Zpomalený Acer Switch

[mobmaniak]

Zdravím poslední dny se mě začal sekat Acer switch, který je využíván pouze pro jeden pokladní systém, nic jiného se na něm nepoužívá.
Předtím to běhalo naprosto v pohodě a i nyní to běhá 80% času v pořádku, ale zrovna když se to nejméně hodí, tak se to zpomalí

Zde log z RSIT
Logfile of random's system information tool 1.15 (written by random/random)
Run by Ji at 2017-02-23 08:54:57
Microsoft Windows 10 Home
System drive C: has 17 GB (58%) free of 29 GB
Total RAM: 1931 MB (40% free)
X86

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:55:17, on 23.02.2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.14393.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\sihost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\taskhostw.exe
C:\Program Files\TeamViewer\TeamViewer.exe
C:\Windows\System32\RuntimeBroker.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxEM.exe
C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
C:\WINDOWS\system32\igfxHK.exe
C:\WINDOWS\system32\igfxTray.exe
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.110.0_x86__kzf8qxf38zg5c\SkypeHost.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
C:\WINDOWS\system32\backgroundTaskHost.exe
C:\WINDOWS\system32\ApplicationFrameHost.exe
C:\WINDOWS\system32\SettingSyncHost.exe
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
C:\WINDOWS\system32\browser_broker.exe
C:\Windows\System32\InstallAgent.exe
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
C:\Windows\System32\DptfPolicyLpmServiceHelper.exe
C:\Program Files\REALTEK\Audio\AP\RtkNGUI.exe
C:\Program Files\Windows Defender\MSASCuiL.exe
C:\WINDOWS\system32\DllHost.exe
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
C:\WINDOWS\system32\backgroundTaskHost.exe
C:\Users\Ji\Downloads\RSIT.exe
C:\Program Files\trend micro\Ji_RSIT.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://acer13.msn.com/?pc=ACJB
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://new.restauracesatlava.cz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\PROGRA~1\McAfee\SITEAD~1\mcieplg.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\PROGRA~1\McAfee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [DptfPolicyLpmServiceHelper] C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe
O4 - HKLM\..\Run: [RtkNGUI] "C:\Program Files\Realtek\Audio\AP\RtkNGUI.exe" /s
O4 - HKLM\..\Run: [WindowsDefender] "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
O4 - HKUS\S-1-5-19\..\Run: [OneDriveSetup] C:\Windows\System32\OneDriveSetup.exe /thfirstsetup (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OneDriveSetup] C:\Windows\System32\OneDriveSetup.exe /thfirstsetup (User 'NETWORK SERVICE')
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~1\McAfee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~1\McAfee\SITEAD~1\mcieplg.dll
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\System32\tbauth.dll
O23 - Service: BTDevManager - Unknown owner - C:\Program Files\REALTEK\REALTEK Bluetooth\BTDevMgr.exe
O23 - Service: Conto - tiskový server /služba/ (ContoPrnServerSvc) - CONSULTA BÜROTECHNIK, s.r.o. - C:\Conto\CPrnServerSvc.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\system32\IntelCpHeciSvc.exe
O23 - Service: @oem8.inf,%WIN32_DPTF_PARTICIPANT_PROC_SERVICE_DISPLAY_NAME%;Intel(R) Dynamic Platform & Thermal Framework Processor Participant Service Application (DptfParticipantProcessorService) - Intel Corporation - C:\WINDOWS\system32\DptfParticipantProcessorService.exe
O23 - Service: @oem8.inf,%WIN32_DPTF_POLICY_CRITICAL_SERVICE_DISPLAY_NAME%;Intel(R) Dynamic Platform & Thermal Framework Critical Service Application (DptfPolicyCriticalService) - Intel Corporation - C:\WINDOWS\system32\DptfPolicyCriticalService.exe
O23 - Service: @oem8.inf,%WIN32_DPTF_POLICY_LPM_SERVICE_DISPLAY_NAME%;Intel(R) Dynamic Platform & Thermal Framework Low Power Mode Service Application (DptfPolicyLpmService) - Intel Corporation - C:\WINDOWS\system32\DptfPolicyLpmService.exe
O23 - Service: Intel(R) HD Graphics Control Panel Service (igfxCUIService1.0.0.0) - Intel Corporation - C:\WINDOWS\system32\igfxCUIService.exe
O23 - Service: Launch Manager Service (LMSvc) - Acer Incorporate - C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: Quick Access Service (QASvc) - Acer Incorporate - C:\Program Files\Acer\Acer Quick Access\QASvc.exe
O23 - Service: TeamViewer 12 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer\TeamViewer_Service.exe
O23 - Service: Touch Tools Launch Service (TouchToolsLaunchService) - Acer Incorporated - C:\Program Files\Acer\Acer Touch Tools\TouchToolsLaunchSvc.exe
O23 - Service: User Experience Improvement Program (UEIPSvc) - acer - C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe

