Odvirování PC, zrychlení počítače, vzdálená pomoc prostřednictvím služby neslape.cz

NOD nachází trojského koně Win32/Fynloski.AN

Máte problém s virem? Vložte sem log z FRST nebo RSIT.

Moderátor: Moderátoři

Pravidla fóra
Pokud chcete pomoc, vložte log z FRST [návod zde] nebo RSIT [návod zde]

Jednotlivé thready budou po vyřešení uzamčeny. Stejně tak ty, které budou nečinné déle než 14 dní. Vizte Pravidlo o zamykání témat. Děkujeme za pochopení.

!NOVINKA!
Nově lze využívat služby vzdálené pomoci, kdy se k vašemu počítači připojí odborník a bližší informace o problému si od vás získá telefonicky! Více na www.neslape.cz
Zamčeno
Zpráva
Autor
Ejcej
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 24 črc 2011 20:31

NOD nachází trojského koně Win32/Fynloski.AN

#1 Příspěvek od Ejcej »

Dobrý den, chtěl bych poprosit o pomoc při vyčištění PC od trojského koně Win32/Fynloski.AN.

Přikládám log z RSIT

Kód: Vybrat vše

Logfile of random's system information tool 1.16 (written by random/random) 
Run by pazdera at 2017-04-28 16:41:32
Microsoft Windows 7 Professional  Service Pack 1
System drive C: has 228 GB (75%) free of 305 GB
Total RAM: 3979 MB (48% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:41:54, on 28.4.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18639)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Windows\SysWOW64\svchost.exe
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\Program Files\trend micro\pazdera_RSITx64.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [SpybotPostWindows10UpgradeReInstall] "C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe"
O4 - HKCU\..\Run: [jwEvBNvKsXEVDREEaksw] C:\Users\pazdera\AppData\Local\Temp\XdSbyQJrUmlmgjRqqXSy.vbs
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe
O23 - Service: ESET SHA Service (ESHASRV) - ESET - C:\Program Files\ESET\ESET Endpoint Security\EShaSrv.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Platform Service (LPlatSvc) - Unknown owner - C:\Windows\system32\LPlatSvc.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\Windows\system32\SAsrv.exe
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: Mobile Broadband Service (WMCoreService) - Ericsson AB - C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8434 bytes

====== Enumerating Processes ======

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
C:\Windows\system32\LPlatSvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\system32\CxAudMsg64.exe
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"
C:\Windows\SysWOW64\SAsrv.exe
C:\Windows\system32\taskhost.exe
"C:\Windows\system32\LPlatSvc.exe" -EM
C:\Windows\system32\taskeng.exe
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe" 
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" 
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe" 
"C:\Program Files\ESET\ESET Endpoint Security\egui.exe" /hide /waitservice
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
"C:\Windows\System32\hkcmd.exe" 
"C:\Windows\System32\igfxpers.exe" 
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" 
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe"
"C:\Windows\SysWOW64\svchost.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
"C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe" servicemode
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.FullScreenMagnifier
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
"C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE" 
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" 
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 "--database=C:\Users\pazdera\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\pazdera\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=57.0.2987.133 --initial-client-data=0x80,0x84,0x88,0x7c,0x8c,0x7fef25b3970,0x7fef25b3960,0x7fef25b3980
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=5020 --on-initialized-event-handle=316 --parent-handle=324 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1164 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,61,74 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x8086 --gpu-device-id=0x0126 --gpu-driver-vendor="Intel Corporation" --gpu-driver-version=9.17.10.4229 --gpu-driver-date=5-26-2015 --service-request-channel-token=1175C6FE984F967860CD3785AC0DBD87 --mojo-platform-channel-handle=1176 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=790ECF3212990D82D7C286140FEFFF70 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=790ECF3212990D82D7C286140FEFFF70 --renderer-client-id=4 --mojo-platform-channel-handle=1876 /prefetch:1
C:\Windows\servicing\TrustedInstaller.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=84ABF762EABA2E13643C00DD80AF5BBC --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=84ABF762EABA2E13643C00DD80AF5BBC --renderer-client-id=12 --mojo-platform-channel-handle=4668 /prefetch:1
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=25518807F62FEF80D3806FFE48C1F8E0 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=25518807F62FEF80D3806FFE48C1F8E0 --renderer-client-id=17 --mojo-platform-channel-handle=2272 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=36C7E48820682F0433825B8538161883 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=36C7E48820682F0433825B8538161883 --renderer-client-id=18 --mojo-platform-channel-handle=2392 /prefetch:1
C:\Windows\System32\svchost.exe -k swprv
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=F589B214A0468F04A19DA0C56BF82883 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=F589B214A0468F04A19DA0C56BF82883 --renderer-client-id=21 --mojo-platform-channel-handle=4152 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=AAE208E008B9F0DF920838897A2B7921 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=AAE208E008B9F0DF920838897A2B7921 --renderer-client-id=28 --mojo-platform-channel-handle=3076 /prefetch:1
C:\Windows\system32\CompatTelRunner.exe 
\??\C:\Windows\system32\conhost.exe "308350311-1943768339955206031939285115-4774526531720227677-3750853211220173311
C:\Windows\system32\CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun -cv:G4wOHeYmnkifKZCK.1
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\sppsvc.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" 
"C:\Windows\system32\SearchFilterHost.exe" 0 528 532 540 65536 536 
"C:\Users\pazdera\Downloads\RSITx64.exe" 

====== Scheduled tasks folder ======

C:\Windows\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\system32\tasks\klcp_update - "%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\CodecTweakTool.exe" /verysilent /update /freq=30
C:\Windows\system32\tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" /autoupdate /silent /autoclose /background
C:\Windows\system32\tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe" /immunize /silent /autoclose
C:\Windows\system32\tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe" /scan /cleanclose
C:\Windows\system32\tasks\Microsoft\Windows Defender\MP Scheduled Scan - c:\program files\windows defender\MpCmdRun.exe Scan -ScheduleJob -WinTask -RestrictPrivilegesScan
C:\Windows\system32\tasks\Microsoft\Windows\WindowsBackup\ConfigNotification - %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
C:\Windows\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\Windows\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -queuereporting
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask - %SystemRoot%\system32\Wat\WatAdminSvc.exe /run
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline - %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask"
C:\Windows\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\Windows\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
C:\Windows\system32\tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask - sc.exe start sppsvc
C:\Windows\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\Windows\system32\tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem - %SystemRoot%\System32\powercfg.exe -energy -auto
C:\Windows\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\Windows\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService - %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks - %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ehDRMInit - %SystemRoot%\ehome\ehPrivJob.exe /DRMInit
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\InstallPlayReady - %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\mcupdate - %SystemRoot%\ehome\mcupdate $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURActivate - %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURDiscovery - %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscovery - %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 - %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 - %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PeriodicScanRetry - %windir%\ehome\MCUpdate.exe -pscn 0
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrScheduleTask - %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RecordingRestart - %SystemRoot%\ehome\ehrec /RestartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RegisterSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ReindexSearchRoot - %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\UpdateRecordPath - %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotifications.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\Windows\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Uploader - %windir%\system32\WSqmCons.exe -u
C:\Windows\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\AitAgent - aitagent
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattel\DiagTrackRunner.exe /UploadEtlFilesOnly
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\Windows\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\Windows\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe

=========Google Chrome=========

C:\Users\pazdera\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Extension aapocclcgogkmnckokdopfmhonfmgoek 1 Prezentace Google 0.9
Extension ahfgeienlihckogmohjhadlkjgocpleb 1 Obchod Chrome 0.2
Extension aohghmighlieiainnegkcijnfilokake 1 Dokumenty Google 0.9
Extension apdfllckaahabafndbhieahigkjlhalf 1 Disk Google 14.1
Extension bepbmhgboaologfdajaanbcjmnhjmhfn 0  
Extension blpcfgokakmgnkcojhhkbfbldkacnbeo 1 YouTube 4.2.8
Extension eemcgdkfndhakfknompkggombfjjjeno 1 Bookmark Manager 0.1
Extension efaidnbmnnnibpcajpcglclefindmkaj 2 Adobe Acrobat 15.1.0.5
Extension felcaaldnbdncclmgdcncolpebgiejap 1 Tabulky Google 1.1
Extension gfdkimpbcpahaombhbimeihdjnejgicl 1 Feedback 1.0
Extension ghbmnnjooekpmoecnnnilnnbdlolhkhi 1 Dokumenty Google offline 1.4
Extension kmendfapggjehodndflmmgagdbamhnfd 1 CryptoTokenExtension 0.9.46
Extension mfehgcgbbipciphmccgaenjidiccnmng 1 Cloud Print 0.1
Extension mfffpogegjflfpflabcdkioaeobkgjik 1 GaiaAuthExtension 0.0.1
Extension mhjfbmdgcfjbbpaeojofohoefgiehjai 1 Chrome PDF Viewer 1
Extension neajdppkdcdipfabeoofebfddakdcjhd 1 Google Network Speech 1.0
Extension nkeimhogjdpnpccoofpliimaahmaaome 1 Google Hangouts 1.3.2
Extension nmmhkkegccagdldgiimedpiccmgmieda 1 Platby Internetového obchodu Chrome 1.0.0.2
Extension pjkljhegncpnkpknbcohdijeoejaedia 1 Gmail 8.1
Extension pkedcjkdefgpdelpbcmbmeomcjbeemfm 1 Chrome Media Router 5717.116.0.4
Homepage: https://www.seznam.cz/
default_search_provider.search_url: 
C:\Users\pazdera\AppData\Local\Google\Chrome\User Data\Default\Preferences
Homepage: 
default_search_provider.search_url: 

