VIRY.CZ

viz nadpis, klasika nepomáhá.
Mám podezření, že je napadená sít. Druhý pevný PC vykazuje stejné příznaky...

Logfile of random's system information tool 1.10 (written by random/random)
Run by PC at 2014-09-10 21:12:45
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 34 GB (30%) free of 114 GB
Total RAM: 8132 MB (74% free)


======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Windows\system32\Dwm.exe"
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
C:\Windows\Explorer.EXE
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
"C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe"
"C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe"
C:\Windows\system32\HPSIsvc.exe
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
"C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe"
"C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"
"C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe" service
"C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe"
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.Helper.exe" /dts
"C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.AutoUpdate.exe" /noprogress
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_000007cc
"C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe"
"C:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" nss 25ce4e48-c95f-492d-8c71-f65148fe79b9 1
\??\C:\Windows\system32\conhost.exe "866547219-489517720-26048245921245725984554694121538509721911130077-1362778880
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" serviceapp
\??\C:\Windows\system32\conhost.exe "1303803253-1701387442687313971-1281541078-467891989-1223076708-9644312381735611684
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-98793643-da15-4ec6-9868-102753bc7bed -SystemEventPortName:HostProcess-7a6fba6f-c349-48ec-8a84-fb401cdc0cbc -IoCancelEventPortName:HostProcess-5d577eb8-d471-403b-b91e-160e89099c84 -NonStateChangingEventPortName:HostProcess-a07e7817-b800-4c31-af99-39b9834db87c -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:30ee2d1b-b1ee-4017-b5a7-3f7ad22b1f73 -DeviceGroupId:
"C:\Program Files (x86)\Common Files\Research In Motion\nginx\\nginx.exe" -c "C:\Users\PC\AppData\Roaming\Research In Motion\BlackBerry 10 Desktop\RemoteAccess\nginx\conf\nginx.conf"
"C:\Program Files (x86)\Common Files\Research In Motion\nginx\\nginx.exe" -c "C:\Users\PC\AppData\Roaming\Research In Motion\BlackBerry 10 Desktop\RemoteAccess\nginx\conf\nginx.conf"
\??\C:\Windows\system32\conhost.exe "2991968782033570144107127457-6642278582904592881186975651-87849147-1967930242
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\Windows\system32\svchost.exe -k SDRSVC
Browser\firefox.exe -no-remote -profile .\Data\Browser\profile.default\
"C:\Users\PC\Desktop\Tor Browser\Tor\tor.exe" --defaults-torrc "C:\Users\PC\Desktop\Tor Browser\Data\Tor\torrc-defaults" -f "C:\Users\PC\Desktop\Tor Browser\Data\Tor\torrc" DataDirectory "C:\Users\PC\Desktop\Tor Browser\Data\Tor" GeoIPFile "C:\Users\PC\Desktop\Tor Browser\Data\Tor\geoip" GeoIPv6File "C:\Users\PC\Desktop\Tor Browser\Data\Tor\geoip6" HashedControlPassword 16:d9c1b00510c5c72860be98793c428abb882b7881c4c9fef605a39e5a33 __OwningControllerProcess 3132
"taskhost.exe"

C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files\trend micro\PC.exe" /silentautolog
"C:\Users\PC\Downloads\RSITx64.exe"
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3692174025-3308642086-1692176655-1000Core.job - C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3692174025-3308642086-1692176655-1000UA.job - C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-10-04 462248]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-10-04 171944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2012-11-19 6846096]
"IAStorIcon"=C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe [2013-01-31 36352]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2014-04-30 2199840]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2014-08-22 1331288]
"ShadowPlay"=C:\Windows\system32\nvspcap64.dll [2014-04-30 1225920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-07-03 3673184]
"BlackBerryLink.exe"=C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.exe [2014-02-03 1464336]
"Google Update"=C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe [2014-01-16 116648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autodesk Sync]
C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [2013-02-05 1081224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EADM]
C:\Program Files (x86)\Origin\Origin.exe [2014-06-26 3595608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShadowPlay]
C:\Windows\system32\nvspcap64.dll [2014-04-30 1225920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2013-03-06 291128]
""= []
"HPUsageTrackingLEDM"=C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [2009-10-15 30264]
"RIMBBLaunchAgent.exe"=C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [2014-01-21 443408]
"RIM PeerManager"=C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [2014-01-22 4484608]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2014-08-07 751184]
"Avira Systray"=C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [2014-08-27 164656]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
""=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.XFR1"=xfcodec64.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2014-09-10 21:08:38 ----D---- C:\rsit
2014-09-10 21:08:38 ----D---- C:\Program Files\trend micro
2014-09-10 19:52:57 ----A---- C:\Windows\system32\drivers\hitmanpro37.sys
2014-09-10 19:48:26 ----D---- C:\ProgramData\HitmanPro
2014-09-10 19:43:01 ----D---- C:\AdwCleaner
2014-09-10 19:42:06 ----SHD---- C:\Config.Msi
2014-09-10 19:41:47 ----A---- C:\Windows\SYSWOW64\ieui.dll
2014-09-10 19:41:47 ----A---- C:\Windows\system32\ieui.dll
2014-09-10 19:41:46 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2014-09-10 19:41:46 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2014-09-10 19:41:46 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\jscript9diag.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\ieUnatt.exe
2014-09-10 19:41:46 ----A---- C:\Windows\system32\iernonce.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\dxtrans.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\dxtmsft.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\msrating.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\vbscript.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\msrating.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\mshtmled.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\msfeeds.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\jsproxy.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\iesetup.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\iedkcs32.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\ie4uinit.exe
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\mshtml.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\ieapfltr.dll
2014-09-10 19:41:43 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2014-09-10 19:41:43 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-10 19:41:43 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-09-10 19:41:42 ----A---- C:\Windows\SYSWOW64\wininet.dll
2014-09-10 19:41:42 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2014-09-10 19:41:42 ----A---- C:\Windows\system32\wininet.dll
2014-09-10 19:41:42 ----A---- C:\Windows\system32\jscript9.dll
2014-09-10 19:41:42 ----A---- C:\Windows\system32\iertutil.dll
2014-09-10 19:41:41 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2014-09-10 19:41:41 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2014-09-10 19:41:41 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2014-09-10 19:41:41 ----A---- C:\Windows\system32\urlmon.dll
2014-09-10 19:41:40 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2014-09-10 19:41:40 ----A---- C:\Windows\system32\ieframe.dll
2014-09-10 19:38:16 ----A---- C:\Windows\SYSWOW64\msmpeg2vdec.dll
2014-09-10 19:38:16 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2014-09-10 17:48:10 ----A---- C:\Windows\SYSWOW64\TSWorkspace.dll
2014-09-10 17:48:10 ----A---- C:\Windows\system32\TSWorkspace.dll
2014-09-10 17:47:53 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2014-09-10 17:47:53 ----A---- C:\Windows\system32\d3d10warp.dll
2014-09-10 17:47:49 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2014-09-10 17:47:49 ----A---- C:\Windows\SYSWOW64\secur32.dll
2014-09-10 17:47:49 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2014-09-10 17:47:49 ----A---- C:\Windows\system32\lsasrv.dll
2014-09-10 17:47:49 ----A---- C:\Windows\system32\kerberos.dll
2014-09-10 17:47:48 ----A---- C:\Windows\system32\aepdu.dll
2014-09-10 17:47:48 ----A---- C:\Windows\system32\aeinv.dll
2014-09-10 13:57:28 ----A---- C:\Windows\SYSWOW64\sqlite3.dll
2014-09-10 13:42:43 ----A---- C:\Windows\ntbtlog.txt
2014-09-10 13:06:23 ----D---- C:\ProgramData\Malwarebytes
2014-09-10 13:05:59 ----D---- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-09-10 13:05:58 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-09-10 13:04:58 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-08-28 08:41:41 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2014-08-28 08:41:41 ----A---- C:\Windows\system32\win32k.sys
2014-08-28 08:41:41 ----A---- C:\Windows\system32\gdi32.dll
2014-08-16 13:39:27 ----D---- C:\Users\PC\AppData\Roaming\Ulozto File Manager
2014-08-13 18:53:56 ----A---- C:\Windows\SYSWOW64\infocardapi.dll
2014-08-13 18:53:56 ----A---- C:\Windows\SYSWOW64\icardagt.exe
2014-08-13 18:53:56 ----A---- C:\Windows\system32\infocardapi.dll
2014-08-13 18:53:56 ----A---- C:\Windows\system32\icardagt.exe
2014-08-13 18:53:54 ----A---- C:\Windows\SYSWOW64\icardres.dll
2014-08-13 18:53:54 ----A---- C:\Windows\system32\icardres.dll
2014-08-13 18:53:46 ----A---- C:\Windows\SYSWOW64\TsWpfWrp.exe
2014-08-13 18:53:46 ----A---- C:\Windows\system32\TsWpfWrp.exe
2014-08-13 16:34:38 ----A---- C:\Windows\SYSWOW64\KBDTAT.DLL
2014-08-13 16:34:38 ----A---- C:\Windows\SYSWOW64\KBDRU1.DLL
2014-08-13 16:34:38 ----A---- C:\Windows\system32\KBDTAT.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\SYSWOW64\KBDYAK.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\SYSWOW64\KBDRU.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\SYSWOW64\KBDBASH.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDYAK.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDRU1.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDRU.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDBASH.DLL
2014-08-13 16:34:36 ----A---- C:\Windows\SYSWOW64\tzres.dll
2014-08-13 16:34:36 ----A---- C:\Windows\system32\tzres.dll
2014-08-13 16:34:34 ----A---- C:\Windows\SYSWOW64\msi.dll
2014-08-13 16:34:34 ----A---- C:\Windows\system32\msi.dll
2014-08-13 16:34:34 ----A---- C:\Windows\system32\authui.dll
2014-08-13 16:34:33 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2014-08-13 16:34:33 ----A---- C:\Windows\SYSWOW64\authui.dll
2014-08-13 16:34:33 ----A---- C:\Windows\system32\msihnd.dll
2014-08-13 16:34:33 ----A---- C:\Windows\system32\consent.exe
2014-08-13 16:34:32 ----A---- C:\Windows\system32\shell32.dll
2014-08-13 16:34:32 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2014-08-13 16:34:31 ----A---- C:\Windows\SYSWOW64\shell32.dll
2014-08-13 16:33:11 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2014-08-13 16:33:11 ----A---- C:\Windows\system32\rpcrt4.dll

