Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

nova.rambler.ru a další pop up malware či co

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
martwer
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 12 dub 2017 16:26

nova.rambler.ru a další pop up malware či co

#1 Příspěvek od martwer »

Dobrý den

Posledních pár měsíců se mi čas od času samovolně otevřel v Chrome nový tab se všemožnými stránkami od loterie po porno.
Teď jsem se rozhodl konečně to odstranit, ale zamotal jsem se do toho ještě víc. Především se mi teď vyhledávání v googlu okamžitě přepíná do nova.rambler.ru + občas další pop-up taby s dalšími stránkámi.
Už jsem toho zkusil dost, ale nedaří se mi odstranit. (Určitě to není v prohlížeči, avg už nic nenajde, malwarebytes rovněž ne)

Měli byste prosím nějaký nápad?
Děkuji moc.

RSIT log zde:

Logfile of random's system information tool 1.10 (written by random/random)
Run by MARTIN at 2017-04-12 20:31:47
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 51 GB (22%) free of 229 GB
Total RAM: 32596 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:31:50, on 12/04/2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18618)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
C:\Program Files\trend micro\MARTIN.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={BEAD2656 ... 2016-01-13 18:43:31&v=4.3.7.452&pid=wtu&sg=&sap=hp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll
O2 - BHO: AVG Web TuneUp - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Web TuneUp\4.3.7.452\AVG Web TuneUp.dll
O2 - BHO: Adobe Acrobat Create PDF Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AvgUi] "C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe" /lps=fmw
O4 - HKLM\..\Run: [vProt] "C:\Program Files (x86)\AVG Web TuneUp\vprot.exe"
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe" /lps=av
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [uTorrent] "C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: adaware antivirus service (adawareantivirusservice) - Unknown owner - C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareService.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Genuine Software Integrity Service (AGSService) - Adobe Systems, Incorporated - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: AvgAMPS - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgamps.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgfwsa.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgidsagenta.exe
O23 - Service: AVG Service (avgsvc) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgwdsvca.exe
O23 - Service: Bluetooth Device Monitor - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Disc Soft Bus Service - Disc Soft Ltd - C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) - AVG Technologies - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: vToolbarUpdater40.3.7 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.3.7\ToolbarUpdater.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Wacom Professional Service (WTabletServicePro) - Wacom Technology, Corp. - C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
O23 - Service: WtuSystemSupport - Unknown owner - C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--
End of file - 14774 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe"
"C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe"
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files\Tablet\Wacom\WTabletServicePro.exe"
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe 45232576
\??\C:\Windows\system32\conhost.exe "16710704331679871228-193866707711982008641067092195-659127148-301877953-1434724327
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareService.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe"
taskeng.exe {FF202DD6-3CB3-4754-9258-15831CCA8FEE}
"C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe"
"C:\Program Files\GridinSoft Anti-Malware\gsam.exe" -startupscan -startupusbscan
"C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe"
"C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
"C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareTray.exe"
"C:\Program Files (x86)\AVG\Av\avgfwsa.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
"C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe"
"C:\Program Files (x86)\AVG\Av\avgidsagenta.exe"
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe"
"C:\Program Files (x86)\Winamp\winampa.exe"
C:\Program Files (x86)\AVG\Av\avgcsrva.exe /pipeName=44800c66-0200-0000-0fe0-c32a1944464a /binaryPath="C:\Program Files (x86)\AVG\Av\\" /logPath=C:\Windows\system32\config\systemprofile\AppData\Local\Avg\log\av16 /logCfgPath=C:\ProgramData\Avg\log\av16
"C:\Program Files (x86)\AVG Web TuneUp\vprot.exe"
/fmw.trayonly
/TRAYONLY
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\AVG\Av\avgwdsvca.exe"
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\Intel\WiFi\bin\EvtEng.exe"
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.3.7\ToolbarUpdater.exe"
"C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe"
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\AVG\Av\avgnsa.exe"
"C:\Program Files (x86)\AVG\Av\avgemca.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe" uTorrent_2776_00B74D10_1771688888 µTorrent4823DF041B09 uTorrent
"C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe" uTorrent_2776_00B74E40_1549723392 µTorrent4823DF041B09 uTorrent
"C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-59c461f2-2fea-4da9-baa6-cfe523ca98ea -SystemEventPortName:HostProcess-196a42c8-5063-45d5-b232-17260ec36c5f -IoCancelEventPortName:HostProcess-0bfb10f3-2778-40d1-854c-6cae4666d119 -NonStateChangingEventPortName:HostProcess-b83f6a50-f1e3-4f0d-83ee-6bfccbca5b6a -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:7d1d2346-97de-41f4-b794-96eab50c807e -DeviceGroupId:
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe"
"C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe"
C:\Program Files (x86)\AVG\Av\avgrsa.exe
"C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe"
"C:\Program Files\Tablet\Wacom\WacomHost.exe" "C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe" au
"C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe"
"C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe" au
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
C:\Windows\system32\wbem\unsecapp.exe -Embedding
ctfmon.exe
"C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareDesktop.exe"
"C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\QtWebEngineProcess.exe" --type=renderer --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --no-sandbox --use-gl=desktop --primordial-pipe-token=5C1C33A447196117F85B605819C5E790 --lang=en-GB --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --mojo-channel-token=6E2A89B566AD91535FC254A961E6A825 --mojo-application-channel-token=5C1C33A447196117F85B605819C5E790 --channel="8840.2.447076038\557465016" --mojo-platform-channel-handle=4032 /prefetch:1
"C:\totalcmd\TOTALCMD64.EXE"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe"
"C:\Windows\system32\wuauclt.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 "--database=C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=57.0.2987.133 --initial-client-data=0x9c,0xa0,0xa4,0x98,0xa8,0x6c257dc8,0x6c257dbc,0x6c257dd4
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=10016 --on-initialized-event-handle=320 --parent-handle=332 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1140 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,74 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x10de --gpu-device-id=0x1184 --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.4411 --gpu-driver-date=9-13-2014 --service-request-channel-token=219DA238448CD89FC4D8E62A3B3C026B --mojo-platform-channel-handle=1176 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1140 --primordial-pipe-token=68B1E070EF45B2819A558B8BD336799D --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=68B1E070EF45B2819A558B8BD336799D --renderer-client-id=4 --mojo-platform-channel-handle=2312 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1140 --primordial-pipe-token=FCEFAB00CEBE1F93BB026FCA72550F5C --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=FCEFAB00CEBE1F93BB026FCA72550F5C --renderer-client-id=5 --mojo-platform-channel-handle=2448 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1140 --primordial-pipe-token=9D64F97104DB45D41607DDF6D8E9F705 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=9D64F97104DB45D41607DDF6D8E9F705 --renderer-client-id=8 --mojo-platform-channel-handle=4672 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1140 --primordial-pipe-token=663565F67357A8BE89D946075C00E4B4 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=663565F67357A8BE89D946075C00E4B4 --renderer-client-id=19 --mojo-platform-channel-handle=6396 /prefetch:1
"C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1140 --primordial-pipe-token=ED344D900F6F3D99AAF61195459BF8A7 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=ED344D900F6F3D99AAF61195459BF8A7 --renderer-client-id=23 --mojo-platform-channel-handle=4568 /prefetch:1
"C:\Program Files (x86)\Skype\Phone\Skype.exe"
"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"

"D:\DOWNLOADS\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineCore1d042d516e1552b.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskMachineUA1d001e6f2de5b17.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskMachineUA1d042d516fc576e.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe Acrobat Create PDF Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08 163720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2010-01-16 688528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
Adobe Acrobat Create PDF from Selection - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08 163720]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-07-13 461888]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
AVG Web TuneUp - C:\Program Files (x86)\AVG Web TuneUp\4.3.7.452\AVG Web TuneUp.dll [2017-02-25 2261576]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe Acrobat Create PDF Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08 141192]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-01-16 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-07-13 173120]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
Adobe Acrobat Create PDF from Selection - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08 141192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe Acrobat Create PDF Toolbar - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08 163720]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe Acrobat Create PDF Toolbar - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08 141192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BLEServicesCtrl"=C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [2013-11-13 184632]
"BTMTrayAgent"=C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [2013-11-07 7818552]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-08-05 508240]
"Autodesk Sync"=C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [2012-02-06 415680]
"Malwarebytes TrayApp"=C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2017-01-20 2780112]
"AdAwareTray"=C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareTray.exe [2017-02-21 4461016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"uTorrent"=C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe [2017-04-06 2144448]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-11-16 8591272]
"AdobeBridge"= []
"DAEMON Tools Pro Agent"=C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [2014-11-10 3761424]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2014-06-27 292848]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-01-21 91520]
""= []
"WinampAgent"=C:\Program Files (x86)\Winamp\winampa.exe [2010-06-29 74752]
"AvgUi"=C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [2016-12-06 240400]
"vProt"=C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [2017-02-25 2183752]
"AVG_UI"=C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [2016-12-06 240400]
"AdobeCS6ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2016-05-20 595992]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk - C:\Windows\Installer\{DAB265AD-27B2-4651-B8D8-F4F3A8ECC705}\LcdctrlDdcci.exe1_A2457035AC9A449AAFF91D310EF3707A.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\adawareantivirusservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\adawareantivirusservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
""=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveTypeAutoRun"=28

