webový prohlížeč zavirován, počítač zpomalený

Zpráva

zmetek · #1 Příspěvek od **zmetek** » 09 led 2017 17:44

Při otevření webového prohlížeče se otvírají cizí stránky a počítač je celkově pomalejší. Prosím o kontrolu.

Logfile of random's system information tool 1.14 (written by random/random)
Run by Martin at 2017-01-09 17:38:53
Microsoft Windows 10 Home
System drive C: has 695 GB (73%) free of 954 GB
Total RAM: 12283 MB (84% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:38:59, on 09.01.2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10586.0713)
Boot mode: Normal

Running processes:
C:\Users\Martin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Users\Martin\AppData\Local\Microsoft\BingSvc\BingSvc.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
C:\PROGRA~2\RAPTRI~1\Raptr\raptr.exe
C:\PROGRA~2\RAPTRI~1\Raptr\raptr_im.exe
C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\trend micro\Martin_RSITx64 (1).exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [PlaysTV] "C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv_launcher.exe" --startup
O4 - HKLM\..\Run: [Raptr] "C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe" --startup
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKCU\..\Run: [OneDrive] "C:\Users\Martin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [cz.seznam.software.autoupdate] "C:\Users\Martin\AppData\Roaming\Seznam.cz\szninstall.exe" -c
O4 - HKCU\..\Run: [cz.seznam.software.szndesktop] "C:\Users\Martin\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
O4 - HKCU\..\Run: [Google Update] C:\Users\Martin\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [BingSvc] C:\Users\Martin\AppData\Local\Microsoft\BingSvc\BingSvc.exe
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: EasyAntiCheat - EasyAntiCheat Ltd - C:\Windows\system32\EasyAntiCheat.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
O23 - Service: Hi-Rez Studios Authenticate and Update Service (HiPatchService) - Hi-Rez Studios - C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Plays.tv Update Service (PlaysService) - Unknown owner - C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\Windows\System32\SensorDataService.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: TeamViewer 11 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\Windows\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8751 bytes

======Enumerating Processes======

C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\dwm.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atiesrxx.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k appmodel
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe"
"C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe"
C:\Windows\SysWOW64\PnkBstrB.exe
C:\Windows\system32\dashost.exe
"C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe" -s
"C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
C:\Windows\system32\sihost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Explorer.EXE
C:\Windows\System32\RuntimeBroker.exe -Embedding
C:\Windows\system32\taskhostw.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
"C:\Users\Martin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
"C:\Program Files (x86)\Steam\Steam.exe" -silent
"C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
"C:\Users\Martin\AppData\Local\Microsoft\BingSvc\BingSvc.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
C:\Windows\system32\browser_broker.exe -Embedding
"C:\PROGRA~2\RAPTRI~1\Raptr\raptr.exe" --log_to_file --from_stub --startup
C:\PROGRA~2\RAPTRI~1\Raptr\raptr_im.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:2036 CREDAT:140556 EDGEHOST /prefetch:6
"C:\PROGRA~2\RAPTRI~1\Raptr\raptr_ep64.exe" 5452
"C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe" "-cachedir=C:\Users\Martin\AppData\Local\Steam\htmlcache" "-steampid=1596" "-buildid=1482202200" "-steamid=0" --disable-gpu-compositing --disable-gpu --process-per-tab --disable-spell-checking --disable-out-of-process-pac --disable-smooth-scrolling --enable-direct-write
"C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 "--database=C:\Users\Martin\AppData\Local\Chromium\User Data\Crashpad" "--metrics-dir=C:\Users\Martin\AppData\Local\Chromium\User Data" --annotation=channel= --annotation=plat=Win32 --annotation=prod= --annotation=ver=01.00.00.01-devel --handshake-handle=0x2d8
"C:\Program Files (x86)\Common Files\Steam\SteamService.exe" /RunAsService
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.570_none_7645b09c266beb53\TiWorker.exe -Embedding
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey 2DE947D3-3591-A016-C0DF-E2F9AE6F8D95 -Reinvoke
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:2036 CREDAT:140559 EDGEHOST /prefetch:6
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1249156137-3488093570-3846741223-10013_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1249156137-3488093570-3846741223-10013 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\Windows\system32\SearchFilterHost.exe" 0 620 624 632 8192 628
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:2036 CREDAT:140560 EDGEHOST /prefetch:6
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe" SCODEF:2036 CREDAT:140561 EDGEHOST /prefetch:6
"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto
"C:\Users\Martin\Downloads\RSITx64 (1).exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\system32\tasks\AMD Updater - "C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe" /AUTOUPDATEIN
C:\Windows\system32\tasks\GoogleUpdateTaskUserS-1-5-21-1249156137-3488093570-3846741223-1001Core - C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Windows\system32\tasks\GoogleUpdateTaskUserS-1-5-21-1249156137-3488093570-3846741223-1001UA - C:\Users\Martin\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\system32\tasks\OneDrive Standalone Update Task v2 - %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
C:\Windows\system32\tasks\User_Feed_Synchronization-{8696B6CC-FD9E-4FB3-9011-F9D1C1355800} - C:\Windows\system32\msfeedssync.exe sync
C:\Windows\system32\tasks\{5D2C7DF5-A578-4CDB-908E-7956D0B70D08} - "c:\windows\system32\launchwinapp.exe" https://ui.skype.com/ui/0/7.30.80.105/c ... age=tsMain
C:\Windows\system32\tasks\Microsoft\Windows\WS\License Validation - rundll32.exe WSClient.dll,WSpTLR licensing
C:\Windows\system32\tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join - %SystemRoot%\System32\dsregcmd.exe
C:\Windows\system32\tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start - C:\Windows\system32\sc.exe start wuauserv
C:\Windows\system32\tasks\Microsoft\Windows\WindowsUpdate\sih - %systemroot%\System32\sihclient.exe
C:\Windows\system32\tasks\Microsoft\Windows\WindowsUpdate\sihboot - %systemroot%\System32\sihclient.exe /boot
C:\Windows\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\Windows\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -upload
C:\Windows\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdCacheMaintenance
C:\Windows\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdCleanup
C:\Windows\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan - %ProgramFiles%\Windows Defender\MpCmdRun.exe Scan -ScheduleJob
C:\Windows\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdVerification
C:\Windows\system32\tasks\Microsoft\Windows\WCM\WiFiTask - %SystemRoot%\System32\WiFiTask.exe
C:\Windows\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\Windows\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Maintenance Install - %systemroot%\system32\usoclient.exe StartInstall
C:\Windows\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Policy Install - %systemroot%\system32\usoclient.exe StartInstall
C:\Windows\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Reboot - %systemroot%\system32\MusNotification.exe Reboot
C:\Windows\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Resume On Boot - %systemroot%\system32\usoclient.exe ResumeUpdate
C:\Windows\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan - %systemroot%\system32\usoclient.exe StartScan
C:\Windows\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display - C:\windows\system32\MusNotification.exe Display
C:\Windows\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot - C:\windows\system32\MusNotification.exe ReadyToReboot
C:\Windows\system32\tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone - %windir%\system32\tzsync.exe
C:\Windows\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\Windows\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\srtasks.exe ExecuteScheduledSPPCreation
C:\Windows\system32\tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask - %windir%\system32\rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
C:\Windows\system32\tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Optimization - %windir%\system32\defrag.exe -c -h -g -# -m 8 -i 13500
C:\Windows\system32\tasks\Microsoft\Windows\SpacePort\SpaceAgentTask - %windir%\system32\SpaceAgent.exe
C:\Windows\system32\tasks\Microsoft\Windows\SpacePort\SpaceManagerTask - %windir%\system32\SpaceMan.exe /Repair
C:\Windows\system32\tasks\Microsoft\Windows\Shell\FamilySafetyMonitor - %windir%\System32\wpcmon.exe
C:\Windows\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\Windows\system32\tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers - %SystemRoot%\System32\drvinst.exe 6
C:\Windows\system32\tasks\Microsoft\Windows\NlaSvc\WiFiTask - %SystemRoot%\System32\WiFiTask.exe nla
C:\Windows\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\Windows\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\Windows\system32\tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser - %SystemRoot%\System32\MbaeParserTask.exe
C:\Windows\system32\tasks\Microsoft\Windows\Management\Provisioning\Logon - %windir%\system32\ProvTool.exe /turn 5
C:\Windows\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotificationWindows.exe
C:\Windows\system32\tasks\Microsoft\Windows\Location\WindowsActionDialog - %windir%\System32\WindowsActionDialog.exe
C:\Windows\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClient - %windir%\system32\dmclient.exe
C:\Windows\system32\tasks\Microsoft\Windows\DUSM\dusmtask - %SystemRoot%\System32\dusmtask.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskFootprint\Diagnostics - %windir%\system32\disksnapshot.exe -z
C:\Windows\system32\tasks\Microsoft\Windows\DiskFootprint\StorageSense - %windir%\system32\rundll32.exe %windir%\system32\StorageUsage.dll,GetStorageUsageInfo
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskCleanup\SilentCleanup - %windir%\system32\cleanmgr.exe /autoclean /d %systemdrive%
C:\Windows\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c -h -o -$
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\Windows\system32\tasks\Microsoft\Windows\Clip\License Validation - %SystemRoot%\system32\ClipUp.exe -p -s -o
C:\Windows\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\Windows\system32\tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup - %windir%\system32\rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
C:\Windows\system32\tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState - %windir%\system32\rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
C:\Windows\system32\tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup - %windir%\system32\dstokenclean.exe
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattelrunner.exe
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\StartupAppTask - %windir%\system32\rundll32.exe Startupscan.dll,SusRunTask
C:\Windows\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\Windows\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe

=========Mozilla firefox=========

ProfilePath - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default

prefs.js - "browser.startup.homepage" - "http://hp.myway.com/fromdoctopdf/ttab02 ... 0wod3bwLNA"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.101.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.101.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll

C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\extensions\
_65Members_@download.fromdoctopdf.com
{ea614400-e918-4741-9a97-7a972ff7c30b}

C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\searchplugins\
bing-.xml

C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\addons.json
Seznam lištička - extension - {ea614400-e918-4741-9a97-7a972ff7c30b}

C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\extensions.json
Seznam lištička - extension - {ea614400-e918-4741-9a97-7a972ff7c30b} - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b}
Bing Search - extension - bingsearch.full@microsoft.com - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\extensions\bingsearch.full@microsoft.com.xpi
Multi-process staged rollout - extension - e10srollout@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\e10srollout@mozilla.org.xpi
Pocket - extension - firefox@getpocket.com - C:\Program Files (x86)\Mozilla Firefox\browser\features\firefox@getpocket.com.xpi
Web Compat - extension - webcompat@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\webcompat@mozilla.org.xpi
Application Update Service Helper - extension - aushelper@mozilla.org - C:\Program Files (x86)\Mozilla Firefox\browser\features\aushelper@mozilla.org.xpi
Default - theme - {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi
FromDocToPDF - extension - _65Members_@download.fromdoctopdf.com - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\extensions\_65Members_@download.fromdoctopdf.com

C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\pluginreg.dat
Plugin - Java(TM) Platform SE 8 U101 - 11.101.2.13 - C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll
Plugin - Java Deployment Toolkit 8.0.1010.13 - 11.101.2.13 - C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npdeployJava1.dll
Plugin - Google Update - 1.3.32.7 - C:\Users\Martin\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll
Plugin - Google Talk Plugin - 5.41.3.0 - C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
Plugin - Google Talk Plugin Video Renderer - 5.41.3.0 - C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npo1d.dll

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-08-04 473152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-04 186944]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"OneDrive"=C:\Users\Martin\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2016-12-14 1517280]
"Steam"=C:\Program Files (x86)\Steam\steam.exe [2016-12-20 2876704]
"cz.seznam.software.autoupdate"=C:\Users\Martin\AppData\Roaming\Seznam.cz\szninstall.exe -c []
"cz.seznam.software.szndesktop"=C:\Users\Martin\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe -q []
"Google Update"=C:\Users\Martin\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe [2016-12-16 601752]
"Skype"=C:\Program Files (x86)\Skype\Phone\Skype.exe [2016-11-15 27230168]
"BingSvc"=C:\Users\Martin\AppData\Local\Microsoft\BingSvc\BingSvc.exe [2015-11-05 144008]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2016-06-22 598552]
"PlaysTV"=C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv_launcher.exe --startup []
"Raptr"=C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe [2016-09-28 58584]
"LogMeIn Hamachi Ui"=C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [2016-11-11 5565960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"DSCAutomationHostEnabled"=2
"EnableCursorSuppression"=1
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"ForceActiveDesktopOn"=0
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-01-09 17:38:53 ----D---- C:\rsit
2017-01-09 17:38:53 ----D---- C:\Program Files\trend micro
2017-01-09 12:30:08 ----D---- C:\Program Files\Plumbytes Software
2017-01-02 11:11:41 ----D---- C:\GOG Games
2017-01-01 17:22:57 ----D---- C:\Users\Martin\AppData\Roaming\OpenOffice
2017-01-01 17:21:23 ----AD---- C:\Program Files (x86)\OpenOffice 4
2016-12-23 15:17:25 ----A---- C:\Windows\system32\drivers\EasyAntiCheat.sys
2016-12-23 14:22:32 ----A---- C:\Windows\SYSWOW64\EasyAntiCheat.exe
2016-12-23 14:00:04 ----D---- C:\ProgramData\Hi-Rez Studios
2016-12-23 14:00:00 ----AD---- C:\Program Files (x86)\Hi-Rez Studios
2016-12-15 20:49:33 ----D---- C:\Program Files (x86)\MeeSoft
2016-12-14 16:21:01 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2016-12-14 16:21:01 ----A---- C:\Windows\SYSWOW64\msi.dll
2016-12-14 16:21:01 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2016-12-14 16:21:01 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2016-12-14 16:21:00 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2016-12-14 16:21:00 ----A---- C:\Windows\SYSWOW64\UserDataTimeUtil.dll
2016-12-14 16:21:00 ----A---- C:\Windows\SYSWOW64\user32.dll
2016-12-14 16:21:00 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2016-12-14 16:21:00 ----A---- C:\Windows\SYSWOW64\GamePanel.exe
2016-12-14 16:21:00 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2016-12-14 16:21:00 ----A---- C:\Windows\SYSWOW64\bcastdvr.exe
2016-12-14 16:21:00 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2016-12-14 16:21:00 ----A---- C:\Windows\SYSWOW64\AppCapture.dll
2016-12-14 16:20:59 ----A---- C:\Windows\system32\UserDataTimeUtil.dll
2016-12-14 16:20:59 ----A---- C:\Windows\system32\msi.dll
2016-12-14 16:20:53 ----A---- C:\Windows\SYSWOW64\edgehtml.dll
2016-12-14 16:20:52 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2016-12-14 16:20:52 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2016-12-14 16:20:52 ----A---- C:\Windows\system32\ie4uinit.exe
2016-12-14 16:20:51 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2016-12-14 16:20:50 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2016-12-14 16:20:50 ----A---- C:\Windows\SYSWOW64\Chakra.dll
2016-12-14 16:20:50 ----A---- C:\Windows\system32\msfeeds.dll
2016-12-14 16:20:50 ----A---- C:\Windows\system32\jscript9.dll
2016-12-14 16:20:49 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2016-12-14 16:20:49 ----A---- C:\Windows\system32\urlmon.dll
2016-12-14 16:20:48 ----A---- C:\Windows\system32\iertutil.dll
2016-12-14 16:20:48 ----A---- C:\Windows\system32\ieapfltr.dll
2016-12-14 16:20:48 ----A---- C:\Windows\system32\Chakradiag.dll
2016-12-14 16:20:48 ----A---- C:\Windows\system32\Chakra.dll
2016-12-14 16:20:47 ----A---- C:\Windows\system32\ieframe.dll
2016-12-14 16:20:47 ----A---- C:\Windows\system32\edgehtml.dll
2016-12-14 16:20:46 ----A---- C:\Windows\system32\WindowsCodecs.dll
2016-12-14 16:20:46 ----A---- C:\Windows\system32\lsasrv.dll
2016-12-14 16:20:45 ----A---- C:\Windows\system32\mshtml.dll
2016-12-14 16:20:43 ----A---- C:\Windows\system32\win32kbase.sys
2016-12-14 16:20:43 ----A---- C:\Windows\system32\drivers\cng.sys
2016-12-14 16:20:43 ----A---- C:\Windows\system32\drivers\clfs.sys
2016-12-14 16:20:43 ----A---- C:\Windows\system32\bcrypt.dll
2016-12-14 16:20:42 ----A---- C:\Windows\system32\win32kfull.sys
2016-12-14 16:20:42 ----A---- C:\Windows\system32\sppobjs.dll
2016-12-14 16:20:42 ----A---- C:\Windows\system32\gdi32.dll
2016-12-14 16:20:42 ----A---- C:\Windows\system32\d3d10warp.dll
2016-12-14 16:20:41 ----A---- C:\Windows\system32\user32.dll
2016-12-14 16:20:41 ----A---- C:\Windows\system32\sppwinob.dll
2016-12-14 16:20:41 ----A---- C:\Windows\system32\GamePanel.exe
2016-12-14 16:20:41 ----A---- C:\Windows\system32\fveapibase.dll
2016-12-14 16:20:41 ----A---- C:\Windows\system32\fveapi.dll
2016-12-14 16:20:41 ----A---- C:\Windows\system32\bcastdvr.exe
2016-12-14 16:20:41 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2016-12-14 16:20:40 ----A---- C:\Windows\system32\appidsvc.dll
2016-12-14 16:20:40 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2016-12-14 16:20:40 ----A---- C:\Windows\system32\appidapi.dll