======List of files/folders modified in the last 1 month======

2014-09-10 21:12:48 ----D---- C:\Windows\Temp
2014-09-10 21:08:38 ----RD---- C:\Program Files
2014-09-10 20:29:02 ----D---- C:\Windows\Microsoft.NET
2014-09-10 20:24:40 ----RSD---- C:\Windows\assembly
2014-09-10 19:58:53 ----D---- C:\Windows\System32
2014-09-10 19:58:53 ----D---- C:\Windows\inf
2014-09-10 19:58:53 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-09-10 19:52:57 ----D---- C:\Windows\system32\drivers
2014-09-10 19:52:56 ----D---- C:\ProgramData\NVIDIA
2014-09-10 19:52:29 ----D---- C:\Windows\system32\config
2014-09-10 19:51:55 ----HD---- C:\ProgramData
2014-09-10 19:51:53 ----SHD---- C:\System Volume Information
2014-09-10 19:45:56 ----D---- C:\Windows\winsxs
2014-09-10 19:45:28 ----D---- C:\Windows\system32\catroot
2014-09-10 19:45:25 ----D---- C:\Windows\SYSWOW64\en-US
2014-09-10 19:45:25 ----D---- C:\Windows\SYSWOW64\cs-CZ
2014-09-10 19:45:25 ----D---- C:\Windows\SysWOW64
2014-09-10 19:45:25 ----D---- C:\Windows\system32\en-US
2014-09-10 19:45:25 ----D---- C:\Windows\system32\cs-CZ
2014-09-10 19:45:25 ----D---- C:\Program Files\Internet Explorer
2014-09-10 19:45:25 ----D---- C:\Program Files (x86)\Internet Explorer
2014-09-10 19:42:53 ----SHD---- C:\Windows\Installer
2014-09-10 19:41:52 ----D---- C:\Windows\system32\catroot2
2014-09-10 19:41:33 ----D---- C:\ProgramData\Microsoft Help
2014-09-10 19:41:10 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2014-09-10 19:40:43 ----D---- C:\Windows
2014-09-10 19:40:43 ----D---- C:\Program Files\Microsoft Security Client
2014-09-10 19:40:43 ----D---- C:\Program Files (x86)\Microsoft Security Client
2014-09-10 19:40:33 ----D---- C:\Windows\system32\MRT
2014-09-10 19:38:31 ----D---- C:\Windows\debug
2014-09-10 19:38:31 ----A---- C:\Windows\system32\MRT.exe
2014-09-10 19:38:16 ----SD---- C:\Windows\system32\CompatTel
2014-09-10 13:58:00 ----D---- C:\Program Files (x86)
2014-09-10 13:41:32 ----D---- C:\Windows\system32\Tasks
2014-09-10 13:01:45 ----D---- C:\Windows\Logs
2014-09-09 18:11:18 ----D---- C:\ProgramData\Package Cache
2014-09-09 18:11:15 ----D---- C:\Program Files (x86)\Avira
2014-09-01 17:10:50 ----D---- C:\Windows\system32\NDF
2014-08-19 17:59:26 ----D---- C:\ProgramData\GFACE
2014-08-14 17:49:12 ----D---- C:\Windows\rescache
2014-08-14 06:53:05 ----RSD---- C:\Windows\Fonts
2014-08-14 06:53:04 ----D---- C:\Windows\PolicyDefinitions
2014-08-11 20:04:17 ----D---- C:\ProgramData\Origin
2014-08-11 19:29:43 ----D---- C:\Program Files (x86)\Origin
2014-08-11 19:23:17 ----A---- C:\Windows\SYSWOW64\PnkBstrB.exe
2014-08-11 19:22:39 ----D---- C:\Users\PC\AppData\Roaming\Origin

