VIRY.CZ

Dobrý den, mohu poprosit o pomoc s odintalací SalePlus? bohužel jsem si ho natáhnul na 2 počítače. Děkuji...

Logfile of random's system information tool 1.10 (written by random/random)
Run by richard at 2015-04-06 20:58:31
Microsoft Windows 7 Professional Service Pack 1
System drive C: has 239 GB (52%) free of 457 GB
Total RAM: 3662 MB (32% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:58:33, on 6.4.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17689)
Boot mode: Normal

Running processes:
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
C:\PROGRAM FILES (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe
C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTray.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\USB Camera\VM331STI.EXE
C:\Windows\SysWOW64\rundll32.exe
C:\ProgramData\{0e0d05ae-13d5-a607-0e0d-d05ae13d16b8}\microsoft office office 2010 keygen ( 100%.exe
C:\ProgramData\{08a00543-05c1-dc53-08a0-0054305c150c}\office 2010 home and office product key.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
C:\Windows\SvcFiles\msde.exe
C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\richard.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13-comm.msn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll
O4 - HKLM\..\Run: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
O4 - HKLM\..\Run: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
O4 - HKLM\..\Run: [331BigDog] C:\Program Files (x86)\USB Camera\VM331STI.EXE
O4 - HKLM\..\Run: [Dolby Advanced Audio v2] "C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart
O4 - HKLM\..\Run: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [Lenovo Registration] C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe /boot
O4 - HKLM\..\Run: [Fastboot] "C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [wsg32.exe] wsg32.exe
O4 - HKLM\..\Run: [Services] C:\Windows\SvcFiles\msde.exe .
O4 - HKCU\..\Run: [Google Update] "C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [GarminExpressTrayApp] "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe"
O4 - HKCU\..\Run: [Zoner Photo Studio Autoupdate] C:\PROGRAM FILES\ZONER\PHOTO STUDIO 15\Program32\ZPSTRAY.EXE
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2677794339-3578005486-2719301744-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-2677794339-3578005486-2719301744-1000\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O4 - HKUS\S-1-5-18\..\Run: [GarminExpressTrayApp] "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [GarminExpressTrayApp] "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe" (User 'Default user')
O4 - Startup: microsoft office office 2010 keygen ( 100%.lnk = C:\ProgramData\{0e0d05ae-13d5-a607-0e0d-d05ae13d16b8}\microsoft office office 2010 keygen ( 100%.exe
O4 - Startup: office 2010 home and office product key.lnk = C:\ProgramData\{08a00543-05c1-dc53-08a0-0054305c150c}\office 2010 home and office product key.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Od&eslat do aplikace OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Odeslat do Bluetooth - C:\Program Files (x86)\Intel\Bluetooth\btSendToObject.htm
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: P&ropojené poznámky aplikace OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O9 - Extra button: Odeslat do Bluetooth - {2F56DCAA-153B-4479-B4E2-547405B34FB9} - C:\Program Files (x86)\Intel\Bluetooth\btSendToPage.htm (HKCU)
O9 - Extra 'Tools' menuitem: Odeslat do Bluetooth - {2F56DCAA-153B-4479-B4E2-547405B34FB9} - C:\Program Files (x86)\Intel\Bluetooth\btSendToPage.htm (HKCU)
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {F680B28A-3AEE-4C88-93ED-45AE9215C128} (CryptSignX Control) - https://adisepo.mfcr.cz/adistc/adis/idp ... tsignx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3BFE0E02-2F35-4ABB-A64A-A94F09658477}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: 602Updater (602XML Updater) - Software602 a.s. - C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel® Centrino® Wireless Bluetooth® + High Speed Service (AMPPALR3) - Intel Corporation - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
O23 - Service: Bluetooth Device Monitor - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
O23 - Service: Bluetooth Media Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
O23 - Service: Bluetooth OBEX Service - Motorola Solutions, Inc. - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
O23 - Service: Intel(R) Centrino(R) Wireless Bluetooth(R) + High Speed Security Service (BTHSSecurityMgr) - Intel(R) Corporation - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @C:\Windows\system32\CxAudMsg64.exe,-100 (CxAudMsg) - Unknown owner - C:\Windows\system32\CxAudMsg64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FastbootService - Lenovo - C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Garmin Core Update Service - Garmin Ltd or its subsidiaries - C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Unknown owner - C:\Windows\system32\ibmpmsvc.exe (file missing)