======List of files/folders modified in the last 1 month======

2017-01-09 17:38:58 ----D---- C:\Windows\Prefetch
2017-01-09 17:38:53 ----RD---- C:\Program Files
2017-01-09 17:38:35 ----D---- C:\Windows\Temp
2017-01-09 17:34:25 ----D---- C:\Program Files (x86)\Steam
2017-01-09 17:33:49 ----D---- C:\Users\Martin\AppData\Roaming\Raptr
2017-01-09 17:33:45 ----D---- C:\Users\Martin\AppData\Roaming\Skype
2017-01-09 17:32:35 ----D---- C:\Windows\system32\sru
2017-01-09 17:30:49 ----D---- C:\Windows\system32\NDF
2017-01-09 16:54:17 ----D---- C:\Windows\AppReadiness
2017-01-09 12:59:56 ----SHD---- C:\System Volume Information
2017-01-09 12:49:17 ----D---- C:\Windows\Microsoft.NET
2017-01-09 11:52:06 ----D---- C:\Windows\Panther
2017-01-08 18:14:57 ----HD---- C:\Program Files\WindowsApps
2017-01-07 20:45:38 ----D---- C:\Windows\SysWOW64
2017-01-07 20:45:34 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2017-01-02 16:51:23 ----D---- C:\Users\Martin\AppData\Roaming\.minecraft
2017-01-02 11:18:55 ----RSD---- C:\Windows\assembly
2017-01-02 11:08:33 ----D---- C:\Windows\System32
2017-01-02 11:08:33 ----D---- C:\Windows\INF
2017-01-02 11:08:33 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-01-01 17:21:36 ----SHD---- C:\Windows\Installer
2017-01-01 17:21:26 ----RSD---- C:\Windows\Fonts
2017-01-01 17:21:23 ----RD---- C:\Program Files (x86)
2016-12-31 16:11:12 ----D---- C:\Windows\system32\drivers
2016-12-30 17:21:42 ----D---- C:\Windows\system32\DriverStore
2016-12-25 11:11:25 ----D---- C:\Windows\system32\Tasks
2016-12-25 11:10:13 ----D---- C:\Program Files\Common Files
2016-12-25 11:10:07 ----D---- C:\ProgramData\Electronic Arts
2016-12-25 11:09:39 ----D---- C:\ProgramData\Origin
2016-12-25 11:04:13 ----AD---- C:\Program Files\AMD
2016-12-25 11:00:30 ----D---- C:\AMD
2016-12-23 14:00:04 ----HD---- C:\ProgramData
2016-12-23 14:00:00 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2016-12-21 13:15:49 ----D---- C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-17 19:10:01 ----D---- C:\Windows\system32\config
2016-12-16 21:42:21 ----D---- C:\Windows\WinSxS
2016-12-16 21:41:35 ----D---- C:\Windows\system32\catroot2
2016-12-16 21:23:46 ----D---- C:\Windows\Tasks
2016-12-16 21:08:46 ----AD---- C:\Program Files (x86)\Mozilla Firefox
2016-12-16 14:59:37 ----D---- C:\Windows\rescache
2016-12-15 17:03:21 ----D---- C:\Windows\SYSWOW64\cs-CZ
2016-12-15 17:03:21 ----D---- C:\Windows\system32\oobe
2016-12-15 17:03:20 ----D---- C:\Windows\system32\cs-CZ
2016-12-15 17:03:20 ----D---- C:\Program Files\Internet Explorer
2016-12-15 17:03:20 ----D---- C:\Program Files (x86)\Internet Explorer
2016-12-15 15:47:20 ----D---- C:\Windows\CbsTemp
2016-12-15 15:47:14 ----D---- C:\Windows\system32\MRT
2016-12-15 15:45:42 ----AC---- C:\Windows\system32\MRT.exe
2016-12-12 00:03:06 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

File C:\Windows\system32\winlogon.exe is digitally signed
File C:\Windows\system32\wininit.exe is digitally signed
File C:\Windows\explorer.exe is digitally signed
File C:\Windows\SysWOW64\explorer.exe is digitally signed
File C:\Windows\system32\svchost.exe is digitally signed
File C:\Windows\SysWOW64\svchost.exe is digitally signed
File C:\Windows\system32\services.exe is digitally signed
File C:\Windows\system32\User32.dll is digitally signed
File C:\Windows\SysWOW64\User32.dll is digitally signed
File C:\Windows\system32\userinit.exe is digitally signed
File C:\Windows\SysWOW64\userinit.exe is digitally signed
File C:\Windows\system32\rpcss.dll is digitally signed
File C:\Windows\system32\Drivers\volsnap.sys is digitally signed