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStorA;iaStorA; C:\Windows\system32\DRIVERS\iaStorA.sys [2013-01-31 652784]
R0 iaStorF;iaStorF; C:\Windows\system32\DRIVERS\iaStorF.sys [2013-01-31 28656]
R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2012-12-21 20616]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2014-07-17 269008]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 AsIO;AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [2012-08-22 15232]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2014-05-27 130584]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2014-05-27 28600]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-10-04 283064]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2014-07-03 117712]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2014-07-17 125584]
R3 hitmanpro37;HitmanPro 3.7 Support Driver; \??\C:\Windows\system32\drivers\hitmanpro37.sys [2014-09-10 32512]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-11-20 4213904]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2012-12-21 366216]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2012-12-21 786056]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2013-01-23 64624]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2014-05-20 197408]
R3 NvStreamKms;NvStreamKms; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2014-04-30 19744]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad64v.sys [2014-03-31 40392]
R3 rimvndis;BlackBerry Virtual Private Network; C:\Windows\System32\Drivers\rimvndis6_AMD64.sys [2014-01-22 17920]
R3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys [2012-12-10 44544]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2009-07-14 11264]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2012-12-26 805088]
S3 MSICDSetup;MSICDSetup; \??\D:\CDriver64.sys []
S3 mvusbews;USB EWS Device; C:\Windows\System32\Drivers\mvusbews.sys [2012-12-24 20480]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RimUsb;zařízení BlackBerry Smartphone; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [2013-12-02 79872]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usbrndis6;Adaptér USB RNDIS6; C:\Windows\system32\DRIVERS\usb80236.sys [2013-02-12 19968]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2014-08-07 430160]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2014-08-07 430160]
R2 asComSvc;ASUS Com Service; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [2012-10-30 927232]
R2 Avira.OE.ServiceHost;Avira Service Host; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-08-27 160048]
R2 HP LaserJet Service;HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [2009-10-15 136192]
R2 HPSIService;HP SI Service; C:\Windows\system32\HPSIsvc.exe [2012-11-08 126856]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-01-31 15344]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-12-10 732160]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-01-23 169432]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-01-23 366552]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2014-08-22 23784]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-04-30 1618888]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-04-30 21009352]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2014-05-20 927520]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2014-05-31 76888]
R2 RIM MDNS;RIM MDNS; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [2014-01-22 389632]
R2 RIM Tunnel Service;BlackBerry Link Communication Manager; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [2014-01-22 1309696]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-05-20 413128]
R3 BlackBerry Device Manager;BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2014-01-21 585728]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-08-22 368624]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S3 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-12-13 12288]
S3 BEService;BattlEye Service; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [2014-07-24 345984]
S3 FlexNet Licensing Service 64;FlexNet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2013-10-23 1471352]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-08-19 111616]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2012-12-10 803872]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-07-16 542912]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-10-06 1255736]
S4 AntiVirWebService;Avira Web Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [2014-08-07 1021520]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Zdravím!
Spusťte nejprve tuto utilitu:

Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

# AdwCleaner v3.309 - Report created 11/09/2014 at 19:12:47
# Updated 02/09/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : PC - PC-PC
# Running from : C:\Users\PC\Downloads\adwcleaner_3.309.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\Conduit

***** [ Browsers ] *****

-\\ Internet Explorer v0.0.0.0


-\\ Google Chrome v

[ File : C:\Users\PC\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [773 octets] - [10/09/2014 19:43:25]
AdwCleaner[R1].txt - [967 octets] - [11/09/2014 19:11:36]
AdwCleaner[S0].txt - [833 octets] - [10/09/2014 19:45:04]
AdwCleaner[S1].txt - [850 octets] - [11/09/2014 19:12:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [909 octets] ##########

Dejte nový log RSIT.