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Small Business Advantage (intelsba) - Intel Corporation - C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lenovo Camera Mute (LENOVO.CAMMUTE) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
O23 - Service: Lenovo Microphone Mute (LENOVO.MICMUTE) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
O23 - Service: Lenovo Keyboard Noise Reduction (LENOVO.TPKNRSVC) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
O23 - Service: ThinkVantage Virtual Camera Controller (LENOVO.TVTVCAM) - Lenovo Group Limited - C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe
O23 - Service: Lenovo Auto Scroll (Lenovo.VIRTSCRLSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: Power Manager DBC Service - Lenovo - C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cisco EnergyWise Enabler (PwmEWSvc) - Lenovo Group Limited - C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Conexant SmartAudio service (SAService) - Conexant Systems, Inc. - C:\Windows\system32\SAsrv.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Soluto Launcher Service (SolutoLauncherService) - Soluto - C:\Program Files\Soluto\SolutoLauncherService.exe
O23 - Service: Soluto Remote Service (SolutoRemoteService) - GlavSoft LLC. - C:\Program Files\Soluto\SolutoRemoteService.exe
O23 - Service: Soluto PCGenome Core Service (SolutoService) - Soluto - C:\Program Files\Soluto\SolutoService.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: System Update (SUService) - Unknown owner - C:\Program Files (x86)\Lenovo\System Update\SUService.exe
O23 - Service: TeamViewer 9 (TeamViewer9) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Unknown owner - C:\Windows\System32\TPHDEXLG64.exe (file missing)
O23 - Service: Lenovo Hotkey Client Loader (TPHKLOAD) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
O23 - Service: On Screen Display (TPHKSVC) - Lenovo Group Limited - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: ValBioService - Validity Sensors, Inc. - C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe
O23 - Service: Validity WBF Policy Service (valWBFPolicyService) - Unknown owner - C:\Windows\system32\valWBFPolicyService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: WDDMService - WDC - C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe
O23 - Service: WD Drive Manager (WDDriveService) - Western Digital - C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
O23 - Service: WDFME (WDFMEService) - Western Digital - C:\Program Files\Western Digital\WD SmartWare\WDFME.exe
O23 - Service: WDRules (WDRulesService) - Western Digital - C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Zero Configuration Service (ZeroConfigService) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

--
End of file - 19176 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\ibmpmsvc.exe
"C:\Windows\system32\nvvsvc.exe"
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k RPCSS
"c:\Program Files\Microsoft Security Client\MsMpEng.exe"
winlogon.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-dcf495d3-9002-4f77-8b72-a021a8d28376 -SystemEventPortName:HostProcess-eede974d-d940-4175-b41d-c12b2794090c -IoCancelEventPortName:HostProcess-7726b659-e0eb-42d8-b19f-2e7b41b68347 -NonStateChangingEventPortName:HostProcess-2ca8cf9e-1458-4821-b53d-3becd1ad86a2 -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:c962a11b-3a45-4a35-a318-02cbe7d2daf3 -DeviceGroupId:
"C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"
C:\Windows\system32\nvvsvc.exe -session -first
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe 26426640
\??\C:\Windows\system32\conhost.exe "-2056065056-68184074513348933661193733931-1942689674927603861120234256330517893
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe"
taskeng.exe {902B1743-24A3-43CF-B27E-6BDCEFB1D364}
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe" /service
"C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe" /service
C:\Windows\system32\CxAudMsg64.exe
"C:\Program Files\Intel\WiFi\bin\EvtEng.exe"
"C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe"
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe"
"C:\Program Files\Intel\iCLS Client\HeciServer.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"
"C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe"
"C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe"
"C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe"
"C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe"
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
"C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe"