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 amdkmafd;@oem8.inf,%AMDKMAFD_svcdesc%;AMD Audio Bus Lower Filter; C:\Windows\System32\drivers\amdkmafd.sys [2015-06-03 31992]
R0 mv91xx;mv91xx; C:\Windows\System32\drivers\mv91xx.sys [2010-03-17 302632]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2015-08-09 21631512]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2015-08-09 673816]
R3 AtiHDAudioService;@oem3.inf,%ATIHdAudioDriver.SvcDesc%;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdWT6.sys [2015-07-21 102912]
R3 Hamachi;@oem7.inf,%Hamachi.Service.DispName%;LogMeIn Hamachi Virtual Miniport); C:\Windows\system32\DRIVERS\Hamdrv.sys [2016-06-07 45680]
R3 rt640x64;@rt640x64.inf,%rt640.Service.DispName%;Realtek RT640 NT Driver; C:\Windows\System32\drivers\rt640x64.sys [2015-10-30 589824]
S3 HyperVideo;HyperVideo; C:\Windows\system32\DRIVERS\HyperVideo.sys [2015-10-30 26112]
S3 netvsc;netvsc; C:\Windows\System32\drivers\netvsc.sys [2015-10-30 108032]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2015-08-09 255512]
R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [2016-11-11 2627080]
R2 HiPatchService;Hi-Rez Studios Authenticate and Update Service; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [2016-12-09 9728]
R2 LMIGuardianSvc;LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [2016-11-11 419248]
R2 OneSyncSvc_2bab9;Hostitel synchronizace_2bab9; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2016-08-06 76888]
R2 PnkBstrB;PnkBstrB; C:\Windows\syswow64\PnkBstrB.exe [2017-01-07 282296]
R2 TeamViewer;TeamViewer 11; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [2016-09-20 7500048]
R3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2016-12-20 1467168]
S2 OneSyncSvc_12d97788;Hostitel synchronizace_12d97788; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_1b030da;Hostitel synchronizace_1b030da; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_1f58033;Hostitel synchronizace_1f58033; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_2eec8;Hostitel synchronizace_2eec8; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_3c4197b;Hostitel synchronizace_3c4197b; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_46494;Hostitel synchronizace_46494; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_591448b;Hostitel synchronizace_591448b; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_5d332cc;Hostitel synchronizace_5d332cc; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_5f487c9;Hostitel synchronizace_5f487c9; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_828a6e;Hostitel synchronizace_828a6e; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_cfd618;Hostitel synchronizace_cfd618; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 OneSyncSvc_ea6a186;Hostitel synchronizace_ea6a186; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 PlaysService;Plays.tv Update Service; C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe []
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-09-20 324224]
S3 EasyAntiCheat;EasyAntiCheat; C:\Windows\syswow64\EasyAntiCheat.exe [2016-12-23 395536]
S3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [2015-10-23 43696]
S3 MessagingService_12d97788;Služba zasílání zpráv_12d97788; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_1b030da;Služba zasílání zpráv_1b030da; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_1f58033;Služba zasílání zpráv_1f58033; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_2bab9;Služba zasílání zpráv_2bab9; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_2eec8;Služba zasílání zpráv_2eec8; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_3c4197b;Služba zasílání zpráv_3c4197b; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_591448b;Služba zasílání zpráv_591448b; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_5d332cc;Služba zasílání zpráv_5d332cc; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_5f487c9;Služba zasílání zpráv_5f487c9; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_828a6e;Služba zasílání zpráv_828a6e; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_cfd618;Služba zasílání zpráv_cfd618; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MessagingService_ea6a186;Služba zasílání zpráv_ea6a186; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2016-12-16 172488]
S3 PimIndexMaintenanceSvc_12d97788;Data kontaktů_12d97788; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_1b030da;Data kontaktů_1b030da; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_1f58033;Data kontaktů_1f58033; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_2bab9;Data kontaktů_2bab9; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_2eec8;Data kontaktů_2eec8; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_3c4197b;Data kontaktů_3c4197b; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_591448b;Data kontaktů_591448b; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_5d332cc;Data kontaktů_5d332cc; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_5f487c9;Data kontaktů_5f487c9; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_828a6e;Data kontaktů_828a6e; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_cfd618;Data kontaktů_cfd618; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 PimIndexMaintenanceSvc_ea6a186;Data kontaktů_ea6a186; C:\Windows\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 UnistoreSvc_12d97788;Úložiště uživatelských dat_12d97788; C:\Windows\System32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 UnistoreSvc_1b030da;Úložiště uživatelských dat_1b030da; C:\Windows\System32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 UnistoreSvc_1f58033;Úložiště uživatelských dat_1f58033; C:\Windows\System32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 UnistoreSvc_2bab9;Úložiště uživatelských dat_2bab9; C:\Windows\System32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=

-----------------EOF-----------------

#2 Příspěvek od **Rudy** » 09 led 2017 18:56

Zdravím!
Spusťte tuto utilitu:

Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.

zmetek · #3 Příspěvek od **zmetek** » 09 led 2017 19:09

# AdwCleaner v6.042 - Log vytvořen 09/01/2017 v 19:03:50
# Aktualizováno dne 06/01/2017 z Malwarebytes
# Databáze : 2017-01-09.3 [Server]
# Operační systém : Windows 10 Home (X64)
# Uživatelské jméno : Martin - DESKTOP-VELANK4
# Spuštěno z : C:\Users\Martin\Desktop\adwcleaner_6.042.exe
# Mod: Čištění
# Podpora : https://www.malwarebytes.com/support

***** [ Služby ] *****

***** [ Složky ] *****

[-] Složka smazána: C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\extensions\_65Members_@download.fromdoctopdf.com
[-] Složka smazána: C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\FromDocToPDF_65