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\efaidnbmnnnibpcajpcglclefindmkaj]
"Path"=


======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2013-07-13 686936]
"SynLenovoHelper"=C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe [2015-07-02 146600]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2015-07-02 3936936]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SACpl.exe [2012-06-13 1647616]
"egui"=C:\Program Files\ESET\ESET Endpoint Security\egui.exe [2014-09-24 4124360]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2016-03-02 183216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2016-03-02 411056]
"Persistence"=C:\Windows\system32\igfxpers.exe [2016-03-02 453544]
"Logitech Download Assistant"=C:\Windows\System32\LogiLDA.dll [2016-10-14 1841496]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotPostWindows10UpgradeReInstall"=C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [2015-07-28 1011200]
"jwEvBNvKsXEVDREEaksw"=C:\Users\pazdera\AppData\Local\Temp\XdSbyQJrUmlmgjRqqXSy.vbs [2017-03-08 351]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SDTray"=C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [2014-06-24 4101576]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
igfxdev.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot - Search & Destroy tray access"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath" = "C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw64.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm

====== File associations ======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

====== List of files/folders created in the last 1 month ======

2017-04-28 16:41:33 ----D---- C:\Program Files\trend micro
2017-04-28 16:41:32 ----D---- C:\rsit
2017-04-15 19:38:40 ----D---- C:\Program Files (x86)\Clementine
2017-04-12 23:00:47 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2017-04-12 23:00:47 ----A---- C:\Windows\system32\rdpcorets.dll
2017-04-12 23:00:47 ----A---- C:\Windows\system32\mshtml.dll
2017-04-12 23:00:45 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-04-12 23:00:45 ----A---- C:\Windows\system32\ieframe.dll
2017-04-12 23:00:44 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-04-12 23:00:44 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-04-12 23:00:43 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-04-12 23:00:43 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\wuaueng.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\wininet.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\ole32.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\iertutil.dll
2017-04-12 23:00:42 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\wucltux.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\win32spl.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\win32k.sys
2017-04-12 23:00:42 ----A---- C:\Windows\system32\urlmon.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\samsrv.dll
2017-04-12 23:00:41 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-04-12 23:00:41 ----A---- C:\Windows\system32\wuapi.dll
2017-04-12 23:00:41 ----A---- C:\Windows\system32\ucrtbase.dll
2017-04-12 23:00:41 ----A---- C:\Windows\system32\quartz.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\msfeeds.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\gdi32.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\cdosys.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\atmfd.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\ucrtbase.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\rdpudd.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\iedkcs32.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\jscript.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 23:00:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-04-12 23:00:36 ----A---- C:\Windows\system32\ntdll.dll
2017-04-12 23:00:35 ----A---- C:\Windows\system32\samlib.dll
2017-04-12 23:00:35 ----A---- C:\Windows\system32\jscript9.dll
2017-04-12 23:00:35 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-04-12 23:00:35 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-04-12 23:00:35 ----A---- C:\Windows\system32\asycfilt.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\samlib.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\mfmjpegdec.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2017-04-12 23:00:34 ----A---- C:\Windows\system32\webcheck.dll
2017-04-12 23:00:34 ----A---- C:\Windows\system32\mfmjpegdec.dll
2017-04-12 23:00:33 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2017-04-12 23:00:33 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-04-12 23:00:33 ----A---- C:\Windows\system32\wuwebv.dll
2017-04-12 23:00:33 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-04-12 23:00:33 ----A---- C:\Windows\system32\ie4uinit.exe
2017-04-12 23:00:33 ----A---- C:\Windows\system32\certcli.dll
2017-04-12 23:00:32 ----A---- C:\Windows\SYSWOW64\wups.dll
2017-04-12 23:00:32 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-04-12 23:00:32 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wups2.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wups.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wudriver.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wuauclt.exe
2017-04-12 23:00:32 ----A---- C:\Windows\system32\vbscript.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\srcore.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\rpcrt4.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\ieui.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\ieapfltr.dll
2017-04-12 23:00:31 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2017-04-12 23:00:31 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\srclient.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\smss.exe
2017-04-12 23:00:31 ----A---- C:\Windows\system32\mshtmled.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\lsasrv.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\kerberos.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\dxtrans.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\dxtmsft.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-04-12 23:00:30 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\WinSetupUI.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\rstrui.exe
2017-04-12 23:00:30 ----A---- C:\Windows\system32\msrating.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\kernel32.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\advapi32.dll
2017-04-12 23:00:29 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\schannel.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\occache.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 23:00:29 ----A---- C:\Windows\system32\jsproxy.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\jscript9diag.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\conhost.exe
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\wow64win.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\winsrv.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\wdigest.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\TSpkg.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\sspicli.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\ncrypt.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\msv1_0.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\KernelBase.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\inseng.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\ieUnatt.exe
2017-04-12 23:00:28 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\wuapp.exe
2017-04-12 23:00:27 ----A---- C:\Windows\system32\wow64.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\rpchttp.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\iesetup.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\iernonce.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-04-12 23:00:27 ----A---- C:\Windows\system32\cdd.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\bcrypt.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\wow64cpu.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\sspisrv.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\secur32.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\lsass.exe
2017-04-12 23:00:26 ----A---- C:\Windows\system32\lpk.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-04-12 23:00:26 ----A---- C:\Windows\system32\fontsub.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\drivers\appid.sys
2017-04-12 23:00:26 ----A---- C:\Windows\system32\dciman32.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\csrsrv.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\cryptbase.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\appidsvc.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\appidapi.dll
2017-04-12 23:00:25 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\lpk.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\ntvdm64.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\credssp.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\auditpol.exe
2017-04-12 23:00:25 ----A---- C:\Windows\system32\atmlib.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 23:00:25 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\user.exe
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\tzres.dll
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-04-12 23:00:23 ----A---- C:\Windows\system32\tzres.dll
2017-04-12 23:00:23 ----A---- C:\Windows\system32\apisetschema.dll
2017-04-12 23:00:22 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-04-12 23:00:22 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-04-12 23:00:22 ----A---- C:\Windows\system32\msaudite.dll
2017-04-12 23:00:22 ----A---- C:\Windows\system32\adtschema.dll
2017-04-12 23:00:21 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-04-12 23:00:21 ----A---- C:\Windows\system32\msobjs.dll
2017-04-12 23:00:21 ----A---- C:\Windows\system32\ieetwcollectorres.dll

====== List of files/folders modified in the last 1 month ======

2017-04-28 16:41:37 ----D---- C:\Windows\Temp
2017-04-28 16:41:33 ----RD---- C:\Program Files
2017-04-28 16:39:01 ----D---- C:\Windows\System32
2017-04-28 16:39:01 ----D---- C:\Windows\inf
2017-04-28 16:39:01 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-04-28 16:38:17 ----SHD---- C:\System Volume Information
2017-04-28 16:34:19 ----D---- C:\Users\pazdera\AppData\Roaming\dclogs
2017-04-28 16:33:15 ----D---- C:\Windows\system32\config
2017-04-15 19:38:40 ----RD---- C:\Program Files (x86)
2017-04-15 19:20:31 ----D---- C:\Windows\Microsoft.NET
2017-04-15 19:20:18 ----RSD---- C:\Windows\assembly
2017-04-15 16:47:24 ----D---- C:\Windows\system32\DriverStore
2017-04-14 18:09:07 ----SHD---- C:\Windows\Installer
2017-04-12 23:34:47 ----D---- C:\Windows
2017-04-12 23:29:50 ----D---- C:\Windows\winsxs
2017-04-12 23:27:49 ----D---- C:\Windows\system32\drivers
2017-04-12 23:26:22 ----D---- C:\Windows\SYSWOW64\sk-SK
2017-04-12 23:26:22 ----D---- C:\Windows\SYSWOW64\en-US
2017-04-12 23:26:22 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-04-12 23:26:22 ----D---- C:\Program Files\Internet Explorer
2017-04-12 23:26:21 ----D---- C:\Windows\SysWOW64
2017-04-12 23:26:20 ----D---- C:\Windows\system32\sk-SK
2017-04-12 23:26:20 ----D---- C:\Windows\system32\en-US
2017-04-12 23:26:20 ----D---- C:\Windows\system32\cs-CZ
2017-04-12 23:26:18 ----D---- C:\Windows\AppPatch
2017-04-12 23:26:18 ----D---- C:\Program Files (x86)\Internet Explorer
2017-04-12 23:26:17 ----D---- C:\Windows\system32\Boot
2017-04-12 23:12:51 ----D---- C:\Windows\system32\MRT
2017-04-12 23:09:11 ----AC---- C:\Windows\system32\MRT.exe
2017-04-12 23:05:48 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-04-12 22:45:10 ----D---- C:\Windows\system32\catroot2