--
End of file - 6068 bytes

======Scheduled tasks folder======

C:\WINDOWS\system32\tasks\BacKGroundAgent - C:\Program Files\Acer\AOP Framework\BackgroundAgent.exe task
C:\WINDOWS\system32\tasks\Launch Manager - "C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe"
C:\WINDOWS\system32\tasks\UbtFrameworkService - "C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe"
C:\WINDOWS\system32\tasks\User_Feed_Synchronization-{A8874CDC-46F8-4309-A080-9766A19373CC} - C:\windows\system32\msfeedssync.exe sync
C:\WINDOWS\system32\tasks\Recovery Management\Notification - C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe
C:\WINDOWS\system32\tasks\Microsoft\XblGameSave\XblGameSaveTask - %windir%\System32\XblGameSaveTask.exe standby
C:\WINDOWS\system32\tasks\Microsoft\XblGameSave\XblGameSaveTaskLogon - %windir%\System32\XblGameSaveTask.exe logon
C:\WINDOWS\system32\tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join - %SystemRoot%\System32\dsregcmd.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join - %SystemRoot%\System32\AutoWorkplace.exe join
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start - C:\WINDOWS\system32\sc.exe start wuauserv
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network - C:\windows\system32\sc.exe start wuauserv
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\sih - %systemroot%\System32\sihclient.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\WindowsUpdate\sihboot - %systemroot%\System32\sihclient.exe /boot
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -upload
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdCacheMaintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdCleanup
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan - %ProgramFiles%\Windows Defender\MpCmdRun.exe Scan -ScheduleJob
C:\WINDOWS\system32\tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification - %ProgramFiles%\Windows Defender\MpCmdRun.exe -IdleTask -TaskName WdVerification
C:\WINDOWS\system32\tasks\Microsoft\Windows\WCM\WiFiTask - %SystemRoot%\System32\WiFiTask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Maintenance Install - %systemroot%\system32\usoclient.exe StartInstall
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Policy Install - %systemroot%\system32\usoclient.exe StartInstall
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Reboot - %systemroot%\system32\MusNotification.exe ReadyToReboot
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Refresh Settings - %systemroot%\system32\usoclient.exe RefreshSettings
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Resume On Boot - %systemroot%\system32\usoclient.exe ResumeUpdate
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan - %systemroot%\system32\usoclient.exe StartScan
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display - %systemroot%\system32\MusNotification.exe Display
C:\WINDOWS\system32\tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot - %systemroot%\system32\MusNotification.exe ReadyToReboot
C:\WINDOWS\system32\tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone - %windir%\system32\tzsync.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\WINDOWS\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\srtasks.exe ExecuteScheduledSPPCreation
C:\WINDOWS\system32\tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask - %windir%\system32\rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\Storage Tiers Management\Storage Tiers Optimization - %windir%\system32\defrag.exe -c -h -g -# -m 8 -i 13500
C:\WINDOWS\system32\tasks\Microsoft\Windows\Speech\SpeechModelDownloadTask - %windir%\system32\speech_onecore\common\SpeechModelDownload.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SpacePort\SpaceAgentTask - %windir%\system32\SpaceAgent.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SpacePort\SpaceManagerTask - %windir%\system32\spaceman.exe /Work
C:\WINDOWS\system32\tasks\Microsoft\Windows\Shell\FamilySafetyMonitor - %windir%\System32\wpcmon.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\SharedPC\Account Cleanup - %windir%\System32\rundll32.exe %windir%\System32\Windows.SharedPC.AccountManager.dll,StartMaintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\WINDOWS\system32\tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers - %SystemRoot%\System32\drvinst.exe 6
C:\WINDOWS\system32\tasks\Microsoft\Windows\NlaSvc\WiFiTask - %SystemRoot%\System32\WiFiTask.exe nla
C:\WINDOWS\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\WINDOWS\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser - %SystemRoot%\System32\MbaeParserTask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Management\Provisioning\Logon - %windir%\system32\ProvTool.exe /turn 5
C:\WINDOWS\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotificationWindows.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Location\WindowsActionDialog - %windir%\System32\WindowsActionDialog.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClient - %windir%\system32\dmclient.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload - %windir%\system32\dmclient.exe utcwnf
C:\WINDOWS\system32\tasks\Microsoft\Windows\EnterpriseMgmt\MDMMaintenenceTask - %windir%\system32\MDMAgent.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DUSM\dusmtask - %SystemRoot%\System32\dusmtask.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskFootprint\Diagnostics - %windir%\system32\disksnapshot.exe -z
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\DiskCleanup\SilentCleanup - %windir%\system32\cleanmgr.exe /autoclean /d %systemdrive%
C:\WINDOWS\system32\tasks\Microsoft\Windows\Device Information\Device - %windir%\system32\devicecensus.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c -h -o -$
C:\WINDOWS\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Clip\License Validation - %SystemRoot%\system32\ClipUp.exe -p -s -o
C:\WINDOWS\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\WINDOWS\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup - %windir%\system32\rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\appuriverifierdaily - %windir%\system32\AppHostRegistrationVerifier.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\appuriverifierinstall - %windir%\system32\AppHostRegistrationVerifier.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState - %windir%\system32\rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
C:\WINDOWS\system32\tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup - %windir%\system32\dstokenclean.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattelrunner.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\WINDOWS\system32\tasks\Microsoft\Windows\Application Experience\StartupAppTask - %windir%\system32\rundll32.exe Startupscan.dll,SusRunTask
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\WINDOWS\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe

=========Google Chrome=========


[HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\fheoggkfdfchfphceeifdbepaooicaho]
"Path"=C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx


======Registry dump======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0CD3154B-DB93-4C17-993D-FE138CB01228}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0CD3154B-DB93-4C17-993D-FE138CB01228}]
"URL"=http://www.bing.com/search?q={searchTer ... TR&pc=ACJB

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
McAfee SiteAdvisor BHO - C:\PROGRA~1\McAfee\SITEAD~1\mcieplg.dll [2015-08-04 244424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - C:\PROGRA~1\McAfee\SITEAD~1\mcieplg.dll [2015-08-04 244424]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DptfPolicyLpmServiceHelper"=C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [2014-04-05 79672]
"RtkNGUI"=C:\Program Files\Realtek\Audio\AP\RtkNGUI.exe [2014-05-07 4616192]
"WindowsDefender"=C:\Program Files\Windows Defender\MSASCuiL.exe [2016-07-16 483840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iaioi2c.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iaioi2ce.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iaiospi.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"DSCAutomationHostEnabled"=2
"EnableCursorSuppression"=1
"EnableUIADesktopToggle"=0
"undockwithoutlogon"=1
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
"StubPath"=%SystemRoot%\inf\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"midimapper"=midimap.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"msacm.msadpcm"=msadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"vidc.cvid"=iccvid.dll
"vidc.i420"=iyuv_32.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvu9"=tsbyuv.dll
"vidc.yvyu"=msyuv.dll
"wavemapper"=msacm32.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"MSVideo8"=VfWWDM32.dll

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-02-23 08:54:58 ----D---- C:\Program Files\trend micro
2017-02-23 08:54:57 ----D---- C:\rsit
2017-01-25 13:07:29 ----A---- C:\WINDOWS\system32\poqexec.exe

======List of files/folders modified in the last 1 month======

2017-02-23 08:55:02 ----D---- C:\WINDOWS\Prefetch
2017-02-23 08:54:58 ----RD---- C:\Program Files
2017-02-23 08:52:39 ----D---- C:\WINDOWS\Temp
2017-02-23 08:51:54 ----D---- C:\WINDOWS\system32\sru
2017-02-23 08:51:53 ----D---- C:\WINDOWS\system32\catroot2
2017-02-23 08:51:46 ----D---- C:\AdwCleaner
2017-02-23 08:45:37 ----HD---- C:\ProgramData
2017-02-23 08:45:37 ----D---- C:\WINDOWS\system32\drivers
2017-02-23 08:43:37 ----HD---- C:\Program Files\WindowsApps
2017-02-23 08:43:37 ----D---- C:\WINDOWS\AppReadiness
2017-02-23 08:36:18 ----D---- C:\WINDOWS\System32
2017-02-22 23:01:08 ----D---- C:\WINDOWS\LiveKernelReports
2017-02-22 23:01:03 ----D---- C:\WINDOWS\system32\SleepStudy
2017-02-22 13:03:42 ----D---- C:\WINDOWS\system32\config
2017-02-22 11:10:39 ----D---- C:\WINDOWS\WinSxS
2017-02-22 11:09:05 ----RD---- C:\WINDOWS\Microsoft.NET
2017-02-22 11:06:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-22 10:56:13 ----SHDC---- C:\WINDOWS\Installer
2017-02-22 10:55:12 ----D---- C:\WINDOWS\system32\Tasks
2017-02-22 10:55:08 ----D---- C:\Program Files\Acer
2017-02-22 10:53:24 ----AD---- C:\ProgramData\regid.1991-06.com.microsoft
2017-02-22 10:53:18 ----SD---- C:\ProgramData\Microsoft
2017-02-22 10:52:16 ----D---- C:\WINDOWS\CbsTemp
2017-02-22 10:48:26 ----AD---- C:\Program Files\TeamViewer
2017-02-10 15:10:06 ----D---- C:\Windows
2017-02-10 15:09:43 ----D---- C:\WINDOWS\Minidump
2017-02-06 20:48:07 ----A---- C:\WINDOWS\system32\FlashPlayerApp.exe
2017-01-28 12:27:17 ----D---- C:\WINDOWS\system32\WDI

