd105458e51e8c74],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\background.html, , [45bca386e3b77eb8bd105458e51e8c74],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\content.js, , [45bca386e3b77eb8bd105458e51e8c74],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\manifest.json, , [45bca386e3b77eb8bd105458e51e8c74],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\lsdb.js, , [0100a584306ab3831cb11d8f6f94a957],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\background.html, , [0100a584306ab3831cb11d8f6f94a957],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\content.js, , [0100a584306ab3831cb11d8f6f94a957],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\manifest.json, , [0100a584306ab3831cb11d8f6f94a957],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\lsdb.js, , [fe03161364369b9b0fbe7d2f62a19769],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\background.html, , [fe03161364369b9b0fbe7d2f62a19769],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\content.js, , [fe03161364369b9b0fbe7d2f62a19769],
PUP.Optional.MultiPlug, C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\manifest.json, , [fe03161364369b9b0fbe7d2f62a19769],
PUP.Optional.UpdateSoftware, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Update Software\Update Software.lnk, , [3cc5fd2c35651a1cb878d6e4a1627090],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\background.html, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\content.js, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\lsdb.js, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bddogigdmgcpnnajjkolfbokeifobkje\1.0\manifest.json, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\background.html, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\content.js, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\lsdb.js, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\lpleipinonnoibneeejgjnoeekmbopbc\154\manifest.json, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\background.html, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\content.js, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\lsdb.js, , [9d64c06908922c0ae0c4a61c1ce608f8],
PUP.Optional.Chromatic, C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\pefflcpkkkpdledhfbhakppmlfljbeno\5.14\manifest.json, , [9d64c06908922c0ae0c4a61c1ce608f8],

Fyzické sektory: 0
(Nenalezeny žádné škodlivé položky)


(end)

[Márty84]

Nalezy nechte odstranit.


Postupujte podle navodu kolegy

Stahnete Junkware Removal Tool http://thisisudax.org/downloads/JRT.exe

• Ulozte nejlepe na plochu
• Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
• Probehne vytvoreni zalohy a nasledne prohledavani
• Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte

Postupujte podle navodu kolegy

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
• Do okna vlozte skript nize

• Kód: Vybrat vše

  autoclean;
  autoclean;
  resethosts;
  emptyclsid;
  IEdefaults;
  FFdefaults;
  CHRdefaults;
  emptyIEcache;
  emptyFFcache;
  emptyCHRcache;
  emptyalltemp;
  emptyflash;
  emptyjava;
  emptyrecycle.bin;

• Nasledne kliknete na Run Script
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

[Hank]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.7 (07.03.2016)
Operating System: Windows 7 Professional x64
Ran by Administrator (Administrator) on st 27.07.2016 at 22:32:39,22
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 18

Successfully deleted: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\4ny6wqyw.default\extensions\staged (Folder)
Successfully deleted: C:\Program Files\update~1 (Folder)
Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FG07KMXC (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GO171D1S (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDS69438 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U74XB1PY (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FG07KMXC (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GO171D1S (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDS69438 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U74XB1PY (Temporary Internet Files Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on st 27.07.2016 at 22:39:55,10
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Hank]

spustil jsem Zoek podle návodu
vyskočila chybová hláška



dal jsem "Ano"

program běžel asi 4 hodiny a nic se nedělo

[Márty84]

Dejte logy podle tohoto navodu http://forum.viry.cz/viewtopic.php?f=13&t=133100 - vypnete na chvili antivir, je mozne, ze to bude blokovat jako skodnou, ale pouzivame to porad, jedna se o falesny poplach
(Kdyby nesel Launcher stahnout, dejte logy jen ze samotneho FRST, tedy bez pouziti Launcheru)

[Hank]

FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-07-2016
Ran by Administrator (administrator) on TOMAS (29-07-2016 15:25:01)
Running from D:\Users\education\Desktop
Loaded Profiles: education & Administrator (Available Profiles: education & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(GlavSoft LLC.) C:\Program Files\TightVNC\tvnserver.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [tvncontrol] => C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2398776 2016-05-02] (NVIDIA Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [8900328 2016-07-11] (AVAST Software)
HKU\S-1-5-21-2757460864-126524720-2486629684-1000 Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% <====== ATTENTION
HKU\S-1-5-21-2757460864-126524720-2486629684-1000 Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% <====== ATTENTION
HKU\S-1-5-21-2757460864-126524720-2486629684-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2757460864-126524720-2486629684-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-2757460864-126524720-2486629684-1000\...\MountPoints2: {6bc84fa3-9325-11e4-8a23-0016e63d6ef5} - G:\LGAutoRun.exe
HKU\S-1-5-21-2757460864-126524720-2486629684-1000\...\MountPoints2: {92bd800c-cdbf-11e5-9eff-0016e63d6ef5} - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2757460864-126524720-2486629684-1000\...\MountPoints2: {ad65b356-294b-11e6-b353-0016e63d6ef5} - G:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-2757460864-126524720-2486629684-500\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2757460864-126524720-2486629684-500\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-06-30] (AVAST Software)
GroupPolicyUsers\S-1-5-21-2757460864-126524720-2486629684-1000\User: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2757460864-126524720-2486629684-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 172.22.1.1 172.22.1.2
Tcpip\..\Interfaces\{DA1197B4-0717-41DF-95BC-9BC3B1416DBC}: [DhcpNameServer] 172.22.1.1 172.22.1.2

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKU\S-1-5-21-2757460864-126524720-2486629684-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
SearchScopes: HKU\S-1-5-21-2757460864-126524720-2486629684-500 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-06-30] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-06-30] (AVAST Software)
BHO-x32: Pomocná služba pro přihlášení k účtu Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\4ny6wqyw.default
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-05-10] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-05-10] (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-06-30]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-06-30]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF

Chrome:
=======
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Disk Google) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-19]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-05-19]
CHR Extension: (Tabulky Google) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-05-19]
CHR Extension: (Dokumenty Google offline) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-19]
CHR Extension: (Avast Online Security) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-05-19]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-05-19]
CHR Extension: (Gmail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-05-19]
CHR HKLM-x32\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-05-06]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-06-30] (AVAST Software)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1165368 2016-05-02] (NVIDIA Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1881144 2016-05-02] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3634232 2016-05-02] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2522680 2016-05-02] (NVIDIA Corporation)
R2 tvnserver; C:\Program Files\TightVNC\tvnserver.exe [2179056 2013-07-19] (GlavSoft LLC.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-06-30] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-06-30] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108304 2016-06-30] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-06-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-06-30] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-06-30] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [473592 2016-07-13] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [162904 2016-06-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [290088 2016-06-30] (AVAST Software)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-07-24] (Malwarebytes)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [28216 2016-05-02] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
R0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [75384 2009-02-03] (Protection Technology (StarForce))
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [107384 2007-02-08] (Protection Technology (StarForce))
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-08-16] (Apple, Inc.) [File not signed]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-29 15:24 - 2016-07-29 15:25 - 00000000 ____D C:\FRST
2016-07-29 15:20 - 2016-07-29 15:23 - 00029696 _____ C:\Users\Administrator\AppData\Local\MSGBOX.EXE
2016-07-27 22:42 - 2016-07-28 09:41 - 00000420 _____ C:\runcheck.txt
2016-07-27 22:42 - 2016-07-27 22:42 - 00000000 ____D C:\zoek_backup
2016-07-27 22:39 - 2016-07-27 22:39 - 00003448 _____ C:\Users\Administrator\Desktop\JRT.txt
2016-07-27 12:20 - 2016-07-27 12:20 - 00000000 ____D C:\Users\education\AppData\Roaming\FFSJ
2016-07-27 12:17 - 2016-07-27 12:17 - 00000000 ____D C:\Users\education\AppData\Local\ThisSideUp
2016-07-24 19:24 - 2016-06-11 08:57 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-07-24 19:24 - 2016-06-11 06:48 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-07-24 19:24 - 2016-06-10 23:38 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-07-24 19:24 - 2016-06-10 23:38 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-07-24 19:24 - 2016-06-10 23:20 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-07-24 19:24 - 2016-06-10 23:19 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-07-24 19:24 - 2016-06-10 23:19 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-07-24 19:24 - 2016-06-10 23:18 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-07-24 19:24 - 2016-06-10 23:18 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-07-24 19:24 - 2016-06-10 23:17 - 02895360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-07-24 19:24 - 2016-06-10 23:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-07-24 19:24 - 2016-06-10 23:08 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-07-24 19:24 - 2016-06-10 23:05 - 25814016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-07-24 19:24 - 2016-06-10 23:04 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-07-24 19:24 - 2016-06-10 23:03 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-07-24 19:24 - 2016-06-10 23:03 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-07-24 19:24 - 2016-06-10 23:02 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-07-24 19:24 - 2016-06-10 23:02 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-07-24 19:24 - 2016-06-10 22:53 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-07-24 19:24 - 2016-06-10 22:50 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-07-24 19:24 - 2016-06-10 22:49 - 06047744 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-07-24 19:24 - 2016-06-10 22:40 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-07-24 19:24 - 2016-06-10 22:38 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-07-24 19:24 - 2016-06-10 22:35 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-07-24 19:24 - 2016-06-10 22:34 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-07-24 19:24 - 2016-06-10 22:31 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-07-24 19:24 - 2016-06-10 22:28 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-07-24 19:24 - 2016-06-10 22:15 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-07-24 19:24 - 2016-06-10 22:13 - 00724992 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-07-24 19:24 - 2016-06-10 22:12 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-07-24 19:24 - 2016-06-10 22:11 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-07-24 19:24 - 2016-06-10 22:10 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-07-24 19:24 - 2016-06-10 21:45 - 15409664 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-07-24 19:24 - 2016-06-10 21:44 - 02869248 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-07-24 19:24 - 2016-06-10 21:30 - 01550848 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-07-24 19:24 - 2016-06-10 21:21 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-07-24 19:24 - 2016-06-10 21:09 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-07-24 19:24 - 2016-06-10 20:54 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-07-24 19:24 - 2016-06-10 20:53 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-07-24 19:24 - 2016-06-10 20:53 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-07-24 19:24 - 2016-06-10 20:53 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-07-24 19:24 - 2016-06-10 20:52 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-07-24 19:24 - 2016-06-10 20:47 - 02287104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-07-24 19:24 - 2016-06-10 20:46 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-07-24 19:24 - 2016-06-10 20:45 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-07-24 19:24 - 2016-06-10 20:42 - 20348928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-07-24 19:24 - 2016-06-10 20:42 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-07-24 19:24 - 2016-06-10 20:41 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-07-24 19:24 - 2016-06-10 20:41 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-07-24 19:24 - 2016-06-10 20:41 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-07-24 19:24 - 2016-06-10 20:32 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-07-24 19:24 - 2016-06-10 20:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-07-24 19:24 - 2016-06-10 20:26 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-07-24 19:24 - 2016-06-10 20:24 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-07-24 19:24 - 2016-06-10 20:23 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-07-24 19:24 - 2016-06-10 20:21 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-07-24 19:24 - 2016-06-10 20:19 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-07-24 19:24 - 2016-06-10 20:14 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-07-24 19:24 - 2016-06-10 20:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-07-24 19:24 - 2016-06-10 20:10 - 00692736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-07-24 19:24 - 2016-06-10 20:09 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-07-24 19:24 - 2016-06-10 20:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-07-24 19:24 - 2016-06-10 19:58 - 13806080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-07-24 19:24 - 2016-06-10 19:45 - 02392576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-07-24 19:24 - 2016-06-10 19:42 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-07-24 19:24 - 2016-06-10 19:41 - 01315840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-07-24 19:23 - 2016-06-26 02:35 - 00041704 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-07-24 19:23 - 2016-06-26 02:27 - 01208320 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-07-24 19:23 - 2016-06-26 02:27 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2016-07-24 19:23 - 2016-06-26 02:27 - 00756736 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2016-07-24 19:23 - 2016-06-26 02:27 - 00344576 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2016-07-24 19:23 - 2016-06-26 02:27 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2016-07-24 19:23 - 2016-06-26 02:27 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2016-07-24 19:23 - 2016-06-25 21:54 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2016-07-24 19:23 - 2016-06-25 21:53 - 00297472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2016-07-24 19:23 - 2016-06-25 21:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2016-07-24 19:23 - 2016-06-25 21:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
2016-07-24 19:23 - 2016-06-25 21:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe
2016-07-24 19:23 - 2016-06-22 15:06 - 00268800 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2016-07-24 19:23 - 2016-06-17 20:24 - 01490432 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-07-24 19:23 - 2016-06-17 20:24 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-07-24 19:23 - 2016-06-17 20:24 - 00544256 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-07-24 19:23 - 2016-06-17 20:24 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-07-24 19:23 - 2016-06-17 20:24 - 00219136 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-07-24 19:23 - 2016-06-17 20:24 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-07-24 19:23 - 2016-06-14 17:03 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-07-24 15:58 - 2016-07-24 15:58 - 01310978 _____ C:\Users\Administrator\Desktop\vysledek.txt
2016-07-24 15:52 - 2016-07-24 15:57 - 01310978 _____ C:\Users\Administrator\Desktop\mbam_log.txt
2016-07-24 07:51 - 2016-07-24 07:54 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-07-24 07:51 - 2016-07-24 07:51 - 00001108 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-07-24 07:51 - 2016-07-24 07:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-07-24 07:50 - 2016-07-24 07:51 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-07-24 07:50 - 2016-07-24 07:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-07-24 07:50 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-07-24 07:50 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-07-24 07:50 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-07-23 21:16 - 2016-07-23 21:16 - 00001206 _____ C:\Users\Administrator\Desktop\CrystalDiskInfo.lnk
2016-07-23 21:15 - 2016-07-23 21:16 - 00000000 ____D C:\Program Files (x86)\CrystalDiskInfo
2016-07-23 21:15 - 2016-07-23 21:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2016-07-23 20:07 - 2016-07-23 20:07 - 00000000 ____D C:\rsit
2016-07-23 20:07 - 2016-07-23 20:07 - 00000000 ____D C:\Program Files\trend micro
2016-07-23 07:52 - 2016-07-23 08:01 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-07-23 07:52 - 2016-07-23 07:52 - 00000000 ____D C:\Users\education\AppData\LocalLow\Adobe
2016-07-23 07:51 - 2016-07-23 08:00 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-07-23 07:51 - 2016-07-23 07:51 - 00000000 ____D C:\Program Files (x86)\Adobe
2016-07-23 07:50 - 2016-07-23 07:53 - 00000000 ____D C:\ProgramData\Adobe
2016-07-23 07:12 - 2016-07-23 10:51 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-07-22 22:50 - 2016-07-22 22:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2016-07-22 22:50 - 2016-07-22 22:50 - 00000000 ____D C:\Program Files\7-Zip
2016-07-22 22:02 - 2016-07-22 22:02 - 00000000 ____D C:\Users\Administrator\AppData\Local\Apple
2016-07-15 19:09 - 2016-07-27 15:08 - 00000000 ____D C:\Users\education\AppData\Roaming\YoudaGames
2016-07-14 19:29 - 2016-07-14 19:29 - 00000000 ____D C:\Users\education\AppData\Roaming\PlayFirst
2016-07-14 19:29 - 2016-07-14 19:29 - 00000000 ____D C:\ProgramData\PlayFirst
2016-07-13 20:12 - 2016-07-13 20:12 - 00000000 ____D C:\Users\education\AppData\Local\ERS G-Studio
2016-07-13 20:11 - 2016-07-14 18:40 - 00000000 ____D C:\Program Files (x86)\Serif Standa
2016-07-01 12:00 - 2016-07-01 12:00 - 00000000 ____D C:\Users\education\AppData\Local\CEF
2016-07-01 11:48 - 2016-07-01 11:48 - 00000000 ____D C:\Users\Administrator\AppData\Local\CEF
2016-06-30 19:06 - 2016-06-30 19:06 - 00390984 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-06-30 19:05 - 2016-06-30 19:05 - 00053208 _____ (AVAST Software) C:\Windows\avastSS.scr