File C:\Windows\system32\winlogon.exe is digitally signed
File C:\Windows\system32\wininit.exe is digitally signed
File C:\Windows\explorer.exe is digitally signed
File C:\Windows\SysWOW64\explorer.exe is digitally signed
File C:\Windows\system32\svchost.exe is digitally signed
File C:\Windows\SysWOW64\svchost.exe is digitally signed
File C:\Windows\system32\services.exe is digitally signed
File C:\Windows\system32\User32.dll is digitally signed
File C:\Windows\SysWOW64\User32.dll is digitally signed
File C:\Windows\system32\userinit.exe is digitally signed
File C:\Windows\SysWOW64\userinit.exe is digitally signed
File C:\Windows\system32\rpcss.dll is digitally signed
File C:\Windows\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2014-09-10 59064]
R0 iaStorA;iaStorA; C:\Windows\system32\drivers\iaStorA.sys [2015-05-29 646408]
R0 iaStorF;iaStorF; C:\Windows\system32\drivers\iaStorF.sys [2015-05-29 30960]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2014-08-19 219696]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2014-08-19 155896]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2014-08-19 40512]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2014-08-19 198096]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2014-03-25 1588440]
R3 cykbfltrService;Cypress Keyboard Filter Driver; C:\Windows\system32\DRIVERS\cykbfltr.sys [2012-06-15 16896]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2015-10-29 506880]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2017-02-20 82816]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2016-03-02 5384728]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2012-10-02 342528]
R3 LenovoRd;LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [2009-05-11 118016]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2015-07-28 178976]
R3 NETwNs64;___ Ovladaè adaptéru øady Intel(R) Wireless WiFi Link 5000 pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETwsw01.sys [2015-05-04 11534096]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2015-07-02 33960]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2015-07-02 607400]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
S3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
S3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\agrsm64.sys [2009-06-10 1146880]
S3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\drivers\Apfiltr.sys [2013-07-13 499504]
S3 atmeltpm;atmeltpm; C:\Windows\system32\drivers\atmeltpm64.sys [2011-08-05 19456]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 71168]
S3 ecnssndis; Mobile Broadband Driver; C:\Windows\System32\Drivers\wwuss64.sys [2011-06-13 26664]
S3 ecnssndisfltr; Mobile Broadband Driver Filter; C:\Windows\System32\Drivers\wwussf64.sys [2011-06-13 30248]
S3 l36wgps; Mobile Broadband GPS Port; C:\Windows\system32\drivers\l36wgps64.sys [2011-07-01 101416]
S3 Mbm3CBus;F3507g Mobile Broadband Device (WDM); C:\Windows\system32\drivers\Mbm3CBus.sys [2011-04-29 419400]
S3 Mbm3DevMt; Mobile Broadband Device Management Driver (WDM); C:\Windows\system32\drivers\Mbm3DevMt.sys [2011-04-29 430664]
S3 Mbm3mdfl; Mobile Broadband Modem Port Filter; C:\Windows\system32\DRIVERS\Mbm3mdfl.sys [2011-04-29 19528]
S3 Mbm3Mdm; Mobile Broadband Modem Port Driver; C:\Windows\system32\DRIVERS\Mbm3Mdm.sys [2011-04-29 483400]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 109056]
S3 SmbDrv;SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [2015-07-02 33448]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2012-08-23 29696]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2013-10-02 29696]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUSB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-20 41984]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2016-12-19 82640]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\cscsvc.dll
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2012-06-08 201376]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; %SystemRoot%\System32\svchost.exe -k utcsvc;"ServiceDll" = %SystemRoot%\system32\diagtrack.dll
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe [2014-09-24 1029704]
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2017-02-20 184400]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
R2 LPlatSvc;Lenovo Platform Service; C:\Windows\system32\LPlatSvc.exe [2017-02-20 711248]
R2 MDM;Machine Debug Manager; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 SAService;Conexant SmartAudio service; C:\Windows\system32\SAsrv.exe []
R2 SDScannerService;Spybot-S&D 2 Scanner Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-06-24 1738168]
R2 SDUpdateService;Spybot-S&D 2 Updating Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2016-09-21 4088608]
R2 SDWSCService;Spybot-S&D 2 Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2016-11-24 235984]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
R2 WMCoreService;Mobile Broadband Service; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [2011-08-12 648744]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2012-04-24 169752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-03-20 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-03-20 125064]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-20 153752]
S3 AppMgmt;@appmgmts.dll,-3250; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\appmgmts.dll
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2016-03-02 290224]
S3 ESHASRV;ESET SHA Service; C:\Program Files\ESET\ESET Endpoint Security\EShaSrv.exe [2014-09-24 190152]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-20 153752]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-25 114688]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; %SystemRoot%\System32\svchost.exe -k PeerDist;"ServiceDll" = %SystemRoot%\system32\peerdistsvc.dll
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\system32\storsvc.dll
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\umrdp.dll
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2016-02-15 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-03-20 51320]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]

-----------------EOF-----------------
Děkuji za pomoc.

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119670
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: NOD nachází trojského koně Win32/Fynloski.AN

#2 Příspěvek od Rudy »

Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan<(hledání) a pak na >Clean< (mazání).
Proběhne skenováni a pak se objeví log, který sem vložte.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Ejcej
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 24 črc 2011 20:31

Re: NOD nachází trojského koně Win32/Fynloski.AN

#3 Příspěvek od Ejcej »

Před vaší odpovědí jsem projel PC spybotem.

Přikládám log AdvCleaneru

Kód: Vybrat vše

# AdwCleaner v6.046 - Log vytvořen 28/04/2017 v 17:51:29
# Aktualizováno dne 24/04/2017 z Malwarebytes
# Databáze : 2017-04-25.1 [Server]
# Operační systém : Windows 7 Professional Service Pack 1 (X64)
# Uživatelské jméno : pazdera - PAZDERA-PC
# Spuštěno z : C:\Users\pazdera\Downloads\adwcleaner_6.046.exe
# Mod: Čištění
# Podpora : https://www.malwarebytes.com/support



***** [ Služby ] *****



***** [ Složky ] *****



***** [ Soubory ] *****



***** [ DLL ] *****



***** [ WMI ] *****



***** [ Zástupci ] *****



***** [ Naplánované úlohy ] *****



***** [ Registry ] *****

[-] Klíč smazán: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\slunecnice.cz
[-] Klíč smazán: HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.slunecnice.cz
[#] Klíč smazán po restartu: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\slunecnice.cz
[#] Klíč smazán po restartu: [x64] HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.slunecnice.cz


***** [ Prohlížeče ] *****



*************************

:: "Tracing" klíče smazány
:: Winsock nastavení vyčištěno

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1257 Bajty] - [28/04/2017 17:51:29]
C:\AdwCleaner\AdwCleaner[S0].txt - [1740 Bajty] - [28/04/2017 17:50:33]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [1403 Bajty] ##########

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119670
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: NOD nachází trojského koně Win32/Fynloski.AN

#4 Příspěvek od Rudy »

Dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Ejcej
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 24 črc 2011 20:31

Re: NOD nachází trojského koně Win32/Fynloski.AN

#5 Příspěvek od Ejcej »

Kód: Vybrat vše

Logfile of random's system information tool 1.16 (written by random/random) 
Run by pazdera at 2017-04-28 19:27:02
Microsoft Windows 7 Professional  Service Pack 1
System drive C: has 234 GB (77%) free of 305 GB
Total RAM: 3979 MB (48% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:27:11, on 28.4.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18639)
Boot mode: Normal

Running processes:
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files\trend micro\pazdera_RSITx64.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [SpybotPostWindows10UpgradeReInstall] "C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe"
O4 - HKCU\..\Run: [jwEvBNvKsXEVDREEaksw] C:\Users\pazdera\AppData\Local\Temp\XdSbyQJrUmlmgjRqqXSy.vbs
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe
O23 - Service: ESET SHA Service (ESHASRV) - ESET - C:\Program Files\ESET\ESET Endpoint Security\EShaSrv.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Platform Service (LPlatSvc) - Unknown owner - C:\Windows\system32\LPlatSvc.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\Windows\system32\SAsrv.exe
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: Mobile Broadband Service (WMCoreService) - Ericsson AB - C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8401 bytes

====== Enumerating Processes ======

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
C:\Windows\system32\LPlatSvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\system32\CxAudMsg64.exe
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"
C:\Windows\SysWOW64\SAsrv.exe
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
"C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe" servicemode
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.FullScreenMagnifier
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe" 
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" 
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe" 
"C:\Program Files\ESET\ESET Endpoint Security\egui.exe" /hide /waitservice
"C:\Windows\System32\hkcmd.exe" 
"C:\Windows\System32\igfxpers.exe" 
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" 
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE" 
"C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe"
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" 
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 "--database=C:\Users\pazdera\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\pazdera\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=57.0.2987.133 --initial-client-data=0x80,0x84,0x88,0x7c,0x8c,0x7fef2433970,0x7fef2433960,0x7fef2433980
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3948 --on-initialized-event-handle=308 --parent-handle=316 /prefetch:6
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1164 --disable-direct-composition --supports-dual-gpus=false --gpu-driver-bug-workarounds=7,10,18,19,20,23,41,61,74 --disable-gl-extensions="GL_KHR_blend_equation_advanced GL_KHR_blend_equation_advanced_coherent" --gpu-vendor-id=0x8086 --gpu-device-id=0x0126 --gpu-driver-vendor="Intel Corporation" --gpu-driver-version=9.17.10.4229 --gpu-driver-date=5-26-2015 --service-request-channel-token=C913129F08FFC45190DA4C4D21B1C635 --mojo-platform-channel-handle=1176 --ignored=" --type=renderer " /prefetch:2
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=55E54487E800CC0BBD9B38EDE2332144 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=55E54487E800CC0BBD9B38EDE2332144 --renderer-client-id=4 --mojo-platform-channel-handle=1932 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=EDEB3BBF6FCEFFBC814DAB5F76A0C1E5 --lang=cs --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=EDEB3BBF6FCEFFBC814DAB5F76A0C1E5 --renderer-client-id=5 --mojo-platform-channel-handle=2736 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=AF80D5F98BC17AA39388FF35F08F6BD2 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=AF80D5F98BC17AA39388FF35F08F6BD2 --renderer-client-id=6 --mojo-platform-channel-handle=3748 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=D564DA203108B95FCB218A15A8D54190 --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=D564DA203108B95FCB218A15A8D54190 --renderer-client-id=8 --mojo-platform-channel-handle=3484 /prefetch:1
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=96B8117F66D85FA308FB0C9FA7E1760E --lang=cs --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=96B8117F66D85FA308FB0C9FA7E1760E --renderer-client-id=7 --mojo-platform-channel-handle=4752 /prefetch:1
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1164 --primordial-pipe-token=287850FA50FC06E0014B1DEC1CF3617A --lang=cs --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=false --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553 --service-request-channel-token=287850FA50FC06E0014B1DEC1CF3617A --renderer-client-id=20 --mojo-platform-channel-handle=5092 /prefetch:1
"C:\Windows\system32\LPlatSvc.exe" -EM
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k defragsvc
"C:\Users\pazdera\Downloads\RSITx64.exe" 
C:\Windows\system32\wbem\wmiprvse.exe