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-04-12 18:39:20 ----D---- C:\Users\MARTIN\AppData\Roaming\adaware
2017-04-12 18:38:28 ----D---- C:\Program Files\adaware
2017-04-12 18:38:05 ----D---- C:\Program Files\Common Files\adaware
2017-04-12 18:37:26 ----D---- C:\ProgramData\adaware
2017-04-12 17:39:33 ----D---- C:\ProgramData\GridinSoft
2017-04-12 17:39:31 ----D---- C:\Program Files\GridinSoft Anti-Malware
2017-04-12 17:34:32 ----A---- C:\Windows\system32\drivers\MBAMChameleon.sys
2017-04-12 17:34:29 ----A---- C:\Windows\system32\drivers\mwac.sys
2017-04-12 17:34:29 ----A---- C:\Windows\system32\drivers\farflt.sys
2017-04-12 17:34:25 ----A---- C:\Windows\system32\drivers\mbam.sys
2017-04-12 17:34:20 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2017-04-12 17:34:14 ----A---- C:\Windows\system32\drivers\mbae64.sys
2017-04-12 17:34:04 ----D---- C:\Program Files\Malwarebytes
2017-04-12 17:32:51 ----D---- C:\ProgramData\HitmanPro
2017-04-12 17:21:50 ----D---- C:\rsit
2017-04-12 17:21:50 ----D---- C:\Program Files\trend micro
2017-04-07 23:27:56 ----D---- C:\ProgramData\Malwarebytes
2017-04-07 23:27:56 ----D---- C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-03-25 18:45:57 ----D---- C:\Users\MARTIN\AppData\Roaming\Steam
2017-03-25 18:31:29 ----D---- C:\Program Files (x86)\Age of Empires II HD The African Kingdoms
2017-03-23 21:20:02 ----A---- C:\Windows\system32\drivers\gtkdrv.sys
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\inseng.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\iertutil.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\iernonce.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-03-14 19:24:47 ----A---- C:\Windows\system32\ie4uinit.exe
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\urlmon.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\occache.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-03-14 19:24:46 ----A---- C:\Windows\system32\msfeeds.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\iesetup.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\iedkcs32.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\dxtrans.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-03-14 19:24:45 ----A---- C:\Windows\system32\vbscript.dll
2017-03-14 19:24:45 ----A---- C:\Windows\system32\jsproxy.dll
2017-03-14 19:24:45 ----A---- C:\Windows\system32\ieUnatt.exe
2017-03-14 19:24:45 ----A---- C:\Windows\system32\ieapfltr.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\webcheck.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\mshtmled.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\jscript.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\ieui.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\ieframe.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\dxtmsft.dll
2017-03-14 19:24:43 ----A---- C:\Windows\system32\wininet.dll
2017-03-14 19:24:43 ----A---- C:\Windows\system32\msrating.dll
2017-03-14 19:24:43 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-03-14 19:24:43 ----A---- C:\Windows\system32\jscript9diag.dll
2017-03-14 19:24:43 ----A---- C:\Windows\system32\jscript9.dll
2017-03-14 19:24:42 ----A---- C:\Windows\system32\win32k.sys
2017-03-14 19:24:42 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-03-14 19:24:42 ----A---- C:\Windows\system32\mshtml.dll
2017-03-14 19:24:41 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-03-14 19:24:41 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-03-14 19:24:41 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\schannel.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\rpcrt4.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\ntdll.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\msxml3.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\lsasrv.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\kerberos.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\DWrite.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\advapi32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\usp10.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\wow64win.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\wow64.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\winsrv.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\wdigest.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\usp10.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\TSpkg.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\srcore.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\rpchttp.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\quartz.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\ncrypt.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\msv1_0.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\mscms.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\KernelBase.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\kernel32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\inetcomm.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\icm32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\gdi32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\FntCache.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\srv.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\appid.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\csrsrv.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\conhost.exe
2017-03-14 19:24:40 ----A---- C:\Windows\system32\certcli.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\bcrypt.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\appidsvc.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-03-14 19:24:40 ----A---- C:\Windows\system32\appidapi.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\adtschema.dll
2017-03-14 19:24:40 ----A---- C:\Windows\HelpPane.exe
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\WcsPlugInService.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\user.exe
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\mscms.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\INETRES.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\icm32.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\wow64cpu.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\WcsPlugInService.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\sspisrv.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\sspicli.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\srclient.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\smss.exe
2017-03-14 19:24:39 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\secur32.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\rstrui.exe
2017-03-14 19:24:39 ----A---- C:\Windows\system32\ntvdm64.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\msxml3r.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\msobjs.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\msaudite.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\lsass.exe
2017-03-14 19:24:39 ----A---- C:\Windows\system32\INETRES.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-03-14 19:24:39 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-03-14 19:24:39 ----A---- C:\Windows\system32\cryptbase.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\credssp.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\auditpol.exe
2017-03-14 19:24:39 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-03-14 19:24:39 ----A---- C:\Windows\system32\apisetschema.dll
2017-03-14 19:20:17 ----A---- C:\Windows\system32\appraiser.dll
2017-03-14 19:20:17 ----A---- C:\Windows\system32\aepic.dll
2017-03-14 19:20:17 ----A---- C:\Windows\system32\aeinv.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\invagent.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\generaltel.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\devinv.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\CompatTelRunner.exe
2017-03-14 19:20:16 ----A---- C:\Windows\system32\centel.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\acmigration.dll

======List of files/folders modified in the last 1 month======

2017-04-12 20:30:03 ----D---- C:\Users\MARTIN\AppData\Roaming\uTorrent
2017-04-12 20:29:24 ----D---- C:\Windows\Temp
2017-04-12 20:29:08 ----D---- C:\ProgramData\MFAData
2017-04-12 20:29:00 ----D---- C:\Users\MARTIN\AppData\Roaming\Skype
2017-04-12 19:04:44 ----D---- C:\Windows\system32\config
2017-04-12 18:54:39 ----D---- C:\Windows\System32
2017-04-12 18:54:39 ----D---- C:\Windows\inf
2017-04-12 18:54:39 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-04-12 18:52:28 ----RD---- C:\Program Files
2017-04-12 18:50:50 ----D---- C:\Windows\system32\drivers
2017-04-12 18:48:31 ----D---- C:\Windows\system32\Tasks
2017-04-12 18:48:14 ----D---- C:\Windows
2017-04-12 18:48:14 ----D---- C:\ProgramData\NVIDIA
2017-04-12 18:48:11 ----HD---- C:\ProgramData
2017-04-12 18:46:29 ----SHD---- C:\System Volume Information
2017-04-12 18:46:23 ----SHD---- C:\Windows\Installer
2017-04-12 18:38:05 ----D---- C:\Program Files\Common Files
2017-04-12 17:41:17 ----D---- C:\Windows\system32\catroot2
2017-04-12 17:41:02 ----D---- C:\Windows\winsxs
2017-04-12 16:15:24 ----D---- C:\Users\MARTIN\AppData\Roaming\DAEMON Tools Pro
2017-04-10 16:15:23 ----D---- C:\Users\MARTIN\AppData\Roaming\vlc
2017-04-10 12:19:50 ----D---- C:\Program Files\WinRAR
2017-04-07 23:39:28 ----D---- C:\Windows\Prefetch
2017-04-07 23:27:56 ----RD---- C:\Program Files (x86)
2017-03-26 19:59:16 ----SD---- C:\Users\MARTIN\AppData\Roaming\Microsoft
2017-03-26 16:05:17 ----D---- C:\Windows\SysWOW64
2017-03-25 14:12:21 ----D---- C:\Windows\SoftwareDistribution
2017-03-17 22:35:15 ----D---- C:\Windows\debug
2017-03-16 15:37:20 ----RSD---- C:\Windows\Fonts
2017-03-15 00:40:56 ----SD---- C:\Windows\system32\CompatTel
2017-03-15 00:40:56 ----D---- C:\Windows\SYSWOW64\migration
2017-03-15 00:40:56 ----D---- C:\Windows\SYSWOW64\es-ES
2017-03-15 00:40:56 ----D---- C:\Windows\SYSWOW64\en-US
2017-03-15 00:40:56 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-03-15 00:40:56 ----D---- C:\Windows\system32\migration
2017-03-15 00:40:56 ----D---- C:\Windows\system32\es-ES
2017-03-15 00:40:56 ----D---- C:\Windows\system32\en-US
2017-03-15 00:40:56 ----D---- C:\Windows\system32\cs-CZ
2017-03-15 00:40:56 ----D---- C:\Windows\system32\Boot
2017-03-15 00:40:56 ----D---- C:\Windows\system32\appraiser
2017-03-15 00:40:56 ----D---- C:\Windows\AppPatch
2017-03-15 00:40:56 ----D---- C:\Program Files\Internet Explorer
2017-03-15 00:40:56 ----D---- C:\Program Files\DVD Maker
2017-03-15 00:40:56 ----D---- C:\Program Files (x86)\Internet Explorer
2017-03-14 23:50:27 ----D---- C:\Windows\system32\MRT
2017-03-14 23:49:30 ----AC---- C:\Windows\system32\MRT.exe
2017-03-14 23:48:35 ----D---- C:\Program Files\Microsoft Silverlight
2017-03-14 23:48:35 ----D---- C:\Program Files (x86)\Microsoft Silverlight

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHA;AVGIDSHA; C:\Windows\system32\DRIVERS\avgidsha.sys [2016-10-05 267008]
R0 Avgloga;AVG Logging Driver; C:\Windows\system32\DRIVERS\avgloga.sys [2016-02-16 360736]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx64.sys [2016-09-26 254208]
R0 Avgrkx64;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx64.sys [2016-06-01 52992]
R0 avguniva;AVG Universal Driver; C:\Windows\system32\DRIVERS\avguniva.sys [2016-06-20 77056]
R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2014-06-27 20464]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 Avgdiska;AVG Disk Driver; C:\Windows\system32\DRIVERS\avgdiska.sys [2016-05-13 163072]
R1 Avgfwfd;AVG network filter service; C:\Windows\system32\DRIVERS\avgfwd6a.sys [2016-10-23 73992]
R1 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\avgidsdrivera.sys [2017-02-20 313088]
R1 Avgldx64;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx64.sys [2016-11-30 298240]
R1 Avgtdia;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdia.sys [2016-07-27 299264]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2015-07-30 186784]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 dtscsibus;DAEMON Tools Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtscsibus.sys [2016-11-17 29864]
R3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D; C:\Windows\system32\DRIVERS\e1d62x64.sys [2014-03-14 487704]
R3 gzflt;gzflt; C:\Windows\system32\DRIVERS\gzflt.sys [2017-02-08 178384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2015-06-18 4496600]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2014-06-27 383472]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2014-06-27 795120]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [2017-04-12 251832]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2014-06-24 125952]
R3 NETwNs64;___ Ovladač adaptéru Intel(R) Wireless pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETwsw02.sys [2013-08-15 3586528]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2014-09-17 197408]
R3 Trufos;Trufos; C:\Windows\system32\DRIVERS\Trufos.sys [2017-02-08 442848]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
R3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2015-07-30 264040]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2014-10-24 25640]
S3 hidkmdf;KMDF Driver; C:\Windows\system32\DRIVERS\hidkmdf.sys [2014-10-25 14136]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TrojanKillerDriver;GridinSoft Trojan Killer Driver; C:\Windows\system32\DRIVERS\gtkdrv.sys [2017-03-23 29456]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WacHidRouter;Wacom Hid Router; C:\Windows\system32\DRIVERS\wachidrouter.sys [2014-10-25 100664]
S3 wacomrouterfilter;Wacom Router Filter Driver; C:\Windows\system32\DRIVERS\wacomrouterfilter.sys [2014-10-25 15160]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 adawareantivirusservice;adaware antivirus service; C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareService.exe [2017-02-21 585784]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-05-08 65432]
R2 AGSService;Adobe Genuine Software Integrity Service; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2017-02-27 2227312]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-01-31 19232]
R2 avgfws;AVG Firewall; C:\Program Files (x86)\AVG\Av\avgfwsa.exe [2017-03-23 1824184]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [2017-03-23 5334432]
R2 avgsvc;AVG Service; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [2016-12-06 1146128]
R2 avgwd;AVG WatchDog; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [2017-03-23 729048]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2013-11-07 1186168]
R2 Bluetooth Media Service;Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2013-11-21 1689976]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2013-11-07 1161592]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2015-10-09 2505472]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2013-08-06 626416]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2014-03-11 260360]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2014-06-24 154584]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2014-06-24 405976]
R2 MBAMService;Malwarebytes Service; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [2017-01-20 4355024]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2014-09-13 934216]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2013-08-06 149744]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-09-13 411968]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 vToolbarUpdater40.3.7;vToolbarUpdater40.3.7; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.3.7\ToolbarUpdater.exe [2017-02-25 1354312]
R3 Disc Soft Bus Service;Disc Soft Bus Service; C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe [2014-11-10 2216208]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2016-11-29 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2016-11-29 125112]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-05 144200]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-03-23 327808]
S2 TuneUp.UtilitiesSvc;AVG PC TuneUp Service; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2015-08-04 2973400]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 AvgAMPS;AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [2017-03-23 1002552]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-11-01 1432400]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-05 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-04 114688]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2014-05-13 887256]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-03-10 147400]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2013-08-06 273136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-11-01 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2016-11-29 51384]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2016-11-29 135848]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2016-11-29 135848]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2016-11-29 135848]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119359
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: nova.rambler.ru a další pop up malware či co

#2 Příspěvek od Rudy »

Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
martwer
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 12 dub 2017 16:26

Re: nova.rambler.ru a další pop up malware či co

#3 Příspěvek od martwer »

Díky za rychlou odpověď!

log zde:

# AdwCleaner v6.045 - Log vytvořen 12/04/2017 v 21:22:49
# Aktualizováno dne 28/03/2017 z Malwarebytes
# Databáze : 2017-04-11.1 [Server]
# Operační systém : Windows 7 Professional Service Pack 1 (X64)
# Uživatelské jméno : MARTIN - MARTWEHR
# Spuštěno z : D:\DOWNLOADS\adwcleaner_6.045.exe
# Mod: Čištění
# Podpora : https://www.malwarebytes.com/support



***** [ Služby ] *****

[-] Služba smazána: vToolbarUpdater40.3.7
[-] Služba smazána: WtuSystemSupport
[-] Služba smazána: SpyHunter 4 Service
[-] Služba smazána: EsgScanner