C:\Windows\SysWOW64\SAsrv.exe
"C:\Program Files\Soluto\SolutoLauncherService.exe"
"C:\Program Files\Soluto\SolutoService.exe"
C:\Windows\system32\svchost.exe -k imgsvc
"C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe"
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe
"C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe"
C:\Windows\system32\valWBFPolicyService.exe
"C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe"
"C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe"
"C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe"
C:\Windows\system32\wbem\unsecapp.exe -Embedding
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe"
"C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe"
"C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe"
"C:\Program Files\Western Digital\WD SmartWare\WDFME.exe"
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
"c:\Program Files\Microsoft Security Client\NisSrv.exe"
C:\Windows\system32\svchost.exe -k bthsvcs
"taskhost.exe"
C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
C:\Windows\system32\rundll32.exe "C:\Program Files\LENOVO\HOTKEY\hotkey.dll",InstallAudioHotkeyHook
C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.OnScreenDisplay
C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE /UEFI\\.\pipe\{C6A9690C-33AE-4a55-8B65-9498CC0A7B34}.ShortcutKey
C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
"C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe"
"C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe"
"C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe"
"C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe"
"C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe"
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe"
"C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe"
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\system32\SearchIndexer.exe /Embedding
taskeng.exe {2EEF4894-6245-4A93-9E87-20A1CF0BAE94}
"C:\PROGRAM FILES (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
"c:\program files\soluto\soluto.exe" /userinit
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe"
"C:\Windows\System32\rundll32.exe" "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
"C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe"
"C:\Program Files\CONEXANT\ForteConfig\fmapp.exe"
"C:\Windows\System32\TpShocks.exe"
"C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe"
"C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
"C:\Program Files\Western Digital\WD SmartWare\WDDMStatus.exe"
"C:\Windows\System32\hkcmd.exe"
"C:\Windows\System32\igfxpers.exe"
"C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
"C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
"C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe" --domain-id F0399437-FD0C-4A48-B101-F0314A6172E4
"C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTray.exe"
"C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
"C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
"C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
"C:\Program Files (x86)\USB Camera\VM331STI.EXE"
"C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart
"C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE"
"C:\Windows\System32\rundll32.exe" C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
"C:\ProgramData\{0e0d05ae-13d5-a607-0e0d-d05ae13d16b8}\microsoft office office 2010 keygen ( 100%.exe" --startup=1
"C:\Windows\System32\rundll32.exe" C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
"C:\ProgramData\{08a00543-05c1-dc53-08a0-0054305c150c}\office 2010 home and office product key.exe" --startup=1
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
"C:\Windows\SvcFiles\msde.exe" .
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe" -Embedding
"C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"
"C:\Program Files\Soluto\SolutoRemoteService.exe" -service
"C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe" /start
"C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE"
"C:\Program Files\Lenovo Fingerprint Reader\SwipeMonitor.exe" ytidilav
\??\C:\Windows\system32\conhost.exe "-11155456511568118589-1426043408-1083237694-183543934248693487321122269481988150932