Logfile of random's system information tool 1.10 (written by random/random)
Run by PC at 2014-09-11 19:29:45
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 33 GB (29%) free of 114 GB
Total RAM: 8132 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:29:51, on 11.9.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe
C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.Helper.exe
C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.AutoUpdate.exe
C:\Program Files (x86)\Common Files\Research In Motion\nginx\nginx.exe
C:\Program Files (x86)\Common Files\Research In Motion\nginx\nginx.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\trend micro\PC.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [HPUsageTrackingLEDM] "C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT LEDM\"
O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Run: [RIM PeerManager] "C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [BlackBerryLink.exe] "C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.exe" /minimize
O4 - HKCU\..\Run: [Google Update] "C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (User 'Default user')
O4 - Global Startup: McAfee Security Scan Plus.lnk = C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe
O9 - Extra 'Tools' menuitem: SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs:
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ASUS Com Service (asComSvc) - Unknown owner - C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: Avira Service Host (Avira.OE.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service: BlackBerry Device Manager - BlackBerry Limited - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FlexNet Licensing Service 64 - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: HP LaserJet Service - HP - C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
O23 - Service: HP SI Service (HPSIService) - Unknown owner - C:\Windows\system32\HPSIsvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: RIM MDNS - Apple Inc. - C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe
O23 - Service: BlackBerry Link Communication Manager (RIM Tunnel Service) - Research In Motion Limited - C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12208 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
"C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe"
"C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe"
"C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe"
C:\Windows\system32\HPSIsvc.exe
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"
"C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT LEDM\"
"C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe"
"C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe" service
"C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe"
"C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.Helper.exe" /dts
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.AutoUpdate.exe" /noprogress
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_0000079c
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" nss 25ce4e48-c95f-492d-8c71-f65148fe79b9 1
"C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe"
\??\C:\Windows\system32\conhost.exe "22944224-13998353762085283710634844002-152753775020722724156464544842017646986
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" serviceapp
\??\C:\Windows\system32\conhost.exe "1094826722-1189749278362786881-1334343068-220040611-535888890917518069368052797
"C:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-108bbdb3-10ad-4b24-bebb-d9ca360ff0c9 -SystemEventPortName:HostProcess-8e85efec-cdc8-4225-bb7e-df72f0f74dd1 -IoCancelEventPortName:HostProcess-d6a60124-5260-4544-9217-d75740e51710 -NonStateChangingEventPortName:HostProcess-f43da4a3-dc4b-4f46-b609-27a35e3cfba3 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:d981b3f7-11f4-433a-a760-7f5b1f4a737b -DeviceGroupId:
C:\Windows\system32\svchost.exe -k SDRSVC
"C:\Program Files (x86)\Common Files\Research In Motion\nginx\\nginx.exe" -c "C:\Users\PC\AppData\Roaming\Research In Motion\BlackBerry 10 Desktop\RemoteAccess\nginx\conf\nginx.conf"
"C:\Program Files (x86)\Common Files\Research In Motion\nginx\\nginx.exe" -c "C:\Users\PC\AppData\Roaming\Research In Motion\BlackBerry 10 Desktop\RemoteAccess\nginx\conf\nginx.conf"
\??\C:\Windows\system32\conhost.exe "895320094-939775880278480746-227573905-485985121442394479-1171638603-507412943
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 524 528 536 65536 532
"C:\Users\PC\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3692174025-3308642086-1692176655-1000Core.job - C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3692174025-3308642086-1692176655-1000UA.job - C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-10-04 462248]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-10-04 171944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2012-11-19 6846096]
"IAStorIcon"=C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe [2013-01-31 36352]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2014-04-30 2199840]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2014-08-22 1331288]
"ShadowPlay"=C:\Windows\system32\nvspcap64.dll [2014-04-30 1225920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-07-03 3673184]
"BlackBerryLink.exe"=C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.exe [2014-02-03 1464336]
"Google Update"=C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe [2014-01-16 116648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autodesk Sync]
C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [2013-02-05 1081224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EADM]
C:\Program Files (x86)\Origin\Origin.exe [2014-06-26 3595608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShadowPlay]
C:\Windows\system32\nvspcap64.dll [2014-04-30 1225920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2013-03-06 291128]
""= []
"HPUsageTrackingLEDM"=C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [2009-10-15 30264]
"RIMBBLaunchAgent.exe"=C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [2014-01-21 443408]
"RIM PeerManager"=C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [2014-01-22 4484608]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2014-08-07 751184]
"Avira Systray"=C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [2014-08-27 164656]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan Plus.lnk - C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
""=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.XFR1"=xfcodec64.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2014-09-11 08:01:33 ----D---- C:\ProgramData\McAfee Security Scan
2014-09-11 08:01:33 ----D---- C:\ProgramData\McAfee
2014-09-11 08:01:31 ----D---- C:\Program Files (x86)\McAfee Security Scan
2014-09-10 21:08:38 ----D---- C:\rsit
2014-09-10 21:08:38 ----D---- C:\Program Files\trend micro
2014-09-10 19:52:57 ----A---- C:\Windows\system32\drivers\hitmanpro37.sys
2014-09-10 19:48:26 ----D---- C:\ProgramData\HitmanPro
2014-09-10 19:43:01 ----D---- C:\AdwCleaner
2014-09-10 19:42:06 ----SHD---- C:\Config.Msi
2014-09-10 19:41:47 ----A---- C:\Windows\SYSWOW64\ieui.dll
2014-09-10 19:41:47 ----A---- C:\Windows\system32\ieui.dll
2014-09-10 19:41:46 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2014-09-10 19:41:46 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2014-09-10 19:41:46 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\jscript9diag.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\ieUnatt.exe
2014-09-10 19:41:46 ----A---- C:\Windows\system32\iernonce.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\dxtrans.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\dxtmsft.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\msrating.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\vbscript.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\msrating.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\mshtmled.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\msfeeds.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\jsproxy.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\iesetup.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\iedkcs32.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\ie4uinit.exe
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\mshtml.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\ieapfltr.dll
2014-09-10 19:41:43 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2014-09-10 19:41:43 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-10 19:41:43 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-09-10 19:41:42 ----A---- C:\Windows\SYSWOW64\wininet.dll
2014-09-10 19:41:42 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2014-09-10 19:41:42 ----A---- C:\Windows\system32\wininet.dll
2014-09-10 19:41:42 ----A---- C:\Windows\system32\jscript9.dll
2014-09-10 19:41:42 ----A---- C:\Windows\system32\iertutil.dll
2014-09-10 19:41:41 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2014-09-10 19:41:41 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2014-09-10 19:41:41 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2014-09-10 19:41:41 ----A---- C:\Windows\system32\urlmon.dll
2014-09-10 19:41:40 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2014-09-10 19:41:40 ----A---- C:\Windows\system32\ieframe.dll
2014-09-10 19:38:16 ----A---- C:\Windows\SYSWOW64\msmpeg2vdec.dll
2014-09-10 19:38:16 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2014-09-10 17:48:10 ----A---- C:\Windows\SYSWOW64\TSWorkspace.dll
2014-09-10 17:48:10 ----A---- C:\Windows\system32\TSWorkspace.dll
2014-09-10 17:47:53 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2014-09-10 17:47:53 ----A---- C:\Windows\system32\d3d10warp.dll
2014-09-10 17:47:49 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2014-09-10 17:47:49 ----A---- C:\Windows\SYSWOW64\secur32.dll
2014-09-10 17:47:49 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2014-09-10 17:47:49 ----A---- C:\Windows\system32\lsasrv.dll
2014-09-10 17:47:49 ----A---- C:\Windows\system32\kerberos.dll
2014-09-10 17:47:48 ----A---- C:\Windows\system32\aepdu.dll
2014-09-10 17:47:48 ----A---- C:\Windows\system32\aeinv.dll
2014-09-10 13:57:28 ----A---- C:\Windows\SYSWOW64\sqlite3.dll
2014-09-10 13:42:43 ----A---- C:\Windows\ntbtlog.txt
2014-09-10 13:06:23 ----D---- C:\ProgramData\Malwarebytes
2014-09-10 13:05:59 ----D---- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-09-10 13:05:58 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-09-10 13:04:58 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-08-28 08:41:41 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2014-08-28 08:41:41 ----A---- C:\Windows\system32\win32k.sys
2014-08-28 08:41:41 ----A---- C:\Windows\system32\gdi32.dll
2014-08-16 13:39:27 ----D---- C:\Users\PC\AppData\Roaming\Ulozto File Manager
2014-08-13 18:53:56 ----A---- C:\Windows\SYSWOW64\infocardapi.dll
2014-08-13 18:53:56 ----A---- C:\Windows\SYSWOW64\icardagt.exe
2014-08-13 18:53:56 ----A---- C:\Windows\system32\infocardapi.dll
2014-08-13 18:53:56 ----A---- C:\Windows\system32\icardagt.exe
2014-08-13 18:53:54 ----A---- C:\Windows\SYSWOW64\icardres.dll
2014-08-13 18:53:54 ----A---- C:\Windows\system32\icardres.dll
2014-08-13 18:53:46 ----A---- C:\Windows\SYSWOW64\TsWpfWrp.exe
2014-08-13 18:53:46 ----A---- C:\Windows\system32\TsWpfWrp.exe
2014-08-13 16:34:38 ----A---- C:\Windows\SYSWOW64\KBDTAT.DLL
2014-08-13 16:34:38 ----A---- C:\Windows\SYSWOW64\KBDRU1.DLL
2014-08-13 16:34:38 ----A---- C:\Windows\system32\KBDTAT.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\SYSWOW64\KBDYAK.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\SYSWOW64\KBDRU.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\SYSWOW64\KBDBASH.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDYAK.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDRU1.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDRU.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDBASH.DLL
2014-08-13 16:34:36 ----A---- C:\Windows\SYSWOW64\tzres.dll
2014-08-13 16:34:36 ----A---- C:\Windows\system32\tzres.dll
2014-08-13 16:34:34 ----A---- C:\Windows\SYSWOW64\msi.dll
2014-08-13 16:34:34 ----A---- C:\Windows\system32\msi.dll
2014-08-13 16:34:34 ----A---- C:\Windows\system32\authui.dll
2014-08-13 16:34:33 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2014-08-13 16:34:33 ----A---- C:\Windows\SYSWOW64\authui.dll
2014-08-13 16:34:33 ----A---- C:\Windows\system32\msihnd.dll
2014-08-13 16:34:33 ----A---- C:\Windows\system32\consent.exe
2014-08-13 16:34:32 ----A---- C:\Windows\system32\shell32.dll
2014-08-13 16:34:32 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2014-08-13 16:34:31 ----A---- C:\Windows\SYSWOW64\shell32.dll
2014-08-13 16:33:11 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2014-08-13 16:33:11 ----A---- C:\Windows\system32\rpcrt4.dll