====== Scheduled tasks folder ======

C:\Windows\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\system32\tasks\klcp_update - "%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\CodecTweakTool.exe" /verysilent /update /freq=30
C:\Windows\system32\tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" /autoupdate /silent /autoclose /background
C:\Windows\system32\tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe" /immunize /silent /autoclose
C:\Windows\system32\tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe" /scan /cleanclose
C:\Windows\system32\tasks\Microsoft\Windows Defender\MP Scheduled Scan - c:\program files\windows defender\MpCmdRun.exe Scan -ScheduleJob -WinTask -RestrictPrivilegesScan
C:\Windows\system32\tasks\Microsoft\Windows\WindowsBackup\ConfigNotification - %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
C:\Windows\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\Windows\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -queuereporting
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask - %SystemRoot%\system32\Wat\WatAdminSvc.exe /run
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline - %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask"
C:\Windows\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\Windows\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
C:\Windows\system32\tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask - sc.exe start sppsvc
C:\Windows\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\Windows\system32\tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem - %SystemRoot%\System32\powercfg.exe -energy -auto
C:\Windows\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\Windows\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService - %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks - %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ehDRMInit - %SystemRoot%\ehome\ehPrivJob.exe /DRMInit
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\InstallPlayReady - %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\mcupdate - %SystemRoot%\ehome\mcupdate $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURActivate - %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURDiscovery - %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscovery - %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 - %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 - %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PeriodicScanRetry - %windir%\ehome\MCUpdate.exe -pscn 0
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrScheduleTask - %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RecordingRestart - %SystemRoot%\ehome\ehrec /RestartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RegisterSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ReindexSearchRoot - %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\UpdateRecordPath - %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotifications.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\Windows\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Uploader - %windir%\system32\WSqmCons.exe -u
C:\Windows\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\AitAgent - aitagent
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattel\DiagTrackRunner.exe /UploadEtlFilesOnly
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\Windows\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\Windows\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe

=========Google Chrome=========

C:\Users\pazdera\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Extension aapocclcgogkmnckokdopfmhonfmgoek 1 Prezentace Google 0.9
Extension ahfgeienlihckogmohjhadlkjgocpleb 1 Obchod Chrome 0.2
Extension aohghmighlieiainnegkcijnfilokake 1 Dokumenty Google 0.9
Extension apdfllckaahabafndbhieahigkjlhalf 1 Disk Google 14.1
Extension bepbmhgboaologfdajaanbcjmnhjmhfn 0  
Extension blpcfgokakmgnkcojhhkbfbldkacnbeo 1 YouTube 4.2.8
Extension eemcgdkfndhakfknompkggombfjjjeno 1 Bookmark Manager 0.1
Extension efaidnbmnnnibpcajpcglclefindmkaj 2 Adobe Acrobat 15.1.0.5
Extension felcaaldnbdncclmgdcncolpebgiejap 1 Tabulky Google 1.1
Extension gfdkimpbcpahaombhbimeihdjnejgicl 1 Feedback 1.0
Extension ghbmnnjooekpmoecnnnilnnbdlolhkhi 1 Dokumenty Google offline 1.4
Extension kmendfapggjehodndflmmgagdbamhnfd 1 CryptoTokenExtension 0.9.46
Extension mfehgcgbbipciphmccgaenjidiccnmng 1 Cloud Print 0.1
Extension mfffpogegjflfpflabcdkioaeobkgjik 1 GaiaAuthExtension 0.0.1
Extension mhjfbmdgcfjbbpaeojofohoefgiehjai 1 Chrome PDF Viewer 1
Extension neajdppkdcdipfabeoofebfddakdcjhd 1 Google Network Speech 1.0
Extension nkeimhogjdpnpccoofpliimaahmaaome 1 Google Hangouts 1.3.2
Extension nmmhkkegccagdldgiimedpiccmgmieda 1 Platby Internetového obchodu Chrome 1.0.0.2
Extension pjkljhegncpnkpknbcohdijeoejaedia 1 Gmail 8.1
Extension pkedcjkdefgpdelpbcmbmeomcjbeemfm 1 Chrome Media Router 5717.116.0.4
Homepage: https://www.seznam.cz/
default_search_provider.search_url: 
C:\Users\pazdera\AppData\Local\Google\Chrome\User Data\Default\Preferences
Homepage: 
default_search_provider.search_url: 

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\efaidnbmnnnibpcajpcglclefindmkaj]
"Path"=


======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"URL"=http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2013-07-13 686936]
"SynLenovoHelper"=C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe [2015-07-02 146600]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2015-07-02 3936936]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SACpl.exe [2012-06-13 1647616]
"egui"=C:\Program Files\ESET\ESET Endpoint Security\egui.exe [2014-09-24 4124360]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2016-03-02 183216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2016-03-02 411056]
"Persistence"=C:\Windows\system32\igfxpers.exe [2016-03-02 453544]
"Logitech Download Assistant"=C:\Windows\System32\LogiLDA.dll [2016-10-14 1841496]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotPostWindows10UpgradeReInstall"=C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [2015-07-28 1011200]
"jwEvBNvKsXEVDREEaksw"=C:\Users\pazdera\AppData\Local\Temp\XdSbyQJrUmlmgjRqqXSy.vbs []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SDTray"=C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [2014-06-24 4101576]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
igfxdev.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot - Search & Destroy tray access"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath" = "C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw64.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm

====== File associations ======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

====== List of files/folders created in the last 1 month ======

2017-04-28 17:49:33 ----D---- C:\AdwCleaner
2017-04-28 16:41:33 ----D---- C:\Program Files\trend micro
2017-04-28 16:41:32 ----D---- C:\rsit
2017-04-15 19:38:40 ----D---- C:\Program Files (x86)\Clementine
2017-04-12 23:00:47 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2017-04-12 23:00:47 ----A---- C:\Windows\system32\rdpcorets.dll
2017-04-12 23:00:47 ----A---- C:\Windows\system32\mshtml.dll
2017-04-12 23:00:45 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-04-12 23:00:45 ----A---- C:\Windows\system32\ieframe.dll
2017-04-12 23:00:44 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-04-12 23:00:44 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-04-12 23:00:43 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-04-12 23:00:43 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\wuaueng.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\wininet.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\ole32.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\iertutil.dll
2017-04-12 23:00:42 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\wucltux.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\win32spl.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\win32k.sys
2017-04-12 23:00:42 ----A---- C:\Windows\system32\urlmon.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\samsrv.dll
2017-04-12 23:00:41 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-04-12 23:00:41 ----A---- C:\Windows\system32\wuapi.dll
2017-04-12 23:00:41 ----A---- C:\Windows\system32\ucrtbase.dll
2017-04-12 23:00:41 ----A---- C:\Windows\system32\quartz.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\msfeeds.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\gdi32.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\cdosys.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\atmfd.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\ucrtbase.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\rdpudd.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\iedkcs32.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\jscript.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 23:00:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-04-12 23:00:36 ----A---- C:\Windows\system32\ntdll.dll
2017-04-12 23:00:35 ----A---- C:\Windows\system32\samlib.dll
2017-04-12 23:00:35 ----A---- C:\Windows\system32\jscript9.dll
2017-04-12 23:00:35 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-04-12 23:00:35 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-04-12 23:00:35 ----A---- C:\Windows\system32\asycfilt.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\samlib.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\mfmjpegdec.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2017-04-12 23:00:34 ----A---- C:\Windows\system32\webcheck.dll
2017-04-12 23:00:34 ----A---- C:\Windows\system32\mfmjpegdec.dll
2017-04-12 23:00:33 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2017-04-12 23:00:33 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-04-12 23:00:33 ----A---- C:\Windows\system32\wuwebv.dll
2017-04-12 23:00:33 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-04-12 23:00:33 ----A---- C:\Windows\system32\ie4uinit.exe
2017-04-12 23:00:33 ----A---- C:\Windows\system32\certcli.dll
2017-04-12 23:00:32 ----A---- C:\Windows\SYSWOW64\wups.dll
2017-04-12 23:00:32 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-04-12 23:00:32 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wups2.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wups.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wudriver.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wuauclt.exe
2017-04-12 23:00:32 ----A---- C:\Windows\system32\vbscript.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\srcore.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\rpcrt4.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\ieui.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\ieapfltr.dll
2017-04-12 23:00:31 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2017-04-12 23:00:31 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\srclient.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\smss.exe
2017-04-12 23:00:31 ----A---- C:\Windows\system32\mshtmled.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\lsasrv.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\kerberos.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\dxtrans.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\dxtmsft.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-04-12 23:00:30 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\WinSetupUI.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\rstrui.exe
2017-04-12 23:00:30 ----A---- C:\Windows\system32\msrating.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\kernel32.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\advapi32.dll
2017-04-12 23:00:29 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\schannel.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\occache.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 23:00:29 ----A---- C:\Windows\system32\jsproxy.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\jscript9diag.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\conhost.exe
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\wow64win.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\winsrv.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\wdigest.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\TSpkg.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\sspicli.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\ncrypt.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\msv1_0.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\KernelBase.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\inseng.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\ieUnatt.exe
2017-04-12 23:00:28 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\wuapp.exe
2017-04-12 23:00:27 ----A---- C:\Windows\system32\wow64.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\rpchttp.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\iesetup.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\iernonce.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-04-12 23:00:27 ----A---- C:\Windows\system32\cdd.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\bcrypt.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\wow64cpu.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\sspisrv.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\secur32.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\lsass.exe
2017-04-12 23:00:26 ----A---- C:\Windows\system32\lpk.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-04-12 23:00:26 ----A---- C:\Windows\system32\fontsub.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\drivers\appid.sys
2017-04-12 23:00:26 ----A---- C:\Windows\system32\dciman32.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\csrsrv.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\cryptbase.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\appidsvc.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\appidapi.dll
2017-04-12 23:00:25 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\lpk.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\ntvdm64.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\credssp.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\auditpol.exe
2017-04-12 23:00:25 ----A---- C:\Windows\system32\atmlib.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 23:00:25 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\user.exe
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\tzres.dll
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-04-12 23:00:23 ----A---- C:\Windows\system32\tzres.dll
2017-04-12 23:00:23 ----A---- C:\Windows\system32\apisetschema.dll
2017-04-12 23:00:22 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-04-12 23:00:22 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-04-12 23:00:22 ----A---- C:\Windows\system32\msaudite.dll
2017-04-12 23:00:22 ----A---- C:\Windows\system32\adtschema.dll
2017-04-12 23:00:21 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-04-12 23:00:21 ----A---- C:\Windows\system32\msobjs.dll
2017-04-12 23:00:21 ----A---- C:\Windows\system32\ieetwcollectorres.dll