***** [ Soubory ] *****

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Zástupci ] *****

***** [ Naplánované úlohy ] *****

***** [ Registry ] *****

***** [ Prohlížeče ] *****

[-] Firefox předvolby vyčištěny: "browser.startup.homepage" - "hxxp://hp.myway.com/fromdoctopdf/ttab02/index.html?coId=0055927b4890499089e7e68302bcb6b4&subId=CMjk_7_0mdECFaQV0wod3bwLNA&ln=en&n=782b981a&ptb=B9FF0B0A-2C54-4FC4-A21F-1917079877FD&st=tab&p2=%5EY6%5Exdm222%5ETTAB02%5Ecz&si=CMjk_7_0mdECFaQV0wod3bwLNA"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.BUTTON_STRUCTURE" - "[{\"b\":223754551,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":223754552,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0\"},{\"b\":223754557,\"c\":\"mindspark.full\",\"p\":\"L.0.1\"},{\"b\":223754561,\"c\":\"mindspark.image\",\"p\":\"L.0.2\"},{\"b\":223754566,\"c\":\"mindspark.advanced\",\"p\":\"L.0.3\"},{\"b\":223754570,\"c\":\"mindspark.directorysearch\",\"p\":\"L.0.4\"},{\"b\":223754507,\"c\":\"mindspark.search\",\"p\":\"L.1\"},{\"b\":225077621,\"c\":\"mindspark.converttopdf\",\"v\":\"1.3.0\",\"p\":\"L.2\"},{\"b\":225077620,\"c\":\"mindspark.converttodoc\",\"v\":\"1.3.0\",\"p\":\"L.3\"},{\"b\":223754534,\"c\":\"mindspark.translate\",\"p\":\"L.4\"},{\"b\":223754535,\"c\":\"mindspark.thesaurus\",\"p\":\"L.5\"},{\"b\":223754536,\"c\":\"mindspark.dictionary\",\"p\":\"L.6\"},{\"b\":223754537,\"c\":\"mindspark.reference\",\"p\":\"L.7\"}]"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.browser.startup.homepage.prev" - "hxxps://www.seznam.cz/"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.browser.startup.homepage.savedPrev" - "true"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.browser.startup.homepage.tb" - "hxxp://hp.myway.com/fromdoctopdf/ttab02/index.html?coId=0055927b4890499089e7e68302bcb6b4&subId=CMjk_7_0mdECFaQV0wod3bwLNA&ln=en&n=782b981a&ptb=B9FF0B0A-2C54-4FC4-A21F-1917079877FD&st=tab&p2=%5EY6%5Exdm222%5ETTAB02%5Ecz&si=CMjk_7_0mdECFaQV0wod3bwLNA"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.browser.startup.page.savedPrev" - 1
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.browser.startup.page.tb" - 1
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.browser.version.last" - "50.0"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.coId" - "0055927b4890499089e7e68302bcb6b4"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.firstKnownVersion" - "7.102.10.4221"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.homepage" - "hxxp://hp.myway.com/fromdoctopdf/ttab02/index.html?coId=0055927b4890499089e7e68302bcb6b4&subId=CMjk_7_0mdECFaQV0wod3bwLNA&ln=en&n=782b981a&ptb=B9FF0B0A-2C54-4FC4-A21F-1917079877FD&st=tab&p2=%5EY6%5Exdm222%5ETTAB02%5Ecz&si=CMjk_7_0mdECFaQV0wod3bwLNA"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.hp.enabled" - true
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.hp.guardType" - "HPR"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.hp.user.defined" - false
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.initialized" - true
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.installType" - "XPI"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.installation.dlpCountryCode" - "CZ"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.installation.installDate" - "2016122906"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.installation.partnerId" - "^Y6^xdm222^TTAB02^cz"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.installation.partnerSubId" - "CMjk_7_0mdECFaQV0wod3bwLNA"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.installation.pixelUrl" - "hxxp://download.fromdoctopdf.com/install_pixels.jhtml?partner=^Y6^xdm222^TTAB02^cz&sub_id=CMjk_7_0mdECFaQV0wod3bwLNA&coId=0055927b4890499089e7e68302bcb6b4&tbGuid=B9FF0B0A-2C54-4FC4-A21F-1917079877FD"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.installation.success" - true
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.installation.toolbarId" - "B9FF0B0A-2C54-4FC4-A21F-1917079877FD"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.lastActivePing" - "1483959070442"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.lastKnownVersion" - "7.102.10.4221"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.lssState" - "{\"previousLocales\":[\"en-US\",\"en\"],\"supportedLocales\":[\"de\",\"es\",\"pt\",\"ja\",\"en\"],\"defaultLocale\":\"en\",\"supportedLocale\":\"en\",\"previousLocale\":\"en\"}"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.options.defaultSearch" - false
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.options.homePageEnabled" - true
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.options.keywordEnabled" - false
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.options.tabEnabled" - true
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.partnerPixelFired" - true
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.productDeliveryOption.language" - "en"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.productDeliveryOption.newTabURL" - "hxxp://hp.myway.com/fromdoctopdf/ttab02/index.html?p2=${partnerID}&n=${installDateHex}&st=tab&ptb=${toolbarID}&si=${partnerSubID}"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.productDeliveryOption.type" - "ToolTab"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.successUrl" - "hxxp://download.fromdoctopdf.com/installComplete.jhtml"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.toolbarCollapsed" - false
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.uninstallSurveyUrl" - "hxxp://www.research.net/r/GBT6YQG?c="
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark._65Members_.uninstallTasks" - "{\"prefBranchesToDelete\":[\"extensions.toolbar.mindspark._65Members_.\"],\"filesToDelete\":[\"C:\\\\Users\\\\Martin\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sehfta35.default\\\\FromDocToPDF_65\\\\B9FF0B0A-2C54-4FC4-A21F-1917079877FD.sqlite\",\"C:\\\\Users\\\\Martin\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\sehfta35.default\\\\FromDocToPDF_65\"]}"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark.hp.enabled" - true
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark.hp.enabled.guid" - "fromdoctopdf@mindspark.com"
[-] Firefox předvolby vyčištěny: "extensions.toolbar.mindspark.lastInstalled" - "fromdoctopdf@mindspark.com"

*************************

:: "Tracing" klíče smazány
:: Winsock nastavení vyčištěno

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [8241 Bajty] - [09/01/2017 19:03:50]
C:\AdwCleaner\AdwCleaner[S0].txt - [9851 Bajty] - [09/01/2017 19:03:34]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [8387 Bajty] ##########

#4 Příspěvek od **Rudy** » 09 led 2017 19:13

Teď dejte log FRST: http://forum.viry.cz/viewtopic.php?f=13&t=133100 .

zmetek · #5 Příspěvek od **zmetek** » 09 led 2017 19:32

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 08-01-2017
Ran by Martin (administrator) on DESKTOP-VELANK4 (09-01-2017 19:29:51)
Running from C:\Users\Martin\Desktop
Loaded Profiles: Martin (Available Profiles: Martin)
Platform: Windows 10 Home Version 1511 (X64) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(© 2015 Microsoft Corporation) C:\Users\Martin\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_ep64.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.10221.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(forum.viry.cz) C:\Users\Martin\Desktop\FRSTLauncher.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [598552 2016-06-22] (Oracle Corporation)
HKLM-x32\...\Run: [PlaysTV] => "C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv_launcher.exe" --startup
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr Inc\Raptr\raptrstub.exe [58584 2016-09-28] (Raptr, Inc)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5565960 2016-11-11] (LogMeIn Inc.)
HKU\S-1-5-21-1249156137-3488093570-3846741223-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2876704 2016-12-20] (Valve Corporation)
HKU\S-1-5-21-1249156137-3488093570-3846741223-1001\...\Run: [cz.seznam.software.autoupdate] => "C:\Users\Martin\AppData\Roaming\Seznam.cz\szninstall.exe" -c
HKU\S-1-5-21-1249156137-3488093570-3846741223-1001\...\Run: [cz.seznam.software.szndesktop] => "C:\Users\Martin\AppData\Roaming\Seznam.cz\bin\wszndesktop.exe" -q
HKU\S-1-5-21-1249156137-3488093570-3846741223-1001\...\Run: [Google Update] => C:\Users\Martin\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe [601752 2016-12-16] (Google Inc.)
HKU\S-1-5-21-1249156137-3488093570-3846741223-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27230168 2016-11-15] (Skype Technologies S.A.)
HKU\S-1-5-21-1249156137-3488093570-3846741223-1001\...\Run: [BingSvc] => C:\Users\Martin\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{2464e463-1367-4b7c-9a90-ce325f5f1002}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{f75f4d05-db1c-4269-8bf3-4cff2807abc1}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-08-04] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-04] (Oracle Corporation)