File C:\WINDOWS\system32\winlogon.exe is digitally signed
File C:\WINDOWS\system32\wininit.exe is digitally signed
File C:\WINDOWS\explorer.exe is digitally signed
File C:\WINDOWS\system32\svchost.exe is digitally signed
File C:\WINDOWS\system32\services.exe is digitally signed
File C:\WINDOWS\system32\User32.dll is digitally signed
File C:\WINDOWS\system32\userinit.exe is digitally signed
File C:\WINDOWS\system32\rpcss.dll is digitally signed
File C:\WINDOWS\system32\Drivers\volsnap.sys is digitally signed

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iorate;@%SystemRoot%\system32\drivers\iorate.sys,-100; C:\WINDOWS\system32\drivers\iorate.sys [2016-11-02 42336]
R0 MBI;@oem18.inf,%MBI.SVCDESC%;Intel(R) Sideband Fabric Device Service; C:\WINDOWS\System32\drivers\MBI.sys [2014-03-19 21456]
R2 clreg;@%SystemRoot%\system32\drivers\registry.sys,-100; C:\WINDOWS\System32\drivers\registry.sys [2016-07-16 58368]
R3 BthMini;@bth.inf,%BTHMINI.SvcDesc%;Bluetooth Radio Driver; C:\WINDOWS\System32\drivers\BTHMINI.sys [2016-08-20 23040]
R3 camera;@oem3.inf,%camera.DeviceDesc%;Intel(R) Imaging Signal Processor 2400; C:\WINDOWS\system32\DRIVERS\camera.sys [2013-12-30 401408]
R3 CM3218x;@oem12.inf,%CM3218xDisplayName%;CM3218x SPB Driver; C:\WINDOWS\System32\drivers\WUDFRd.sys [2016-07-16 161280]
R3 CPLMACPI;@oem12.inf,%CPLMACPI.SvcDesc%;Capella Micro CPLMACPI Sensor Filter; C:\WINDOWS\System32\drivers\CPLMACPI.sys [2013-09-08 16488]
R3 DptfDevDisplay;DptfDevDisplay; C:\WINDOWS\System32\drivers\DptfDevDisplay.sys [2014-03-19 28112]
R3 DptfDevGen;DptfDevGen; C:\WINDOWS\System32\drivers\DptfDevGen.sys [2014-03-19 36304]
R3 DptfDevProc;DptfDevProc; C:\WINDOWS\System32\drivers\DptfDevProc.sys [2014-03-19 80848]
R3 DptfManager;DptfManager; C:\WINDOWS\System32\drivers\DptfManager.sys [2014-03-19 181712]
R3 GPIO;@oem22.inf,%GPIO.SVCDESC%;Intel SoC GPIO Controller Driver; C:\WINDOWS\System32\drivers\iaiogpioe.sys [2014-03-19 23552]
R3 GpioVirtual;@oem1.inf,%Driver_Service.Desc%;GPED Virtual GPIO controller driver; C:\WINDOWS\System32\drivers\iaiogpiovirtual.sys [2014-03-19 16896]
R3 iaioi2c;@oem4.inf,%Driver_Service.Desc%;I2C Controller Service; C:\WINDOWS\System32\drivers\iaioi2ce.sys [2014-03-19 58368]
R3 iaiospi;@oem9.inf,%Driver_Service.Desc%;SPI Controller Service; C:\WINDOWS\System32\drivers\iaiospi.sys [2014-03-19 53760]
R3 iaiouart;@oem14.inf,%iaiouart.SVCDESC%;UART Controller; C:\WINDOWS\System32\drivers\iaiouart.sys [2014-03-19 87552]
R3 IntelSST;@oem6.inf,%IntelSST_Audio.SvcDesc%;Intel SST Audio Device (WDM); C:\WINDOWS\system32\drivers\isstrtc.sys [2013-12-30 254464]
R3 INVN_MotionApps;@oem2.inf,%INVN_MotionAppsDisplayName%;InvenSense MotionApps Driver; C:\WINDOWS\System32\drivers\WUDFRd.sys [2016-07-16 161280]
R3 iwdbus;@oem27.inf,%iwdbus.SVCDESC%;IWD Bus Enumerator; C:\WINDOWS\System32\drivers\iwdbus.sys [2015-12-01 35320]
R3 ov2722;@oem23.inf,%ov2722.SVCDESC%;Camera Sensor OV2720; C:\WINDOWS\System32\drivers\ov2722.sys [2013-12-30 43520]
R3 PMIC;@oem0.inf,%Driver_Service.Desc%;Intel(R) Power Management IC Device Service; C:\WINDOWS\System32\drivers\PMIC.sys [2014-03-19 48128]
R3 rtii2sac;@oem13.inf,%CodecDevice.SVCDESC%;Realtek I2S Audio Codec Device Driver; C:\WINDOWS\system32\DRIVERS\rtii2sac.sys [2014-06-04 183000]
R3 RtkUart;@oem10.inf,%RtkBtUart.SVCDESC%;Realtek Bluetooth UART Bus Driver Service; C:\WINDOWS\System32\drivers\RtkUart.sys [2014-07-11 507608]
R3 RtlWlans;@netrtwlans.inf,%RtlWlans.DeviceDesc.DispName%;Realtek Wireless LAN 802.11n SDIO Network Adapter; C:\WINDOWS\System32\drivers\rtwlans.sys [2016-07-16 4304384]
R3 TXEI;@oem17.inf,%TEE_SvcDesc%;Intel(R) Trusted Execution Engine Interface ; C:\WINDOWS\System32\drivers\TXEI.sys [2014-03-19 75792]
S0 megasas2i;megasas2i; C:\WINDOWS\System32\drivers\MegaSas2i.sys [2016-10-05 56672]
S2 Parvdm;Parvdm; C:\WINDOWS\System32\drivers\parvdm.sys [2016-07-16 9216]
S3 AcpiDev;@acpidev.inf,%AcpiDev.SvcDesc%;ACPI Devices driver; C:\WINDOWS\System32\drivers\AcpiDev.sys [2016-07-16 12800]
S3 applockerfltr;@%systemroot%\system32\srpapi.dll,-102; C:\WINDOWS\system32\drivers\applockerfltr.sys [2016-07-16 12288]
S3 BTHPORT;@bth.inf,%BTHPORT.SvcDesc%;Bluetooth Port Driver; C:\WINDOWS\System32\drivers\BTHport.sys [2016-11-11 755200]
S3 DptfDevAmbient;DptfDevAmbient; C:\WINDOWS\System32\drivers\DptfDevAmbient.sys [2014-03-19 44496]
S3 DptfDevDBPT;DptfDevDBPT; C:\WINDOWS\System32\drivers\DptfDevPower.sys [2014-03-19 25552]
S3 iagpio;@iagpio.inf,%iagpio.SVCDESC%;Intel Serial IO GPIO Controller Driver; C:\WINDOWS\System32\drivers\iagpio.sys [2016-07-16 25600]
S3 IndirectKmd;@%SystemRoot%\system32\drivers\IndirectKmd.sys,-100; C:\WINDOWS\System32\drivers\IndirectKmd.sys [2016-07-16 30208]
S3 intaud_WaveExtensible;@oem20.inf,%INTAUD_WEX.SvcDesc%;Intel WiDi Audio Device; C:\WINDOWS\system32\drivers\intelaud.sys [2015-12-01 44016]
S3 irda;IrDA; C:\WINDOWS\system32\drivers\irda.sys [2016-07-16 94720]
S3 NetAdapterCx;Network Adapter Wdf Class Extension Library; C:\WINDOWS\system32\drivers\NetAdapterCx.sys [2016-07-16 62976]
S3 UcmTcpciCx0101;UCM-TCPCI KMDF Class Extension; C:\WINDOWS\System32\Drivers\UcmTcpciCx.sys [2016-07-16 76800]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BTDevManager;BTDevManager; C:\Program Files\REALTEK\REALTEK Bluetooth\BTDevMgr.exe [2014-03-12 70144]
R2 CDPUserSvc_403d9;CDPUserSvc_403d9; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
R2 ContoPrnServerSvc;Conto - tiskový server /služba/; C:\Conto\CPrnServerSvc.exe [2016-12-05 7362048]
R2 DptfParticipantProcessorService;@oem8.inf,%WIN32_DPTF_PARTICIPANT_PROC_SERVICE_DISPLAY_NAME%;Intel(R) Dynamic Platform & Thermal Framework Processor Participant Service Application; C:\WINDOWS\system32\DptfParticipantProcessorService.exe [2014-04-05 81720]
R2 DptfPolicyCriticalService;@oem8.inf,%WIN32_DPTF_POLICY_CRITICAL_SERVICE_DISPLAY_NAME%;Intel(R) Dynamic Platform & Thermal Framework Critical Service Application; C:\WINDOWS\system32\DptfPolicyCriticalService.exe [2014-04-05 95544]
R2 DptfPolicyLpmService;@oem8.inf,%WIN32_DPTF_POLICY_LPM_SERVICE_DISPLAY_NAME%;Intel(R) Dynamic Platform & Thermal Framework Low Power Mode Service Application; C:\WINDOWS\system32\DptfPolicyLpmService.exe [2014-04-05 88888]
R2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service; C:\WINDOWS\system32\igfxCUIService.exe [2016-05-03 292832]
R2 LMSvc;Launch Manager Service; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [2014-07-28 461544]
R2 OneSyncSvc_403d9;Hostitel synchronizace_403d9; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
R2 TeamViewer;TeamViewer 12; C:\Program Files\TeamViewer\TeamViewer_Service.exe [2016-12-15 10351856]
R2 TouchToolsLaunchService;Touch Tools Launch Service; C:\Program Files\Acer\Acer Touch Tools\TouchToolsLaunchSvc.exe [2014-01-09 247040]
R3 FontCache3.0.0.0;@%SystemRoot%\system32\PresentationHost.exe,-3309; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2016-05-25 43696]
R3 PimIndexMaintenanceSvc_403d9;Data kontaktů_403d9; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
R3 TimeBrokerSvc;@%windir%\system32\TimeBrokerServer.dll,-1001; %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted;"ServiceDll"=%SystemRoot%\System32\TimeBrokerServer.dll
R3 UnistoreSvc_403d9;Úložiště uživatelských dat_403d9; C:\WINDOWS\System32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
R3 UserDataSvc_403d9;Přístup k uživatelským datům_403d9; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S2 CDPUserSvc;@%SystemRoot%\system32\cdpusersvc.dll,-100; %SystemRoot%\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=%SystemRoot%\System32\CDPUserSvc.dll
S3 FrameServer;@%systemroot%\system32\FrameServer.dll,-100; %SystemRoot%\System32\svchost.exe -k Camera;"ServiceDll"=%SystemRoot%\system32\FrameServer.dll
S3 irmon;@%SystemRoot%\System32\irmon.dll,-2000; %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll"=%SystemRoot%\System32\irmon.dll
S3 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [2015-08-04 132160]
S3 MessagingService_403d9;Služba zasílání zpráv_403d9; C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup;"ServiceDll"=
S3 QASvc;Quick Access Service; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [2014-06-26 451816]
S3 RmSvc;@%SystemRoot%\system32\RMapi.dll,-1001; %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted;"ServiceDll"=%SystemRoot%\System32\RMapi.dll
S3 UEIPSvc;User Experience Improvement Program; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [2014-07-15 234240]
S4 shpamsvc;@%SystemRoot%\System32\Windows.SharedPC.AccountManager.dll,-100; %SystemRoot%\System32\svchost.exe -k netsvcs;"ServiceDll"=%systemroot%\system32\Windows.SharedPC.AccountManager.dll