====== List of files/folders modified in the last 1 month ======

2017-04-28 19:27:05 ----D---- C:\Windows\Temp
2017-04-28 18:44:55 ----D---- C:\Windows\system32\config
2017-04-28 17:59:49 ----D---- C:\Windows\System32
2017-04-28 17:59:49 ----D---- C:\Windows\inf
2017-04-28 17:59:49 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-04-28 17:48:15 ----D---- C:\ProgramData\Spybot - Search & Destroy
2017-04-28 17:46:03 ----SHD---- C:\System Volume Information
2017-04-28 17:42:47 ----D---- C:\Windows\Prefetch
2017-04-28 16:49:13 ----SHD---- C:\Windows\Installer
2017-04-28 16:49:11 ----D---- C:\Windows\system32\Tasks
2017-04-28 16:47:37 ----D---- C:\Windows\SysWOW64
2017-04-28 16:41:33 ----RD---- C:\Program Files
2017-04-15 19:38:40 ----RD---- C:\Program Files (x86)
2017-04-15 19:20:31 ----D---- C:\Windows\Microsoft.NET
2017-04-15 19:20:18 ----RSD---- C:\Windows\assembly
2017-04-15 16:47:24 ----D---- C:\Windows\system32\DriverStore
2017-04-12 23:34:47 ----D---- C:\Windows
2017-04-12 23:29:50 ----D---- C:\Windows\winsxs
2017-04-12 23:27:49 ----D---- C:\Windows\system32\drivers
2017-04-12 23:26:22 ----D---- C:\Windows\SYSWOW64\sk-SK
2017-04-12 23:26:22 ----D---- C:\Windows\SYSWOW64\en-US
2017-04-12 23:26:22 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-04-12 23:26:22 ----D---- C:\Program Files\Internet Explorer
2017-04-12 23:26:20 ----D---- C:\Windows\system32\sk-SK
2017-04-12 23:26:20 ----D---- C:\Windows\system32\en-US
2017-04-12 23:26:20 ----D---- C:\Windows\system32\cs-CZ
2017-04-12 23:26:18 ----D---- C:\Windows\AppPatch
2017-04-12 23:26:18 ----D---- C:\Program Files (x86)\Internet Explorer
2017-04-12 23:26:17 ----D---- C:\Windows\system32\Boot
2017-04-12 23:12:51 ----D---- C:\Windows\system32\MRT
2017-04-12 23:09:11 ----AC---- C:\Windows\system32\MRT.exe
2017-04-12 23:05:48 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-04-12 22:45:10 ----D---- C:\Windows\system32\catroot2

File C:\Windows\system32\winlogon.exe is digitally signed
File C:\Windows\system32\wininit.exe is digitally signed
File C:\Windows\explorer.exe is digitally signed
File C:\Windows\SysWOW64\explorer.exe is digitally signed
File C:\Windows\system32\svchost.exe is digitally signed
File C:\Windows\SysWOW64\svchost.exe is digitally signed
File C:\Windows\system32\services.exe is digitally signed
File C:\Windows\system32\User32.dll is digitally signed
File C:\Windows\SysWOW64\User32.dll is digitally signed
File C:\Windows\system32\userinit.exe is digitally signed
File C:\Windows\SysWOW64\userinit.exe is digitally signed
File C:\Windows\system32\rpcss.dll is digitally signed
File C:\Windows\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2014-09-10 59064]
R0 iaStorA;iaStorA; C:\Windows\system32\drivers\iaStorA.sys [2015-05-29 646408]
R0 iaStorF;iaStorF; C:\Windows\system32\drivers\iaStorF.sys [2015-05-29 30960]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2014-08-19 219696]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2014-08-19 155896]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2014-08-19 40512]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2014-08-19 198096]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2014-03-25 1588440]
R3 cykbfltrService;Cypress Keyboard Filter Driver; C:\Windows\system32\DRIVERS\cykbfltr.sys [2012-06-15 16896]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2015-10-29 506880]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2017-02-20 82816]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2016-03-02 5384728]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2012-10-02 342528]
R3 LenovoRd;LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [2009-05-11 118016]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2015-07-28 178976]
R3 NETwNs64;___ Ovladaè adaptéru øady Intel(R) Wireless WiFi Link 5000 pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETwsw01.sys [2015-05-04 11534096]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2015-07-02 33960]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2015-07-02 607400]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
S3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
S3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\agrsm64.sys [2009-06-10 1146880]
S3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\drivers\Apfiltr.sys [2013-07-13 499504]
S3 atmeltpm;atmeltpm; C:\Windows\system32\drivers\atmeltpm64.sys [2011-08-05 19456]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 71168]
S3 ecnssndis; Mobile Broadband Driver; C:\Windows\System32\Drivers\wwuss64.sys [2011-06-13 26664]
S3 ecnssndisfltr; Mobile Broadband Driver Filter; C:\Windows\System32\Drivers\wwussf64.sys [2011-06-13 30248]
S3 l36wgps; Mobile Broadband GPS Port; C:\Windows\system32\drivers\l36wgps64.sys [2011-07-01 101416]
S3 Mbm3CBus;F3507g Mobile Broadband Device (WDM); C:\Windows\system32\drivers\Mbm3CBus.sys [2011-04-29 419400]
S3 Mbm3DevMt; Mobile Broadband Device Management Driver (WDM); C:\Windows\system32\drivers\Mbm3DevMt.sys [2011-04-29 430664]
S3 Mbm3mdfl; Mobile Broadband Modem Port Filter; C:\Windows\system32\DRIVERS\Mbm3mdfl.sys [2011-04-29 19528]
S3 Mbm3Mdm; Mobile Broadband Modem Port Driver; C:\Windows\system32\DRIVERS\Mbm3Mdm.sys [2011-04-29 483400]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 109056]
S3 SmbDrv;SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [2015-07-02 33448]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2012-08-23 29696]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2013-10-02 29696]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUSB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-20 41984]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-02-02 82640]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\cscsvc.dll
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2012-06-08 201376]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; %SystemRoot%\System32\svchost.exe -k utcsvc;"ServiceDll" = %SystemRoot%\system32\diagtrack.dll
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe [2014-09-24 1029704]
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2017-02-20 184400]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
R2 LPlatSvc;Lenovo Platform Service; C:\Windows\system32\LPlatSvc.exe [2017-02-20 711248]
R2 MDM;Machine Debug Manager; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 SAService;Conexant SmartAudio service; C:\Windows\system32\SAsrv.exe []
R2 SDScannerService;Spybot-S&D 2 Scanner Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-06-24 1738168]
R2 SDUpdateService;Spybot-S&D 2 Updating Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2016-09-21 4088608]
R2 SDWSCService;Spybot-S&D 2 Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2016-11-24 235984]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
R2 WMCoreService;Mobile Broadband Service; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [2011-08-12 648744]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2012-04-24 169752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-03-20 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-03-20 125064]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-20 153752]
S3 AppMgmt;@appmgmts.dll,-3250; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\appmgmts.dll
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2016-03-02 290224]
S3 ESHASRV;ESET SHA Service; C:\Program Files\ESET\ESET Endpoint Security\EShaSrv.exe [2014-09-24 190152]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-20 153752]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-25 114688]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; %SystemRoot%\System32\svchost.exe -k PeerDist;"ServiceDll" = %SystemRoot%\system32\peerdistsvc.dll
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\system32\storsvc.dll
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\umrdp.dll
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2016-02-15 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-03-20 51320]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119670
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: NOD nachází trojského koně Win32/Fynloski.AN