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="3912.0.1948272212\169592521" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,18,40 --gpu-vendor-id=0x8086 --gpu-device-id=0x0166 --gpu-driver-vendor="Intel Corporation" --gpu-driver-version=9.17.10.2843 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/ChromeSuggestions/Control/DomRel-Enable/enable/EmbeddedSearch/Group1 dev:pp6 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionContentVerification/ControlEnforce/ExtensionInstallVerification/None/GoogleNow/Enable/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/DevHUPDecayWithHQPRelevanceScoring_HUPDecayDisabled/PasswordGeneration/Enabled/RefreshTokenDeviceId/Disabled/RememberCertificateErrorDecisions/Default/SafeBrowsingIncidentReportingService/Enabled/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_62/UMA-Uniformity-Trial-10-Percent/group_01/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/default/UwSInterstitialStatus/On/V8CacheOptions/default/VoiceTrigger/Install/WebRTC-ScreencastTargetBitrateOvershoot/Control/WebRTC-SupportVP9/Default/" --extension-process --enable-webrtc-hw-h264-encoding --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=3912 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --channel="3912.2.882124779\1237703922" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=ppapi --channel="3912.5.241883142\1606813905" --ppapi-flash-args=enable_hw_video_decode=1 --lang=cs --ignored=" --type=renderer " /prefetch:-632637702
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/ChromeSuggestions/Control/DomRel-Enable/enable/EmbeddedSearch/Group1 dev:pp6 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionContentVerification/ControlEnforce/ExtensionInstallVerification/None/GoogleNow/Enable/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/DevHUPDecayWithHQPRelevanceScoring_HUPDecayDisabled/PasswordGeneration/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/RefreshTokenDeviceId/Disabled/RememberCertificateErrorDecisions/Default/SafeBrowsingIncidentReportingService/Enabled/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_62/UMA-Uniformity-Trial-10-Percent/group_01/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/default/UwSInterstitialStatus/On/V8CacheOptions/default/VoiceTrigger/Install/WebRTC-ScreencastTargetBitrateOvershoot/Control/WebRTC-SupportVP9/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=3912 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --channel="3912.7.408992959\496001636" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/ChromeSuggestions/Control/DomRel-Enable/enable/EmbeddedSearch/Group1 dev:pp6 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionContentVerification/ControlEnforce/ExtensionInstallVerification/None/GoogleNow/Enable/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/DevHUPDecayWithHQPRelevanceScoring_HUPDecayDisabled/PasswordGeneration/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/RefreshTokenDeviceId/Disabled/RememberCertificateErrorDecisions/Default/SafeBrowsingIncidentReportingService/Enabled/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_62/UMA-Uniformity-Trial-10-Percent/group_01/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/default/UwSInterstitialStatus/On/V8CacheOptions/default/VoiceTrigger/Install/WebRTC-ScreencastTargetBitrateOvershoot/Control/WebRTC-SupportVP9/Default/" --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=3912 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --channel="3912.8.1058650236\871040015" /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/ChromeSuggestions/Control/DomRel-Enable/enable/EmbeddedSearch/Group1 dev:pp6 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionContentVerification/ControlEnforce/ExtensionInstallVerification/None/GoogleNow/Enable/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/DevHUPDecayWithHQPRelevanceScoring_HUPDecayDisabled/PasswordGeneration/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/RefreshTokenDeviceId/Disabled/RememberCertificateErrorDecisions/Default/SafeBrowsingIncidentReportingService/Enabled/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_62/UMA-Uniformity-Trial-10-Percent/group_01/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/default/UwSInterstitialStatus/On/V8CacheOptions/default/VoiceTrigger/Install/WebRTC-ScreencastTargetBitrateOvershoot/Control/WebRTC-SupportVP9/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=3912 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --channel="3912.10.1413765243\2005160788" /prefetch:673131151
C:\Windows\system32\AUDIODG.EXE 0x9fc
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe8_ Global\UsGthrCtrlFltPipeMssGthrPipe8 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --enable-deferred-image-decoding --lang=cs --force-fieldtrials="BrowserBlacklist/Enabled/CTRequiredForEVTrial/RequirementEnforced/ChromeSuggestions/Control/DomRel-Enable/enable/EmbeddedSearch/Group1 dev:pp6 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionContentVerification/ControlEnforce/ExtensionInstallVerification/None/GoogleNow/Enable/NewProfileManagement/Enabled/OmniboxBundledExperimentV1/DevHUPDecayWithHQPRelevanceScoring_HUPDecayDisabled/PasswordGeneration/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/RefreshTokenDeviceId/Disabled/RememberCertificateErrorDecisions/Default/SafeBrowsingIncidentReportingService/Enabled/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Population-Restrict/normal/UMA-Uniformity-Trial-1-Percent/group_62/UMA-Uniformity-Trial-10-Percent/group_01/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_04/UMA-Uniformity-Trial-5-Percent/group_17/UMA-Uniformity-Trial-50-Percent/default/UwSInterstitialStatus/On/V8CacheOptions/default/VoiceTrigger/Install/WebRTC-ScreencastTargetBitrateOvershoot/Control/WebRTC-SupportVP9/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --font-cache-shared-mem-suffix=3912 --enable-pinch-virtual-viewport --enable-delegated-renderer --num-raster-threads=2 --channel="3912.11.1865066474\185339360" /prefetch:673131151