FireFox:
========
FF DefaultProfile: sehfta35.default
FF ProfilePath: C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default [2017-01-09]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\sehfta35.default -> Bing
FF SearchEngineOrder.3: Mozilla\Firefox\Profiles\sehfta35.default -> Bing
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\sehfta35.default -> Bing
FF Extension: (Bing Search) - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\Extensions\bingsearch.full@microsoft.com.xpi [2016-12-09]
FF Extension: (Seznam lištička) - C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\Extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [2016-08-05]
FF SearchPlugin: C:\Users\Martin\AppData\Roaming\Mozilla\Firefox\Profiles\sehfta35.default\searchplugins\bing-.xml [2016-12-10]
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-04] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-04] (Oracle Corporation)
FF Plugin HKU\S-1-5-21-1249156137-3488093570-3846741223-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-1249156137-3488093570-3846741223-1001: @talk.google.com/O1DPlugin -> C:\Users\Martin\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-1249156137-3488093570-3846741223-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Martin\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-1249156137-3488093570-3846741223-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Martin\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Martin\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Martin\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [395536 2016-12-23] (EasyAntiCheat Ltd)
R2 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [2627080 2016-11-11] (LogMeIn Inc.)
U2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2016-12-09] (Hi-Rez Studios) [File not signed]
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2016-11-11] (LogMeIn, Inc.)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2016-08-06] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7500048 2016-09-20] (TeamViewer GmbH)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2016-10-25] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-10-25] (Microsoft Corporation)
S2 PlaysService; "C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [31992 2015-06-03] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-07-21] (Advanced Micro Devices)
R3 Hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [45680 2016-06-07] (LogMeIn Inc.)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek )
R3 RtlWlanu; C:\Windows\System32\drivers\rtwlanu.sys [3764736 2015-10-30] (Realtek Semiconductor Corporation )
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 wdm_usb; C:\Windows\system32\DRIVERS\usb2ser.sys [159936 2016-08-16] (MBB)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-09 19:29 - 2017-01-09 19:30 - 00009992 _____ C:\Users\Martin\Desktop\FRST.txt
2017-01-09 19:29 - 2017-01-09 19:29 - 00000000 ____D C:\FRST
2017-01-09 19:27 - 2017-01-09 19:27 - 00112640 _____ (forum.viry.cz) C:\Users\Martin\Desktop\FRSTLauncher.exe
2017-01-09 19:26 - 2017-01-09 19:27 - 02419200 _____ (Farbar) C:\Users\Martin\Desktop\FRST64.exe
2017-01-09 19:02 - 2017-01-09 19:03 - 00000000 ____D C:\AdwCleaner
2017-01-09 19:00 - 2017-01-09 19:02 - 03988944 _____ C:\Users\Martin\Desktop\adwcleaner_6.042.exe
2017-01-09 18:50 - 2017-01-09 18:58 - 114150296 _____ C:\Users\Martin\Downloads\Microsoft-Windows-MediaFeaturePack-OOB-Package_x64.msu
2017-01-09 18:32 - 2017-01-09 18:32 - 00020950 _____ C:\Users\Martin\Downloads\20484220_5f2718fc6d44c5ae61d4275d679bbf1ededf58e5 (1).cab
2017-01-09 18:16 - 2017-01-09 18:16 - 00000000 ____D C:\Users\Martin\AppData\Local\ElevatedDiagnostics
2017-01-09 18:00 - 2017-01-09 18:01 - 00020950 _____ C:\Users\Martin\Downloads\20484220_5f2718fc6d44c5ae61d4275d679bbf1ededf58e5.cab
2017-01-09 17:38 - 2017-01-09 17:39 - 00000000 ____D C:\rsit
2017-01-09 17:38 - 2017-01-09 17:38 - 01323520 _____ C:\Users\Martin\Downloads\RSITx64 (1).exe
2017-01-09 17:38 - 2017-01-09 17:38 - 01222144 _____ C:\Users\Martin\Downloads\RSITx64.exe
2017-01-09 17:38 - 2017-01-09 17:38 - 00000000 ____D C:\Program Files\trend micro
2017-01-09 12:30 - 2017-01-09 16:43 - 00000000 ____D C:\Program Files\Plumbytes Software
2017-01-09 12:30 - 2017-01-09 12:48 - 00000000 ____D C:\Users\Martin\AppData\Local\{12A8CCFE-3C33-4995-BAD8-074E4C5B22FD}
2017-01-09 12:26 - 2017-01-09 12:26 - 00881904 _____ (Plumbytes Software) C:\Users\Martin\Downloads\antimalwaresetup.exe
2017-01-02 11:17 - 2017-01-02 11:17 - 00001814 _____ C:\Users\Public\Desktop\SPORE™.lnk
2017-01-02 11:17 - 2017-01-02 11:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SPORE™ Collection [GOG.com]
2017-01-02 11:11 - 2017-01-02 11:11 - 00000000 ____D C:\GOG Games
2017-01-02 11:06 - 2017-01-02 11:11 - 00000000 ____D C:\Users\Martin\Desktop\SPORE™ Collection (GOG)
2017-01-01 19:30 - 2017-01-01 19:30 - 00021168 _____ C:\Users\Martin\Desktop\sloh III.odt
2017-01-01 17:22 - 2017-01-01 17:22 - 00000000 ____D C:\Users\Martin\AppData\Roaming\OpenOffice
2017-01-01 17:21 - 2017-01-01 17:21 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.1.3.lnk
2017-01-01 17:21 - 2017-01-01 17:21 - 00000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.3
2017-01-01 17:21 - 2017-01-01 17:21 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2017-01-01 17:20 - 2017-01-01 17:20 - 00000000 ____D C:\Users\Martin\Desktop\OpenOffice 4.1.3 (cs) Installation Files
2017-01-01 17:11 - 2017-01-01 17:20 - 128605432 _____ C:\Users\Martin\Downloads\Apache_OpenOffice_4.1.3_Win_x86_install_cs.exe
2017-01-01 16:47 - 2017-01-01 17:05 - 407010384 _____ (Microsoft Corporation) C:\Users\Martin\Downloads\microsoft-office-2007_2007.exe
2017-01-01 16:13 - 2017-01-01 16:41 - 570570144 _____ (Microsoft Corporation) C:\Users\Martin\Downloads\X16-32004 Office 2010 Czech 32bit.exe
2016-12-27 18:24 - 2016-12-27 19:10 - 823309176 _____ C:\Users\Martin\Downloads\Kříž-u-potoka-1937-LQ.avi
2016-12-27 14:11 - 2016-12-27 14:11 - 00016209 _____ C:\Users\Martin\Desktop\TABULKA+MZ.docx
2016-12-25 11:11 - 2016-12-25 11:11 - 00003162 _____ C:\Windows\System32\Tasks\{5D2C7DF5-A578-4CDB-908E-7956D0B70D08}
2016-12-23 15:17 - 2016-12-23 15:17 - 00552184 _____ C:\Windows\system32\Drivers\EasyAntiCheat.sys
2016-12-23 14:22 - 2016-12-23 14:23 - 00000000 ____D C:\Users\Martin\AppData\Local\HirezLauncherUI
2016-12-23 14:22 - 2016-12-23 10:39 - 00395536 _____ (EasyAntiCheat Ltd) C:\Windows\SysWOW64\EasyAntiCheat.exe
2016-12-23 14:00 - 2017-01-09 19:05 - 00000000 ____D C:\Program Files (x86)\Hi-Rez Studios
2016-12-23 14:00 - 2016-12-23 15:17 - 00000000 ____D C:\ProgramData\Hi-Rez Studios
2016-12-23 14:00 - 2016-12-23 14:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
2016-12-16 21:09 - 2016-12-16 21:09 - 00000000 ____D C:\Users\Martin\AppData\Local\Chromium
2016-12-15 20:49 - 2016-12-15 20:49 - 02006016 _____ C:\Users\Martin\Downloads\DiagramDesignerSetup1.28.msi
2016-12-15 20:49 - 2016-12-15 20:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diagram Designer
2016-12-15 20:49 - 2016-12-15 20:49 - 00000000 ____D C:\Program Files (x86)\MeeSoft
2016-12-14 16:21 - 2016-11-22 10:24 - 02938408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-12-14 16:21 - 2016-11-22 10:17 - 00106896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2016-12-14 16:21 - 2016-11-22 10:16 - 00064072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2016-12-14 16:21 - 2016-11-22 09:49 - 02195640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2016-12-14 16:21 - 2016-11-22 09:48 - 01522672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2016-12-14 16:21 - 2016-11-22 09:47 - 01372312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-12-14 16:21 - 2016-11-22 09:47 - 01337240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-12-14 16:21 - 2016-11-22 09:12 - 00094720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserDataTimeUtil.dll
2016-12-14 16:21 - 2016-11-22 08:54 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AppCapture.dll
2016-12-14 16:21 - 2016-11-22 08:41 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcastdvr.exe
2016-12-14 16:21 - 2016-11-22 08:38 - 00541184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GamePanel.exe
2016-12-14 16:21 - 2016-11-22 07:59 - 03671040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-12-14 16:21 - 2016-11-22 07:55 - 01500160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-12-14 16:20 - 2016-11-22 12:42 - 00384864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\clfs.sys
2016-12-14 16:20 - 2016-11-22 11:43 - 03692040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-12-14 16:20 - 2016-11-22 11:38 - 01540224 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2016-12-14 16:20 - 2016-11-22 11:38 - 00692136 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2016-12-14 16:20 - 2016-11-22 11:36 - 00159640 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2016-12-14 16:20 - 2016-11-22 11:35 - 00609056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-12-14 16:20 - 2016-11-22 11:35 - 00075448 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2016-12-14 16:20 - 2016-11-22 11:04 - 02549456 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2016-12-14 16:20 - 2016-11-22 11:03 - 01777280 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2016-12-14 16:20 - 2016-11-22 11:02 - 01594416 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-12-14 16:20 - 2016-11-22 11:02 - 01399216 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-12-14 16:20 - 2016-11-22 10:32 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\UserDataTimeUtil.dll