***** [ Složky ] *****

[-] Složka smazána: C:\ProgramData\Avg_Update_0116avi
[-] Složka smazána: C:\Users\MARTIN\AppData\Local\avg web tuneup
[-] Složka smazána: C:\Users\MARTIN\Downloads\Reimage
[#] Složka smazána po restartu: C:\Users\MARTIN\Downloads\reimage
[-] Složka smazána: C:\Users\MARTIN\AppData\Roaming\Enigma Software Group
[-] Složka smazána: C:\Program Files\Enigma Software Group
[-] Složka smazána: C:\Program Files\Common Files\AVG Secure Search
[-] Složka smazána: C:\sh4ldr
[-] Složka smazána: C:\ProgramData\AVG Secure Search
[-] Složka smazána: C:\ProgramData\AVG Security Toolbar
[-] Složka smazána: C:\ProgramData\avg web tuneup
[#] Složka smazána po restartu: C:\ProgramData\Application Data\AVG Secure Search
[#] Složka smazána po restartu: C:\ProgramData\Application Data\AVG Security Toolbar
[#] Složka smazána po restartu: C:\ProgramData\Application Data\avg web tuneup
[-] Složka smazána: C:\Program Files (x86)\avg web tuneup
[-] Složka smazána: C:\Program Files (x86)\Common Files\AVG Secure Search


***** [ Soubory ] *****

[-] Soubor smazán: C:\Users\MARTIN\Desktop\SpyHunter.lnk
[-] Soubor smazán: C:\Windows\SysNative\drivers\EsgScanner.sys


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Zástupci ] *****

[-] Zástupce vyléčen: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
[-] Zástupce vyléčen: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Age of Empires II HD The African Kingdoms\Age of Empires II HD The African Kingdoms.lnk
[-] Zástupce vyléčen: C:\Users\MARTIN\Desktop\Launcher – zástupce.lnk
[-] Zástupce vyléčen: C:\Users\MARTIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[-] Zástupce vyléčen: C:\Users\MARTIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
[-] Zástupce vyléčen: C:\Users\MARTIN\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[-] Zástupce vyléčen: C:\Users\MARTIN\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[-] Zástupce vyléčen: C:\Users\MARTIN\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Internet Explorer.lnk


***** [ Naplánované úlohy ] *****

[-] Úloha smazána: {18FAA19E-7D52-4D48-8815-36ACB44F0624}
[-] Úloha smazána: SpyHunter4Startup


***** [ Registry ] *****

[-] Klíč smazán: HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd
[-] Klíč smazán: HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd.1
[-] Klíč smazán: HKLM\SOFTWARE\Classes\ScriptHelper.NativeApi
[-] Klíč smazán: HKLM\SOFTWARE\Classes\ScriptHelper.NativeApi.1
[-] Klíč smazán: HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
[-] Klíč smazán: HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
[-] Klíč smazán: HKLM\SOFTWARE\Classes\WtuServer.WtuServerObj
[-] Klíč smazán: HKLM\SOFTWARE\Classes\WtuServer.WtuServerObj.1
[#] Klíč smazán po restartu: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd
[#] Klíč smazán po restartu: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd.1
[#] Klíč smazán po restartu: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.NativeApi
[#] Klíč smazán po restartu: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.NativeApi.1
[#] Klíč smazán po restartu: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
[#] Klíč smazán po restartu: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
[#] Klíč smazán po restartu: [x64] HKLM\SOFTWARE\Classes\WtuServer.WtuServerObj
[#] Klíč smazán po restartu: [x64] HKLM\SOFTWARE\Classes\WtuServer.WtuServerObj.1
[-] Klíč smazán: HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
[-] Klíč smazán: HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Klíč smazán: HKLM\SOFTWARE\Classes\CLSID\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Klíč smazán: HKLM\SOFTWARE\Classes\CLSID\{CA3A5461-96B5-46DD-9341-5350D3C94615}
[-] Klíč smazán: HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
[-] Klíč smazán: HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
[-] Klíč smazán: HKLM\SOFTWARE\Classes\TypeLib\{4BC8AD89-AC5F-4DBD-A38F-C355C7DD33D7}
[-] Klíč smazán: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Klíč smazán: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Klíč smazán: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Klíč smazán: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Klíč smazán: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Klíč smazán: HKLM\SOFTWARE\AVG Tuneup
[-] Klíč smazán: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyHunter
[-] Klíč smazán: [x64] HKLM\SOFTWARE\EnigmaSoftwareGroup
[-] Data obnovena: HKU\S-1-5-21-562087197-3438250226-4212528524-1000\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Data obnovena: HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Data obnovena: [x64] HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Klíč smazán: HKU\S-1-5-21-562087197-3438250226-4212528524-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Data obnovena: HKU\S-1-5-21-562087197-3438250226-4212528524-1000\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[#] Klíč smazán po restartu: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Data obnovena: HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[#] Klíč smazán po restartu: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Data obnovena: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DefaultScope] {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[-] Hodnota smazána: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
[-] Klíč smazán: HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh
[-] Klíč smazán: HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin


***** [ Prohlížeče ] *****



*************************

:: "Tracing" klíče smazány
:: Winsock nastavení vyčištěno

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [2710 Bajty] - [13/12/2015 13:33:47]
C:\AdwCleaner\AdwCleaner[C2].txt - [7405 Bajty] - [12/04/2017 21:22:49]
C:\AdwCleaner\AdwCleaner[S1].txt - [2643 Bajty] - [13/12/2015 13:32:04]
C:\AdwCleaner\AdwCleaner[S2].txt - [8385 Bajty] - [12/04/2017 21:22:04]

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [7624 Bajty] ##########
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119359
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: nova.rambler.ru a další pop up malware či co

#4 Příspěvek od Rudy »

Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
martwer
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 12 dub 2017 16:26

Re: nova.rambler.ru a další pop up malware či co

#5 Příspěvek od martwer »

Logfile of random's system information tool 1.10 (written by random/random)
Run by MARTIN at 2017-04-12 22:09:32
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 49 GB (22%) free of 229 GB
Total RAM: 32596 MB (88% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:09:34, on 12/04/2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18618)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\trend micro\MARTIN.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll
O2 - BHO: Adobe Acrobat Create PDF Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AvgUi] "C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe" /lps=fmw
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe" /lps=av
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [uTorrent] "C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: adaware antivirus service (adawareantivirusservice) - Unknown owner - C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareService.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Genuine Software Integrity Service (AGSService) - Adobe Systems, Incorporated - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: AvgAMPS - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgamps.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgfwsa.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgidsagenta.exe
O23 - Service: AVG Service (avgsvc) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgwdsvca.exe
O23 - Service: Bluetooth Device Monitor - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Disc Soft Bus Service - Disc Soft Ltd - C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) - AVG Technologies - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Wacom Professional Service (WTabletServicePro) - Wacom Technology, Corp. - C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--
End of file - 13523 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe"
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files\Tablet\Wacom\WTabletServicePro.exe"
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\WLANExt.exe 49658512
\??\C:\Windows\system32\conhost.exe "-5143586347668161141437589199-358778463-147355133-1268414476-1980818276-1239893248
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareService.exe"
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe"
"C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe"
"C:\Program Files (x86)\AVG\Av\avgfwsa.exe"
"C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe"
"C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
"C:\Program Files (x86)\AVG\Av\avgidsagenta.exe"
"C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareTray.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe"
"C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
C:\Program Files (x86)\AVG\Av\avgcsrva.exe /pipeName=44800c66-0200-0000-fca6-4614daea0d7f /binaryPath="C:\Program Files (x86)\AVG\Av\\" /logPath=C:\Windows\system32\config\systemprofile\AppData\Local\Avg\log\av16 /logCfgPath=C:\ProgramData\Avg\log\av16
"C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe"
"C:\Windows\system32\NOTEPAD.EXE" C:\AdwCleaner\AdwCleaner[C3].txt
"C:\Program Files (x86)\AVG\Av\avgwdsvca.exe"
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\Intel\WiFi\bin\EvtEng.exe"
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe"
"C:\Program Files (x86)\Winamp\winampa.exe"
/fmw.trayonly
C:\Windows\system32\svchost.exe -k imgsvc
/TRAYONLY
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\AVG\Av\avgnsa.exe"
"C:\Program Files (x86)\AVG\Av\avgemca.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe" uTorrent_2764_00331FC0_1671120124 µTorrent4823DF041B09 uTorrent
"C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe" uTorrent_2764_00331E90_38152 µTorrent4823DF041B09 uTorrent
"C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-f0980944-8b47-4388-9011-fab09f500d52 -SystemEventPortName:HostProcess-c855d8e5-99d7-411e-bd0d-7428c0574953 -IoCancelEventPortName:HostProcess-8549d390-2a85-4f46-86f5-b6073a426cdf -NonStateChangingEventPortName:HostProcess-701b9cce-e3ff-4379-89b5-fe46d6529786 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:1bf4817e-81a1-4c0b-b86d-3d7aefdda743 -DeviceGroupId:
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe"
"C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe"
"C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe"
C:\Program Files (x86)\AVG\Av\avgrsa.exe
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
"C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe"
"C:\Program Files\Tablet\Wacom\WacomHost.exe" "C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe" au
"C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe" au
"C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 "--database=C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=57.0.2987.133 --initial-client-data=0x9c,0xa0,0xa4,0x98,0xa8,0x72227dc8,0x72227dbc,0x72227dd4
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=7824 --on-initialized-event-handle=320 --parent-handle=332 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1144 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,74 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x10de --gpu-device-id=0x1184 --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.4411 --gpu-driver-date=9-13-2014 --service-request-channel-token=FD9473D0E9A6821444984B2CFF1C8D63 --mojo-platform-channel-handle=1156 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1144 --primordial-pipe-token=A1FE997657441C94D0D2F1F473DA9FE0 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=A1FE997657441C94D0D2F1F473DA9FE0 --renderer-client-id=4 --mojo-platform-channel-handle=1976 /prefetch:1
ctfmon.exe
"C:\Program Files (x86)\Skype\Phone\Skype.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1144 --primordial-pipe-token=698F282F24331C1941059206A5B74D58 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=698F282F24331C1941059206A5B74D58 --renderer-client-id=7 --mojo-platform-channel-handle=3508 /prefetch:1
"C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe"
"C:\Windows\system32\wuauclt.exe"
"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto
"C:\totalcmd\TOTALCMD64.EXE"

C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"D:\DOWNLOADS\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineCore1d042d516e1552b.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskMachineUA1d001e6f2de5b17.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskMachineUA1d042d516fc576e.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe Acrobat Create PDF Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08 163720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL [2010-01-16 688528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
Adobe Acrobat Create PDF from Selection - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08 163720]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-07-13 461888]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe Acrobat Create PDF Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08 141192]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2010-01-16 561552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-07-13 173120]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
Adobe Acrobat Create PDF from Selection - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08 141192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe Acrobat Create PDF Toolbar - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\x64\AcroIEFavClient.dll [2014-05-08 163720]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\Toolbar]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe Acrobat Create PDF Toolbar - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll [2014-05-08 141192]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BLEServicesCtrl"=C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [2013-11-13 184632]
"BTMTrayAgent"=C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [2013-11-07 7818552]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-08-05 508240]
"Autodesk Sync"=C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [2012-02-06 415680]
"AdAwareTray"=C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareTray.exe [2017-02-21 4461016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"uTorrent"=C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe [2017-04-06 2144448]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-11-16 8591272]
"AdobeBridge"= []
"DAEMON Tools Pro Agent"=C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [2014-11-10 3761424]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2014-06-27 292848]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-01-21 91520]
""= []
"WinampAgent"=C:\Program Files (x86)\Winamp\winampa.exe [2010-06-29 74752]
"AvgUi"=C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [2016-12-06 240400]
"AVG_UI"=C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [2016-12-06 240400]
"AdobeCS6ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2016-05-20 595992]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk - C:\Windows\Installer\{DAB265AD-27B2-4651-B8D8-F4F3A8ECC705}\LcdctrlDdcci.exe1_A2457035AC9A449AAFF91D310EF3707A.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\adawareantivirusservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\adawareantivirusservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
""=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveTypeAutoRun"=28