#6 Příspěvek od Rudy »

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore
C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA
C:\Users\pazdera\AppData\Local\Temp\XdSbyQJrUmlmgjRqqXSy.vbs

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]/64
[-HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]/64
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"jwEvBNvKsXEVDREEaksw"=-

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Ejcej
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 24 črc 2011 20:31

Re: NOD nachází trojského koně Win32/Fynloski.AN

#7 Příspěvek od Ejcej »

Nový log RSIT po OTM a restartu:

Kód: Vybrat vše

Logfile of random's system information tool 1.16 (written by random/random) 
Run by pazdera at 2017-04-28 20:26:32
Microsoft Windows 7 Professional  Service Pack 1
System drive C: has 232 GB (76%) free of 305 GB
Total RAM: 3979 MB (69% free)
X64

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:26:42, on 28.4.2017
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18639)
Boot mode: Normal

Running processes:
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files\trend micro\pazdera_RSITx64.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O4 - HKLM\..\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [SpybotPostWindows10UpgradeReInstall] "C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe
O23 - Service: ESET SHA Service (ESHASRV) - ESET - C:\Program Files\ESET\ESET Endpoint Security\EShaSrv.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Aktualizace Google (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Aktualizace Google (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Platform Service (LPlatSvc) - Unknown owner - C:\Windows\system32\LPlatSvc.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\Windows\system32\SAsrv.exe
O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: Mobile Broadband Service (WMCoreService) - Ericsson AB - C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8298 bytes

====== Enumerating Processes ======

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
C:\Windows\system32\LPlatSvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k WbioSvcGroup
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\system32\CxAudMsg64.exe
C:\Windows\System32\svchost.exe -k utcsvc
"C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe"
"C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"
C:\Windows\SysWOW64\SAsrv.exe
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe"
"C:\Windows\system32\LPlatSvc.exe" -EM
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
"C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe" servicemode
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.FullScreenMagnifier
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\notepad.exe" C:\_OTM\MovedFiles\04282017_202305.log
"C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe" 
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" 
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe" 
"C:\Program Files\ESET\ESET Endpoint Security\egui.exe" /hide /waitservice
"C:\Windows\System32\hkcmd.exe" 
"C:\Windows\System32\igfxpers.exe" 
"C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" 
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE" 
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Users\pazdera\Downloads\RSITx64.exe" 
C:\Windows\system32\wbem\wmiprvse.exe

====== Scheduled tasks folder ======

C:\Windows\system32\tasks\Adobe Acrobat Update Task - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\system32\tasks\GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\system32\tasks\GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\system32\tasks\klcp_update - "%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\CodecTweakTool.exe" /verysilent /update /freq=30
C:\Windows\system32\tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" /autoupdate /silent /autoclose /background
C:\Windows\system32\tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe" /immunize /silent /autoclose
C:\Windows\system32\tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system - "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe" /scan /cleanclose
C:\Windows\system32\tasks\Microsoft\Windows Defender\MP Scheduled Scan - c:\program files\windows defender\MpCmdRun.exe Scan -ScheduleJob -WinTask -RestrictPrivilegesScan
C:\Windows\system32\tasks\Microsoft\Windows\WindowsBackup\ConfigNotification - %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
C:\Windows\system32\tasks\Microsoft\Windows\Windows Media Sharing\UpdateLibrary - "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
C:\Windows\system32\tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange - %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
C:\Windows\system32\tasks\Microsoft\Windows\Windows Error Reporting\QueueReporting - %windir%\system32\wermgr.exe -queuereporting
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask - %SystemRoot%\system32\Wat\WatAdminSvc.exe /run
C:\Windows\system32\tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline - %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask"
C:\Windows\system32\tasks\Microsoft\Windows\UPnP\UPnPHostConfig - sc.exe config upnphost start= auto
C:\Windows\system32\tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime - %windir%\system32\sc.exe start w32time task_started
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 - %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
C:\Windows\system32\tasks\Microsoft\Windows\SystemRestore\SR - %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
C:\Windows\system32\tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask - sc.exe start sppsvc
C:\Windows\system32\tasks\Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask - %windir%\system32\RAServer.exe /offerraupdate
C:\Windows\system32\tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem - %SystemRoot%\System32\powercfg.exe -energy -auto
C:\Windows\system32\tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo - %windir%\system32\gatherNetworkInfo.vbs
C:\Windows\system32\tasks\Microsoft\Windows\MUI\LPRemove - %windir%\system32\lpremove.exe
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService - %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks - %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ehDRMInit - %SystemRoot%\ehome\ehPrivJob.exe /DRMInit
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\InstallPlayReady - %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\mcupdate - %SystemRoot%\ehome\mcupdate $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURActivate - %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\OCURDiscovery - %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscovery - %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 - %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 - %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PeriodicScanRetry - %windir%\ehome\MCUpdate.exe -pscn 0
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\PvrScheduleTask - %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RecordingRestart - %SystemRoot%\ehome\ehrec /RestartRecording
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\RegisterSearch - %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\ReindexSearchRoot - %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask - %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
C:\Windows\system32\tasks\Microsoft\Windows\Media Center\UpdateRecordPath - %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Location\Notifications - %windir%\System32\LocationNotifications.exe
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector - %windir%\system32\rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
C:\Windows\system32\tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver - %windir%\system32\DFDWiz.exe
C:\Windows\system32\tasks\Microsoft\Windows\Defrag\ScheduledDefrag - %windir%\system32\defrag.exe -c
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator - %SystemRoot%\System32\wsqmcons.exe
C:\Windows\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Uploader - %windir%\system32\WSqmCons.exe -u
C:\Windows\system32\tasks\Microsoft\Windows\Bluetooth\UninstallDeviceTask - BthUdTask.exe $(Arg0)
C:\Windows\system32\tasks\Microsoft\Windows\Autochk\Proxy - %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\AitAgent - aitagent
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - %windir%\system32\compattel\DiagTrackRunner.exe /UploadEtlFilesOnly
C:\Windows\system32\tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater - %windir%\system32\compattelrunner.exe -maintenance
C:\Windows\system32\tasks\Microsoft\Windows\AppID\PolicyConverter - %windir%\system32\appidpolicyconverter.exe
C:\Windows\system32\tasks\Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck - %windir%\system32\appidcertstorecheck.exe

=========Google Chrome=========

C:\Users\pazdera\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Extension aapocclcgogkmnckokdopfmhonfmgoek 1 Prezentace Google 0.9
Extension ahfgeienlihckogmohjhadlkjgocpleb 1 Obchod Chrome 0.2
Extension aohghmighlieiainnegkcijnfilokake 1 Dokumenty Google 0.9
Extension apdfllckaahabafndbhieahigkjlhalf 1 Disk Google 14.1
Extension bepbmhgboaologfdajaanbcjmnhjmhfn 0  
Extension blpcfgokakmgnkcojhhkbfbldkacnbeo 1 YouTube 4.2.8
Extension eemcgdkfndhakfknompkggombfjjjeno 1 Bookmark Manager 0.1
Extension efaidnbmnnnibpcajpcglclefindmkaj 2 Adobe Acrobat 15.1.0.5
Extension felcaaldnbdncclmgdcncolpebgiejap 1 Tabulky Google 1.1
Extension gfdkimpbcpahaombhbimeihdjnejgicl 1 Feedback 1.0
Extension ghbmnnjooekpmoecnnnilnnbdlolhkhi 1 Dokumenty Google offline 1.4
Extension kmendfapggjehodndflmmgagdbamhnfd 1 CryptoTokenExtension 0.9.46
Extension mfehgcgbbipciphmccgaenjidiccnmng 1 Cloud Print 0.1
Extension mfffpogegjflfpflabcdkioaeobkgjik 1 GaiaAuthExtension 0.0.1
Extension mhjfbmdgcfjbbpaeojofohoefgiehjai 1 Chrome PDF Viewer 1
Extension neajdppkdcdipfabeoofebfddakdcjhd 1 Google Network Speech 1.0
Extension nkeimhogjdpnpccoofpliimaahmaaome 1 Google Hangouts 1.3.2
Extension nmmhkkegccagdldgiimedpiccmgmieda 1 Platby Internetového obchodu Chrome 1.0.0.2
Extension pjkljhegncpnkpknbcohdijeoejaedia 1 Gmail 8.1
Extension pkedcjkdefgpdelpbcmbmeomcjbeemfm 1 Chrome Media Router 5717.116.0.4
Homepage: https://www.seznam.cz/
default_search_provider.search_url: 
C:\Users\pazdera\AppData\Local\Google\Chrome\User Data\Default\Preferences
Homepage: 
default_search_provider.search_url: 

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\efaidnbmnnnibpcajpcglclefindmkaj]
"Path"=


======Registry dump ======


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}


[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Apoint"=C:\Program Files\Apoint2K\Apoint.exe [2013-07-13 686936]
"SynLenovoHelper"=C:\Program Files\Synaptics\SynTP\SynLenovoHelper.exe [2015-07-02 146600]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2015-07-02 3936936]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SACpl.exe [2012-06-13 1647616]
"egui"=C:\Program Files\ESET\ESET Endpoint Security\egui.exe [2014-09-24 4124360]
"IgfxTray"=C:\Windows\system32\igfxtray.exe [2016-03-02 183216]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2016-03-02 411056]
"Persistence"=C:\Windows\system32\igfxpers.exe [2016-03-02 453544]
"Logitech Download Assistant"=C:\Windows\System32\LogiLDA.dll [2016-10-14 1841496]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SpybotPostWindows10UpgradeReInstall"=C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [2015-07-28 1011200]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SDTray"=C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [2014-06-24 4101576]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
igfxdev.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders" = credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot - Search & Destroy tray access"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater"
"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe" = "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath" = "C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.LAGS"=lagarith.dll
"VIDC.X264"=x264vfw64.dll
"VIDC.XVID"=xvidvfw.dll
"VIDC.FFDS"=ff_vfw.dll
"msacm.ac3acm"=ac3acm.acm
"msacm.l3codecp"=l3codecp.acm