======List of files/folders modified in the last 1 month======

2014-09-11 19:29:47 ----D---- C:\Windows\Temp
2014-09-11 19:26:24 ----D---- C:\Windows\system32\config
2014-09-11 19:20:08 ----D---- C:\Windows\System32
2014-09-11 19:20:08 ----D---- C:\Windows\inf
2014-09-11 19:20:08 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-09-11 19:13:11 ----D---- C:\ProgramData\NVIDIA
2014-09-11 08:01:33 ----HD---- C:\ProgramData
2014-09-11 08:01:31 ----D---- C:\Program Files (x86)
2014-09-11 08:01:30 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2014-09-10 21:08:38 ----RD---- C:\Program Files
2014-09-10 20:29:02 ----D---- C:\Windows\Microsoft.NET
2014-09-10 20:24:40 ----RSD---- C:\Windows\assembly
2014-09-10 19:52:57 ----D---- C:\Windows\system32\drivers
2014-09-10 19:51:53 ----SHD---- C:\System Volume Information
2014-09-10 19:45:56 ----D---- C:\Windows\winsxs
2014-09-10 19:45:28 ----D---- C:\Windows\system32\catroot
2014-09-10 19:45:25 ----D---- C:\Windows\SYSWOW64\en-US
2014-09-10 19:45:25 ----D---- C:\Windows\SYSWOW64\cs-CZ
2014-09-10 19:45:25 ----D---- C:\Windows\SysWOW64
2014-09-10 19:45:25 ----D---- C:\Windows\system32\en-US
2014-09-10 19:45:25 ----D---- C:\Windows\system32\cs-CZ
2014-09-10 19:45:25 ----D---- C:\Program Files\Internet Explorer
2014-09-10 19:45:25 ----D---- C:\Program Files (x86)\Internet Explorer
2014-09-10 19:42:53 ----SHD---- C:\Windows\Installer
2014-09-10 19:41:52 ----D---- C:\Windows\system32\catroot2
2014-09-10 19:41:33 ----D---- C:\ProgramData\Microsoft Help
2014-09-10 19:41:10 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2014-09-10 19:40:43 ----D---- C:\Windows
2014-09-10 19:40:43 ----D---- C:\Program Files\Microsoft Security Client
2014-09-10 19:40:43 ----D---- C:\Program Files (x86)\Microsoft Security Client
2014-09-10 19:40:33 ----D---- C:\Windows\system32\MRT
2014-09-10 19:38:31 ----D---- C:\Windows\debug
2014-09-10 19:38:31 ----A---- C:\Windows\system32\MRT.exe
2014-09-10 19:38:16 ----SD---- C:\Windows\system32\CompatTel
2014-09-10 13:41:32 ----D---- C:\Windows\system32\Tasks
2014-09-10 13:01:45 ----D---- C:\Windows\Logs
2014-09-09 18:11:18 ----D---- C:\ProgramData\Package Cache
2014-09-09 18:11:15 ----D---- C:\Program Files (x86)\Avira
2014-09-01 17:10:50 ----D---- C:\Windows\system32\NDF
2014-08-19 17:59:26 ----D---- C:\ProgramData\GFACE
2014-08-14 17:49:12 ----D---- C:\Windows\rescache
2014-08-14 06:53:05 ----RSD---- C:\Windows\Fonts
2014-08-14 06:53:04 ----D---- C:\Windows\PolicyDefinitions

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStorA;iaStorA; C:\Windows\system32\DRIVERS\iaStorA.sys [2013-01-31 652784]
R0 iaStorF;iaStorF; C:\Windows\system32\DRIVERS\iaStorF.sys [2013-01-31 28656]
R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2012-12-21 20616]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2014-07-17 269008]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 AsIO;AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [2012-08-22 15232]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2014-05-27 130584]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2014-05-27 28600]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-10-04 283064]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2014-07-03 117712]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2014-07-17 125584]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-11-20 4213904]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2012-12-21 366216]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2012-12-21 786056]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2013-01-23 64624]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2014-05-20 197408]
R3 NvStreamKms;NvStreamKms; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2014-04-30 19744]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad64v.sys [2014-03-31 40392]
R3 rimvndis;BlackBerry Virtual Private Network; C:\Windows\System32\Drivers\rimvndis6_AMD64.sys [2014-01-22 17920]
R3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys [2012-12-10 44544]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2009-07-14 11264]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2012-12-26 805088]
S3 hitmanpro37;HitmanPro 3.7 Support Driver; \??\C:\Windows\system32\drivers\hitmanpro37.sys [2014-09-10 32512]
S3 MSICDSetup;MSICDSetup; \??\D:\CDriver64.sys []
S3 mvusbews;USB EWS Device; C:\Windows\System32\Drivers\mvusbews.sys [2012-12-24 20480]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RimUsb;zařízení BlackBerry Smartphone; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [2013-12-02 79872]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usbrndis6;Adaptér USB RNDIS6; C:\Windows\system32\DRIVERS\usb80236.sys [2013-02-12 19968]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2014-08-07 430160]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2014-08-07 430160]
R2 asComSvc;ASUS Com Service; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [2012-10-30 927232]
R2 Avira.OE.ServiceHost;Avira Service Host; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-08-27 160048]
R2 HP LaserJet Service;HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [2009-10-15 136192]
R2 HPSIService;HP SI Service; C:\Windows\system32\HPSIsvc.exe [2012-11-08 126856]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-01-31 15344]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-12-10 732160]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-01-23 169432]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-01-23 366552]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2014-08-22 23784]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-04-30 1618888]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-04-30 21009352]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2014-05-20 927520]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2014-05-31 76888]
R2 RIM MDNS;RIM MDNS; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [2014-01-22 389632]
R2 RIM Tunnel Service;BlackBerry Link Communication Manager; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [2014-01-22 1309696]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-05-20 413128]
R3 BlackBerry Device Manager;BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2014-01-21 585728]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-08-22 368624]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S3 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-12-13 12288]
S3 BEService;BattlEye Service; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [2014-07-24 345984]
S3 FlexNet Licensing Service 64;FlexNet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2013-10-23 1471352]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-08-19 111616]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2012-12-10 803872]
S3 McComponentHostService;McAfee Security Scan Component Host Service; C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [2012-09-05 234776]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-07-16 542912]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-10-06 1255736]
S4 AntiVirWebService;Avira Web Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [2014-08-07 1021520]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:

:files
C:\Program Files (x86)\McAfee Security Scan
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3692174025-3308642086-1692176655-1000Core.job
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3692174025-3308642086-1692176655-1000UA.job
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
C:\ProgramData\McAfee Security Scan

:reg
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

:services
McComponentHostService

:commands
[Purity]
[Emptytemp]
[Emptyflash]

a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.