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-04-12 21:09:35 ----A---- C:\autoexec.bat
2017-04-12 18:39:20 ----D---- C:\Users\MARTIN\AppData\Roaming\adaware
2017-04-12 18:38:28 ----D---- C:\Program Files\adaware
2017-04-12 18:38:05 ----D---- C:\Program Files\Common Files\adaware
2017-04-12 18:37:26 ----D---- C:\ProgramData\adaware
2017-04-12 17:39:33 ----D---- C:\ProgramData\GridinSoft
2017-04-12 17:39:31 ----D---- C:\Program Files\GridinSoft Anti-Malware
2017-04-12 17:32:51 ----D---- C:\ProgramData\HitmanPro
2017-04-12 17:21:50 ----D---- C:\rsit
2017-04-12 17:21:50 ----D---- C:\Program Files\trend micro
2017-04-07 23:27:56 ----D---- C:\ProgramData\Malwarebytes
2017-03-25 18:45:57 ----D---- C:\Users\MARTIN\AppData\Roaming\Steam
2017-03-25 18:31:29 ----D---- C:\Program Files (x86)\Age of Empires II HD The African Kingdoms
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-03-14 19:24:47 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\inseng.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\iertutil.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\iernonce.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-03-14 19:24:47 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-03-14 19:24:47 ----A---- C:\Windows\system32\ie4uinit.exe
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-03-14 19:24:46 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\urlmon.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\occache.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-03-14 19:24:46 ----A---- C:\Windows\system32\msfeeds.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\iesetup.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\iedkcs32.dll
2017-03-14 19:24:46 ----A---- C:\Windows\system32\dxtrans.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-03-14 19:24:45 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-03-14 19:24:45 ----A---- C:\Windows\system32\vbscript.dll
2017-03-14 19:24:45 ----A---- C:\Windows\system32\jsproxy.dll
2017-03-14 19:24:45 ----A---- C:\Windows\system32\ieUnatt.exe
2017-03-14 19:24:45 ----A---- C:\Windows\system32\ieapfltr.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\webcheck.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\mshtmled.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\jscript.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\ieui.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\ieframe.dll
2017-03-14 19:24:44 ----A---- C:\Windows\system32\dxtmsft.dll
2017-03-14 19:24:43 ----A---- C:\Windows\system32\wininet.dll
2017-03-14 19:24:43 ----A---- C:\Windows\system32\msrating.dll
2017-03-14 19:24:43 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-03-14 19:24:43 ----A---- C:\Windows\system32\jscript9diag.dll
2017-03-14 19:24:43 ----A---- C:\Windows\system32\jscript9.dll
2017-03-14 19:24:42 ----A---- C:\Windows\system32\win32k.sys
2017-03-14 19:24:42 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-03-14 19:24:42 ----A---- C:\Windows\system32\mshtml.dll
2017-03-14 19:24:41 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-03-14 19:24:41 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-03-14 19:24:41 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\schannel.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\rpcrt4.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\ntdll.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\msxml3.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\lsasrv.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\kerberos.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\DWrite.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\advapi32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\usp10.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\wow64win.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\wow64.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\winsrv.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\wdigest.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\usp10.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\TSpkg.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\srcore.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\rpchttp.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\quartz.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\ncrypt.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\msv1_0.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\mscms.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\KernelBase.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\kernel32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\inetcomm.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\icm32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\gdi32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\FntCache.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\srv.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\appid.sys
2017-03-14 19:24:40 ----A---- C:\Windows\system32\csrsrv.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\conhost.exe
2017-03-14 19:24:40 ----A---- C:\Windows\system32\certcli.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\bcrypt.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\appidsvc.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-03-14 19:24:40 ----A---- C:\Windows\system32\appidapi.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\adtschema.dll
2017-03-14 19:24:40 ----A---- C:\Windows\HelpPane.exe
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-03-14 19:24:39 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\WcsPlugInService.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\user.exe
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\mscms.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\INETRES.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\icm32.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\wow64cpu.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\WcsPlugInService.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\sspisrv.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\sspicli.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\srclient.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\smss.exe
2017-03-14 19:24:39 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\secur32.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\rstrui.exe
2017-03-14 19:24:39 ----A---- C:\Windows\system32\ntvdm64.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\msxml3r.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\msobjs.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\msaudite.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\lsass.exe
2017-03-14 19:24:39 ----A---- C:\Windows\system32\INETRES.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-03-14 19:24:39 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-03-14 19:24:39 ----A---- C:\Windows\system32\cryptbase.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\credssp.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\auditpol.exe
2017-03-14 19:24:39 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-03-14 19:24:39 ----A---- C:\Windows\system32\apisetschema.dll
2017-03-14 19:20:17 ----A---- C:\Windows\system32\appraiser.dll
2017-03-14 19:20:17 ----A---- C:\Windows\system32\aepic.dll
2017-03-14 19:20:17 ----A---- C:\Windows\system32\aeinv.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\invagent.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\generaltel.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\devinv.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\CompatTelRunner.exe
2017-03-14 19:20:16 ----A---- C:\Windows\system32\centel.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\acmigration.dll

======List of files/folders modified in the last 1 month======

2017-04-12 22:09:23 ----D---- C:\Users\MARTIN\AppData\Roaming\uTorrent
2017-04-12 22:09:11 ----D---- C:\Windows\Temp
2017-04-12 22:08:01 ----D---- C:\Windows\system32\config
2017-04-12 22:05:59 ----D---- C:\Users\MARTIN\AppData\Roaming\Skype
2017-04-12 21:58:16 ----D---- C:\Windows\System32
2017-04-12 21:58:16 ----D---- C:\Windows\inf
2017-04-12 21:58:16 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-04-12 21:54:05 ----D---- C:\ProgramData\NVIDIA
2017-04-12 21:52:49 ----D---- C:\AdwCleaner
2017-04-12 21:24:15 ----RD---- C:\Program Files
2017-04-12 21:24:15 ----D---- C:\Windows
2017-04-12 21:22:45 ----D---- C:\Windows\system32\Tasks
2017-04-12 21:22:45 ----D---- C:\Windows\system32\drivers
2017-04-12 21:22:44 ----D---- C:\Program Files (x86)\Common Files
2017-04-12 21:22:40 ----RD---- C:\Program Files (x86)
2017-04-12 21:22:36 ----HD---- C:\ProgramData
2017-04-12 21:22:35 ----D---- C:\Program Files\Common Files
2017-04-12 21:20:51 ----D---- C:\ProgramData\MFAData
2017-04-12 18:46:29 ----SHD---- C:\System Volume Information
2017-04-12 18:46:23 ----SHD---- C:\Windows\Installer
2017-04-12 17:41:17 ----D---- C:\Windows\system32\catroot2
2017-04-12 17:41:02 ----D---- C:\Windows\winsxs
2017-04-12 16:15:24 ----D---- C:\Users\MARTIN\AppData\Roaming\DAEMON Tools Pro
2017-04-10 16:15:23 ----D---- C:\Users\MARTIN\AppData\Roaming\vlc
2017-04-10 12:19:50 ----D---- C:\Program Files\WinRAR
2017-04-07 23:39:28 ----D---- C:\Windows\Prefetch
2017-03-26 19:59:16 ----SD---- C:\Users\MARTIN\AppData\Roaming\Microsoft
2017-03-26 16:05:17 ----D---- C:\Windows\SysWOW64
2017-03-25 14:12:21 ----D---- C:\Windows\SoftwareDistribution
2017-03-17 22:35:15 ----D---- C:\Windows\debug
2017-03-16 15:37:20 ----RSD---- C:\Windows\Fonts
2017-03-15 00:40:56 ----SD---- C:\Windows\system32\CompatTel
2017-03-15 00:40:56 ----D---- C:\Windows\SYSWOW64\migration
2017-03-15 00:40:56 ----D---- C:\Windows\SYSWOW64\es-ES
2017-03-15 00:40:56 ----D---- C:\Windows\SYSWOW64\en-US
2017-03-15 00:40:56 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-03-15 00:40:56 ----D---- C:\Windows\system32\migration
2017-03-15 00:40:56 ----D---- C:\Windows\system32\es-ES
2017-03-15 00:40:56 ----D---- C:\Windows\system32\en-US
2017-03-15 00:40:56 ----D---- C:\Windows\system32\cs-CZ
2017-03-15 00:40:56 ----D---- C:\Windows\system32\Boot
2017-03-15 00:40:56 ----D---- C:\Windows\system32\appraiser
2017-03-15 00:40:56 ----D---- C:\Windows\AppPatch
2017-03-15 00:40:56 ----D---- C:\Program Files\Internet Explorer
2017-03-15 00:40:56 ----D---- C:\Program Files\DVD Maker
2017-03-15 00:40:56 ----D---- C:\Program Files (x86)\Internet Explorer
2017-03-14 23:50:27 ----D---- C:\Windows\system32\MRT
2017-03-14 23:49:30 ----AC---- C:\Windows\system32\MRT.exe
2017-03-14 23:48:35 ----D---- C:\Program Files\Microsoft Silverlight
2017-03-14 23:48:35 ----D---- C:\Program Files (x86)\Microsoft Silverlight

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHA;AVGIDSHA; C:\Windows\system32\DRIVERS\avgidsha.sys [2016-10-05 267008]
R0 Avgloga;AVG Logging Driver; C:\Windows\system32\DRIVERS\avgloga.sys [2016-02-16 360736]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx64.sys [2016-09-26 254208]
R0 Avgrkx64;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx64.sys [2016-06-01 52992]
R0 avguniva;AVG Universal Driver; C:\Windows\system32\DRIVERS\avguniva.sys [2016-06-20 77056]
R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2014-06-27 20464]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 Avgdiska;AVG Disk Driver; C:\Windows\system32\DRIVERS\avgdiska.sys [2016-05-13 163072]
R1 Avgfwfd;AVG network filter service; C:\Windows\system32\DRIVERS\avgfwd6a.sys [2016-10-23 73992]
R1 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\avgidsdrivera.sys [2017-02-20 313088]
R1 Avgldx64;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx64.sys [2016-11-30 298240]
R1 Avgtdia;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdia.sys [2016-07-27 299264]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2015-07-30 186784]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 dtscsibus;DAEMON Tools Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtscsibus.sys [2016-11-17 29864]
R3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D; C:\Windows\system32\DRIVERS\e1d62x64.sys [2014-03-14 487704]
R3 gzflt;gzflt; C:\Windows\system32\DRIVERS\gzflt.sys [2017-02-08 178384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2015-06-18 4496600]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2014-06-27 383472]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2014-06-27 795120]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2014-06-24 125952]
R3 NETwNs64;___ Ovladač adaptéru Intel(R) Wireless pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETwsw02.sys [2013-08-15 3586528]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2014-09-17 197408]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
R3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2015-07-30 264040]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2014-10-24 25640]
S3 hidkmdf;KMDF Driver; C:\Windows\system32\DRIVERS\hidkmdf.sys [2014-10-25 14136]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 Trufos;Trufos; C:\Windows\system32\DRIVERS\Trufos.sys [2017-02-08 442848]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WacHidRouter;Wacom Hid Router; C:\Windows\system32\DRIVERS\wachidrouter.sys [2014-10-25 100664]
S3 wacomrouterfilter;Wacom Router Filter Driver; C:\Windows\system32\DRIVERS\wacomrouterfilter.sys [2014-10-25 15160]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 adawareantivirusservice;adaware antivirus service; C:\Program Files\adaware\adaware antivirus\adaware antivirus\12.0.649.11190\AdAwareService.exe [2017-02-21 585784]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-05-08 65432]
R2 AGSService;Adobe Genuine Software Integrity Service; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2017-02-27 2227312]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-01-31 19232]
R2 avgfws;AVG Firewall; C:\Program Files (x86)\AVG\Av\avgfwsa.exe [2017-03-23 1824184]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [2017-03-23 5334432]
R2 avgsvc;AVG Service; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [2016-12-06 1146128]
R2 avgwd;AVG WatchDog; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [2017-03-23 729048]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2013-11-07 1186168]
R2 Bluetooth Media Service;Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2013-11-21 1689976]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2013-11-07 1161592]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2015-10-09 2505472]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2013-08-06 626416]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2014-03-11 260360]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2014-06-24 154584]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2014-06-24 405976]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2014-09-13 934216]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2013-08-06 149744]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-09-13 411968]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R3 Disc Soft Bus Service;Disc Soft Bus Service; C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe [2014-11-10 2216208]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2016-11-29 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2016-11-29 125112]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-05 144200]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-03-23 327808]
S2 TuneUp.UtilitiesSvc;AVG PC TuneUp Service; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2015-08-04 2973400]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 AvgAMPS;AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [2017-03-23 1002552]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-11-01 1432400]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-05 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-04 114688]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2014-05-13 887256]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-03-10 147400]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2013-08-06 273136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-11-01 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2016-11-29 51384]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2016-11-29 135848]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2016-11-29 135848]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2016-11-29 135848]