====== File associations ======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

====== List of files/folders created in the last 1 month ======

2017-04-28 20:23:05 ----D---- C:\_OTM
2017-04-28 17:49:33 ----D---- C:\AdwCleaner
2017-04-28 16:41:33 ----D---- C:\Program Files\trend micro
2017-04-28 16:41:32 ----D---- C:\rsit
2017-04-15 19:38:40 ----D---- C:\Program Files (x86)\Clementine
2017-04-12 23:00:47 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2017-04-12 23:00:47 ----A---- C:\Windows\system32\rdpcorets.dll
2017-04-12 23:00:47 ----A---- C:\Windows\system32\mshtml.dll
2017-04-12 23:00:45 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2017-04-12 23:00:45 ----A---- C:\Windows\system32\ieframe.dll
2017-04-12 23:00:44 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2017-04-12 23:00:44 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2017-04-12 23:00:43 ----A---- C:\Windows\SYSWOW64\wininet.dll
2017-04-12 23:00:43 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\wuaueng.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\wininet.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\ole32.dll
2017-04-12 23:00:43 ----A---- C:\Windows\system32\iertutil.dll
2017-04-12 23:00:42 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\wucltux.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\win32spl.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\win32k.sys
2017-04-12 23:00:42 ----A---- C:\Windows\system32\urlmon.dll
2017-04-12 23:00:42 ----A---- C:\Windows\system32\samsrv.dll
2017-04-12 23:00:41 ----A---- C:\Windows\SYSWOW64\win32spl.dll
2017-04-12 23:00:41 ----A---- C:\Windows\system32\wuapi.dll
2017-04-12 23:00:41 ----A---- C:\Windows\system32\ucrtbase.dll
2017-04-12 23:00:41 ----A---- C:\Windows\system32\quartz.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\msfeeds.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\gdi32.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\cdosys.dll
2017-04-12 23:00:40 ----A---- C:\Windows\system32\atmfd.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\quartz.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\ole32.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2017-04-12 23:00:39 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\ucrtbase.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\rdpudd.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\iedkcs32.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\drivers\dxgmms1.sys
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 23:00:38 ----A---- C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 23:00:37 ----A---- C:\Windows\SYSWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\jscript.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 23:00:37 ----A---- C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 23:00:36 ----A---- C:\Windows\system32\ntoskrnl.exe
2017-04-12 23:00:36 ----A---- C:\Windows\system32\ntdll.dll
2017-04-12 23:00:35 ----A---- C:\Windows\system32\samlib.dll
2017-04-12 23:00:35 ----A---- C:\Windows\system32\jscript9.dll
2017-04-12 23:00:35 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2017-04-12 23:00:35 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2017-04-12 23:00:35 ----A---- C:\Windows\system32\asycfilt.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\webcheck.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\samlib.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\mfmjpegdec.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\cdosys.dll
2017-04-12 23:00:34 ----A---- C:\Windows\SYSWOW64\asycfilt.dll
2017-04-12 23:00:34 ----A---- C:\Windows\system32\webcheck.dll
2017-04-12 23:00:34 ----A---- C:\Windows\system32\mfmjpegdec.dll
2017-04-12 23:00:33 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2017-04-12 23:00:33 ----A---- C:\Windows\SYSWOW64\certcli.dll
2017-04-12 23:00:33 ----A---- C:\Windows\system32\wuwebv.dll
2017-04-12 23:00:33 ----A---- C:\Windows\system32\mshtmlmedia.dll
2017-04-12 23:00:33 ----A---- C:\Windows\system32\ie4uinit.exe
2017-04-12 23:00:33 ----A---- C:\Windows\system32\certcli.dll
2017-04-12 23:00:32 ----A---- C:\Windows\SYSWOW64\wups.dll
2017-04-12 23:00:32 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2017-04-12 23:00:32 ----A---- C:\Windows\SYSWOW64\jscript.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wups2.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wups.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wudriver.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\wuauclt.exe
2017-04-12 23:00:32 ----A---- C:\Windows\system32\vbscript.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\srcore.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\rpcrt4.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\ieui.dll
2017-04-12 23:00:32 ----A---- C:\Windows\system32\ieapfltr.dll
2017-04-12 23:00:31 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2017-04-12 23:00:31 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\srclient.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\smss.exe
2017-04-12 23:00:31 ----A---- C:\Windows\system32\mshtmled.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\lsasrv.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\kerberos.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\dxtrans.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\dxtmsft.dll
2017-04-12 23:00:31 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2017-04-12 23:00:30 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\WinSetupUI.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\rstrui.exe
2017-04-12 23:00:30 ----A---- C:\Windows\system32\msrating.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\kernel32.dll
2017-04-12 23:00:30 ----A---- C:\Windows\system32\advapi32.dll
2017-04-12 23:00:29 ----A---- C:\Windows\SYSWOW64\srclient.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\schannel.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\occache.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 23:00:29 ----A---- C:\Windows\system32\jsproxy.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\jscript9diag.dll
2017-04-12 23:00:29 ----A---- C:\Windows\system32\conhost.exe
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\ieui.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2017-04-12 23:00:28 ----A---- C:\Windows\SYSWOW64\advapi32.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\wow64win.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\winsrv.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\wdigest.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\TSpkg.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\sspicli.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\ncrypt.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\msv1_0.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\MshtmlDac.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\KernelBase.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\inseng.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\ieUnatt.exe
2017-04-12 23:00:28 ----A---- C:\Windows\system32\ieetwproxystub.dll
2017-04-12 23:00:28 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\occache.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\msrating.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2017-04-12 23:00:27 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\wuapp.exe
2017-04-12 23:00:27 ----A---- C:\Windows\system32\wow64.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\rpchttp.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\iesetup.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\iernonce.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2017-04-12 23:00:27 ----A---- C:\Windows\system32\cdd.dll
2017-04-12 23:00:27 ----A---- C:\Windows\system32\bcrypt.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\schannel.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\rpchttp.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\inseng.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2017-04-12 23:00:26 ----A---- C:\Windows\SYSWOW64\bcrypt.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\wow64cpu.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\sspisrv.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\setbcdlocale.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\secur32.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\lsass.exe
2017-04-12 23:00:26 ----A---- C:\Windows\system32\lpk.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\ieetwcollector.exe
2017-04-12 23:00:26 ----A---- C:\Windows\system32\fontsub.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\drivers\appid.sys
2017-04-12 23:00:26 ----A---- C:\Windows\system32\dciman32.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\csrsrv.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\cryptbase.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\appidsvc.dll
2017-04-12 23:00:26 ----A---- C:\Windows\system32\appidapi.dll
2017-04-12 23:00:25 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\wow32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\secur32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\lpk.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\credssp.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2017-04-12 23:00:25 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\ntvdm64.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\credssp.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\auditpol.exe
2017-04-12 23:00:25 ----A---- C:\Windows\system32\atmlib.dll
2017-04-12 23:00:25 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 23:00:25 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 23:00:24 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 23:00:23 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\user.exe
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\tzres.dll
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\setup16.exe
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\instnm.exe
2017-04-12 23:00:23 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2017-04-12 23:00:23 ----A---- C:\Windows\system32\tzres.dll
2017-04-12 23:00:23 ----A---- C:\Windows\system32\apisetschema.dll
2017-04-12 23:00:22 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2017-04-12 23:00:22 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2017-04-12 23:00:22 ----A---- C:\Windows\system32\msaudite.dll
2017-04-12 23:00:22 ----A---- C:\Windows\system32\adtschema.dll
2017-04-12 23:00:21 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2017-04-12 23:00:21 ----A---- C:\Windows\system32\msobjs.dll
2017-04-12 23:00:21 ----A---- C:\Windows\system32\ieetwcollectorres.dll