-----------------EOF-----------------

[Rudy]

Zdravím!
Lituji, ale nejsme bezplatný servis pro firemní PC:

...který je využíván pouze pro jeden pokladní systém...

Viz pravidla: http://forum.viry.cz/viewtopic.php?f=12&t=5601 (bod 6). Zkuste to zde: https://neslape.cz/?utm_campaign=neslap ... ium=banner .

[mobmaniak]

Tohle bych pochopil, pokud bysme byli opravdu firma o 100 zaměstnancích, která má svoje IT oddělení, ale nás je zde 5 a nikdo z nás nedělá IT očividně, každopádně jsem doufal, že mě pomůžete, když Vám po každé radě, která vyřešila můj problem posílám donate, ale viditelně je zde lepší nebýt upřímný a přiložit jen log

[Rudy]

Máme to v pravidlech od doby, kdy jsme byli zneužíváni mnoha dokonce profesionálními ajťáky. Tak se nám nedivte, že jsme nechtěli dělat zadarmo něco, za co jiný slízne smetanu. Budiž, podívám se na to. Spusťte tuto utilitu:

Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.

[mobmaniak]

Já tomu rozumím, ale upřímně mě nenapadlo, že by nějaký člověk placený za IT tohle zneužíval, ale tak každý jsme nějaký koukám.