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-29 15:19 - 2009-07-14 06:45 - 00028160 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-29 15:19 - 2009-07-14 06:45 - 00028160 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-29 15:11 - 2014-03-08 19:35 - 00000000 ____D C:\ProgramData\NVIDIA
2016-07-29 15:11 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-28 16:34 - 2009-07-14 12:49 - 00668542 _____ C:\Windows\system32\perfh005.dat
2016-07-28 16:34 - 2009-07-14 12:49 - 00141202 _____ C:\Windows\system32\perfc005.dat
2016-07-28 16:34 - 2009-07-14 07:13 - 01583226 _____ C:\Windows\system32\PerfStringBackup.INI
2016-07-28 16:34 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-07-28 06:27 - 2016-05-18 18:00 - 00004616 __RSH C:\Users\education\ntuser.pol
2016-07-28 06:27 - 2014-03-08 18:38 - 00000000 ____D C:\Users\education
2016-07-27 22:56 - 2016-05-19 20:08 - 00000644 __RSH C:\Users\Administrator\ntuser.pol
2016-07-27 22:56 - 2014-04-02 10:08 - 00000000 ____D C:\Users\Administrator
2016-07-27 14:30 - 2016-05-20 18:36 - 00000000 ____D C:\Users\education\AppData\Local\CrashDumps
2016-07-26 14:24 - 2014-03-09 01:12 - 00504488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-07-25 11:44 - 2015-04-04 14:19 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2016-07-25 11:44 - 2015-04-04 14:19 - 00000000 ___SD C:\Windows\system32\GWX
2016-07-25 08:02 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2016-07-25 07:04 - 2009-07-14 06:45 - 00408376 _____ C:\Windows\system32\FNTCACHE.DAT
2016-07-25 07:01 - 2014-12-11 15:01 - 00000000 ____D C:\Windows\system32\appraiser
2016-07-25 07:01 - 2009-07-14 13:07 - 00000000 ____D C:\Program Files\Windows Journal
2016-07-24 16:27 - 2016-02-21 20:40 - 00000000 ____D C:\Users\education\AppData\Roaming\MPC-HC
2016-07-23 19:50 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2016-07-23 14:33 - 2014-04-11 16:58 - 00000000 ____D C:\Program Files (x86)\Google
2016-07-23 10:51 - 2014-04-11 17:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-07-23 07:59 - 2014-03-09 04:53 - 00000000 ____D C:\Users\education\AppData\Roaming\Adobe
2016-07-23 07:52 - 2014-03-10 15:59 - 00000000 ____D C:\Users\education\AppData\Local\Adobe
2016-07-22 22:57 - 2016-02-21 20:38 - 00003594 _____ C:\Windows\System32\Tasks\klcp_update
2016-07-22 22:56 - 2016-02-21 20:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2016-07-22 22:56 - 2016-02-21 20:37 - 00000000 ____D C:\Program Files (x86)\K-Lite Codec Pack
2016-07-22 22:31 - 2014-08-03 18:25 - 00000000 ____D C:\ProgramData\Skype
2016-07-22 22:27 - 2014-10-08 21:54 - 00000000 ____D C:\KMPlayer
2016-07-22 22:24 - 2015-01-20 11:09 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2016-07-22 22:24 - 2015-01-20 11:09 - 00000000 ____D C:\Program Files\iPod
2016-07-22 22:12 - 2015-01-20 11:04 - 00000000 ____D C:\ProgramData\Apple
2016-07-22 21:56 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-07-14 18:41 - 2014-03-11 22:32 - 00000000 ____D C:\Windows\Minidump
2016-07-14 18:36 - 2014-08-04 15:50 - 00002832 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2016-07-13 16:39 - 2014-08-01 21:38 - 00473592 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2016-07-01 11:46 - 2016-05-06 19:14 - 00003884 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1462554893
2016-06-30 19:08 - 2014-08-01 21:38 - 00003922 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-06-30 19:06 - 2014-08-01 21:38 - 00473592 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.146730651829602
2016-06-30 19:06 - 2014-08-01 21:38 - 00290088 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-06-30 19:06 - 2014-08-01 21:38 - 00162904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-06-30 19:06 - 2014-08-01 21:38 - 00108304 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-06-30 19:06 - 2014-08-01 21:38 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-06-30 19:06 - 2014-08-01 21:38 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-06-30 19:06 - 2014-08-01 21:38 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-06-30 19:05 - 2016-05-06 19:12 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2016-06-30 19:05 - 2014-08-01 21:38 - 01070904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

