ClamWin Karanténa

[Thor]

Ahoj,

chtěl bych Vás poprosit o rady jak dostat z karantény ClamWinu některé soubory o jejichž škodlivosti pochybuji. Resp. jak zjistím, jestli jsou dané soubory nějak škodlivé nebo nebezpečné? Na virustotal mi nejde je oskenovat, když mají tu koncovku INFECTED. Odstranění souborů ze systému mi znemožnilo funkci programů Rainbow Six 3: raven Shield a taky Lenovo boot optimizer. A možná dalších. Jinak scan od KVRT mi nenašel žádné infikované soubory, narozdíl od ClamWinu. Ani MBAM nic nenašel.

Děkuji

log z Clamu - https://www.dropbox.com/s/a9yno6ih3ze66 ... g.txt?dl=0

[Rudy]

Zdravím!
Každý slušný antivir musí mít možnost smazat karanténu. Pokud vám ve smazání něco brání, budete to muset odinstalovat, případně to zkusit v nouz. režimu.

[Thor]

Ale já ty soubory nechci smazat. Já je chci obnovit, protože bez nich mi nefungují výše zmíněné aplikace. Spíš mě zajímá, proč je antivir označil a jestli jsou škodlivé. Abych neobnovil něco, co mi v pc bude dělat neplechu

[Rudy]

Je to visual basic script a v něm jsou často psány i závadné skripty. Pořádný antivir (Avast, Eset, Noroton apod.) to pozná, tenhle asi ne. Opravdu nevím, zda tyto skripty jsou v pořádku, či ne (je jich tolik, že si to nelze zapamatovat).

[Thor]

Co znamená tohle - https://www.virustotal.com/cs/file/b8ca ... 471547315/

ClamAV je buď hodně důsledný, nebo falešný podle výsledků scanu. Co si o tom myslíte? Myslíte, že soubor pro jazyk pro Lenovo Boot Optimizer z oficiálních stránek výrobce, obsahuje trojana?

[Rudy]

ClamAV je antivir, který naše fórum nedoporučuje. Takže si spíš myslím, že jde o falešnou detekci. Tyhle firemní utilitym které jsou přidávány do Windows mají různé nectnosti, malware sem v nich ale ještě neviděl.

[Thor]

Dobře. Díky. Jaký tedy používáte antivirový scanner pro občasnou prevenci a to samé pro malware?

A mohl bych sem hodit log z RSITu na kontrolu, nebo si mám vytvořit téma v sekci prevence?


Díky

[Rudy]

Log sem dát můžete (lépe ale log FRST: http://forum.viry.cz/viewtopic.php?f=13&t=133100 ). Pokud potřebuji AV skener, použiji MBAM: http://www.malwarebytes.org/mbam.php . Jako rezidentní antivirus mám Avast.

[Thor]

Ten Váš FRSTLauncheru nejde vůbec stáhnout ani jedním z prohlížečů (Chrome/Mozilla) ani když mám vypnutý Avast. Prohlížeče mi hlásí, že ten soubor obsahuje vir, proto ho nestáhnou. Stáhnout šel jen ten Farbar Recorvery Scan Tool.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-08-2016
Ran by Mike (administrator) on BOSTON (18-08-2016 21:52:20)
Running from C:\Users\Mike\Downloads
Loaded Profiles: Mike (Available Profiles: Mike & Administrator & DefaultAppPool)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(AVAST Software) C:\Program Files\Avast\avastui.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\System32\dfrgui.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [9753024 2015-11-14] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5908928 2015-11-14] (Lenovo(beijing) Limited)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2841896 2011-10-28] (Synaptics Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14021336 2015-06-18] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_DOLBYDRAGON] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-04-28] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1393880 2015-04-28] (Realtek Semiconductor)
HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [206176 2016-08-18] (Lenovo)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Avast\AvastUI.exe [7408312 2016-06-27] (AVAST Software)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [23546672 2016-08-01] (Dropbox, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8894680 2016-08-05] (Piriform Ltd)
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\MountPoints2: {1e464f15-de79-11e5-8313-b870f42a2b90} - H:\RunGame.exe
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\MountPoints2: {4baff6cc-8b17-11e5-917a-806e6f6e6963} - D:\.\Autorun\UBIAUTORUN.EXE .\cd2.ini
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\MountPoints2: {6e0c8875-8e41-11e5-a148-74e50b0c9fe6} - E:\Autorun.exe
HKU\S-1-5-18\...\Run: [KSS] => "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe" autorun
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2015-11-14] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [181488 2016-08-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [159352 2016-08-11] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Avast\ashShA64.dll [2016-05-08] (AVAST Software)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.38.dll [2016-08-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.38.dll [2016-08-01] (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{9E62C974-2559-496D-92E7-85C2C0FF6F6F}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{A952C5B8-0933-4165-B496-1407EDD105BD}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{A952C5B8-0933-4165-B496-1407EDD105BD}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-07-22] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Avast\aswWebRepIE64.dll [2016-04-24] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-22] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Avast\aswWebRepIE.dll [2016-04-24] (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6ky4rbed.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-12] ()
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-22] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-12] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\6ky4rbed.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-06]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\Avast\WebRep\FF [2016-05-08]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\Avast\SafePrice\FF [2016-05-08]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\Avast\SafePrice\FF