Logfile of random's system information tool 1.10 (written by random/random)
Run by PC at 2014-09-12 06:54:56
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 35 GB (30%) free of 114 GB
Total RAM: 8132 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:55:01, on 12.9.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe
C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.Helper.exe
C:\Program Files (x86)\Common Files\Research In Motion\nginx\nginx.exe
C:\Program Files (x86)\Common Files\Research In Motion\nginx\nginx.exe
C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.AutoUpdate.exe
C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\trend micro\PC.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [HPUsageTrackingLEDM] "C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT LEDM\"
O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Run: [RIM PeerManager] "C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [BlackBerryLink.exe] "C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.exe" /minimize
O4 - HKCU\..\Run: [Google Update] "C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe
O9 - Extra 'Tools' menuitem: SmartPrint - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs:
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Real-Time Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ASUS Com Service (asComSvc) - Unknown owner - C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: Avira Service Host (Avira.OE.ServiceHost) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
O23 - Service: BattlEye Service (BEService) - Unknown owner - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service: BlackBerry Device Manager - BlackBerry Limited - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FlexNet Licensing Service 64 - Flexera Software LLC - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: HP LaserJet Service - HP - C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
O23 - Service: HP SI Service (HPSIService) - Unknown owner - C:\Windows\system32\HPSIsvc.exe (file missing)
O23 - Service: Intel(R) Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: RIM MDNS - Apple Inc. - C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe
O23 - Service: BlackBerry Link Communication Manager (RIM Tunnel Service) - Research In Motion Limited - C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12002 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
"C:\Windows\system32\nvvsvc.exe"
"C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"
C:\Windows\system32\svchost.exe -k RPCSS
"C:\Program Files\Microsoft Security Client\MsMpEng.exe"
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs

"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\System32\spoolsv.exe
"taskhost.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe"
"C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe"
"C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe"
C:\Windows\system32\HPSIsvc.exe
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe"
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe"
C:\Windows\SysWOW64\PnkBstrA.exe
"C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe" service
"C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe" avshadowcontrol0_000007a4
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" nss 25ce4e48-c95f-492d-8c71-f65148fe79b9 1
\??\C:\Windows\system32\conhost.exe "-1669386631-106161472-487657169785120162-1983095623-256099180-1974482104-362823380
"C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe" serviceapp
\??\C:\Windows\system32\conhost.exe "2034958739628979028-13257892793485060801461117654-1859842803-316294739-121505325
"C:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
"C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe"
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
"C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-36efb2ed-0cd3-4c1a-b27f-8040a975bab5 -SystemEventPortName:HostProcess-87c1450d-2eb1-4394-9690-3ebf6ef21302 -IoCancelEventPortName:HostProcess-d0c22413-b20f-4dd5-a403-7ac5c0b7972d -NonStateChangingEventPortName:HostProcess-821afd2e-eee0-41e8-8794-2e15f77eb88f -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:8efc4d7b-90e2-41b7-b04e-e88187a0b971 -DeviceGroupId:
"C:\Windows\notepad.exe" C:\_OTM\MovedFiles\09122014_065100.log
"C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe" -s
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe" /c
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT LEDM\"
"C:\Program Files (x86)\Common Files\Research in Motion\USB Drivers\RIMBBLaunchAgent.exe"
"C:\Program Files (x86)\Common Files\Research in Motion\Tunnel Manager\PeerManager.exe"
"C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe"
"C:/Program Files/NVIDIA Corporation/Display/nvtray.exe" -user_has_logged_in 1
"C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.Helper.exe" /dts
"C:\Program Files (x86)\Common Files\Research In Motion\nginx\\nginx.exe" -c "C:\Users\PC\AppData\Roaming\Research In Motion\BlackBerry 10 Desktop\RemoteAccess\nginx\conf\nginx.conf"
"C:\Program Files (x86)\Common Files\Research In Motion\nginx\\nginx.exe" -c "C:\Users\PC\AppData\Roaming\Research In Motion\BlackBerry 10 Desktop\RemoteAccess\nginx\conf\nginx.conf"
\??\C:\Windows\system32\conhost.exe "2141795186-13413539006446152841231020536-1744093357592060552252283084-1982029037
"C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.AutoUpdate.exe" /noprogress
"C:\Program Files (x86)\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe" -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Users\PC\Downloads\RSITx64.exe"
"C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-10-04 462248]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-10-04 171944]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"=C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [2012-11-19 6846096]
"IAStorIcon"=C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe [2013-01-31 36352]
"NvBackend"=C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2014-04-30 2199840]
"MSC"=C:\Program Files\Microsoft Security Client\msseces.exe [2014-08-22 1331288]
"ShadowPlay"=C:\Windows\system32\nvspcap64.dll [2014-04-30 1225920]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-07-03 3673184]
"BlackBerryLink.exe"=C:\Program Files (x86)\Research In Motion\BlackBerry Link\BlackBerryLink.exe [2014-02-03 1464336]
"Google Update"=C:\Users\PC\AppData\Local\Google\Update\GoogleUpdate.exe [2014-01-16 116648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autodesk Sync]
C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [2013-02-05 1081224]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EADM]
C:\Program Files (x86)\Origin\Origin.exe [2014-06-26 3595608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShadowPlay]
C:\Windows\system32\nvspcap64.dll [2014-04-30 1225920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02 254336]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2013-03-06 291128]
""= []
"HPUsageTrackingLEDM"=C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [2009-10-15 30264]
"RIMBBLaunchAgent.exe"=C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [2014-01-21 443408]
"RIM PeerManager"=C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [2014-01-22 4484608]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21 959904]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2014-08-07 751184]
"Avira Systray"=C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [2014-08-27 164656]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\hitmanpro37.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37Crusader]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HitmanPro37CrusaderBoot]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
""=

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"VIDC.XFR1"=xfcodec64.dll
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*
.scr - open - C:\Windows\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 month======