"C:\Users\richard\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\AutoKMS.job - C:\Windows\AutoKMS.exe
C:\Windows\tasks\AutoKMSDaily.job - C:\Windows\AutoKMS.exe
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002Core.job - C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002UA.job - C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe /ua /installsource scheduler

=========Mozilla firefox=========

ProfilePath - C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin]
"Description"=Google Earth in your browser
"Path"=C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@google.com/npPicasa3,version=3.0.0]
"Description"=Picasa3 plugin
"Path"=C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42]
"Description"=Intel IPT WebApi plugin
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater]
"Description"=This plugin updates Intel WebAPI component
"Path"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.40.2]
"Description"=Java™ Deployment Toolkit
"Path"=C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.40.2]
"Description"=Oracle® Next Generation Java™ Plug-In
"Path"=C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0]
"Description"=Microsoft SharePoint Plug-in for Firefox
"Path"=C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@software602.cz/602XML Filler]
"Description"=602XML Filler Plugin
"Path"=C:\Program Files (x86)\Software602\602XML\Filler\npfiller.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9]
"Description"=Google Update
"Path"=C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\MozillaPlugins\Adobe Reader]
"Description"=Handles PDFs in-place in Firefox
"Path"=C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll


[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/GENUINE]
"Description"=
"Path"=disabled

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0]
"Description"=Ag Player Plugin
"Path"=c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0]
"Description"=Office Authorization plug-in for NPAPI browsers
"Path"=C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL

C:\Program Files (x86)\Mozilla Firefox\extensions\
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default\extensions\
staged

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14 2117216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL [2013-03-06 690392]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-25 460712]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]
Skype Click to Call for Internet Explorer - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14 1709152]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
Office Document Cache Handler - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [2013-03-06 562904]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-25 172968]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"BLEServicesCtrl"=C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [2012-06-01 184112]
"BTMTrayAgent"=C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [2012-06-18 11586944]
"SmartAudio"=C:\Program Files\CONEXANT\SAII\SACpl.exe [2012-06-13 1647616]
"cAudioFilterAgent"=C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [2012-06-15 887968]
"ForteConfig"=C:\Program Files\Conexant\ForteConfig\fmapp.exe [2010-10-26 49056]
"TpShocks"=C:\Windows\SYSTEM32\TpShocks.exe [2013-02-13 382248]
"LENOVO.TPKNRRES"=C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [2012-12-11 293232]
"MSC"=c:\Program Files\Microsoft Security Client\msseces.exe [2015-01-30 1332296]
"BCSSync"=C:\Program Files\Microsoft Office\Office14\BCSSync.exe [2012-11-05 108144]
"WD Quick View"=C:\Program Files\Western Digital\WD SmartWare\WDDMStatus.exe [2011-12-15 4244888]
"HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2012-08-26 398656]
"Persistence"=C:\Windows\system32\igfxpers.exe [2012-08-26 441152]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2014-02-24 2809072]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Google Update"=C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe [2014-01-13 116648]
"GarminExpressTrayApp"=C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [2014-12-31 688984]