# AdwCleaner v6.043 - Log vytvořen 23/02/2017 v 11:47:09
# Aktualizováno dne 27/01/2017 z Malwarebytes
# Databáze : 2017-02-23.2 [Server]
# Operační systém : Windows 10 Home (X86)
# Uživatelské jméno : Ji - TABLETSATLAVA
# Spuštěno z : C:\Users\Ji\Downloads\adwcleaner_6.043.exe
# Mod: Čištění
# Podpora : https://www.malwarebytes.com/support



***** [ Služby ] *****



***** [ Složky ] *****



***** [ Soubory ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Zástupci ] *****



***** [ Naplánované úlohy ] *****



***** [ Registry ] *****



***** [ Prohlížeče ] *****



*************************

:: "Tracing" klíče smazány
:: Winsock nastavení vyčištěno

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1610 Bajty] - [11/12/2016 16:45:08]
C:\AdwCleaner\AdwCleaner[C2].txt - [1163 Bajty] - [23/02/2017 08:51:46]
C:\AdwCleaner\AdwCleaner[C3].txt - [1311 Bajty] - [23/02/2017 11:28:05]
C:\AdwCleaner\AdwCleaner[C4].txt - [1012 Bajty] - [23/02/2017 11:47:09]
C:\AdwCleaner\AdwCleaner[S0].txt - [1796 Bajty] - [11/12/2016 16:40:03]
C:\AdwCleaner\AdwCleaner[S1].txt - [1510 Bajty] - [23/02/2017 08:51:36]
C:\AdwCleaner\AdwCleaner[S2].txt - [1658 Bajty] - [23/02/2017 11:27:53]
C:\AdwCleaner\AdwCleaner[S3].txt - [1802 Bajty] - [23/02/2017 11:47:02]

########## EOF - C:\AdwCleaner\AdwCleaner[C4].txt - [1377 Bajty] ##########

[Rudy]

Bohužel, v minulosti se to stalo několikrát. Toto je OK. Dejte log FRST: http://forum.viry.cz/viewtopic.php?f=13&t=133100 . V desítkách nemohu mazat z RSIT, riskuji poškození systému.

[mobmaniak]

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-02-2017
Ran by Ji (administrator) on TABLETSATLAVA (23-02-2017 12:55:54)
Running from C:\Users\Ji\Desktop
Loaded Profiles: Ji (Available Profiles: Ji)
Platform: Microsoft Windows 10 Home Version 1607 (X86) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
() C:\Program Files\REALTEK\REALTEK Bluetooth\BTDevMgr.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe
(CONSULTA BÜROTECHNIK, s.r.o.) C:\Conto\CPrnServerSvc.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Touch Tools\TouchToolsLaunchSvc.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\tv_w32.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMLockHandler.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe
(Realtek Semiconductor) C:\Program Files\REALTEK\Audio\AP\RtkNGUI.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(forum.viry.cz) C:\Users\Ji\Desktop\FRSTLauncher.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [79672 2014-04-05] (Intel Corporation)
HKLM\...\Run: [RtkNGUI] => C:\Program Files\Realtek\Audio\AP\RtkNGUI.exe [4616192 2014-05-07] (Realtek Semiconductor)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [483840 2016-07-16] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{c0626a3f-f775-489b-8ae7-802f9037a6b3}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\S-1-5-21-1649363852-862439970-3261606450-1005\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://new.restauracesatlava.cz/
HKU\S-1-5-21-1649363852-862439970-3261606450-1005\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
SearchScopes: HKU\S-1-5-21-1649363852-862439970-3261606450-1005 -> DefaultScope {0CD3154B-DB93-4C17-993D-FE138CB01228} URL =
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\SiteAdvisor\mcieplg.dll [2015-08-04] (McAfee, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files\McAfee\SiteAdvisor\mcieplg.dll [2015-08-04] (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor\mcieplg.dll [2015-08-04] (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor\mcieplg.dll [2015-08-04] (McAfee, Inc.)