2014-09-12 06:51:00 ----D---- C:\_OTM
2014-09-11 20:40:54 ----A---- C:\autoexec.bat
2014-09-11 20:40:12 ----D---- C:\Program Files\Enigma Software Group
2014-09-11 08:01:33 ----D---- C:\ProgramData\McAfee
2014-09-10 21:08:38 ----D---- C:\rsit
2014-09-10 21:08:38 ----D---- C:\Program Files\trend micro
2014-09-10 19:52:57 ----A---- C:\Windows\system32\drivers\hitmanpro37.sys
2014-09-10 19:48:26 ----D---- C:\ProgramData\HitmanPro
2014-09-10 19:43:01 ----D---- C:\AdwCleaner
2014-09-10 19:41:47 ----A---- C:\Windows\SYSWOW64\ieui.dll
2014-09-10 19:41:47 ----A---- C:\Windows\system32\ieui.dll
2014-09-10 19:41:46 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2014-09-10 19:41:46 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2014-09-10 19:41:46 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\MshtmlDac.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\jscript9diag.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\ieUnatt.exe
2014-09-10 19:41:46 ----A---- C:\Windows\system32\iernonce.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\dxtrans.dll
2014-09-10 19:41:46 ----A---- C:\Windows\system32\dxtmsft.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\msrating.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2014-09-10 19:41:45 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\vbscript.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\msrating.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\mshtmled.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\msfeeds.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\jsproxy.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\iesetup.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\iedkcs32.dll
2014-09-10 19:41:45 ----A---- C:\Windows\system32\ie4uinit.exe
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2014-09-10 19:41:44 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\mshtmlmedia.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\mshtml.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\ieetwproxystub.dll
2014-09-10 19:41:44 ----A---- C:\Windows\system32\ieapfltr.dll
2014-09-10 19:41:43 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2014-09-10 19:41:43 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-10 19:41:43 ----A---- C:\Windows\system32\ieetwcollector.exe
2014-09-10 19:41:42 ----A---- C:\Windows\SYSWOW64\wininet.dll
2014-09-10 19:41:42 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2014-09-10 19:41:42 ----A---- C:\Windows\system32\wininet.dll
2014-09-10 19:41:42 ----A---- C:\Windows\system32\jscript9.dll
2014-09-10 19:41:42 ----A---- C:\Windows\system32\iertutil.dll
2014-09-10 19:41:41 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2014-09-10 19:41:41 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2014-09-10 19:41:41 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2014-09-10 19:41:41 ----A---- C:\Windows\system32\urlmon.dll
2014-09-10 19:41:40 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2014-09-10 19:41:40 ----A---- C:\Windows\system32\ieframe.dll
2014-09-10 19:38:16 ----A---- C:\Windows\SYSWOW64\msmpeg2vdec.dll
2014-09-10 19:38:16 ----A---- C:\Windows\system32\msmpeg2vdec.dll
2014-09-10 17:48:10 ----A---- C:\Windows\SYSWOW64\TSWorkspace.dll
2014-09-10 17:48:10 ----A---- C:\Windows\system32\TSWorkspace.dll
2014-09-10 17:47:53 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2014-09-10 17:47:53 ----A---- C:\Windows\system32\d3d10warp.dll
2014-09-10 17:47:49 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2014-09-10 17:47:49 ----A---- C:\Windows\SYSWOW64\secur32.dll
2014-09-10 17:47:49 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2014-09-10 17:47:49 ----A---- C:\Windows\system32\lsasrv.dll
2014-09-10 17:47:49 ----A---- C:\Windows\system32\kerberos.dll
2014-09-10 17:47:48 ----A---- C:\Windows\system32\aepdu.dll
2014-09-10 17:47:48 ----A---- C:\Windows\system32\aeinv.dll
2014-09-10 13:57:28 ----A---- C:\Windows\SYSWOW64\sqlite3.dll
2014-09-10 13:42:43 ----A---- C:\Windows\ntbtlog.txt
2014-09-10 13:06:23 ----D---- C:\ProgramData\Malwarebytes
2014-09-10 13:05:59 ----D---- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-09-10 13:05:58 ----A---- C:\Windows\system32\drivers\MBAMSwissArmy.sys
2014-09-10 13:04:58 ----A---- C:\Windows\system32\drivers\mbamchameleon.sys
2014-08-28 08:41:41 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2014-08-28 08:41:41 ----A---- C:\Windows\system32\win32k.sys
2014-08-28 08:41:41 ----A---- C:\Windows\system32\gdi32.dll
2014-08-16 13:39:27 ----D---- C:\Users\PC\AppData\Roaming\Ulozto File Manager
2014-08-13 18:53:56 ----A---- C:\Windows\SYSWOW64\infocardapi.dll
2014-08-13 18:53:56 ----A---- C:\Windows\SYSWOW64\icardagt.exe
2014-08-13 18:53:56 ----A---- C:\Windows\system32\infocardapi.dll
2014-08-13 18:53:56 ----A---- C:\Windows\system32\icardagt.exe
2014-08-13 18:53:54 ----A---- C:\Windows\SYSWOW64\icardres.dll
2014-08-13 18:53:54 ----A---- C:\Windows\system32\icardres.dll
2014-08-13 18:53:46 ----A---- C:\Windows\SYSWOW64\TsWpfWrp.exe
2014-08-13 18:53:46 ----A---- C:\Windows\system32\TsWpfWrp.exe
2014-08-13 16:34:38 ----A---- C:\Windows\SYSWOW64\KBDTAT.DLL
2014-08-13 16:34:38 ----A---- C:\Windows\SYSWOW64\KBDRU1.DLL
2014-08-13 16:34:38 ----A---- C:\Windows\system32\KBDTAT.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\SYSWOW64\KBDYAK.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\SYSWOW64\KBDRU.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\SYSWOW64\KBDBASH.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDYAK.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDRU1.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDRU.DLL
2014-08-13 16:34:37 ----A---- C:\Windows\system32\KBDBASH.DLL
2014-08-13 16:34:36 ----A---- C:\Windows\SYSWOW64\tzres.dll
2014-08-13 16:34:36 ----A---- C:\Windows\system32\tzres.dll
2014-08-13 16:34:34 ----A---- C:\Windows\SYSWOW64\msi.dll
2014-08-13 16:34:34 ----A---- C:\Windows\system32\msi.dll
2014-08-13 16:34:34 ----A---- C:\Windows\system32\authui.dll
2014-08-13 16:34:33 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2014-08-13 16:34:33 ----A---- C:\Windows\SYSWOW64\authui.dll
2014-08-13 16:34:33 ----A---- C:\Windows\system32\msihnd.dll
2014-08-13 16:34:33 ----A---- C:\Windows\system32\consent.exe
2014-08-13 16:34:32 ----A---- C:\Windows\system32\shell32.dll
2014-08-13 16:34:32 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2014-08-13 16:34:31 ----A---- C:\Windows\SYSWOW64\shell32.dll
2014-08-13 16:33:11 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2014-08-13 16:33:11 ----A---- C:\Windows\system32\rpcrt4.dll