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.cz/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Session Restore: Default -> is enabled.
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.866\_platform_specific\win_x64\widevinecdmadapter.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\PepperFlash\21.0.0.216\pepflashplayer.dll => No File
CHR Profile: C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Dokumenty Google) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-04-11]
CHR Extension: (Disk Google) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-11]
CHR Extension: (YouTube) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-14]
CHR Extension: (Vyhledávání Google) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-14]
CHR Extension: (Tabulky Google) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-14]
CHR Extension: (Dokumenty Google offline) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (AdBlock) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-07-29]
CHR Extension: (Lightshot (Nástroje snímků)) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbniclmhobmnbdlbpiphghaielnnpgdp [2016-05-19]
CHR Extension: (Kontrola e-mailu Google) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2015-11-14]
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-01]
CHR Extension: (YouTube Unblocker) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2016-08-18] [UpdateUrl: hxxp://www.unblocker.yt/addon/chrome/updates.xml] <==== ATTENTION
CHR Extension: (Gmail) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-14]
CHR Extension: (Chrome Media Router) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-18]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-04-24]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\Avast\AvastSvc.exe [243296 2016-05-08] (AVAST Software)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-11-14] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-11-14] (Dropbox, Inc.)
S3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1268568 2015-06-18] (Disc Soft Ltd)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [268704 2016-04-04] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation)
S3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-14] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-14] (NVIDIA Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [294616 2015-05-22] (Realtek Semiconductor)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3833248 2016-04-04] (Intel® Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-05-08] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-05-08] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-05-08] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-05-08] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-05-08] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-05-08] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [465792 2016-05-08] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [166432 2016-05-08] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [292704 2016-08-05] (AVAST Software)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-11-14] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [181304 2016-03-28] (Intel Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [12400 2016-08-08] (Macrovision Europe Ltd) [File not signed]
S3 semav6msr64; C:\Windows\system32\drivers\semav6msr64.sys [21984 2015-06-04] ()
S3 trufos; C:\Windows\System32\drivers\trufos.sys [350160 2015-12-31] (BitDefender S.R.L.)
S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-18 21:52 - 2016-08-18 21:52 - 00020507 _____ C:\Users\Mike\Downloads\FRST.txt
2016-08-18 21:52 - 2016-08-18 21:52 - 00000000 ____D C:\FRST
2016-08-18 21:49 - 2016-08-18 21:49 - 02394624 _____ (Farbar) C:\Users\Mike\Downloads\FRST64.exe
2016-08-18 21:48 - 2016-08-18 21:48 - 00112640 _____ (forum.viry.cz) C:\Users\Mike\Downloads\Nepotvrzeno 311131.crdownload
2016-08-18 21:25 - 2016-08-18 21:25 - 00084184 _____ C:\Users\Mike\AppData\Local\GDIPFONTCACHEV1.DAT
2016-08-18 21:24 - 2016-08-18 21:24 - 00337888 _____ C:\Windows\system32\FNTCACHE.DAT
2016-08-18 21:19 - 2016-08-18 21:19 - 00002306 _____ C:\Users\Administrator\Desktop\Ubi Soft Product Registration.lnk
2016-08-18 21:19 - 2016-08-18 21:19 - 00000000 ____D C:\Program Files (x86)\Ubi Soft
2016-08-18 21:09 - 2016-08-18 21:18 - 00001843 _____ C:\Users\Public\Desktop\Play Raven Shield.lnk
2016-08-18 21:09 - 2016-08-18 21:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Storm Entertainment
2016-08-18 14:25 - 2016-08-18 14:25 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Ashampoo
2016-08-18 14:25 - 2016-08-18 14:25 - 00000000 ____D C:\Users\Mike\AppData\Local\Ashampoo
2016-08-18 02:04 - 2016-08-18 02:15 - 00000000 ____D C:\Users\Mike\AppData\Local\NPE
2016-08-17 22:16 - 2016-08-17 22:16 - 00000000 ____D C:\Users\Mike\Downloads\Byt
2016-08-17 19:01 - 2016-08-17 19:43 - 00011526 _____ C:\Users\Mike\Desktop\BYT.xlsx
2016-08-17 14:12 - 2016-08-17 14:12 - 00000000 ____D C:\Windows\SysWOW64\NV
2016-08-17 14:12 - 2016-08-17 14:12 - 00000000 ____D C:\Windows\system32\NV