"Zoner Photo Studio Autoupdate"=C:\PROGRAM FILES\ZONER\PHOTO STUDIO 15\Program32\ZPSTRAY.EXE [2013-02-18 774168]
"CCleaner Monitoring"=C:\Program Files\CCleaner\CCleaner64.exe [2015-03-13 7451928]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"=C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [2012-07-19 133440]
"USB3MON"=C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [2012-05-21 291648]
"331BigDog"=C:\Program Files (x86)\USB Camera\VM331STI.EXE [2012-12-17 548864]
"Dolby Advanced Audio v2"=C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [2012-09-01 508656]
"PWMTRV"=rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor []
"Lenovo Registration"=C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [2011-06-01 4315872]
"Fastboot"=C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [2012-11-21 1085744]
"BrMfcWnd"=C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [2009-05-26 1159168]
"ControlCenter3"=C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [2008-12-24 114688]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"wsg32.exe"=wsg32.exe []
"Services"=C:\Windows\SvcFiles\msde.exe [2015-04-06 3760640]

C:\Users\richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
microsoft office office 2010 keygen ( 100%.lnk - C:\ProgramData\{0e0d05ae-13d5-a607-0e0d-d05ae13d16b8}\microsoft office office 2010 keygen ( 100%.exe
office 2010 home and office product key.lnk - C:\ProgramData\{08a00543-05c1-dc53-08a0-0054305c150c}\office 2010 home and office product key.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\Windows\SYSTEM32\igfxdev.dll [2012-08-25 441856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL [2013-12-19 6671064]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL [2013-12-19 4171480]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MsMpSvc]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"VIDC.UYVY"=msyuv.dll
"VIDC.YUY2"=msyuv.dll
"VIDC.YVYU"=msyuv.dll
"VIDC.IYUV"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"VIDC.YVU9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"MSVideo8"=VfWWDM32.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"wave4"=wdmaud.drv
"midi4"=wdmaud.drv
"mixer4"=wdmaud.drv
"wave5"=wdmaud.drv
"midi5"=wdmaud.drv
"mixer5"=wdmaud.drv
"aux2"=wdmaud.drv
"wave6"=wdmaud.drv
"midi6"=wdmaud.drv
"mixer6"=wdmaud.drv
"aux3"=wdmaud.drv
"wave7"=wdmaud.drv
"midi7"=wdmaud.drv
"mixer7"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 month======

2015-04-06 20:58:31 ----D---- C:\rsit
2015-04-06 20:58:31 ----D---- C:\Program Files\trend micro
2015-04-06 20:25:42 ----D---- C:\Windows\sdmf
2015-04-06 20:25:41 ----D---- C:\Windows\SvcFiles
2015-04-06 14:23:05 ----D---- C:\_OTM
2015-04-06 13:59:07 ----D---- C:\AdwCleaner
2015-04-06 13:53:45 ----D---- C:\rei
2015-04-06 13:16:26 ----D---- C:\Program Files\CCleaner
2015-04-03 07:09:30 ----SHD---- C:\Config.Msi
2015-03-25 14:21:38 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2015-03-25 14:21:05 ----D---- C:\ProgramData\Oracle
2015-03-25 13:59:05 ----D---- C:\Windows\SYSWOW64\X86
2015-03-25 13:59:05 ----D---- C:\Windows\SYSWOW64\AMD64
2015-03-25 13:57:57 ----D---- C:\Program Files (x86)\Multi Search
2015-03-25 13:57:23 ----D---- C:\ProgramData\11891872521113091656
2015-03-25 13:57:04 ----D---- C:\ProgramData\enhiencfpffafonhadogjlfekiiplkmj
2015-03-25 13:56:36 ----D---- C:\ProgramData\{0e0d05ae-13d5-a607-0e0d-d05ae13d16b8}
2015-03-25 13:55:51 ----D---- C:\ProgramData\{08a00543-05c1-dc53-08a0-0054305c150c}
2015-03-25 08:49:25 ----A---- C:\Windows\system32\acmigration.dll
2015-03-25 08:49:24 ----A---- C:\Windows\system32\invagent.dll
2015-03-25 08:49:24 ----A---- C:\Windows\system32\generaltel.dll
2015-03-25 08:49:24 ----A---- C:\Windows\system32\devinv.dll
2015-03-25 08:49:24 ----A---- C:\Windows\system32\appraiser.dll
2015-03-25 08:49:24 ----A---- C:\Windows\system32\aeinv.dll
2015-03-25 08:49:23 ----A---- C:\Windows\system32\aepic.dll
2015-03-25 08:49:23 ----A---- C:\Windows\system32\aepdu.dll
2015-03-16 17:36:33 ----D---- C:\Program Files (x86)\Microsoft ASP.NET
2015-03-13 16:48:47 ----D---- C:\Program Files\Microsoft Power Query for Excel
2015-03-11 08:25:55 ----A---- C:\Windows\system32\atmfd.dll
2015-03-11 08:25:54 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2015-03-11 08:25:54 ----A---- C:\Windows\system32\lpk.dll
2015-03-11 08:25:53 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2015-03-11 08:25:53 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2015-03-11 08:25:53 ----A---- C:\Windows\system32\dciman32.dll
2015-03-11 08:25:53 ----A---- C:\Windows\system32\atmlib.dll
2015-03-11 08:25:52 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2015-03-11 08:25:52 ----A---- C:\Windows\system32\fontsub.dll
2015-03-11 08:25:51 ----A---- C:\Windows\SYSWOW64\lpk.dll