======List of files/folders modified in the last 1 month======

2014-09-12 06:54:58 ----D---- C:\Windows\Temp
2014-09-12 06:52:41 ----D---- C:\ProgramData\NVIDIA
2014-09-12 06:52:24 ----D---- C:\Windows\system32\config
2014-09-12 06:51:21 ----D---- C:\Windows
2014-09-12 06:51:00 ----HD---- C:\ProgramData
2014-09-12 06:51:00 ----D---- C:\Windows\Tasks
2014-09-12 06:51:00 ----D---- C:\Program Files (x86)
2014-09-12 06:50:51 ----D---- C:\Windows\System32
2014-09-12 06:50:51 ----D---- C:\Windows\inf
2014-09-12 06:50:51 ----A---- C:\Windows\system32\PerfStringBackup.INI
2014-09-12 06:47:35 ----SHD---- C:\Windows\Installer
2014-09-12 06:47:35 ----SD---- C:\Users\PC\AppData\Roaming\Microsoft
2014-09-12 06:47:34 ----D---- C:\Windows\system32\Tasks
2014-09-12 06:47:12 ----D---- C:\Windows\system32\drivers
2014-09-12 06:46:34 ----SHD---- C:\System Volume Information
2014-09-11 21:34:15 ----D---- C:\Windows\rescache
2014-09-11 20:40:12 ----RD---- C:\Program Files
2014-09-11 20:39:48 ----D---- C:\Program Files (x86)\Common Files
2014-09-11 08:01:30 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2014-09-10 20:29:02 ----D---- C:\Windows\Microsoft.NET
2014-09-10 20:24:40 ----RSD---- C:\Windows\assembly
2014-09-10 19:45:56 ----D---- C:\Windows\winsxs
2014-09-10 19:45:28 ----D---- C:\Windows\system32\catroot
2014-09-10 19:45:25 ----D---- C:\Windows\SYSWOW64\en-US
2014-09-10 19:45:25 ----D---- C:\Windows\SYSWOW64\cs-CZ
2014-09-10 19:45:25 ----D---- C:\Windows\SysWOW64
2014-09-10 19:45:25 ----D---- C:\Windows\system32\en-US
2014-09-10 19:45:25 ----D---- C:\Windows\system32\cs-CZ
2014-09-10 19:45:25 ----D---- C:\Program Files\Internet Explorer
2014-09-10 19:45:25 ----D---- C:\Program Files (x86)\Internet Explorer
2014-09-10 19:41:52 ----D---- C:\Windows\system32\catroot2
2014-09-10 19:41:33 ----D---- C:\ProgramData\Microsoft Help
2014-09-10 19:41:10 ----A---- C:\Windows\SYSWOW64\PerfStringBackup.INI
2014-09-10 19:40:43 ----D---- C:\Program Files\Microsoft Security Client
2014-09-10 19:40:43 ----D---- C:\Program Files (x86)\Microsoft Security Client
2014-09-10 19:40:33 ----D---- C:\Windows\system32\MRT
2014-09-10 19:38:31 ----D---- C:\Windows\debug
2014-09-10 19:38:31 ----A---- C:\Windows\system32\MRT.exe
2014-09-10 19:38:16 ----SD---- C:\Windows\system32\CompatTel
2014-09-10 13:01:45 ----D---- C:\Windows\Logs
2014-09-09 18:11:18 ----D---- C:\ProgramData\Package Cache
2014-09-09 18:11:15 ----D---- C:\Program Files (x86)\Avira
2014-09-01 17:10:50 ----D---- C:\Windows\system32\NDF
2014-08-19 17:59:26 ----D---- C:\ProgramData\GFACE
2014-08-14 06:53:05 ----RSD---- C:\Windows\Fonts
2014-08-14 06:53:04 ----D---- C:\Windows\PolicyDefinitions

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStorA;iaStorA; C:\Windows\system32\DRIVERS\iaStorA.sys [2013-01-31 652784]
R0 iaStorF;iaStorF; C:\Windows\system32\DRIVERS\iaStorF.sys [2013-01-31 28656]
R0 iusb3hcs;Ovladač přepínání hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2012-12-21 20616]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2014-07-17 269008]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R1 AsIO;AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [2012-08-22 15232]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2014-05-27 130584]
R1 avkmgr;avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [2014-05-27 28600]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-10-04 283064]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2014-07-03 117712]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2014-07-17 125584]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [2012-11-20 4213904]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2012-12-21 366216]
R3 iusb3xhc;Ovladač rozšiřitelného hostitelského řadiče Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2012-12-21 786056]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2013-01-23 64624]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda64v.sys [2014-05-20 197408]
R3 NvStreamKms;NvStreamKms; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [2014-04-30 19744]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM); C:\Windows\system32\drivers\nvvad64v.sys [2014-03-31 40392]
R3 rimvndis;BlackBerry Virtual Private Network; C:\Windows\System32\Drivers\rimvndis6_AMD64.sys [2014-01-22 17920]
R3 RimVSerPort;RIM Virtual Serial Port v2; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys [2012-12-10 44544]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2009-07-14 11264]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2012-12-26 805088]
S3 esgiguard;esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys []
S3 hitmanpro37;HitmanPro 3.7 Support Driver; \??\C:\Windows\system32\drivers\hitmanpro37.sys [2014-09-10 32512]
S3 MSICDSetup;MSICDSetup; \??\D:\CDriver64.sys []
S3 mvusbews;USB EWS Device; C:\Windows\System32\Drivers\mvusbews.sys [2012-12-24 20480]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RimUsb;zařízení BlackBerry Smartphone; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [2013-12-02 79872]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 usbrndis6;Adaptér USB RNDIS6; C:\Windows\system32\DRIVERS\usb80236.sys [2013-02-12 19968]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-21 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2013-12-21 65432]
R2 AntiVirService;Avira Real-Time Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2014-08-07 430160]
R2 AntiVirSchedulerService;Avira Scheduler; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2014-08-07 430160]
R2 asComSvc;ASUS Com Service; C:\Program Files (x86)\ASUS\AXSP\1.01.01\atkexComSvc.exe [2012-10-30 927232]
R2 Avira.OE.ServiceHost;Avira Service Host; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-08-27 160048]
R2 HP LaserJet Service;HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [2009-10-15 136192]
R2 HPSIService;HP SI Service; C:\Windows\system32\HPSIsvc.exe [2012-11-08 126856]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-01-31 15344]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-12-10 732160]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2013-01-23 169432]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2013-01-23 366552]
R2 MsMpSvc;Microsoft Antimalware Service; C:\Program Files\Microsoft Security Client\MsMpEng.exe [2014-08-22 23784]
R2 NvNetworkService;NVIDIA Network Service; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-04-30 1618888]
R2 NvStreamSvc;NVIDIA Streamer Service; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-04-30 21009352]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2014-05-20 927520]
R2 PnkBstrA;PnkBstrA; C:\Windows\syswow64\PnkBstrA.exe [2014-05-31 76888]
R2 RIM MDNS;RIM MDNS; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [2014-01-22 389632]
R2 RIM Tunnel Service;BlackBerry Link Communication Manager; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [2014-01-22 1309696]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-05-20 413128]
R3 BlackBerry Device Manager;BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2014-01-21 585728]
R3 NisSrv;@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; C:\Program Files\Microsoft Security Client\NisSrv.exe [2014-08-22 368624]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-09-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-09-11 124088]
S3 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2013-09-11 51808]
S3 Autodesk Content Service;Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-12-13 12288]
S3 BEService;BattlEye Service; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [2014-07-24 345984]
S3 FlexNet Licensing Service 64;FlexNet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2013-10-23 1471352]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2014-08-19 111616]
S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2012-12-10 803872]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 149352]
S3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2014-07-16 542912]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-10-06 1255736]
S4 AntiVirWebService;Avira Web Protection; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [2014-08-07 1021520]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2013-09-11 139856]

-----------------EOF-----------------

Dvouklikem na soubor C:\Program Files\trend micro\PC.exe spusťte HijackThis. Klikněte na "Do a system scan only" a v otevřeném okně vlevo ve čtverečcích zaškrtněte:

O20 - AppInit_DLLs:

Klikněte na >FixChecked<. Pak znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC.

vše uděláno, stále přesměrovává

Ve kterém prohlížeči?

crome

v Tor-ovi to nedělá.

Chrome zazálohujte pomocí Chromebackup: http://www.stahuj.centrum.cz/internet_a ... me-backup/ . Pak Chrome odinstalujte vč. jeho profilu. Znovu nainstalujte a zpět ze zálohy nakopírujte pouze záložky, příp. hesla.