2016-08-17 14:10 - 2016-08-11 16:31 - 40068544 _____ C:\Windows\system32\nvcompiler.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 35182648 _____ C:\Windows\SysWOW64\nvcompiler.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 34798528 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 28203968 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 19832440 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 17462904 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 17249896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 14075960 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2016-08-17 14:10 - 2016-08-11 16:31 - 10719920 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 10530960 _____ C:\Windows\system32\nvptxJitCompiler.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 10264136 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 09078776 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 08674320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 08644640 _____ C:\Windows\SysWOW64\nvptxJitCompiler.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 03597248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 03166264 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 01922616 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6437254.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 01586744 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6437254.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 01021888 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 00958912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 00945088 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 00897592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 00695136 _____ C:\Windows\system32\nvfatbinaryLoader.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 00584896 _____ C:\Windows\SysWOW64\nvfatbinaryLoader.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 00153368 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 00131720 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2016-08-17 14:10 - 2016-08-11 16:31 - 00039992 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2016-08-17 14:10 - 2016-08-11 16:31 - 00000669 _____ C:\Windows\SysWOW64\nv-vk32.json
2016-08-17 14:10 - 2016-08-11 16:31 - 00000669 _____ C:\Windows\system32\nv-vk64.json
2016-08-17 13:53 - 2016-07-08 17:32 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-08-17 13:53 - 2016-07-08 17:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-08-17 13:53 - 2016-07-07 17:36 - 01896168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2016-08-17 13:53 - 2016-07-07 17:36 - 00377576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2016-08-17 13:53 - 2016-07-07 17:36 - 00287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2016-08-17 13:53 - 2016-07-07 17:08 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2016-08-17 13:53 - 2016-07-01 17:31 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-08-17 13:53 - 2016-07-01 17:31 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2016-08-17 13:53 - 2016-07-01 17:13 - 00741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-08-17 13:53 - 2016-07-01 17:13 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2016-08-17 13:53 - 2016-07-01 16:56 - 00464896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-08-17 13:53 - 2016-07-01 16:56 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-08-17 13:53 - 2016-07-01 16:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-08-12 13:44 - 2016-08-12 13:44 - 00000000 ____D C:\Users\Mike\Documents\League of Legends
2016-08-10 19:40 - 2016-08-10 19:40 - 00084184 _____ C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2016-08-10 19:40 - 2016-08-10 19:40 - 00001389 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-08-10 19:40 - 2016-08-10 19:40 - 00000020 ___SH C:\Users\Administrator\ntuser.ini
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Šablony
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Soubory cookie
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Poslední
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Okolní tiskárny
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Okolní síť
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Nabídka Start
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Dokumenty
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Documents\Obrázky
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Documents\Hudba
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Documents\Filmy
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\Data aplikací
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 _SHDL C:\Users\Administrator\AppData\Local\Data aplikací
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Intel
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 ____D C:\Users\Administrator\AppData\Local\NVIDIA
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 ____D C:\Users\Administrator\AppData\Local\Dropbox
2016-08-10 19:40 - 2016-08-10 19:40 - 00000000 ____D C:\Users\Administrator
2016-08-10 19:40 - 2016-04-27 16:18 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\AVAST Software
2016-08-10 19:40 - 2009-07-14 17:36 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Media Center Programs
2016-08-10 19:01 - 2016-08-17 22:27 - 00000000 ____D C:\Users\Mike\AppData\Roaming\uTorrent
2016-08-10 19:01 - 2016-08-10 19:01 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\uTorrent