-----------------EOF-----------------
Nahoru
martwer
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 12 dub 2017 16:26

Re: nova.rambler.ru a další pop up malware či co

#6 Příspěvek od martwer »

tak projel jsem to utilitou gridin softwarea a vypadá to dobře..
Pokud byste ale v logu našli ještě nějaké další problémy, tak budu rád samozřejmě.
Zde aktuální RSIT:

Děkuji

:


Logfile of random's system information tool 1.10 (written by random/random)
Run by MARTIN at 2017-04-13 13:23:12
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 51 GB (22%) free of 229 GB
Total RAM: 32596 MB (87% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:23:13, on 13/04/2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18639)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\MARTIN.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AvgUi] "C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe" /lps=fmw
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe" /lps=av
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [uTorrent] "C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Genuine Software Integrity Service (AGSService) - Adobe Systems, Incorporated - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: AvgAMPS - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgamps.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgfwsa.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgidsagenta.exe
O23 - Service: AVG Service (avgsvc) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgwdsvca.exe
O23 - Service: Bluetooth Device Monitor - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Disc Soft Bus Service - Disc Soft Ltd - C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) - AVG Technologies - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Wacom Professional Service (WTabletServicePro) - Wacom Technology, Corp. - C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--
End of file - 12024 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe"
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files\Tablet\Wacom\WTabletServicePro.exe"
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\WLANExt.exe 51429552
\??\C:\Windows\system32\conhost.exe "-190306653611739637751956552544-615693893-1957493196-2015557310-1248925456-169012019
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe"
taskeng.exe {F89D0CCB-F0CB-4697-B5BB-5A1BAE4E5ADF}
"C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe"
"C:\Program Files\GridinSoft Anti-Malware\gsam.exe" -startupusbscan -finishrem -rb
"C:\Program Files (x86)\AVG\Av\avgfwsa.exe"
"C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe"
"C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
"C:\Program Files (x86)\AVG\Av\avgidsagenta.exe"
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe"
"C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
C:\Program Files (x86)\AVG\Av\avgcsrva.exe /pipeName=44800c66-0200-0000-9f93-9f30902a764c /binaryPath="C:\Program Files (x86)\AVG\Av\\" /logPath=C:\Windows\system32\config\systemprofile\AppData\Local\Avg\log\av16 /logCfgPath=C:\ProgramData\Avg\log\av16
"C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe"
"C:\Program Files (x86)\AVG\Av\avgwdsvca.exe"
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\Intel\WiFi\bin\EvtEng.exe"
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe"
"C:\Program Files (x86)\Winamp\winampa.exe"
C:\Windows\system32\svchost.exe -k imgsvc
/TRAYONLY
/fmw.trayonly
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\AVG\Av\avgnsa.exe"
"C:\Program Files (x86)\AVG\Av\avgemca.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe" uTorrent_2760_03796D90_226446312 µTorrent4823DF041B09 uTorrent
"C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe" uTorrent_2760_03796F58_825118809 µTorrent4823DF041B09 uTorrent
"C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe"
"C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe"
"C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe"
C:\Program Files (x86)\AVG\Av\avgrsa.exe
"C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe"
"C:\Program Files\Tablet\Wacom\WacomHost.exe" "C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe" au
"C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe" au
"C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe"
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
ctfmon.exe
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 "--database=C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=57.0.2987.133 --initial-client-data=0x9c,0xa0,0xa4,0x98,0xa8,0x73097dc8,0x73097dbc,0x73097dd4
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=8208 --on-initialized-event-handle=320 --parent-handle=332 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1240 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,74 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x10de --gpu-device-id=0x1184 --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.4411 --gpu-driver-date=9-13-2014 --service-request-channel-token=AAA68789F73AAEE0023058EADE760E5C --mojo-platform-channel-handle=1248 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe"
C:\Windows\servicing\TrustedInstaller.exe
"C:\Program Files (x86)\Skype\Phone\Skype.exe"
C:\Windows\system32\msiexec.exe /V
"C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe" -auto
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1240 --primordial-pipe-token=B483329479F0EC2A052277BE1BCDF01B --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=B483329479F0EC2A052277BE1BCDF01B --renderer-client-id=45 --mojo-platform-channel-handle=2492 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1240 --primordial-pipe-token=A91C55648D6F81E35525F5A741896931 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=A91C55648D6F81E35525F5A741896931 --renderer-client-id=49 --mojo-platform-channel-handle=2856 /prefetch:1
"C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1240 --primordial-pipe-token=DCAB301F14D55EB30DBD7E57474F18EF --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=DCAB301F14D55EB30DBD7E57474F18EF --renderer-client-id=63 --mojo-platform-channel-handle=3260 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1240 --primordial-pipe-token=DE01BA66A22EF5104B3CD805563A8D60 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=DE01BA66A22EF5104B3CD805563A8D60 --renderer-client-id=70 --mojo-platform-channel-handle=3644 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1240 --primordial-pipe-token=CB58FC7CF9429E71EC9912346C8DC221 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=CB58FC7CF9429E71EC9912346C8DC221 --renderer-client-id=72 --mojo-platform-channel-handle=5812 /prefetch:1

"C:\totalcmd\TOTALCMD64.EXE"
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"D:\DOWNLOADS\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineCore1d042d516e1552b.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskMachineUA1d001e6f2de5b17.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\GoogleUpdateTaskMachineUA1d042d516fc576e.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BLEServicesCtrl"=C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [2013-11-13 184632]
"BTMTrayAgent"=C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [2013-11-07 7818552]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-08-05 508240]
"Autodesk Sync"=C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [2012-02-06 415680]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"uTorrent"=C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe [2017-04-06 2144448]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-11-16 8591272]
"AdobeBridge"= []
"DAEMON Tools Pro Agent"=C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [2014-11-10 3761424]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2014-06-27 292848]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-01-21 91520]
""= []
"WinampAgent"=C:\Program Files (x86)\Winamp\winampa.exe [2010-06-29 74752]
"AvgUi"=C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [2016-12-06 240400]
"AVG_UI"=C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [2016-12-06 240400]
"AdobeCS6ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2016-05-20 595992]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk - C:\Windows\Installer\{DAB265AD-27B2-4651-B8D8-F4F3A8ECC705}\LcdctrlDdcci.exe1_A2457035AC9A449AAFF91D310EF3707A.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
""=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveTypeAutoRun"=28

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-04-13 13:16:19 ----SHD---- C:\Config.Msi
2017-04-13 13:16:06 ----A---- C:\ProgramData\adaware-installer-reboot-required.tmp
2017-04-12 21:09:35 ----A---- C:\autoexec.bat
2017-04-12 18:38:05 ----D---- C:\Program Files\Common Files\adaware
2017-04-12 17:42:30 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-04-12 17:42:30 ----A---- C:\Windows\system32\mshtml.dll
2017-04-12 17:42:29 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-04-12 17:42:29 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-04-12 17:42:29 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-04-12 17:42:29 ----A---- C:\Windows\system32\wininet.dll
2017-04-12 17:42:29 ----A---- C:\Windows\system32\iertutil.dll
2017-04-12 17:42:29 ----A---- C:\Windows\system32\ieframe.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\wucltux.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\wuaueng.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\wuapi.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\win32spl.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\win32k.sys
2017-04-12 17:42:28 ----A---- C:\Windows\system32\urlmon.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\ucrtbase.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\samsrv.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\quartz.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\ole32.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\msfeeds.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\iedkcs32.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\gdi32.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2017-04-12 17:42:28 ----A---- C:\Windows\system32\cdosys.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\atmfd.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\ucrtbase.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\samlib.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\mfmjpegdec.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\webcheck.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\samlib.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-04-12 17:42:27 ----A---- C:\Windows\system32\ntdll.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\mfmjpegdec.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\jscript9.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\jscript.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\ie4uinit.exe
2017-04-12 17:42:27 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-04-12 17:42:27 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-04-12 17:42:27 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2017-04-12 17:42:27 ----A---- C:\Windows\system32\certcli.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\asycfilt.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\wups.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wuwebv.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wups2.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wups.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wudriver.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wuauclt.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wuapp.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wow64win.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wow64cpu.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wow64.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\winsrv.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\WinSetupUI.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wdigest.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\vbscript.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\TSpkg.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\sspisrv.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\sspicli.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\srcore.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\srclient.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\smss.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\secur32.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\schannel.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\rstrui.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\rpcrt4.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\rpchttp.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\occache.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ncrypt.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\msv1_0.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\msrating.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\mshtmled.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\lsass.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\lsasrv.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\lpk.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\KernelBase.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\kernel32.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\kerberos.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\jsproxy.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\jscript9diag.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\inseng.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ieUnatt.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ieui.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\iesetup.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\iernonce.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ieapfltr.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\fontsub.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\dxtrans.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\dxtmsft.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-04-12 17:42:26 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-04-12 17:42:26 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-04-12 17:42:26 ----A---- C:\Windows\system32\drivers\appid.sys
2017-04-12 17:42:26 ----A---- C:\Windows\system32\dciman32.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\csrsrv.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\cryptbase.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\conhost.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\cdd.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\bcrypt.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\appidsvc.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\appidapi.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\advapi32.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\user.exe
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\tzres.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\lpk.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\tzres.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\ntvdm64.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\msobjs.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\msaudite.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\credssp.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\auditpol.exe
2017-04-12 17:42:25 ----A---- C:\Windows\system32\atmlib.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 17:42:25 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 17:42:25 ----A---- C:\Windows\system32\apisetschema.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\adtschema.dll
2017-04-12 17:39:33 ----D---- C:\ProgramData\GridinSoft
2017-04-12 17:39:31 ----D---- C:\Program Files\GridinSoft Anti-Malware
2017-04-12 17:32:51 ----D---- C:\ProgramData\HitmanPro
2017-04-12 17:21:50 ----D---- C:\rsit
2017-04-12 17:21:50 ----D---- C:\Program Files\trend micro
2017-04-07 23:27:56 ----D---- C:\ProgramData\Malwarebytes
2017-03-25 18:45:57 ----D---- C:\Users\MARTIN\AppData\Roaming\Steam
2017-03-25 18:31:29 ----D---- C:\Program Files (x86)\Age of Empires II HD The African Kingdoms
2017-03-20 00:48:06 ----A---- C:\Windows\SYSWOW64\msvcr110_clr0400.dll
2017-03-20 00:48:06 ----A---- C:\Windows\SYSWOW64\msvcr100_clr0400.dll
2017-03-20 00:48:06 ----A---- C:\Windows\SYSWOW64\msvcp110_clr0400.dll
2017-03-20 00:48:06 ----A---- C:\Windows\SYSWOW64\aspnet_counters.dll
2017-03-20 00:41:38 ----A---- C:\Windows\system32\msvcr110_clr0400.dll
2017-03-20 00:41:38 ----A---- C:\Windows\system32\msvcr100_clr0400.dll
2017-03-20 00:41:38 ----A---- C:\Windows\system32\msvcp110_clr0400.dll
2017-03-20 00:41:38 ----A---- C:\Windows\system32\aspnet_counters.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\msxml3.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\DWrite.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\usp10.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\usp10.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\mscms.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\inetcomm.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\icm32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\FntCache.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\srv.sys
2017-03-14 19:24:40 ----A---- C:\Windows\HelpPane.exe
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\WcsPlugInService.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\mscms.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\INETRES.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\icm32.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\WcsPlugInService.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\msxml3r.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\INETRES.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-03-14 19:24:39 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-03-14 19:20:17 ----A---- C:\Windows\system32\appraiser.dll
2017-03-14 19:20:17 ----A---- C:\Windows\system32\aepic.dll
2017-03-14 19:20:17 ----A---- C:\Windows\system32\aeinv.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\invagent.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\generaltel.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\devinv.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\CompatTelRunner.exe
2017-03-14 19:20:16 ----A---- C:\Windows\system32\centel.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\acmigration.dll