FireFox:
========
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor
FF Extension: (McAfee SiteAdvisor) - C:\Program Files\McAfee\SiteAdvisor [2016-12-09] [not signed]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2015-08-20]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 BTDevManager; C:\Program Files\REALTEK\REALTEK Bluetooth\BTDevMgr.exe [70144 2014-03-12] () [File not signed]
R2 ContoPrnServerSvc; C:\Conto\CPrnServerSvc.exe [7362048 2016-12-05] (CONSULTA BÜROTECHNIK, s.r.o.) [File not signed]
S3 cphs; C:\WINDOWS\system32\IntelCpHeciSvc.exe [299488 2016-05-03] (Intel Corporation)
R2 DptfParticipantProcessorService; C:\WINDOWS\system32\DptfParticipantProcessorService.exe [81720 2014-04-05] (Intel Corporation)
R2 DptfPolicyCriticalService; C:\WINDOWS\system32\DptfPolicyCriticalService.exe [95544 2014-04-05] (Intel Corporation)
R2 DptfPolicyLpmService; C:\WINDOWS\system32\DptfPolicyLpmService.exe [88888 2014-04-05] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [292832 2016-05-03] (Intel Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [461544 2014-07-28] (Acer Incorporate)
S3 McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [132160 2015-08-04] (McAfee, Inc.)
S3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [451816 2014-06-26] (Acer Incorporate)
R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [10351856 2016-12-15] (TeamViewer GmbH)
R2 TouchToolsLaunchService; C:\Program Files\Acer\Acer Touch Tools\TouchToolsLaunchSvc.exe [247040 2014-01-09] (Acer Incorporated)
S3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [234240 2014-07-15] (acer)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [271496 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [84928 2016-07-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthMini; C:\WINDOWS\System32\drivers\BTHMINI.sys [23040 2016-08-20] (Microsoft Corporation)
R3 camera; C:\WINDOWS\system32\DRIVERS\camera.sys [401408 2013-12-30] (Intel Corporation)
R3 CM3218x; C:\WINDOWS\System32\drivers\WUDFRd.sys [161280 2016-07-16] (Microsoft Corporation)
R3 CPLMACPI; C:\WINDOWS\System32\drivers\CPLMACPI.sys [16488 2013-09-08] (Capella Microsystems, Inc.)
S3 DptfDevAmbient; C:\WINDOWS\System32\drivers\DptfDevAmbient.sys [44496 2014-03-19] (Intel Corporation)
S3 DptfDevDBPT; C:\WINDOWS\System32\drivers\DptfDevPower.sys [25552 2014-03-19] (Intel Corporation)
R3 DptfDevDisplay; C:\WINDOWS\System32\drivers\DptfDevDisplay.sys [28112 2014-03-19] (Intel Corporation)
R3 DptfDevGen; C:\WINDOWS\System32\drivers\DptfDevGen.sys [36304 2014-03-19] (Intel Corporation)
R3 DptfDevProc; C:\WINDOWS\System32\drivers\DptfDevProc.sys [80848 2014-03-19] (Intel Corporation)
R3 DptfManager; C:\WINDOWS\System32\drivers\DptfManager.sys [181712 2014-03-19] (Intel Corporation)
R3 GPIO; C:\WINDOWS\System32\drivers\iaiogpioe.sys [23552 2014-03-19] (Intel Corporation)
R3 GpioVirtual; C:\WINDOWS\System32\drivers\iaiogpiovirtual.sys [16896 2014-03-19] (Intel Corporation)
R3 iaioi2c; C:\WINDOWS\System32\drivers\iaioi2ce.sys [58368 2014-03-19] (Intel Corporation)
R3 iaiospi; C:\WINDOWS\System32\drivers\iaiospi.sys [53760 2014-03-19] (Intel Corporation)
R3 iaiouart; C:\WINDOWS\System32\drivers\iaiouart.sys [87552 2014-03-19] (Intel Corporation)
S3 intaud_WaveExtensible; C:\WINDOWS\system32\drivers\intelaud.sys [44016 2015-12-01] (Intel Corporation)
R3 IntelSST; C:\WINDOWS\system32\drivers\isstrtc.sys [254464 2013-12-30] (Intel(R) Corporation)
R3 INVN_MotionApps; C:\WINDOWS\System32\drivers\WUDFRd.sys [161280 2016-07-16] (Microsoft Corporation)
R3 iwdbus; C:\WINDOWS\System32\drivers\iwdbus.sys [35320 2015-12-01] (Intel Corporation)
R0 MBI; C:\WINDOWS\System32\drivers\MBI.sys [21456 2014-03-19] (Intel Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [62976 2016-07-16] ()
R3 ov2722; C:\WINDOWS\System32\drivers\ov2722.sys [43520 2013-12-30] (Intel Corporation)
R3 PMIC; C:\WINDOWS\System32\drivers\PMIC.sys [48128 2014-03-19] (Intel Corporation)
R3 rtii2sac; C:\WINDOWS\system32\DRIVERS\rtii2sac.sys [183000 2014-06-04] (Realtek Semiconductor Corp.)
R3 RtkUart; C:\WINDOWS\System32\drivers\RtkUart.sys [507608 2014-07-11] (Realtek Semiconductor Corporation)
R3 RtlWlans; C:\WINDOWS\System32\drivers\rtwlans.sys [4304384 2016-07-16] (Realtek Semiconductor Corporation )
R3 TXEI; C:\WINDOWS\System32\drivers\TXEI.sys [75792 2014-03-19] (Intel Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [37912 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [244576 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [100192 2016-07-16] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-23 12:55 - 2017-02-23 12:56 - 00010357 _____ C:\Users\Ji\Desktop\FRST.txt
2017-02-23 12:55 - 2017-02-23 12:55 - 00000000 ____D C:\FRST
2017-02-23 12:54 - 2017-02-23 12:54 - 01765376 _____ (Farbar) C:\Users\Ji\Desktop\FRST.exe
2017-02-23 12:54 - 2017-02-23 12:54 - 00112640 _____ (forum.viry.cz) C:\Users\Ji\Desktop\FRSTLauncher.exe
2017-02-23 12:51 - 2017-02-23 12:51 - 00727740 _____ C:\WINDOWS\Minidump\022317-14421-01.dmp
2017-02-23 08:54 - 2017-02-23 08:55 - 00000000 ____D C:\rsit
2017-02-23 08:54 - 2017-02-23 08:55 - 00000000 ____D C:\Program Files\trend micro
2017-02-23 08:54 - 2017-02-23 08:54 - 01201152 _____ C:\Users\Ji\Downloads\RSIT.exe
2017-02-23 08:48 - 2017-02-23 08:48 - 04015056 _____ C:\Users\Ji\Downloads\adwcleaner_6.043.exe
2017-02-22 11:03 - 2017-02-22 11:04 - 55566792 _____ (Malwarebytes ) C:\Users\Ji\Downloads\mb3-setup-consumer-3.0.6.1469.exe
2017-02-10 15:09 - 2017-02-10 15:09 - 00696964 _____ C:\WINDOWS\Minidump\021017-14468-01.dmp
2017-01-25 13:07 - 2016-12-21 05:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-23 12:52 - 2016-12-10 08:00 - 00000000 __SHD C:\Users\Ji\IntelGraphicsProfiles
2017-02-23 12:52 - 2016-12-09 16:39 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-23 12:52 - 2016-12-09 16:14 - 00000000 ____D C:\Users\Ji
2017-02-23 12:52 - 2016-12-09 16:06 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-23 12:51 - 2016-12-11 16:25 - 00000000 ____D C:\WINDOWS\Minidump
2017-02-23 11:51 - 2016-12-09 16:35 - 01959640 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-23 11:51 - 2016-07-16 18:01 - 00693864 _____ C:\WINDOWS\system32\perfh005.dat
2017-02-23 11:51 - 2016-07-16 18:01 - 00163492 _____ C:\WINDOWS\system32\perfc005.dat
2017-02-23 11:47 - 2016-12-11 16:37 - 00000000 ____D C:\AdwCleaner
2017-02-23 11:47 - 2016-07-16 03:22 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-02-23 11:42 - 2016-07-16 09:29 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-23 11:38 - 2015-08-20 16:04 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-02-23 08:43 - 2016-07-16 09:29 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-23 08:36 - 2016-07-16 09:29 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-02-22 10:55 - 2016-11-29 14:01 - 00000000 ____D C:\Users\Ji\AppData\Local\Acer
2017-02-22 10:55 - 2014-11-10 15:19 - 00000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2017-02-22 10:55 - 2014-11-10 15:19 - 00000000 ____D C:\Program Files\Acer
2017-02-22 10:54 - 2016-11-29 14:02 - 00000000 ___RD C:\Users\Ji\OneDrive
2017-02-22 10:53 - 2016-07-16 09:29 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-02-22 10:52 - 2016-07-16 09:19 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-02-22 10:48 - 2016-12-05 09:31 - 00000000 ____D C:\Program Files\TeamViewer
2017-02-06 20:48 - 2016-07-16 09:31 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2017-02-06 20:48 - 2016-07-16 09:31 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======


Some files in TEMP:
====================
2016-12-11 16:36 - 2016-08-15 15:44 - 4964568 _____ (Acer Incorporated) C:\Users\Ji\AppData\Local\Temp\AcerDocsSetup.exe
2016-12-11 16:52 - 2016-09-09 11:02 - 1681624 _____ (Acer Incorporated) C:\Users\Ji\AppData\Local\Temp\AcerPortalSetup.exe
2016-12-02 20:42 - 2016-12-02 20:42 - 2458672 _____ (The OpenSSL Project, http://www.openssl.org/) C:\Users\Ji\AppData\Local\Temp\libeay32.dll
2016-12-02 20:42 - 2016-12-02 20:42 - 0970912 _____ (Microsoft Corporation) C:\Users\Ji\AppData\Local\Temp\msvcr120.dll
2016-12-02 20:42 - 2016-12-02 20:42 - 0772672 _____ () C:\Users\Ji\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Ji\Desktop" je 1 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]