2016-08-10 14:51 - 2016-08-02 16:54 - 00394440 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-08-10 14:51 - 2016-08-02 16:08 - 00346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-08-10 14:51 - 2016-08-02 08:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-08-10 14:51 - 2016-08-02 08:31 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-08-10 14:51 - 2016-08-02 08:23 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-08-10 14:51 - 2016-08-02 08:19 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-08-10 14:51 - 2016-08-02 08:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-08-10 14:51 - 2016-08-02 08:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-08-10 14:51 - 2016-08-02 07:59 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-08-10 14:51 - 2016-08-02 07:54 - 20343808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-08-10 14:51 - 2016-08-02 07:51 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-08-10 14:51 - 2016-08-02 07:51 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-08-10 14:51 - 2016-08-02 07:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-08-10 14:51 - 2016-08-02 07:51 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-08-10 14:51 - 2016-08-02 07:50 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-08-10 14:51 - 2016-08-02 07:44 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-08-10 14:51 - 2016-08-02 07:38 - 00724992 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-08-10 14:51 - 2016-08-02 07:29 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-08-10 14:51 - 2016-08-02 07:28 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-08-10 14:51 - 2016-08-02 07:25 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-08-10 14:51 - 2016-08-02 07:24 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-08-10 14:51 - 2016-08-02 07:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-08-10 14:51 - 2016-08-02 07:15 - 00692736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-08-10 14:51 - 2016-08-02 07:14 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-08-10 14:51 - 2016-08-02 07:10 - 01550848 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-08-10 14:51 - 2016-08-02 06:53 - 01316352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-08-10 14:51 - 2016-08-02 06:51 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-08-10 14:51 - 2016-07-08 17:37 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-08-10 14:51 - 2016-07-08 17:37 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-08-10 14:51 - 2016-07-08 17:32 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00343552 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-08-10 14:51 - 2016-07-08 17:32 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-08-10 14:51 - 2016-07-08 17:17 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-08-10 14:51 - 2016-07-08 17:17 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-08-10 14:51 - 2016-07-08 17:16 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-08-10 14:51 - 2016-07-08 17:03 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-08-10 14:51 - 2016-07-08 16:57 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-08-10 14:51 - 2016-07-08 16:56 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-08-10 14:51 - 2016-07-08 16:56 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-08-10 14:51 - 2016-07-08 16:55 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-08-10 14:51 - 2016-07-08 16:55 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-08-10 14:51 - 2016-07-08 16:50 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-08-10 14:50 - 2016-08-02 08:54 - 25808384 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-08-10 14:50 - 2016-08-02 08:47 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-08-10 14:50 - 2016-08-02 08:32 - 02894336 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-08-10 14:50 - 2016-08-02 08:32 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-08-10 14:50 - 2016-08-02 08:31 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-08-10 14:50 - 2016-08-02 08:31 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-08-10 14:50 - 2016-08-02 08:31 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-08-10 14:50 - 2016-08-02 08:24 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-08-10 14:50 - 2016-08-02 08:20 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-08-10 14:50 - 2016-08-02 08:19 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-08-10 14:50 - 2016-08-02 08:18 - 06047744 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-08-10 14:50 - 2016-08-02 08:18 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-08-10 14:50 - 2016-08-02 08:18 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-08-10 14:50 - 2016-08-02 08:11 - 00969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-08-10 14:50 - 2016-08-02 08:08 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-08-10 14:50 - 2016-08-02 07:56 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-08-10 14:50 - 2016-08-02 07:55 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-08-10 14:50 - 2016-08-02 07:53 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-08-10 14:50 - 2016-08-02 07:51 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-08-10 14:50 - 2016-08-02 07:47 - 02286592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-08-10 14:50 - 2016-08-02 07:45 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-08-10 14:50 - 2016-08-02 07:42 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-08-10 14:50 - 2016-08-02 07:41 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-08-10 14:50 - 2016-08-02 07:41 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-08-10 14:50 - 2016-08-02 07:41 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-08-10 14:50 - 2016-08-02 07:40 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-08-10 14:50 - 2016-08-02 07:38 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-08-10 14:50 - 2016-08-02 07:37 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-08-10 14:50 - 2016-08-02 07:36 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-08-10 14:50 - 2016-08-02 07:33 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-08-10 