==================== Files in the root of some directories =======

2016-07-29 15:20 - 2016-07-29 15:23 - 0029696 _____ () C:\Users\Administrator\AppData\Local\MSGBOX.EXE
2014-03-15 17:45 - 2014-03-15 17:45 - 0000040 _____ () C:\ProgramData\spds90.txt

Some files in TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\7za.exe
C:\Users\Administrator\AppData\Local\Temp\DaS_21.exe
C:\Users\Administrator\AppData\Local\Temp\hijackthis.exe
C:\Users\Administrator\AppData\Local\Temp\libeay32.dll
C:\Users\Administrator\AppData\Local\Temp\msvcr120.dll
C:\Users\Administrator\AppData\Local\Temp\NirCmd.exe
C:\Users\Administrator\AppData\Local\Temp\PEVZ.EXE
C:\Users\Administrator\AppData\Local\Temp\remove.exe
C:\Users\Administrator\AppData\Local\Temp\sed.exe
C:\Users\Administrator\AppData\Local\Temp\shortcut.exe
C:\Users\Administrator\AppData\Local\Temp\sqlite3.dll
C:\Users\Administrator\AppData\Local\Temp\swreg.exe
C:\Users\Administrator\AppData\Local\Temp\swxcacls.exe
C:\Users\Administrator\AppData\Local\Temp\wget.exe
C:\Users\Administrator\AppData\Local\Temp\zoek-delete.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-07-27 13:06

==================== End of FRST.txt ============================