==================== End Of Log ==============================
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-02-2017
Ran by Ji (administrator) on TABLETSATLAVA (23-02-2017 13:11:22)
Running from C:\Users\Ji\Desktop
Loaded Profiles: Ji (Available Profiles: Ji)
Platform: Microsoft Windows 10 Home Version 1607 (X86) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
() C:\Program Files\REALTEK\REALTEK Bluetooth\BTDevMgr.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe
(CONSULTA BÜROTECHNIK, s.r.o.) C:\Conto\CPrnServerSvc.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Touch Tools\TouchToolsLaunchSvc.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\tv_w32.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMLockHandler.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe
(Realtek Semiconductor) C:\Program Files\REALTEK\Audio\AP\RtkNGUI.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(forum.viry.cz) C:\Users\Ji\Desktop\FRSTLauncher.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [79672 2014-04-05] (Intel Corporation)
HKLM\...\Run: [RtkNGUI] => C:\Program Files\Realtek\Audio\AP\RtkNGUI.exe [4616192 2014-05-07] (Realtek Semiconductor)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [483840 2016-07-16] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{c0626a3f-f775-489b-8ae7-802f9037a6b3}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\S-1-5-21-1649363852-862439970-3261606450-1005\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://new.restauracesatlava.cz/
HKU\S-1-5-21-1649363852-862439970-3261606450-1005\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
SearchScopes: HKU\S-1-5-21-1649363852-862439970-3261606450-1005 -> DefaultScope {0CD3154B-DB93-4C17-993D-FE138CB01228} URL =
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\SiteAdvisor\mcieplg.dll [2015-08-04] (McAfee, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files\McAfee\SiteAdvisor\mcieplg.dll [2015-08-04] (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor\mcieplg.dll [2015-08-04] (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor\mcieplg.dll [2015-08-04] (McAfee, Inc.)

FireFox:
========
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor
FF Extension: (McAfee SiteAdvisor) - C:\Program Files\McAfee\SiteAdvisor [2016-12-09] [not signed]

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2015-08-20]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 BTDevManager; C:\Program Files\REALTEK\REALTEK Bluetooth\BTDevMgr.exe [70144 2014-03-12] () [File not signed]
R2 ContoPrnServerSvc; C:\Conto\CPrnServerSvc.exe [7362048 2016-12-05] (CONSULTA BÜROTECHNIK, s.r.o.) [File not signed]
S3 cphs; C:\WINDOWS\system32\IntelCpHeciSvc.exe [299488 2016-05-03] (Intel Corporation)
R2 DptfParticipantProcessorService; C:\WINDOWS\system32\DptfParticipantProcessorService.exe [81720 2014-04-05] (Intel Corporation)
R2 DptfPolicyCriticalService; C:\WINDOWS\system32\DptfPolicyCriticalService.exe [95544 2014-04-05] (Intel Corporation)
R2 DptfPolicyLpmService; C:\WINDOWS\system32\DptfPolicyLpmService.exe [88888 2014-04-05] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [292832 2016-05-03] (Intel Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [461544 2014-07-28] (Acer Incorporate)
S3 McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [132160 2015-08-04] (McAfee, Inc.)
S3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [451816 2014-06-26] (Acer Incorporate)
R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [10351856 2016-12-15] (TeamViewer GmbH)
R2 TouchToolsLaunchService; C:\Program Files\Acer\Acer Touch Tools\TouchToolsLaunchSvc.exe [247040 2014-01-09] (Acer Incorporated)
R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [234240 2014-07-15] (acer)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [271496 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [84928 2016-07-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 BthMini; C:\WINDOWS\System32\drivers\BTHMINI.sys [23040 2016-08-20] (Microsoft Corporation)
R3 camera; C:\WINDOWS\system32\DRIVERS\camera.sys [401408 2013-12-30] (Intel Corporation)
R3 CM3218x; C:\WINDOWS\System32\drivers\WUDFRd.sys [161280 2016-07-16] (Microsoft Corporation)
R3 CPLMACPI; C:\WINDOWS\System32\drivers\CPLMACPI.sys [16488 2013-09-08] (Capella Microsystems, Inc.)
S3 DptfDevAmbient; C:\WINDOWS\System32\drivers\DptfDevAmbient.sys [44496 2014-03-19] (Intel Corporation)
S3 DptfDevDBPT; C:\WINDOWS\System32\drivers\DptfDevPower.sys [25552 2014-03-19] (Intel Corporation)
R3 DptfDevDisplay; C:\WINDOWS\System32\drivers\DptfDevDisplay.sys [28112 2014-03-19] (Intel Corporation)
R3 DptfDevGen; C:\WINDOWS\System32\drivers\DptfDevGen.sys [36304 2014-03-19] (Intel Corporation)
R3 DptfDevProc; C:\WINDOWS\System32\drivers\DptfDevProc.sys [80848 2014-03-19] (Intel Corporation)
R3 DptfManager; C:\WINDOWS\System32\drivers\DptfManager.sys [181712 2014-03-19] (Intel Corporation)
R3 GPIO; C:\WINDOWS\System32\drivers\iaiogpioe.sys [23552 2014-03-19] (Intel Corporation)
R3 GpioVirtual; C:\WINDOWS\System32\drivers\iaiogpiovirtual.sys [16896 2014-03-19] (Intel Corporation)
R3 iaioi2c; C:\WINDOWS\System32\drivers\iaioi2ce.sys [58368 2014-03-19] (Intel Corporation)
R3 iaiospi; C:\WINDOWS\System32\drivers\iaiospi.sys [53760 2014-03-19] (Intel Corporation)
R3 iaiouart; C:\WINDOWS\System32\drivers\iaiouart.sys [87552 2014-03-19] (Intel Corporation)
S3 intaud_WaveExtensible; C:\WINDOWS\system32\drivers\intelaud.sys [44016 2015-12-01] (Intel Corporation)
R3 IntelSST; C:\WINDOWS\system32\drivers\isstrtc.sys [254464 2013-12-30] (Intel(R) Corporation)
R3 INVN_MotionApps; C:\WINDOWS\System32\drivers\WUDFRd.sys [161280 2016-07-16] (Microsoft Corporation)
R3 iwdbus; C:\WINDOWS\System32\drivers\iwdbus.sys [35320 2015-12-01] (Intel Corporation)
R0 MBI; C:\WINDOWS\System32\drivers\MBI.sys [21456 2014-03-19] (Intel Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [62976 2016-07-16] ()
R3 ov2722; C:\WINDOWS\System32\drivers\ov2722.sys [43520 2013-12-30] (Intel Corporation)
R3 PMIC; C:\WINDOWS\System32\drivers\PMIC.sys [48128 2014-03-19] (Intel Corporation)
R3 rtii2sac; C:\WINDOWS\system32\DRIVERS\rtii2sac.sys [183000 2014-06-04] (Realtek Semiconductor Corp.)
R3 RtkUart; C:\WINDOWS\System32\drivers\RtkUart.sys [507608 2014-07-11] (Realtek Semiconductor Corporation)
R3 RtlWlans; C:\WINDOWS\System32\drivers\rtwlans.sys [4304384 2016-07-16] (Realtek Semiconductor Corporation )
R3 TXEI; C:\WINDOWS\System32\drivers\TXEI.sys [75792 2014-03-19] (Intel Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [37912 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [244576 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [100192 2016-07-16] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-23 12:58 - 2017-02-23 12:58 - 00017432 _____ C:\Users\Ji\Desktop\FRST3.txt
2017-02-23 12:55 - 2017-02-23 13:11 - 00010839 _____ C:\Users\Ji\Desktop\FRST.txt
2017-02-23 12:55 - 2017-02-23 13:11 - 00000000 ____D C:\FRST
2017-02-23 12:54 - 2017-02-23 12:54 - 01765376 _____ (Farbar) C:\Users\Ji\Desktop\FRST.exe
2017-02-23 12:54 - 2017-02-23 12:54 - 00112640 _____ (forum.viry.cz) C:\Users\Ji\Desktop\FRSTLauncher.exe
2017-02-23 12:51 - 2017-02-23 12:51 - 00727740 _____ C:\WINDOWS\Minidump\022317-14421-01.dmp
2017-02-23 08:54 - 2017-02-23 08:55 - 00000000 ____D C:\rsit
2017-02-23 08:54 - 2017-02-23 08:55 - 00000000 ____D C:\Program Files\trend micro
2017-02-23 08:54 - 2017-02-23 08:54 - 01201152 _____ C:\Users\Ji\Downloads\RSIT.exe
2017-02-23 08:48 - 2017-02-23 08:48 - 04015056 _____ C:\Users\Ji\Downloads\adwcleaner_6.043.exe
2017-02-22 11:03 - 2017-02-22 11:04 - 55566792 _____ (Malwarebytes ) C:\Users\Ji\Downloads\mb3-setup-consumer-3.0.6.1469.exe
2017-02-10 15:09 - 2017-02-10 15:09 - 00696964 _____ C:\WINDOWS\Minidump\021017-14468-01.dmp
2017-01-25 13:07 - 2016-12-21 05:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-02-23 12:58 - 2016-12-09 16:35 - 01993422 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-23 12:58 - 2016-07-16 18:01 - 00710252 _____ C:\WINDOWS\system32\perfh005.dat
2017-02-23 12:58 - 2016-07-16 18:01 - 00168784 _____ C:\WINDOWS\system32\perfc005.dat
2017-02-23 12:52 - 2016-12-10 08:00 - 00000000 __SHD C:\Users\Ji\IntelGraphicsProfiles
2017-02-23 12:52 - 2016-12-09 16:39 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-23 12:52 - 2016-12-09 16:14 - 00000000 ____D C:\Users\Ji
2017-02-23 12:52 - 2016-12-09 16:06 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-23 12:51 - 2016-12-11 16:25 - 00000000 ____D C:\WINDOWS\Minidump
2017-02-23 11:47 - 2016-12-11 16:37 - 00000000 ____D C:\AdwCleaner
2017-02-23 11:47 - 2016-07-16 03:22 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-02-23 11:42 - 2016-07-16 09:29 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-23 11:38 - 2015-08-20 16:04 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-02-23 08:43 - 2016-07-16 09:29 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-23 08:36 - 2016-07-16 09:29 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-02-22 10:55 - 2016-11-29 14:01 - 00000000 ____D C:\Users\Ji\AppData\Local\Acer
2017-02-22 10:55 - 2014-11-10 15:19 - 00000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2017-02-22 10:55 - 2014-11-10 15:19 - 00000000 ____D C:\Program Files\Acer
2017-02-22 10:54 - 2016-11-29 14:02 - 00000000 ___RD C:\Users\Ji\OneDrive
2017-02-22 10:53 - 2016-07-16 09:29 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-02-22 10:52 - 2016-07-16 09:19 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-02-22 10:48 - 2016-12-05 09:31 - 00000000 ____D C:\Program Files\TeamViewer
2017-02-06 20:48 - 2016-07-16 09:31 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2017-02-06 20:48 - 2016-07-16 09:31 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======