14:50 - 2016-08-02 07:28 - 15412224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-08-10 14:50 - 2016-08-02 07:26 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-08-10 14:50 - 2016-08-02 07:23 - 02868224 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-08-10 14:50 - 2016-08-02 07:21 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-08-10 14:50 - 2016-08-02 07:16 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-08-10 14:50 - 2016-08-02 07:14 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-08-10 14:50 - 2016-08-02 07:11 - 13808128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-08-10 14:50 - 2016-08-02 06:59 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-08-10 14:50 - 2016-08-02 06:56 - 02393088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-08-10 14:49 - 2016-07-08 17:01 - 03218944 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-08-07 22:20 - 2016-08-08 14:29 - 00012400 _____ (Macrovision Europe Ltd) C:\Windows\SysWOW64\Drivers\SECDRV.SYS
2016-08-07 22:17 - 2002-12-23 18:54 - 00026096 ____R (Microsoft Corporation) C:\Windows\SysWOW64\xmlinst.exe
2016-08-07 22:17 - 2002-09-29 02:09 - 00505104 ____R (Microsoft Corporation) C:\Windows\SysWOW64\msxml.dll
2016-08-07 22:17 - 2002-09-29 02:09 - 00140488 ____R (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.ocx
2016-08-07 22:17 - 2002-09-29 02:09 - 00115016 ____R (Microsoft Corporation) C:\Windows\SysWOW64\MSINET.OCX
2016-08-07 22:17 - 2002-09-29 02:09 - 00089360 ____R (Microsoft Corporation) C:\Windows\SysWOW64\VB5DB.DLL
2016-08-07 22:17 - 2002-09-29 02:09 - 00069632 ____R C:\Windows\SysWOW64\xmltok.dll
2016-08-07 22:17 - 2002-09-29 02:09 - 00036864 ____R C:\Windows\SysWOW64\xmlparse.dll
2016-08-07 22:17 - 2002-09-29 02:09 - 00035840 ____R C:\Windows\SysWOW64\comdlg32.oca
2016-08-07 22:17 - 2002-09-29 02:09 - 00029184 ____R C:\Windows\SysWOW64\MSINET.oca
2016-08-07 22:17 - 2002-09-29 02:09 - 00028432 ____R (Microsoft Corporation) C:\Windows\SysWOW64\msxmlr.dll
2016-08-07 22:17 - 2002-09-29 02:09 - 00024576 ____R (Microsoft Corporation) C:\Windows\SysWOW64\msxml3a.dll
2016-08-06 11:58 - 2016-08-07 21:34 - 00000000 ____D C:\Windows\System32\Tasks\Lenovo
2016-08-06 11:58 - 2016-08-07 21:34 - 00000000 ____D C:\Users\Mike\AppData\Local\Deployment
2016-08-06 11:58 - 2016-08-06 11:58 - 00000000 ____D C:\Users\Mike\AppData\Local\Apps\2.0
2016-08-05 22:05 - 2016-08-05 22:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-07-30 11:47 - 2016-07-30 11:47 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-07-30 11:47 - 2016-07-30 11:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-07-22 18:53 - 2016-06-26 02:27 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2016-07-22 18:53 - 2016-06-26 02:27 - 00756736 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2016-07-22 18:53 - 2016-06-26 02:27 - 00344576 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2016-07-22 18:53 - 2016-06-26 02:27 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2016-07-22 18:53 - 2016-06-26 02:27 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2016-07-22 18:53 - 2016-06-25 21:54 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2016-07-22 18:53 - 2016-06-25 21:53 - 00297472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2016-07-22 18:53 - 2016-06-25 21:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2016-07-22 18:53 - 2016-06-25 21:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
2016-07-22 18:53 - 2016-06-25 21:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe
2016-07-22 18:53 - 2016-06-06 18:50 - 01483264 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2016-07-22 18:53 - 2016-06-06 18:50 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2016-07-22 18:53 - 2016-06-06 18:50 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2016-07-22 18:53 - 2016-06-06 18:50 - 00141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2016-07-22 18:53 - 2016-06-06 17:23 - 01176064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2016-07-22 18:53 - 2016-06-06 17:23 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2016-07-22 18:53 - 2016-06-06 17:23 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2016-07-22 18:53 - 2016-06-06 17:23 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2016-07-22 18:52 - 2016-06-26 02:35 - 00041704 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-07-22 18:52 - 2016-06-26 02:27 - 01208320 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-07-22 18:52 - 2016-06-22 15:06 - 00268800 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2016-07-22 18:52 - 2016-06-17 20:24 - 01490432 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-07-22 18:52 - 2016-06-17 20:24 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-07-22 18:52 - 2016-06-17 20:24 - 00544256 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-07-22 18:52 - 2016-06-17 20:24 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-07-22 18:52 - 2016-06-17 20:24 - 00219136 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-07-22 18:52 - 2016-06-17 20:24 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-07-22 18:42 - 2016-07-22 18:42 - 00110144 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2016-07-22 18:42 - 2016-07-22 18:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-07-20 20:16 - 2016-07-20 20:16 - 00000000 ____D C:\Program Files\Bonjour
2016-07-20 20:16 - 2016-07-20 20:16 - 00000000 ____D C:\Program Files (x86)\Bonjour
2016-07-20 02:28 - 2016-07-20 02:28 - 00000000 ____D C:\ProgramData\Apple
2016-07-20 02:25 - 2016-07-20 02:25 - 00000000 ____D C:\Users\Mike\Andy