2016-12-14 16:20 - 2016-11-22 10:21 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2016-12-14 16:20 - 2016-11-22 10:13 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2016-12-14 16:20 - 2016-11-22 10:00 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2016-12-14 16:20 - 2016-11-22 09:59 - 00221696 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-12-14 16:20 - 2016-11-22 09:55 - 00431104 _____ (Microsoft Corporation) C:\Windows\system32\bcastdvr.exe
2016-12-14 16:20 - 2016-11-22 09:54 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\Chakradiag.dll
2016-12-14 16:20 - 2016-11-22 09:50 - 00715776 _____ (Microsoft Corporation) C:\Windows\system32\GamePanel.exe
2016-12-14 16:20 - 2016-11-22 09:35 - 00784896 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-12-14 16:20 - 2016-11-22 09:32 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2016-12-14 16:20 - 2016-11-22 09:27 - 01752576 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-12-14 16:20 - 2016-11-22 09:20 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2016-12-14 16:20 - 2016-11-22 09:04 - 03587584 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2016-12-14 16:20 - 2016-11-22 08:57 - 03351040 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-12-14 16:20 - 2016-11-22 08:53 - 01728000 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-12-14 16:20 - 2016-11-22 08:36 - 00766464 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2016-12-14 16:20 - 2016-11-22 08:26 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-12-14 16:20 - 2016-11-22 08:26 - 00687616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-12-14 16:20 - 2016-11-22 08:21 - 01526272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-12-14 16:20 - 2016-11-22 08:15 - 22373376 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2016-12-14 16:20 - 2016-11-22 08:14 - 04895744 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-12-14 16:20 - 2016-11-22 08:02 - 24610304 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-12-14 16:20 - 2016-11-22 08:01 - 13392384 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-12-14 16:20 - 2016-11-22 07:49 - 07839232 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2016-12-14 16:20 - 2016-11-22 07:35 - 19350016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-12-14 16:20 - 2016-11-22 07:34 - 18670080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2016-12-14 16:20 - 2016-11-22 07:34 - 12134400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-12-14 16:20 - 2016-11-22 07:32 - 03663872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-12-14 16:20 - 2016-11-22 07:17 - 05658624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2016-12-14 16:04 - 2016-12-14 16:04 - 00003292 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-09 19:24 - 2016-11-19 19:13 - 00000000 ____D C:\Users\Martin\AppData\LocalLow\Mozilla
2017-01-09 19:15 - 2016-06-19 13:24 - 00000000 ____D C:\Windows\Panther
2017-01-09 19:12 - 2016-06-30 21:10 - 00000000 ____D C:\Program Files (x86)\Steam
2017-01-09 19:12 - 2016-04-27 07:54 - 01771468 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-09 19:12 - 2016-04-27 07:11 - 00750030 _____ C:\Windows\system32\perfh005.dat
2017-01-09 19:12 - 2016-04-27 07:11 - 00150654 _____ C:\Windows\system32\perfc005.dat
2017-01-09 19:12 - 2015-10-30 08:21 - 00000000 ____D C:\Windows\INF
2017-01-09 19:07 - 2016-08-23 16:56 - 00000000 ____D C:\Users\Martin\AppData\Roaming\Skype
2017-01-09 19:06 - 2016-08-05 07:32 - 00000000 ____D C:\Users\Martin\AppData\Local\LogMeIn Hamachi
2017-01-09 19:05 - 2016-04-27 07:49 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-09 19:00 - 2015-10-30 08:11 - 00000000 ____D C:\Windows\CbsTemp
2017-01-09 18:08 - 2016-09-02 19:35 - 00004214 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8696B6CC-FD9E-4FB3-9011-F9D1C1355800}
2017-01-09 17:33 - 2016-09-02 19:28 - 00000000 ____D C:\Users\Martin\AppData\Roaming\Raptr
2017-01-09 17:32 - 2016-04-26 22:45 - 00225024 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-09 17:30 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\system32\NDF
2017-01-09 16:54 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\AppReadiness
2017-01-08 18:14 - 2015-10-30 08:24 - 00000000 ___HD C:\Program Files\WindowsApps
2017-01-07 20:45 - 2016-08-06 08:26 - 00282296 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2017-01-07 20:45 - 2016-08-06 08:26 - 00282296 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2017-01-07 20:43 - 2016-08-06 08:26 - 00215128 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2017-01-02 16:51 - 2016-08-04 19:12 - 00000000 ____D C:\Users\Martin\AppData\Roaming\.minecraft
2017-01-02 11:19 - 2016-10-30 16:41 - 00000000 ____D C:\Users\Martin\Documents\My Spore Creations
2016-12-31 16:11 - 2015-10-30 08:23 - 00000000 ____D C:\Windows\system32\drivers
2016-12-30 17:21 - 2015-10-30 07:28 - 00000000 ____D C:\Windows\system32\DriverStore
2016-12-29 21:11 - 2016-06-19 12:32 - 00000000 ____D C:\Users\Martin
2016-12-28 21:51 - 2016-06-19 12:32 - 00524288 ___SH C:\Users\Martin\NTUSER.DAT{793c963e-0c00-11e6-b8cb-dee43b2d9249}.TMContainer00000000000000000001.regtrans-ms
2016-12-28 21:51 - 2016-06-19 12:32 - 00065536 ___SH C:\Users\Martin\NTUSER.DAT{793c963e-0c00-11e6-b8cb-dee43b2d9249}.TM.blf
2016-12-28 20:25 - 2016-07-01 22:32 - 00000000 ____D C:\Users\Martin\Documents\Square Enix
2016-12-28 16:55 - 2016-08-06 08:26 - 00000000 ____D C:\Users\Martin\Documents\BFBC2
2016-12-25 11:43 - 2016-06-19 12:26 - 00107088 _____ C:\Windows\PFRO.log
2016-12-25 11:11 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\system32\Tasks
2016-12-25 11:10 - 2016-09-01 18:09 - 00000000 ____D C:\ProgramData\Electronic Arts
2016-12-25 11:10 - 2015-10-30 07:28 - 00000000 ____D C:\Program Files\Common Files
2016-12-25 11:09 - 2016-09-01 18:09 - 00000000 ____D C:\ProgramData\Origin
2016-12-25 11:04 - 2016-06-19 12:44 - 00000000 ____D C:\Program Files\AMD
2016-12-25 11:00 - 2016-06-19 12:44 - 00000000 ____D C:\AMD
2016-12-23 15:17 - 2016-07-01 09:52 - 00000000 ____D C:\Users\Martin\Documents\My Games
2016-12-23 14:00 - 2016-07-07 08:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-12-23 14:00 - 2015-10-30 08:24 - 00000000 ___HD C:\ProgramData
2016-12-21 13:15 - 2016-06-30 21:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-17 11:39 - 2016-06-19 12:29 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{485596d2-7ed5-11e5-80df-e41d2d718e10}.TMContainer00000000000000000002.regtrans-ms
2016-12-17 11:39 - 2016-06-19 12:29 - 00065536 ___SH C:\Windows\system32\config\COMPONENTS{485596d2-7ed5-11e5-80df-e41d2d718e10}.TM.blf
2016-12-16 21:52 - 2016-06-19 12:29 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{485596d2-7ed5-11e5-80df-e41d2d718e10}.TMContainer00000000000000000001.regtrans-ms
2016-12-16 21:42 - 2015-10-30 07:28 - 00000000 ____D C:\Windows\WinSxS
2016-12-16 21:41 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\system32\catroot2
2016-12-16 21:23 - 2016-10-15 17:53 - 00003736 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1249156137-3488093570-3846741223-1001UA
2016-12-16 21:23 - 2016-10-15 17:53 - 00003468 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1249156137-3488093570-3846741223-1001Core
2016-12-16 21:23 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\Tasks
2016-12-16 21:09 - 2016-06-30 21:18 - 00000000 ____D C:\Users\Martin\AppData\Local\Steam
2016-12-16 21:08 - 2016-08-26 23:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-12-16 14:59 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\rescache
2016-12-15 18:45 - 2015-10-30 07:28 - 00262144 ___SH C:\Users\Default\NTUSER.DAT
2016-12-15 17:03 - 2016-08-05 07:36 - 00000000 ____D C:\Users\Default\AppData\Local\LogMeIn Hamachi
2016-12-15 17:03 - 2016-08-05 07:36 - 00000000 ____D C:\Users\Default User\AppData\Local\LogMeIn Hamachi
2016-12-15 17:03 - 2016-06-19 12:26 - 00524288 ___SH C:\Windows\system32\config\DRIVERS{485596e0-7ed5-11e5-80df-e41d2d718e10}.TMContainer00000000000000000001.regtrans-ms
2016-12-15 17:03 - 2016-06-19 12:26 - 00065536 ___SH C:\Windows\system32\config\DRIVERS{485596e0-7ed5-11e5-80df-e41d2d718e10}.TM.blf
2016-12-15 17:03 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\SysWOW64\cs-CZ
2016-12-15 17:03 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\system32\oobe
2016-12-15 17:03 - 2015-10-30 08:24 - 00000000 ____D C:\Windows\system32\cs-CZ
2016-12-15 17:03 - 2015-10-30 08:24 - 00000000 ____D C:\Program Files\Internet Explorer
2016-12-15 17:03 - 2015-10-30 08:24 - 00000000 ____D C:\Program Files (x86)\Internet Explorer
2016-12-15 15:47 - 2016-06-19 12:53 - 00000000 ____D C:\Windows\system32\MRT
2016-12-15 15:45 - 2016-06-19 12:53 - 135632432 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-12-14 16:04 - 2016-06-19 12:34 - 00002394 _____ C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-12-14 16:04 - 2016-06-19 12:34 - 00000000 ___RD C:\Users\Martin\OneDrive
2016-12-12 00:03 - 2015-10-30 08:26 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-12 00:03 - 2015-10-30 08:26 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