Some files in TEMP:
====================
2016-12-11 16:36 - 2016-08-15 15:44 - 4964568 _____ (Acer Incorporated) C:\Users\Ji\AppData\Local\Temp\AcerDocsSetup.exe
2016-12-11 16:52 - 2016-09-09 11:02 - 1681624 _____ (Acer Incorporated) C:\Users\Ji\AppData\Local\Temp\AcerPortalSetup.exe
2016-12-02 20:42 - 2016-12-02 20:42 - 2458672 _____ (The OpenSSL Project, http://www.openssl.org/) C:\Users\Ji\AppData\Local\Temp\libeay32.dll
2016-12-02 20:42 - 2016-12-02 20:42 - 0970912 _____ (Microsoft Corporation) C:\Users\Ji\AppData\Local\Temp\msvcr120.dll
2016-12-02 20:42 - 2016-12-02 20:42 - 0772672 _____ () C:\Users\Ji\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\Ji\Desktop" je 1 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
DisableNotifications REG_DWORD 0x0
EnableFirewall REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]


==================== End Of Log ==============================

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

Start
SearchScopes: HKU\S-1-5-21-1649363852-862439970-3261606450-1005 -> DefaultScope {0CD3154B-DB93-4C17-993D-FE138CB01228} URL =
C:\Users\Ji\AppData\Local\Temp

EmptyTemp:
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

[mobmaniak]

Udělal jsem fix dle instrukcí, ale poté se pc restartovalo a log jsem vzal z plochy, snad je to správně, vypadá to i dle času
Fix result of Farbar Recovery Scan Tool (x86) Version: 23-02-2017
Ran by Ji (23-02-2017 13:37:48) Run:1
Running from C:\Users\Ji\Desktop
Loaded Profiles: Ji (Available Profiles: Ji)
Boot Mode: Normal

==============================================

fixlist content:
*****************
Start
SearchScopes: HKU\S-1-5-21-1649363852-862439970-3261606450-1005 -> DefaultScope {0CD3154B-DB93-4C17-993D-FE138CB01228} URL =
C:\Users\Ji\AppData\Local\Temp

EmptyTemp:
End
*****************

HKU\S-1-5-21-1649363852-862439970-3261606450-1005\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully.
C:\Users\Ji\AppData\Local\Temp => moved successfully

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 23350025 B
Java, Flash, Steam htmlcache => 971 B
Windows/system/drivers => 13378530 B
Edge => 21709236 B
Chrome => 0 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 128 B
LocalService => 2356 B
NetworkService => 0 B
Ji => 2558434 B

RecycleBin => 0 B
EmptyTemp: => 58.2 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 13:38:01 ====

[Rudy]

OK. Nastala nějaká změna?