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-18 21:38 - 2016-05-12 17:09 - 00000914 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-08-18 21:33 - 2009-07-14 06:45 - 00025872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-08-18 21:33 - 2009-07-14 06:45 - 00025872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-08-18 21:26 - 2015-11-14 15:02 - 00000000 ___RD C:\Users\Mike\Dropbox
2016-08-18 21:25 - 2016-04-11 16:07 - 00000948 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-18 21:25 - 2015-11-14 23:43 - 00106243 _____ C:\Windows\system32\fastboot.set
2016-08-18 21:25 - 2015-11-14 14:59 - 00000900 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2016-08-18 21:25 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-18 21:21 - 2015-11-14 13:24 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-08-18 21:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-08-18 21:09 - 2016-04-11 16:07 - 00000952 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-18 21:07 - 2015-11-19 17:39 - 00000000 ____D C:\Users\Mike\AppData\Local\CrashDumps
2016-08-18 21:05 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Help
2016-08-18 21:04 - 2015-11-14 23:43 - 00203000 _____ C:\Windows\system32\LsDefrag.bmp
2016-08-18 21:04 - 2015-11-14 23:43 - 00057952 _____ (Lenovo) C:\Windows\system32\Drivers\fbfmon.sys
2016-08-18 21:04 - 2015-11-14 23:43 - 00044896 _____ (Lenovo) C:\Windows\system32\FbDefrag.exe
2016-08-18 21:04 - 2015-11-14 23:43 - 00015968 _____ (Lenovo) C:\Windows\system32\NFbfmon.dll
2016-08-18 21:04 - 2015-11-14 23:43 - 00013408 _____ (Lenovo) C:\Windows\system32\Drivers\BPntDrv.sys
2016-08-18 21:04 - 2015-11-14 23:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2016-08-18 21:04 - 2015-11-14 14:59 - 00000904 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2016-08-18 21:04 - 2015-11-14 13:24 - 00000000 ____D C:\Program Files (x86)\Lenovo
2016-08-18 20:55 - 2009-07-14 17:18 - 00727572 _____ C:\Windows\system32\perfh005.dat
2016-08-18 20:55 - 2009-07-14 17:18 - 00165774 _____ C:\Windows\system32\perfc005.dat
2016-08-18 20:55 - 2009-07-14 07:13 - 01746698 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-18 19:02 - 2015-11-14 12:25 - 00004152 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-08-18 18:07 - 2015-12-11 19:08 - 00000085 _____ C:\Windows\wininit.ini
2016-08-18 01:58 - 2015-11-28 20:06 - 00007620 _____ C:\Users\Mike\AppData\Local\Resmon.ResmonCfg
2016-08-18 00:37 - 2016-06-10 03:51 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2016-08-18 00:37 - 2016-02-07 04:50 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2016-08-18 00:37 - 2015-11-30 19:00 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2016-08-17 22:51 - 2016-06-17 22:03 - 00000000 ____D C:\Users\Mike\AppData\Roaming\vlc
2016-08-17 20:43 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2016-08-17 19:15 - 2016-04-28 17:20 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-08-17 14:12 - 2015-11-14 15:59 - 00000000 ____D C:\ProgramData\NVIDIA
2016-08-17 14:12 - 2015-11-14 13:13 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2016-08-12 02:21 - 2016-04-13 17:36 - 00000000 ____D C:\Users\Mike\Documents\kalendare
2016-08-12 01:38 - 2015-11-14 22:22 - 00000000 ___RD C:\MEDIA
2016-08-11 16:31 - 2016-05-24 08:56 - 14352304 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2016-08-11 16:31 - 2016-03-07 19:35 - 00494120 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2016-08-11 16:31 - 2015-11-14 15:56 - 03911624 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2016-08-11 16:31 - 2015-11-14 15:56 - 03451904 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2016-08-11 16:31 - 2015-11-14 15:56 - 00409624 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2016-08-11 16:31 - 2015-11-14 15:56 - 00181488 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2016-08-11 16:31 - 2015-11-14 15:56 - 00159352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2016-08-11 16:31 - 2015-11-14 15:56 - 00039731 _____ C:\Windows\system32\nvinfo.pb