====== List of files/folders modified in the last 1 month ======

2017-04-28 20:26:42 ----D---- C:\Windows\Prefetch
2017-04-28 20:25:02 ----D---- C:\Windows\Temp
2017-04-28 20:24:00 ----D---- C:\Windows\system32\config
2017-04-28 19:54:53 ----D---- C:\Windows\rescache
2017-04-28 17:59:49 ----D---- C:\Windows\System32
2017-04-28 17:59:49 ----D---- C:\Windows\inf
2017-04-28 17:59:49 ----A---- C:\Windows\system32\PerfStringBackup.INI
2017-04-28 17:48:15 ----D---- C:\ProgramData\Spybot - Search & Destroy
2017-04-28 17:46:03 ----SHD---- C:\System Volume Information
2017-04-28 16:49:13 ----SHD---- C:\Windows\Installer
2017-04-28 16:49:11 ----D---- C:\Windows\system32\Tasks
2017-04-28 16:47:37 ----D---- C:\Windows\SysWOW64
2017-04-28 16:41:33 ----RD---- C:\Program Files
2017-04-15 19:38:40 ----RD---- C:\Program Files (x86)
2017-04-15 19:20:31 ----D---- C:\Windows\Microsoft.NET
2017-04-15 19:20:18 ----RSD---- C:\Windows\assembly
2017-04-15 16:47:24 ----D---- C:\Windows\system32\DriverStore
2017-04-12 23:34:47 ----D---- C:\Windows
2017-04-12 23:29:50 ----D---- C:\Windows\winsxs
2017-04-12 23:27:49 ----D---- C:\Windows\system32\drivers
2017-04-12 23:26:22 ----D---- C:\Windows\SYSWOW64\sk-SK
2017-04-12 23:26:22 ----D---- C:\Windows\SYSWOW64\en-US
2017-04-12 23:26:22 ----D---- C:\Windows\SYSWOW64\cs-CZ
2017-04-12 23:26:22 ----D---- C:\Program Files\Internet Explorer
2017-04-12 23:26:20 ----D---- C:\Windows\system32\sk-SK
2017-04-12 23:26:20 ----D---- C:\Windows\system32\en-US
2017-04-12 23:26:20 ----D---- C:\Windows\system32\cs-CZ
2017-04-12 23:26:18 ----D---- C:\Windows\AppPatch
2017-04-12 23:26:18 ----D---- C:\Program Files (x86)\Internet Explorer
2017-04-12 23:26:17 ----D---- C:\Windows\system32\Boot
2017-04-12 23:12:51 ----D---- C:\Windows\system32\MRT
2017-04-12 23:09:11 ----AC---- C:\Windows\system32\MRT.exe
2017-04-12 23:05:48 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2017-04-12 22:45:10 ----D---- C:\Windows\system32\catroot2

File C:\Windows\system32\winlogon.exe is digitally signed
File C:\Windows\system32\wininit.exe is digitally signed
File C:\Windows\explorer.exe is digitally signed
File C:\Windows\SysWOW64\explorer.exe is digitally signed
File C:\Windows\system32\svchost.exe is digitally signed
File C:\Windows\SysWOW64\svchost.exe is digitally signed
File C:\Windows\system32\services.exe is digitally signed
File C:\Windows\system32\User32.dll is digitally signed
File C:\Windows\SysWOW64\User32.dll is digitally signed
File C:\Windows\system32\userinit.exe is digitally signed
File C:\Windows\SysWOW64\userinit.exe is digitally signed
File C:\Windows\system32\rpcss.dll is digitally signed
File C:\Windows\system32\Drivers\volsnap.sys is digitally signed

====== List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2014-09-10 59064]
R0 iaStorA;iaStorA; C:\Windows\system32\drivers\iaStorA.sys [2015-05-29 646408]
R0 iaStorF;iaStorF; C:\Windows\system32\drivers\iaStorF.sys [2015-05-29 30960]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2014-08-19 219696]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2014-08-19 155896]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2014-08-19 40512]
R1 lenovo.smi;Lenovo System Interface Driver; C:\Windows\system32\DRIVERS\smiifx64.sys [2013-05-22 15472]
R1 vwififlt;Virtual WiFi Filter Driver; C:\Windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2014-08-19 198096]
R2 risdxc;risdxc; C:\Windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2014-03-25 1588440]
R3 cykbfltrService;Cypress Keyboard Filter Driver; C:\Windows\system32\DRIVERS\cykbfltr.sys [2012-06-15 16896]
R3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C; C:\Windows\system32\DRIVERS\e1c62x64.sys [2015-10-29 506880]
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2017-02-20 82816]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2016-03-02 5384728]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2012-10-02 342528]
R3 LenovoRd;LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [2009-05-11 118016]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [2015-07-28 178976]
R3 NETwNs64;___ Ovladaè adaptéru øady Intel(R) Wireless WiFi Link 5000 pro systém Windows 7 64 Bit; C:\Windows\system32\DRIVERS\NETwsw01.sys [2015-05-04 11534096]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2015-07-02 33960]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2015-07-02 607400]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2016-02-05 147904]
S3 5U877;USB Video Device; C:\Windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
S3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\agrsm64.sys [2009-06-10 1146880]
S3 ApfiltrService;Alps Pointing-device Filter Driver; C:\Windows\system32\drivers\Apfiltr.sys [2013-07-13 499504]
S3 atmeltpm;atmeltpm; C:\Windows\system32\drivers\atmeltpm64.sys [2011-08-05 19456]
S3 BthEnum;Ovladač pro Bluetooth Request Block; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2012-07-06 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-04-28 80384]
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-20 71168]
S3 ecnssndis; Mobile Broadband Driver; C:\Windows\System32\Drivers\wwuss64.sys [2011-06-13 26664]
S3 ecnssndisfltr; Mobile Broadband Driver Filter; C:\Windows\System32\Drivers\wwussf64.sys [2011-06-13 30248]
S3 l36wgps; Mobile Broadband GPS Port; C:\Windows\system32\drivers\l36wgps64.sys [2011-07-01 101416]
S3 Mbm3CBus;F3507g Mobile Broadband Device (WDM); C:\Windows\system32\drivers\Mbm3CBus.sys [2011-04-29 419400]
S3 Mbm3DevMt; Mobile Broadband Device Management Driver (WDM); C:\Windows\system32\drivers\Mbm3DevMt.sys [2011-04-29 430664]
S3 Mbm3mdfl; Mobile Broadband Modem Port Filter; C:\Windows\system32\DRIVERS\Mbm3mdfl.sys [2011-04-29 19528]
S3 Mbm3Mdm; Mobile Broadband Modem Port Driver; C:\Windows\system32\DRIVERS\Mbm3Mdm.sys [2011-04-29 483400]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2010-11-20 109056]
S3 SmbDrv;SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [2015-07-02 33448]
S3 SrvHsfHDA;SrvHsfHDA; C:\Windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92; C:\Windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac; C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 terminpt;Microsoft Remote Desktop Input Driver; C:\Windows\system32\drivers\terminpt.sys [2012-08-23 29696]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2013-10-02 29696]
S3 vmbus;vmbus; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUSB Driver; C:\Windows\system32\DRIVERS\WinUSB.sys [2010-11-20 41984]

====== List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled) ======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2017-02-02 82640]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\cscsvc.dll
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2012-06-08 201376]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; %SystemRoot%\System32\svchost.exe -k utcsvc;"ServiceDll" = %SystemRoot%\system32\diagtrack.dll
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe [2014-09-24 1029704]
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2017-02-20 184400]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-05-27 110128]
R2 LPlatSvc;Lenovo Platform Service; C:\Windows\system32\LPlatSvc.exe [2017-02-20 711248]
R2 MDM;Machine Debug Manager; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [2006-10-26 335872]
R2 SAService;Conexant SmartAudio service; C:\Windows\system32\SAsrv.exe []
R2 SDScannerService;Spybot-S&D 2 Scanner Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2014-06-24 1738168]
R2 SDUpdateService;Spybot-S&D 2 Updating Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2016-09-21 4088608]
R2 SDWSCService;Spybot-S&D 2 Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2016-11-24 235984]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 125424]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-05-27 125488]
R2 WMCoreService;Mobile Broadband Service; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [2011-08-12 648744]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [2012-04-24 169752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2017-03-20 105096]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2017-03-20 125064]
S2 gupdate;Služba Aktualizace Google (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-20 153752]
S3 AppMgmt;@appmgmts.dll,-3250; %SystemRoot%\system32\svchost.exe -k netsvcs;"ServiceDll" = %SystemRoot%\System32\appmgmts.dll
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2016-03-02 290224]
S3 ESHASRV;ESET SHA Service; C:\Program Files\ESET\ESET Endpoint Security\EShaSrv.exe [2014-09-24 190152]
S3 gupdatem;Služba Aktualizace Google (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-02-20 153752]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2017-03-25 114688]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; %SystemRoot%\System32\svchost.exe -k PeerDist;"ServiceDll" = %SystemRoot%\system32\peerdistsvc.dll
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\system32\storsvc.dll
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted;"ServiceDll" = %SystemRoot%\System32\umrdp.dll
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2016-02-15 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2017-03-20 51320]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2017-03-20 135800]

-----------------EOF-----------------

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119670
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: NOD nachází trojského koně Win32/Fynloski.AN

#8 Příspěvek od Rudy »

Smazáno. Nastala nějaká změna?
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Ejcej
Návštěvník
Návštěvník
Příspěvky: 29
Registrován: 24 črc 2011 20:31

Re: NOD nachází trojského koně Win32/Fynloski.AN

#9 Příspěvek od Ejcej »

JJ NOD už nic nenajde a neotvírají se stránky na které jsem neklikl.

Děkuji mnohokráte za pomoc.

Uživatelský avatar
Rudy
Site Admin
Site Admin
Příspěvky: 119670
Registrován: 30 říj 2003 13:42
Bydliště: Plzeň
Kontaktovat uživatele:

Re: NOD nachází trojského koně Win32/Fynloski.AN

#10 Příspěvek od Rudy »

Rádo se stalo! :)
Dotazy a logy vkládejte pouze do vašich threadů. Soukromé zprávy, icq a e-maily neslouží k řešení vašich problémů.

Podpořte, prosím, naše fórum : https://platba.viry.cz/payment/.

Navštivte: Obrázek

e-mail: rudy(zavináč)forum.viry.cz

Varování:
Před odvirováním PC si udělejte zálohy svých důležitých dat (pošta, kontakty, dokumenty, fotografie, videa, hudba apod.). Virus mimo svých "viditelných" aktivit může poškodit systém!


Po dořešení vašeho problému bude vlákno zamknuto. Stejně tak tehdy, pokud bude nečinné více než 14dnů. Pokud budete chtít vlákno aktivovat, napište mi na mail uvedený výše.

Zamčeno