======List of files/folders modified in the last 1 month======

2017-04-13 13:21:34 ----D---- C:\Users\MARTIN\AppData\Roaming\uTorrent
2017-04-13 13:21:08 ----D---- C:\Windows\Temp
2017-04-13 13:20:42 ----D---- C:\ProgramData\MFAData
2017-04-13 13:17:02 ----D---- C:\Windows\System32
2017-04-13 13:17:02 ----D---- C:\Windows\inf
2017-04-13 13:17:02 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-04-13 13:16:21 ----RD---- C:\Program Files
2017-04-13 13:16:21 ----HD---- C:\ProgramData
2017-04-13 13:16:20 ----SHD---- C:\Windows\Installer
2017-04-13 13:16:01 ----D---- C:\Windows\system32\drivers
2017-04-13 13:15:57 ----SHD---- C:\System Volume Information
2017-04-13 13:14:15 ----D---- C:\Users\MARTIN\AppData\Roaming\Skype
2017-04-13 13:14:02 ----D---- C:\Windows\system32\config
2017-04-13 13:11:24 ----D---- C:\Windows\system32\Tasks
2017-04-13 13:11:06 ----D---- C:\ProgramData\NVIDIA
2017-04-13 09:44:53 ----D---- C:\AdwCleaner
2017-04-13 08:53:55 ----D---- C:\Windows\Microsoft.NET
2017-04-13 08:50:29 ----RSD---- C:\Windows\assembly
2017-04-13 08:38:53 ----D---- C:\Windows\winsxs
2017-04-13 08:37:39 ----D---- C:\Windows\SYSWOW64\es-ES
2017-04-13 08:37:39 ----D---- C:\Windows\SYSWOW64\en-US
2017-04-13 08:37:39 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-04-13 08:37:39 ----D---- C:\Windows\SysWOW64
2017-04-13 08:37:39 ----D---- C:\Windows\system32\es-ES
2017-04-13 08:37:39 ----D---- C:\Windows\system32\en-US
2017-04-13 08:37:39 ----D---- C:\Windows\system32\cs-CZ
2017-04-13 08:37:39 ----D---- C:\Windows\system32\Boot
2017-04-13 08:37:39 ----D---- C:\Windows\AppPatch
2017-04-13 08:37:39 ----D---- C:\Program Files\Internet Explorer
2017-04-13 08:37:39 ----D---- C:\Program Files (x86)\Internet Explorer
2017-04-13 01:28:10 ----D---- C:\Program Files\Microsoft Silverlight
2017-04-13 01:28:10 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2017-04-13 01:28:00 ----D---- C:\Windows\system32\MRT
2017-04-13 01:27:12 ----D---- C:\Windows\debug
2017-04-13 01:27:08 ----AC---- C:\Windows\system32\MRT.exe
2017-04-13 01:26:05 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-04-12 23:04:20 ----D---- C:\Windows
2017-04-12 21:22:44 ----D---- C:\Program Files (x86)\Common Files
2017-04-12 21:22:40 ----RD---- C:\Program Files (x86)
2017-04-12 21:22:35 ----D---- C:\Program Files\Common Files
2017-04-12 17:41:17 ----D---- C:\Windows\system32\catroot2
2017-04-12 16:15:24 ----D---- C:\Users\MARTIN\AppData\Roaming\DAEMON Tools Pro
2017-04-10 16:15:23 ----D---- C:\Users\MARTIN\AppData\Roaming\vlc
2017-04-10 12:19:50 ----D---- C:\Program Files\WinRAR
2017-04-07 23:39:28 ----D---- C:\Windows\Prefetch
2017-03-26 19:59:16 ----SD---- C:\Users\MARTIN\AppData\Roaming\Microsoft
2017-03-25 14:12:21 ----D---- C:\Windows\SoftwareDistribution
2017-03-16 15:37:20 ----RSD---- C:\Windows\Fonts
2017-03-15 00:40:56 ----SD---- C:\Windows\system32\CompatTel
2017-03-15 00:40:56 ----D---- C:\Windows\SYSWOW64\migration
2017-03-15 00:40:56 ----D---- C:\Windows\system32\migration
2017-03-15 00:40:56 ----D---- C:\Windows\system32\appraiser
2017-03-15 00:40:56 ----D---- C:\Program Files\DVD Maker

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHA;AVGIDSHA; C:\Windows\system32\DRIVERS\avgidsha.sys [2016-10-05 267008]
R0 Avgloga;AVG Logging Driver; C:\Windows\system32\DRIVERS\avgloga.sys [2016-02-16 360736]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx64.sys [2016-09-26 254208]
R0 Avgrkx64;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx64.sys [2016-06-01 52992]
R0 avguniva;AVG Universal Driver; C:\Windows\system32\DRIVERS\avguniva.sys [2016-06-20 77056]
R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2014-06-27 20464]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 Avgdiska;AVG Disk Driver; C:\Windows\system32\DRIVERS\avgdiska.sys [2016-05-13 163072]
R1 Avgfwfd;AVG network filter service; C:\Windows\system32\DRIVERS\avgfwd6a.sys [2016-10-23 73992]
R1 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\avgidsdrivera.sys [2017-02-20 313088]
R1 Avgldx64;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx64.sys [2016-11-30 298240]
R1 Avgtdia;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdia.sys [2016-07-27 299264]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2015-07-30 186784]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 dtscsibus;DAEMON Tools Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtscsibus.sys [2016-11-17 29864]
R3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D; C:\Windows\system32\DRIVERS\e1d62x64.sys [2014-03-14 487704]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2015-06-18 4496600]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2014-06-27 383472]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2014-06-27 795120]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2014-06-24 125952]
R3 NETwNs64;___ Ovladač adaptéru Intel(R) Wireless pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETwsw02.sys [2013-08-15 3586528]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2014-09-17 197408]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2015-07-30 264040]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2014-10-24 25640]
S3 hidkmdf;KMDF Driver; C:\Windows\system32\DRIVERS\hidkmdf.sys [2014-10-25 14136]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TrojanKillerDriver;GridinSoft Trojan Killer Driver; C:\Windows\system32\DRIVERS\gtkdrv.sys [2017-02-10 29456]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WacHidRouter;Wacom Hid Router; C:\Windows\system32\DRIVERS\wachidrouter.sys [2014-10-25 100664]
S3 wacomrouterfilter;Wacom Router Filter Driver; C:\Windows\system32\DRIVERS\wacomrouterfilter.sys [2014-10-25 15160]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-05-08 65432]
R2 AGSService;Adobe Genuine Software Integrity Service; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2017-02-27 2227312]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-01-31 19232]
R2 avgfws;AVG Firewall; C:\Program Files (x86)\AVG\Av\avgfwsa.exe [2017-03-23 1824184]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [2017-03-23 5334432]
R2 avgsvc;AVG Service; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [2016-12-06 1146128]
R2 avgwd;AVG WatchDog; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [2017-03-23 729048]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2013-11-07 1186168]
R2 Bluetooth Media Service;Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2013-11-21 1689976]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2013-11-07 1161592]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2015-10-09 2505472]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2013-08-06 626416]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2014-03-11 260360]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2014-06-24 154584]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2014-06-24 405976]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2014-09-13 934216]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2013-08-06 149744]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-09-13 411968]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R3 Disc Soft Bus Service;Disc Soft Bus Service; C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe [2014-11-10 2216208]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-03-20 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-03-20 125064]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-05 144200]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-03-23 327808]
S2 TuneUp.UtilitiesSvc;AVG PC TuneUp Service; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2015-08-04 2973400]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 AvgAMPS;AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [2017-03-23 1002552]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-11-01 1432400]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-05 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-25 114688]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2014-05-13 887256]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-03-10 147400]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2013-08-06 273136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-11-01 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-03-20 51320]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119359
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: nova.rambler.ru a další pop up malware či co

#7 Příspěvek od Rudy »

Sice jsem vám žádný gridin software neradil (máme jiné páky), nicméně ještě dočistíme. Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore1d042d516e1552b.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA1d001e6f2de5b17.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA1d042d516fc576e.job

:reg
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
martwer
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 12 dub 2017 16:26

Re: nova.rambler.ru a další pop up malware či co

#8 Příspěvek od martwer »

Ok, díky:

Logfile of random's system information tool 1.10 (written by random/random)
Run by MARTIN at 2017-04-13 20:25:24
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 51 GB (22%) free of 229 GB
Total RAM: 32596 MB (88% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:25:25, on 13/04/2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18639)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe
C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe
C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\MARTIN.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AvgUi] "C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe" /lps=fmw
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe" /lps=av
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [uTorrent] "C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Genuine Software Integrity Service (AGSService) - Adobe Systems, Incorporated - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: AvgAMPS - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgamps.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgfwsa.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgidsagenta.exe
O23 - Service: AVG Service (avgsvc) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\Av\avgwdsvca.exe
O23 - Service: Bluetooth Device Monitor - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Disc Soft Bus Service - Disc Soft Ltd - C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) - AVG Technologies - C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Wacom Professional Service (WTabletServicePro) - Wacom Technology, Corp. - C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--
End of file - 11556 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe"
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files\Tablet\Wacom\WTabletServicePro.exe"
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\WLANExt.exe 45537312
\??\C:\Windows\system32\conhost.exe "-1762486814896246478-1777268423-686341953-1623302011345778026663080097-1397906589
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe"
"C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe"
"C:\Program Files (x86)\AVG\Av\avgfwsa.exe"
taskeng.exe {B51122F9-4235-47C1-AAD3-813474342F40}
"C:\Program Files (x86)\AVG\Av\avgidsagenta.exe"
"C:\Program Files\GridinSoft Anti-Malware\gsam.exe" -startupusbscan
"C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe"
C:\Program Files (x86)\AVG\Av\avgcsrva.exe /pipeName=44800c66-0200-0000-e285-bc1dca2ebe4c /binaryPath="C:\Program Files (x86)\AVG\Av\\" /logPath=C:\Windows\system32\config\systemprofile\AppData\Local\Avg\log\av16 /logCfgPath=C:\ProgramData\Avg\log\av16
"C:\Program Files (x86)\AVG\Av\avgwdsvca.exe"
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\Intel\WiFi\bin\EvtEng.exe"
C:\Windows\system32\IProsetMonitor.exe
"C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\AVG\Av\avgnsa.exe"
"C:\Program Files (x86)\AVG\Av\avgemca.exe"
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe"
"C:\Program Files\Tablet\Wacom\WacomHost.exe" "C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe" au
"C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe" au
"C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe"
C:\Program Files (x86)\AVG\Av\avgrsa.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe"
"C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
"C:\Program Files (x86)\EIZO\ScreenManager Pro for LCD (DDCCI)\LcdctrlDdcci.exe"
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files (x86)\Winamp\winampa.exe"
/fmw.trayonly
/TRAYONLY
"C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe"
"C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe"
"C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe"
"C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe"
"C:\Program Files\CCleaner\CCleaner.exe" /MONITOR /uac
"C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe" uTorrent_4920_0038D830_1514269335 µTorrent4823DF041B09 uTorrent
"C:\Users\MARTIN\AppData\Roaming\uTorrent\updates\3.5.0_43580\utorrentie.exe" uTorrent_4920_0038CCE8_2038378761 µTorrent4823DF041B09 uTorrent
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
ctfmon.exe
"C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "https://forum.viry.cz/"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 "--database=C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=57.0.2987.133 --initial-client-data=0x9c,0xa0,0xa4,0x98,0xa8,0x5c547dc8,0x5c547dbc,0x5c547dd4
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=7148 --on-initialized-event-handle=320 --parent-handle=332 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1208 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,74 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x10de --gpu-device-id=0x1184 --gpu-driver-vendor=NVIDIA --gpu-driver-version=9.18.13.4411 --gpu-driver-date=9-13-2014 --service-request-channel-token=62961503A9F198C33082153E9669BD17 --mojo-platform-channel-handle=1224 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1208 --primordial-pipe-token=4065691AA846A64DBDE3467D66C667CA --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=4065691AA846A64DBDE3467D66C667CA --renderer-client-id=5 --mojo-platform-channel-handle=1952 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1208 --primordial-pipe-token=B46293C86623DFF6B82CF771DD711EF5 --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=B46293C86623DFF6B82CF771DD711EF5 --renderer-client-id=4 --mojo-platform-channel-handle=2396 /prefetch:1
"C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe"
"C:\totalcmd\TOTALCMD64.EXE"