2016-08-11 13:49 - 2015-11-14 15:57 - 06384576 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2016-08-11 13:49 - 2015-11-14 15:57 - 02469944 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2016-08-11 13:49 - 2015-11-14 15:57 - 01764408 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2016-08-11 13:49 - 2015-11-14 15:57 - 01363392 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2016-08-11 13:49 - 2015-11-14 15:57 - 00548920 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2016-08-11 13:49 - 2015-11-14 15:57 - 00392128 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2016-08-11 13:49 - 2015-11-14 15:57 - 00150584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\oemdspif.dll
2016-08-11 13:49 - 2015-11-14 15:57 - 00081856 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
2016-08-11 13:49 - 2015-11-14 15:57 - 00069568 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2016-08-10 21:30 - 2016-04-22 23:02 - 00000000 ____D C:\Users\Mike\AppData\Roaming\GHISLER
2016-08-10 20:12 - 2016-07-17 18:54 - 00001889 _____ C:\Users\Mike\Desktop\League of legends.lnk
2016-08-10 19:40 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-08-10 14:59 - 2015-11-14 12:29 - 00000000 ____D C:\Windows\system32\MRT
2016-08-10 14:52 - 2015-11-14 12:29 - 147640136 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-08-09 02:48 - 2015-11-14 21:16 - 00000000 ____D C:\Users\Mike\AppData\Roaming\DAEMON Tools Lite
2016-08-08 13:54 - 2015-11-14 15:57 - 07255045 _____ C:\Windows\system32\nvcoproc.bin
2016-08-07 22:20 - 2015-11-24 19:50 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-08-07 21:34 - 2015-11-14 13:24 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2016-08-06 18:57 - 2015-12-06 21:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-08-06 11:26 - 2015-11-14 13:07 - 00000000 ____D C:\ProgramData\Package Cache
2016-08-05 22:05 - 2015-11-14 14:59 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-08-05 16:10 - 2015-11-14 12:25 - 00292704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys
2016-08-05 13:44 - 2016-06-10 03:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-08-05 13:40 - 2016-06-29 15:39 - 00003560 _____ C:\Windows\System32\Tasks\klcp_update
2016-08-05 13:40 - 2016-06-29 15:39 - 00000000 ____D C:\Program Files (x86)\K-Lite Codec Pack
2016-08-05 11:28 - 2016-04-11 16:07 - 00002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-05 11:28 - 2016-04-11 16:07 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-04 22:15 - 2015-11-14 14:53 - 00000000 ____D C:\Users\Mike\AppData\Roaming\XnView
2016-08-04 12:50 - 2015-11-14 14:00 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-07-30 23:33 - 2015-11-14 14:22 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Skype
2016-07-30 11:47 - 2016-05-30 15:23 - 00002697 _____ C:\Users\Public\Desktop\Skype.lnk
2016-07-30 11:47 - 2015-11-14 14:22 - 00000000 ____D C:\ProgramData\Skype
2016-07-28 23:04 - 2016-04-11 16:07 - 00003948 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-07-28 23:04 - 2016-04-11 16:07 - 00003696 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-22 19:03 - 2016-07-01 23:18 - 00000000 ____D C:\Windows\EOONotify
2016-07-22 19:03 - 2015-11-14 20:59 - 00000000 ____D C:\Windows\system32\appraiser
2016-07-22 18:42 - 2016-05-10 22:53 - 00000000 ____D C:\Program Files\Java
2016-07-22 18:42 - 2015-11-14 14:21 - 00000000 ____D C:\Users\Mike\.oracle_jre_usage
2016-07-20 02:29 - 2015-11-14 15:41 - 01773346 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2016-07-20 02:25 - 2015-11-08 15:07 - 00000000 ____D C:\Users\Mike
2016-07-19 23:06 - 2015-11-14 12:24 - 00000000 ____D C:\Program Files\Avast