Some files in TEMP:
====================
C:\Users\Martin\AppData\Local\Temp\BSvcProcessor.exe
C:\Users\Martin\AppData\Local\Temp\BSvcUpdater.exe
C:\Users\Martin\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\Martin\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\Martin\AppData\Local\Temp\jre-8u111-windows-au.exe
C:\Users\Martin\AppData\Local\Temp\playstv_patch.exe
C:\Users\Martin\AppData\Local\Temp\raptrpatch.exe
C:\Users\Martin\AppData\Local\Temp\raptr_stub.exe
C:\Users\Martin\AppData\Local\Temp\{E638ABC1-0067-474b-A379-87CFE81E7848}.exe
C:\Users\Martin\AppData\Local\Temp\~EBD4.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================

==================== MBR and Partition Table ==================

==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Alternate Data Streams (whitelisted) ==================

==================== Security Center ==================

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)

***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Martin\Desktop" je 11667 MB.

***** Startup Programs *****

***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR"=dword:00000001

==================== End Of Log ==============================

#6 Příspěvek od **Rudy** » 09 led 2017 20:13

Otevřte poznámkový blok a zkopírujte do něj:

Start
HKU\S-1-5-21-1249156137-3488093570-3846741223-1001\...\Run: [BingSvc] => C:\Users\Martin\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)
C:\Users\Martin\AppData\Local\Microsoft\BingSvc
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\sehfta35.default -> Bing
FF SearchEngineOrder.3: Mozilla\Firefox\Profiles\sehfta35.default -> Bing
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\sehfta35.default -> Bing
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1249156137-3488093570-3846741223-1001UA
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1249156137-3488093570-3846741223-1001Core
C:\Users\Martin\AppData\Local\Temp

EmptyTemp:
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Z logu:

Velikost slozky "C:\Users\Martin\Desktop" je 11667 MB.

To je příliš mnoho a může to způsobovat zpomalení startu systému. Vytvořte C:\Users\Martin novou složku a přesuňte do ní všechna data z plochy (kromě zástupců). Na plochu si pak dejte zástupce té složky pro snazší přístup.

zmetek · #7 Příspěvek od **zmetek** » 09 led 2017 21:12

Po restartu mi log nenaskočil, tak jsem to zkopíroval ze souboru Fixlog.
Plochu jsem důkladně vyčistil.

Fix result of Farbar Recovery Scan Tool (x64) Version: 08-01-2017
Ran by Martin (09-01-2017 21:03:04) Run:1
Running from C:\Users\Martin\Desktop
Loaded Profiles: Martin (Available Profiles: Martin)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
HKU\S-1-5-21-1249156137-3488093570-3846741223-1001\...\Run: [BingSvc] => C:\Users\Martin\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)
C:\Users\Martin\AppData\Local\Microsoft\BingSvc
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\sehfta35.default -> Bing
FF SearchEngineOrder.3: Mozilla\Firefox\Profiles\sehfta35.default -> Bing
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\sehfta35.default -> Bing
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1249156137-3488093570-3846741223-1001UA
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1249156137-3488093570-3846741223-1001Core
C:\Users\Martin\AppData\Local\Temp

EmptyTemp:
End
*****************

HKU\S-1-5-21-1249156137-3488093570-3846741223-1001\Software\Microsoft\Windows\CurrentVersion\Run\\BingSvc => value removed successfully
C:\Users\Martin\AppData\Local\Microsoft\BingSvc => moved successfully
Firefox DefaultSearchEngine removed successfully
Firefox SearchEngineOrder.3 removed successfully
Firefox SelectedSearchEngine removed successfully
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1249156137-3488093570-3846741223-1001UA => moved successfully
C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1249156137-3488093570-3846741223-1001Core => moved successfully
C:\Users\Martin\AppData\Local\Temp => moved successfully

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 61113276 B
Java, Flash, Steam htmlcache => 134533075 B
Windows/system/drivers => 112165886 B
Edge => 264571985 B
Chrome => 0 B
Firefox => 117566748 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 36846 B
Martin => 34539184 B

RecycleBin => 15145869184 B
EmptyTemp: => 14.8 GB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 21:03:50 ====

#8 Příspěvek od **Rudy** » 09 led 2017 21:19

Smazáno. Nastala nějaká změna?

zmetek · #9 Příspěvek od **zmetek** » 10 led 2017 08:46

Znatelně lepší, hlavně internet už zase normálně funguje. Můžu si i nastavit domovskou stránku

S rychlostí mám podobný problém i na notebooku, je možné se na to taky nějak podívat? Preventivně...

Já už teda začal čistit plochu

ale stejně...

A kde můžu zaškrtnout něco jako že jste bezvadná stránka?

#10 Příspěvek od **Rudy** » 10 led 2017 18:23

To nikde nezaškrtnete.

Můžete to dát vědět ostatním.

VIRY.CZ

webový prohlížeč zavirován, počítač zpomalený

webový prohlížeč zavirován, počítač zpomalený

Re: webový prohlížeč zavirován, počítač zpomalený

Re: webový prohlížeč zavirován, počítač zpomalený

Re: webový prohlížeč zavirován, počítač zpomalený

Re: webový prohlížeč zavirován, počítač zpomalený

Re: webový prohlížeč zavirován, počítač zpomalený

Re: webový prohlížeč zavirován, počítač zpomalený

Re: webový prohlížeč zavirován, počítač zpomalený

Re: webový prohlížeč zavirován, počítač zpomalený

Re: webový prohlížeč zavirován, počítač zpomalený