C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"D:\DOWNLOADS\RSITx64.exe"

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BLEServicesCtrl"=C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [2013-11-13 184632]
"BTMTrayAgent"=C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [2013-11-07 7818552]
"AdobeAAMUpdater-1.0"=C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-08-05 508240]
"Autodesk Sync"=C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [2012-02-06 415680]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-21 1475584]
"uTorrent"=C:\Users\MARTIN\AppData\Roaming\uTorrent\uTorrent.exe [2017-04-06 2144448]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-11-16 8591272]
"AdobeBridge"= []
"DAEMON Tools Pro Agent"=C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [2014-11-10 3761424]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2014-06-27 292848]
"SwitchBoard"=C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
"AdobeCS5ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [2010-02-22 406992]
"BCSSync"=C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [2010-01-21 91520]
""= []
"WinampAgent"=C:\Program Files (x86)\Winamp\winampa.exe [2010-06-29 74752]
"AvgUi"=C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [2016-12-06 240400]
"AVG_UI"=C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [2016-12-06 240400]
"AdobeCS6ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [2012-03-09 1073312]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
ScreenManager Pro for LCD (DDCCI) Ver.2.4.0.lnk - C:\Windows\Installer\{DAB265AD-27B2-4651-B8D8-F4F3A8ECC705}\LcdctrlDdcci.exe1_A2457035AC9A449AAFF91D310EF3707A.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 6723984]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2010-01-21 4222864]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MBAMService]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
""=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0
"NoDriveTypeAutoRun"=28

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2017-04-13 20:04:16 ----D---- C:\_OTM
2017-04-13 13:16:19 ----SHD---- C:\Config.Msi
2017-04-12 21:09:35 ----A---- C:\autoexec.bat
2017-04-12 18:38:05 ----D---- C:\Program Files\Common Files\adaware
2017-04-12 17:42:30 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-04-12 17:42:30 ----A---- C:\Windows\system32\mshtml.dll
2017-04-12 17:42:29 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-04-12 17:42:29 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-04-12 17:42:29 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-04-12 17:42:29 ----A---- C:\Windows\system32\wininet.dll
2017-04-12 17:42:29 ----A---- C:\Windows\system32\iertutil.dll
2017-04-12 17:42:29 ----A---- C:\Windows\system32\ieframe.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-04-12 17:42:28 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\wucltux.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\wuaueng.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\wuapi.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\win32spl.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\win32k.sys
2017-04-12 17:42:28 ----A---- C:\Windows\system32\urlmon.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\ucrtbase.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\samsrv.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\quartz.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\ole32.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\msfeeds.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\iedkcs32.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\gdi32.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2017-04-12 17:42:28 ----A---- C:\Windows\system32\cdosys.dll
2017-04-12 17:42:28 ----A---- C:\Windows\system32\atmfd.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\ucrtbase.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\samlib.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\mfmjpegdec.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\webcheck.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\samlib.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-04-12 17:42:27 ----A---- C:\Windows\system32\ntdll.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\mfmjpegdec.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\jscript9.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\jscript.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\ie4uinit.exe
2017-04-12 17:42:27 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-04-12 17:42:27 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-04-12 17:42:27 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2017-04-12 17:42:27 ----A---- C:\Windows\system32\certcli.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\asycfilt.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 17:42:27 ----A---- C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\wups.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-04-12 17:42:26 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wuwebv.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wups2.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wups.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wudriver.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wuauclt.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wuapp.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wow64win.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wow64cpu.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wow64.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\winsrv.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\WinSetupUI.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\wdigest.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\vbscript.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\TSpkg.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\sspisrv.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\sspicli.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\srcore.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\srclient.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\smss.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\secur32.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\schannel.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\rstrui.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\rpcrt4.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\rpchttp.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\occache.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ncrypt.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\msv1_0.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\msrating.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\mshtmled.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\lsass.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\lsasrv.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\lpk.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\KernelBase.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\kernel32.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\kerberos.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\jsproxy.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\jscript9diag.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\inseng.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ieUnatt.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ieui.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\iesetup.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\iernonce.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\ieapfltr.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\fontsub.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\dxtrans.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\dxtmsft.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-04-12 17:42:26 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-04-12 17:42:26 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-04-12 17:42:26 ----A---- C:\Windows\system32\drivers\appid.sys
2017-04-12 17:42:26 ----A---- C:\Windows\system32\dciman32.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\csrsrv.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\cryptbase.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\conhost.exe
2017-04-12 17:42:26 ----A---- C:\Windows\system32\cdd.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\bcrypt.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\appidsvc.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\appidapi.dll
2017-04-12 17:42:26 ----A---- C:\Windows\system32\advapi32.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 17:42:25 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\user.exe
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\tzres.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\lpk.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-04-12 17:42:25 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\tzres.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\ntvdm64.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\msobjs.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\msaudite.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\credssp.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\auditpol.exe
2017-04-12 17:42:25 ----A---- C:\Windows\system32\atmlib.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 17:42:25 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 17:42:25 ----A---- C:\Windows\system32\apisetschema.dll
2017-04-12 17:42:25 ----A---- C:\Windows\system32\adtschema.dll
2017-04-12 17:39:33 ----D---- C:\ProgramData\GridinSoft
2017-04-12 17:39:31 ----D---- C:\Program Files\GridinSoft Anti-Malware
2017-04-12 17:32:51 ----D---- C:\ProgramData\HitmanPro
2017-04-12 17:21:50 ----D---- C:\rsit
2017-04-12 17:21:50 ----D---- C:\Program Files\trend micro
2017-04-07 23:27:56 ----D---- C:\ProgramData\Malwarebytes
2017-03-25 18:45:57 ----D---- C:\Users\MARTIN\AppData\Roaming\Steam
2017-03-25 18:31:29 ----D---- C:\Program Files (x86)\Age of Empires II HD The African Kingdoms
2017-03-20 00:48:06 ----A---- C:\Windows\SYSWOW64\msvcr110_clr0400.dll
2017-03-20 00:48:06 ----A---- C:\Windows\SYSWOW64\msvcr100_clr0400.dll
2017-03-20 00:48:06 ----A---- C:\Windows\SYSWOW64\msvcp110_clr0400.dll
2017-03-20 00:48:06 ----A---- C:\Windows\SYSWOW64\aspnet_counters.dll
2017-03-20 00:41:38 ----A---- C:\Windows\system32\msvcr110_clr0400.dll
2017-03-20 00:41:38 ----A---- C:\Windows\system32\msvcr100_clr0400.dll
2017-03-20 00:41:38 ----A---- C:\Windows\system32\msvcp110_clr0400.dll
2017-03-20 00:41:38 ----A---- C:\Windows\system32\aspnet_counters.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\msxml3.dll
2017-03-14 19:24:41 ----A---- C:\Windows\system32\DWrite.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\usp10.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\inetcomm.dll
2017-03-14 19:24:40 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\usp10.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\mscms.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\inetcomm.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\icm32.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\FntCache.dll
2017-03-14 19:24:40 ----A---- C:\Windows\system32\drivers\srv.sys
2017-03-14 19:24:40 ----A---- C:\Windows\HelpPane.exe
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\WcsPlugInService.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\mscms.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\INETRES.dll
2017-03-14 19:24:39 ----A---- C:\Windows\SYSWOW64\icm32.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\WcsPlugInService.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\msxml3r.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\INETRES.dll
2017-03-14 19:24:39 ----A---- C:\Windows\system32\drivers\srvnet.sys
2017-03-14 19:24:39 ----A---- C:\Windows\system32\drivers\srv2.sys
2017-03-14 19:20:17 ----A---- C:\Windows\system32\appraiser.dll
2017-03-14 19:20:17 ----A---- C:\Windows\system32\aepic.dll
2017-03-14 19:20:17 ----A---- C:\Windows\system32\aeinv.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\invagent.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\generaltel.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\devinv.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\CompatTelRunner.exe
2017-03-14 19:20:16 ----A---- C:\Windows\system32\centel.dll
2017-03-14 19:20:16 ----A---- C:\Windows\system32\acmigration.dll