==================== Files in the root of some directories =======

2015-11-28 20:06 - 2016-08-18 01:58 - 0007620 _____ () C:\Users\Mike\AppData\Local\Resmon.ResmonCfg

Some zero byte size files/folders:
==========================
C:\Windows\logo1_.exe
C:\Windows\logo_1.exe
C:\Windows\RUNDL132.EXE
C:\Windows\rundll16.exe
C:\Windows\VDLL.DLL
C:\Windows\SysWOW64\runouce.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-08-16 13:01

==================== End of FRST.txt ============================

[Rudy]

Přes IE by mělo jít stáhnout. Otevřte poznámkový blok a zkopírujte do něj:

Start
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\MountPoints2: {1e464f15-de79-11e5-8313-b870f42a2b90} - H:\RunGame.exe
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\MountPoints2: {4baff6cc-8b17-11e5-917a-806e6f6e6963} - D:\.\Autorun\UBIAUTORUN.EXE .\cd2.ini
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\MountPoints2: {6e0c8875-8e41-11e5-a148-74e50b0c9fe6} - E:\Autorun.exe
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR Extension: (YouTube Unblocker) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2016-08-18] [UpdateUrl: hxxp://www.unblocker.yt/addon/chrome/updates.xml] <==== ATTENTION
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
C:\Windows\logo1_.exe
C:\Windows\logo_1.exe
C:\Windows\RUNDL132.EXE
C:\Windows\rundll16.exe
C:\Windows\VDLL.DLL
C:\Windows\SysWOW64\runouce.exe
End

Uložte do C:\Users\Mike\Downloads jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

[Thor]

Fix result of Farbar Recovery Scan Tool (x64) Version: 17-08-2016
Ran by Mike (18-08-2016 22:51:02) Run:1
Running from C:\Users\Mike\Downloads
Loaded Profiles: Mike (Available Profiles: Mike & Administrator & DefaultAppPool)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\MountPoints2: {1e464f15-de79-11e5-8313-b870f42a2b90} - H:\RunGame.exe
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\MountPoints2: {4baff6cc-8b17-11e5-917a-806e6f6e6963} - D:\.\Autorun\UBIAUTORUN.EXE .\cd2.ini
HKU\S-1-5-21-10019738-4020004794-2649741095-1000\...\MountPoints2: {6e0c8875-8e41-11e5-a148-74e50b0c9fe6} - E:\Autorun.exe
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
CHR Extension: (YouTube Unblocker) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2016-08-18] [UpdateUrl: hxxp://www.unblocker.yt/addon/chrome/updates.xml] <==== ATTENTION
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
C:\Windows\logo1_.exe
C:\Windows\logo_1.exe
C:\Windows\RUNDL132.EXE
C:\Windows\rundll16.exe
C:\Windows\VDLL.DLL
C:\Windows\SysWOW64\runouce.exe
End
*****************

"HKU\S-1-5-21-10019738-4020004794-2649741095-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1e464f15-de79-11e5-8313-b870f42a2b90}" => key removed successfully
HKCR\CLSID\{1e464f15-de79-11e5-8313-b870f42a2b90} => key not found.
"HKU\S-1-5-21-10019738-4020004794-2649741095-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4baff6cc-8b17-11e5-917a-806e6f6e6963}" => key removed successfully
HKCR\CLSID\{4baff6cc-8b17-11e5-917a-806e6f6e6963} => key not found.
"HKU\S-1-5-21-10019738-4020004794-2649741095-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6e0c8875-8e41-11e5-a148-74e50b0c9fe6}" => key removed successfully
HKCR\CLSID\{6e0c8875-8e41-11e5-a148-74e50b0c9fe6} => key not found.
"HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE" => key removed successfully
C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl <==== ATTENTION => not found
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => moved successfully
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA => moved successfully
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore => moved successfully
C:\Windows\logo1_.exe => moved successfully
C:\Windows\logo_1.exe => moved successfully
C:\Windows\RUNDL132.EXE => moved successfully
C:\Windows\rundll16.exe => moved successfully
C:\Windows\VDLL.DLL => moved successfully
C:\Windows\SysWOW64\runouce.exe => moved successfully

==== End of Fixlog 22:51:03 ====

[Rudy]

Smazáno. Nastala nějaká změna?

[Thor]

Těžko říct Já jsem Lenovo Boot Opt. reinstaloval a to samé jsem provedl s Rainbow Six. Takže zatím to všechno šlape jak má. Až na problém s oprávněním. Potřeboval bych nějak zjistit, jestli mám svůj účet správně nastaven. Aby se mi neukazovala okna jako je v příloze.

Jo a občas (asi po použití nějakého čistícího softwaru - ADW Cleaner nebo SpyBot) se mi u ikonek objeví symbol zabezpečení windows. Nechci ho tam. Odstraním ho tím, že smažu cache ikon? viz. http://www.thewindowsclub.com/rebuild-t ... he-windows

[Thor]

Ikona.

[Rudy]

Toto je ikona RSIT64. Ten smažte a s ním vše, co vytvořil.