2015-03-11 08:25:44 ----A---- C:\Windows\SYSWOW64\mf.dll
2015-03-11 08:25:44 ----A---- C:\Windows\system32\ntoskrnl.exe
2015-03-11 08:25:43 ----A---- C:\Windows\SYSWOW64\wmp.dll
2015-03-11 08:25:42 ----A---- C:\Windows\system32\crypt32.dll
2015-03-11 08:25:41 ----A---- C:\Windows\SYSWOW64\crypt32.dll
2015-03-11 08:25:40 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2015-03-11 08:25:40 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2015-03-11 08:25:39 ----A---- C:\Windows\system32\drivers\mountmgr.sys
2015-03-11 08:25:38 ----A---- C:\Windows\system32\mf.dll
2015-03-11 08:25:37 ----A---- C:\Windows\system32\wmp.dll
2015-03-11 08:25:34 ----A---- C:\Windows\system32\drmv2clt.dll
2015-03-11 08:25:33 ----A---- C:\Windows\SYSWOW64\quartz.dll
2015-03-11 08:25:32 ----A---- C:\Windows\system32\quartz.dll
2015-03-11 08:25:31 ----A---- C:\Windows\SYSWOW64\drmv2clt.dll
2015-03-11 08:25:30 ----A---- C:\Windows\system32\winload.exe
2015-03-11 08:25:30 ----A---- C:\Windows\system32\msscp.dll
2015-03-11 08:25:29 ----A---- C:\Windows\SYSWOW64\qdvd.dll
2015-03-11 08:25:29 ----A---- C:\Windows\SYSWOW64\cryptui.dll
2015-03-11 08:25:29 ----A---- C:\Windows\SYSWOW64\blackbox.dll
2015-03-11 08:25:29 ----A---- C:\Windows\system32\wmdrmsdk.dll
2015-03-11 08:25:29 ----A---- C:\Windows\system32\wintrust.dll
2015-03-11 08:25:29 ----A---- C:\Windows\system32\pcasvc.dll
2015-03-11 08:25:29 ----A---- C:\Windows\system32\cryptui.dll
2015-03-11 08:25:29 ----A---- C:\Windows\system32\cryptnet.dll
2015-03-11 08:25:29 ----A---- C:\Windows\system32\audiosrv.dll
2015-03-11 08:25:28 ----A---- C:\Windows\SYSWOW64\wintrust.dll
2015-03-11 08:25:28 ----A---- C:\Windows\SYSWOW64\cryptnet.dll
2015-03-11 08:25:28 ----A---- C:\Windows\system32\srcore.dll
2015-03-11 08:25:28 ----A---- C:\Windows\system32\rstrui.exe
2015-03-11 08:25:28 ----A---- C:\Windows\system32\blackbox.dll
2015-03-11 08:25:27 ----A---- C:\Windows\SYSWOW64\wmdrmsdk.dll
2015-03-11 08:25:27 ----A---- C:\Windows\system32\drmmgrtn.dll
2015-03-11 08:25:27 ----A---- C:\Windows\system32\AUDIOKSE.dll
2015-03-11 08:25:26 ----A---- C:\Windows\SYSWOW64\msscp.dll
2015-03-11 08:25:26 ----A---- C:\Windows\SYSWOW64\mfplat.dll
2015-03-11 08:25:26 ----A---- C:\Windows\SYSWOW64\evr.dll
2015-03-11 08:25:26 ----A---- C:\Windows\SYSWOW64\drmmgrtn.dll
2015-03-11 08:25:26 ----A---- C:\Windows\SYSWOW64\cryptsvc.dll
2015-03-11 08:25:26 ----A---- C:\Windows\system32\mfplat.dll
2015-03-11 08:25:26 ----A---- C:\Windows\system32\evr.dll
2015-03-11 08:25:25 ----A---- C:\Windows\system32\qdvd.dll
2015-03-11 08:25:25 ----A---- C:\Windows\system32\AudioSes.dll
2015-03-11 08:25:25 ----A---- C:\Windows\system32\audiodg.exe
2015-03-11 08:25:24 ----A---- C:\Windows\system32\msnetobj.dll
2015-03-11 08:25:24 ----A---- C:\Windows\system32\cryptsvc.dll
2015-03-11 08:25:23 ----A---- C:\Windows\SYSWOW64\msnetobj.dll
2015-03-11 08:25:23 ----A---- C:\Windows\SYSWOW64\AudioEng.dll
2015-03-11 08:25:23 ----A---- C:\Windows\system32\rrinstaller.exe
2015-03-11 08:25:23 ----A---- C:\Windows\system32\pcadm.dll
2015-03-11 08:25:23 ----A---- C:\Windows\system32\AudioEng.dll
2015-03-11 08:25:22 ----A---- C:\Windows\SYSWOW64\rrinstaller.exe
2015-03-11 08:25:22 ----A---- C:\Windows\SYSWOW64\mfps.dll
2015-03-11 08:25:22 ----A---- C:\Windows\SYSWOW64\AUDIOKSE.dll
2015-03-11 08:25:22 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2015-03-11 08:25:22 ----A---- C:\Windows\system32\smss.exe
2015-03-11 08:25:22 ----A---- C:\Windows\system32\mfps.dll
2015-03-11 08:25:21 ----A---- C:\Windows\SYSWOW64\AudioSes.dll
2015-03-11 08:25:21 ----A---- C:\Windows\system32\pcawrk.exe
2015-03-11 08:25:21 ----A---- C:\Windows\system32\msmmsp.dll
2015-03-11 08:25:21 ----A---- C:\Windows\system32\drivers\PEAuth.sys
2015-03-11 08:25:21 ----A---- C:\Windows\system32\appidsvc.dll
2015-03-11 08:25:21 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 08:25:21 ----A---- C:\Windows\system32\appidapi.dll
2015-03-11 08:25:20 ----A---- C:\Windows\SYSWOW64\cryptsp.dll
2015-03-11 08:25:20 ----A---- C:\Windows\system32\srclient.dll
2015-03-11 08:25:20 ----A---- C:\Windows\system32\pcalua.exe
2015-03-11 08:25:20 ----A---- C:\Windows\system32\mfpmp.exe
2015-03-11 08:25:20 ----A---- C:\Windows\system32\cryptsp.dll
2015-03-11 08:25:19 ----A---- C:\Windows\SYSWOW64\mfpmp.exe
2015-03-11 08:25:18 ----A---- C:\Windows\SYSWOW64\srclient.dll
2015-03-11 08:25:18 ----A---- C:\Windows\system32\setbcdlocale.dll
2015-03-11 08:25:18 ----A---- C:\Windows\system32\EncDump.dll
2015-03-11 08:25:18 ----A---- C:\Windows\system32\csrsrv.dll
2015-03-11 08:25:16 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 08:25:14 ----A---- C:\Windows\system32\drivers\appid.sys
2015-03-11 08:25:10 ----A---- C:\Windows\system32\spwmp.dll
2015-03-11 08:25:09 ----A---- C:\Windows\SYSWOW64\spwmp.dll