======List of files/folders modified in the last 1 month======

2017-04-13 20:24:28 ----D---- C:\Users\MARTIN\AppData\Roaming\uTorrent
2017-04-13 20:21:03 ----D---- C:\Windows\Temp
2017-04-13 20:11:54 ----D---- C:\Windows\System32
2017-04-13 20:11:54 ----D---- C:\Windows\inf
2017-04-13 20:11:54 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-04-13 20:06:09 ----D---- C:\Windows\system32\Tasks
2017-04-13 20:05:58 ----D---- C:\ProgramData\NVIDIA
2017-04-13 20:05:01 ----D---- C:\Windows\system32\config
2017-04-13 20:04:16 ----D---- C:\Windows\Tasks
2017-04-13 19:58:53 ----D---- C:\Users\MARTIN\AppData\Roaming\Skype
2017-04-13 19:20:18 ----D---- C:\ProgramData\MFAData
2017-04-13 19:10:44 ----HD---- C:\ProgramData
2017-04-13 13:27:30 ----SHD---- C:\System Volume Information
2017-04-13 13:24:42 ----D---- C:\Windows\system32\drivers
2017-04-13 13:16:21 ----RD---- C:\Program Files
2017-04-13 13:16:20 ----SHD---- C:\Windows\Installer
2017-04-13 09:44:53 ----D---- C:\AdwCleaner
2017-04-13 08:53:55 ----D---- C:\Windows\Microsoft.NET
2017-04-13 08:50:29 ----RSD---- C:\Windows\assembly
2017-04-13 08:38:53 ----D---- C:\Windows\winsxs
2017-04-13 08:37:39 ----D---- C:\Windows\SYSWOW64\es-ES
2017-04-13 08:37:39 ----D---- C:\Windows\SYSWOW64\en-US
2017-04-13 08:37:39 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-04-13 08:37:39 ----D---- C:\Windows\SysWOW64
2017-04-13 08:37:39 ----D---- C:\Windows\system32\es-ES
2017-04-13 08:37:39 ----D---- C:\Windows\system32\en-US
2017-04-13 08:37:39 ----D---- C:\Windows\system32\cs-CZ
2017-04-13 08:37:39 ----D---- C:\Windows\system32\Boot
2017-04-13 08:37:39 ----D---- C:\Windows\AppPatch
2017-04-13 08:37:39 ----D---- C:\Program Files\Internet Explorer
2017-04-13 08:37:39 ----D---- C:\Program Files (x86)\Internet Explorer
2017-04-13 01:28:10 ----D---- C:\Program Files\Microsoft Silverlight
2017-04-13 01:28:10 ----D---- C:\Program Files (x86)\Microsoft Silverlight
2017-04-13 01:28:00 ----D---- C:\Windows\system32\MRT
2017-04-13 01:27:12 ----D---- C:\Windows\debug
2017-04-13 01:27:08 ----AC---- C:\Windows\system32\MRT.exe
2017-04-13 01:26:05 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-04-12 23:04:20 ----D---- C:\Windows
2017-04-12 21:22:44 ----D---- C:\Program Files (x86)\Common Files
2017-04-12 21:22:40 ----RD---- C:\Program Files (x86)
2017-04-12 21:22:35 ----D---- C:\Program Files\Common Files
2017-04-12 17:41:17 ----D---- C:\Windows\system32\catroot2
2017-04-12 16:15:24 ----D---- C:\Users\MARTIN\AppData\Roaming\DAEMON Tools Pro
2017-04-10 16:15:23 ----D---- C:\Users\MARTIN\AppData\Roaming\vlc
2017-04-10 12:19:50 ----D---- C:\Program Files\WinRAR
2017-04-07 23:39:28 ----D---- C:\Windows\Prefetch
2017-03-26 19:59:16 ----SD---- C:\Users\MARTIN\AppData\Roaming\Microsoft
2017-03-25 14:12:21 ----D---- C:\Windows\SoftwareDistribution
2017-03-16 15:37:20 ----RSD---- C:\Windows\Fonts
2017-03-15 00:40:56 ----SD---- C:\Windows\system32\CompatTel
2017-03-15 00:40:56 ----D---- C:\Windows\SYSWOW64\migration
2017-03-15 00:40:56 ----D---- C:\Windows\system32\migration
2017-03-15 00:40:56 ----D---- C:\Windows\system32\appraiser
2017-03-15 00:40:56 ----D---- C:\Program Files\DVD Maker

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AVGIDSHA;AVGIDSHA; C:\Windows\system32\DRIVERS\avgidsha.sys [2016-10-05 267008]
R0 Avgloga;AVG Logging Driver; C:\Windows\system32\DRIVERS\avgloga.sys [2016-02-16 360736]
R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx64.sys [2016-09-26 254208]
R0 Avgrkx64;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx64.sys [2016-06-01 52992]
R0 avguniva;AVG Universal Driver; C:\Windows\system32\DRIVERS\avguniva.sys [2016-06-20 77056]
R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2014-06-27 20464]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 Avgdiska;AVG Disk Driver; C:\Windows\system32\DRIVERS\avgdiska.sys [2016-05-13 163072]
R1 Avgfwfd;AVG network filter service; C:\Windows\system32\DRIVERS\avgfwd6a.sys [2016-10-23 73992]
R1 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\avgidsdrivera.sys [2017-02-20 313088]
R1 Avgldx64;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx64.sys [2016-11-30 298240]
R1 Avgtdia;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdia.sys [2016-07-27 299264]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2015-07-30 186784]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R3 dtscsibus;DAEMON Tools Virtual SCSI Bus; C:\Windows\system32\DRIVERS\dtscsibus.sys [2016-11-17 29864]
R3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D; C:\Windows\system32\DRIVERS\e1d62x64.sys [2014-03-14 487704]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2015-06-18 4496600]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2014-06-27 383472]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2014-06-27 795120]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2014-06-24 125952]
R3 NETwNs64;___ Ovladač adaptéru Intel(R) Wireless pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETwsw02.sys [2013-08-15 3586528]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2014-09-17 197408]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service; C:\Windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2015-07-30 264040]
S3 gdrv;gdrv; \??\C:\Windows\gdrv.sys [2014-10-24 25640]
S3 hidkmdf;KMDF Driver; C:\Windows\system32\DRIVERS\hidkmdf.sys [2014-10-25 14136]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TrojanKillerDriver;GridinSoft Trojan Killer Driver; C:\Windows\system32\DRIVERS\gtkdrv.sys [2017-02-10 29456]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-21 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-21 21760]
S3 WacHidRouter;Wacom Hid Router; C:\Windows\system32\DRIVERS\wachidrouter.sys [2014-10-25 100664]
S3 wacomrouterfilter;Wacom Router Filter Driver; C:\Windows\system32\DRIVERS\wacomrouterfilter.sys [2014-10-25 15160]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-05-08 65432]
R2 AGSService;Adobe Genuine Software Integrity Service; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2017-02-27 2227312]
R2 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-01-31 19232]
R2 avgfws;AVG Firewall; C:\Program Files (x86)\AVG\Av\avgfwsa.exe [2017-03-23 1824184]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [2017-03-23 5334432]
R2 avgsvc;AVG Service; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [2016-12-06 1146128]
R2 avgwd;AVG WatchDog; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [2017-03-23 729048]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2013-11-07 1186168]
R2 Bluetooth Media Service;Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2013-11-21 1689976]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2013-11-07 1161592]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2015-10-09 2505472]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2013-08-06 626416]
R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [2014-03-11 260360]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2014-06-24 154584]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2014-06-24 405976]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2014-09-13 934216]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2013-08-06 149744]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-09-13 411968]
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R3 Disc Soft Bus Service;Disc Soft Bus Service; C:\Program Files (x86)\DAEMON Tools Pro\DiscSoftBusService.exe [2014-11-10 2216208]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-03-20 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-03-20 125064]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-05 144200]
S2 SkypeUpdate;Skype Updater; C:\Program Files (x86)\Skype\Updater\Updater.exe [2016-03-23 327808]
S2 TuneUp.UtilitiesSvc;AVG PC TuneUp Service; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2015-08-04 2973400]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 AvgAMPS;AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [2017-03-23 1002552]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2014-11-01 1432400]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-05 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-25 114688]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2014-05-13 887256]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-01-21 30963576]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2017-03-10 147400]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2013-08-06 273136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SwitchBoard;SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-11-01 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-03-20 51320]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]

-----------------EOF-----------------
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119359
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: nova.rambler.ru a další pop up malware či co

#9 Příspěvek od Rudy »

Smazáno. Teď spusťte tyto skeny:

1. Stahnete Zoek.exe http://download.bleepingcomputer.com/smeenk/zoek.exe a ulozte jej na plochu

Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
Do okna vlozte skript nize




autoclean;
resethosts;
emptyclsid;
IEdefaults;
FFdefaults;
CHRdefaults;
emptyIEcache;
emptyFFcache;
emptyCHRcache;
emptyalltemp;
emptyflash;
emptyjava;
emptyrecycle.bin;





Nasledne kliknete na Run Script
PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem.

a

2. Junkware removal tool: http://thisisudax.org/downloads/JRT.exe
•Ulozte nejlepe na plochu
•Po spusteni se zobrazi licencni podminky, stisknete libovolnou klavesu
•Probehne vytvoreni zalohy a nasledne prohledavani
•Probehne skenovani a pak se objevi log, pripadne bude ulozen v c:\JRT jako JRT.txt, ten sem vlozte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
martwer
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 12 dub 2017 16:26

Re: nova.rambler.ru a další pop up malware či co

#10 Příspěvek od martwer »

zoek:


Zoek.exe v5.0.0.1 Updated 27-09-2015
Tool run by MARTIN on 13/04/2017 at 20:46:21.10.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode No Internet Access Detected
Launched: C:\Users\MARTIN\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

13/04/2017 20:47:05 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\Seznam.cz deleted successfully
C:\Program Files\Bitmanagement Software deleted successfully
C:\PROGRA~3\ALM deleted successfully
C:\PROGRA~3\Malwarebytes deleted successfully
C:\PROGRA~3\Ubisoft deleted successfully
C:\Users\Default\AppData\Roaming\DAEMON Tools Pro deleted successfully
C:\Users\MARTIN\AppData\Local\CrashDumps deleted successfully
C:\Users\MARTIN\AppData\Local\EmieBrowserModeList deleted successfully
C:\Users\MARTIN\AppData\Local\EmieSiteList deleted successfully
C:\Users\MARTIN\AppData\Local\EmieUserList deleted successfully
C:\Users\MARTIN\AppData\Local\GHISLER deleted successfully
C:\Users\MARTIN\AppData\Local\Opera Software deleted successfully
C:\Users\MARTIN\AppData\Local\Skype deleted successfully
C:\Users\MARTIN\AppData\Local\Ubisoft Game Launcher deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-562087197-3438250226-4212528524-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{95B7759C-8C7F-4BF1-B163-73684A933233} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\MARTIN\AppData\Roaming\Thunderbird\Profiles\1sr1cvbj.default\prefs.js:

Added to C:\Users\MARTIN\AppData\Roaming\Thunderbird\Profiles\1sr1cvbj.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Seznam.cz not found
C:\windows\SysNative\Tasks\0316tbUpdateInfo deleted
C:\Users\MARTIN\.android deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\MARTIN\AppData\Local\cache deleted
C:\Users\MARTIN\AppData\Local\CrashRpt deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\MARTIN\AppData\Roaming\Thunderbird\Profiles\1sr1cvbj.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"web2pdfextension@web2pdf.adobedotcom"="C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn" [02/11/2014 00:38]

==== Firefox Extensions ======================

==== Firefox Plugins ======================


==== Chromium Look ======================


Chrome Media Router - MARTIN\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... 02&pc=UE14"

==== Reset Google Chrome ======================

C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Web TuneUp deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\MARTIN\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\MARTIN\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=232 folders=33 107915390 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\MARTIN\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\MARTIN\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 13/04/2017 at 21:03:16.29 ======================


JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.3 (04.10.2017)
Operating System: Windows 7 Professional x64
Ran by MARTIN (Administrator) on 13/04/2017 at 21:05:04.99
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0




Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13/04/2017 at 21:06:51.94
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119359
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: nova.rambler.ru a další pop up malware či co

#11 Příspěvek od Rudy »

OK. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
martwer
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 12 dub 2017 16:26

Re: nova.rambler.ru a další pop up malware či co

#12 Příspěvek od martwer »

Žádné stopy po nějaké anomálii. Běhá to dobře..super.
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119359
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: nova.rambler.ru a další pop up malware či co

#13 Příspěvek od Rudy »

To jsem rád! :)
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
martwer
Návštěvník
Návštěvník
Příspěvky: 18
Registrován: 12 dub 2017 16:26

Re: nova.rambler.ru a další pop up malware či co

#14 Příspěvek od martwer »

Tak ještě jednou děkuji!

A ještě jeden dotaz, když už jsem zde. Myslíte, že by bylo možné zkusit podobnou proceduru na mém druhém pc/notebooku?
Tam nemám problém s malwarem atp. ale na svůj hardware hardware se chová již hodně zpomaleně. Asi již zkrátka zanesený hodně.
Rád bych se vyhnul kompletní reinstalaci, můžeme na to ješte mrknout?
Nahoru
Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119359
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:
Kontaktovat uživatele Rudy

Re: nova.rambler.ru a další pop up malware či co

#15 Příspěvek od Rudy »

Můžeme. Postup bude asi stejný (téměř). Dejte ale log FRST: http://forum.viry.cz/viewtopic.php?f=13&t=133100 . Tem je novější.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování: Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.
Nahoru
Zamčeno

Zpět na „Řešení problémů, logy“