2015-03-11 08:25:09 ----A---- C:\Windows\SYSWOW64\dxmasf.dll
2015-03-11 08:25:09 ----A---- C:\Windows\system32\pcaevts.dll
2015-03-11 08:25:09 ----A---- C:\Windows\system32\dxmasf.dll
2015-03-11 08:25:08 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2015-03-11 08:25:08 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2015-03-11 08:25:08 ----A---- C:\Windows\system32\apisetschema.dll
2015-03-11 08:25:07 ----A---- C:\Windows\system32\wmploc.DLL
2015-03-11 08:25:03 ----A---- C:\Windows\SYSWOW64\mferror.dll
2015-03-11 08:25:03 ----A---- C:\Windows\system32\mferror.dll
2015-03-11 08:24:52 ----A---- C:\Windows\system32\rdpudd.dll
2015-03-11 08:24:52 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-11 08:24:52 ----A---- C:\Windows\system32\rdpcorets.dll
2015-03-11 08:24:18 ----A---- C:\Windows\SYSWOW64\ubpm.dll
2015-03-11 08:24:18 ----A---- C:\Windows\system32\ubpm.dll
2015-03-11 08:24:17 ----A---- C:\Windows\system32\shell32.dll
2015-03-11 08:24:16 ----A---- C:\Windows\SYSWOW64\shell32.dll
2015-03-11 08:24:11 ----A---- C:\Windows\system32\schannel.dll
2015-03-11 08:24:11 ----A---- C:\Windows\system32\lsasrv.dll
2015-03-11 08:24:11 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-03-11 08:24:11 ----A---- C:\Windows\system32\drivers\cng.sys
2015-03-11 08:24:10 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-03-11 08:24:10 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-03-11 08:24:10 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-03-11 08:24:10 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-03-11 08:24:10 ----A---- C:\Windows\system32\wdigest.dll
2015-03-11 08:24:10 ----A---- C:\Windows\system32\TSpkg.dll
2015-03-11 08:24:10 ----A---- C:\Windows\system32\sspicli.dll
2015-03-11 08:24:10 ----A---- C:\Windows\system32\ncrypt.dll
2015-03-11 08:24:10 ----A---- C:\Windows\system32\msv1_0.dll
2015-03-11 08:24:10 ----A---- C:\Windows\system32\kerberos.dll
2015-03-11 08:24:10 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-03-11 08:24:09 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-03-11 08:24:09 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-03-11 08:24:09 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-03-11 08:24:09 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-03-11 08:24:09 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-03-11 08:24:09 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-03-11 08:24:09 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-03-11 08:24:09 ----A---- C:\Windows\system32\sspisrv.dll
2015-03-11 08:24:09 ----A---- C:\Windows\system32\secur32.dll
2015-03-11 08:24:09 ----A---- C:\Windows\system32\lsass.exe
2015-03-11 08:24:09 ----A---- C:\Windows\system32\credssp.dll
2015-03-11 08:24:09 ----A---- C:\Windows\system32\auditpol.exe
2015-03-11 08:24:09 ----A---- C:\Windows\system32\adtschema.dll
2015-03-11 08:24:08 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-03-11 08:24:08 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-03-11 08:24:08 ----A---- C:\Windows\system32\msobjs.dll
2015-03-11 08:24:08 ----A---- C:\Windows\system32\msaudite.dll
2015-03-11 08:24:04 ----A---- C:\Windows\SYSWOW64\msctf.dll
2015-03-11 08:24:04 ----A---- C:\Windows\system32\msctf.dll
2015-03-11 08:24:03 ----A---- C:\Windows\SYSWOW64\WindowsCodecs.dll
2015-03-11 08:24:03 ----A---- C:\Windows\system32\WindowsCodecs.dll
2015-03-11 08:24:02 ----A---- C:\Windows\system32\win32k.sys
2015-03-11 08:23:59 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-03-11 08:23:59 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-03-11 08:23:59 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-03-11 08:23:59 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-03-11 08:23:58 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-03-11 08:23:58 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-03-11 08:23:57 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-03-11 08:23:57 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-03-11 08:23:57 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-03-11 08:23:57 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-03-11 08:23:57 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-11 08:23:57 ----A---- C:\Windows\system32\iernonce.dll
2015-03-11 08:23:57 ----A---- C:\Windows\system32\ie4uinit.exe
2015-03-11 08:23:56 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-03-11 08:23:56 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-03-11 08:23:55 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-03-11 08:23:55 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-03-11 08:23:55 ----A---- C:\Windows\system32\iedkcs32.dll
2015-03-11 08:23:54 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-03-11 08:23:54 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-03-11 08:23:54 ----A---- C:\Windows\system32\urlmon.dll
2015-03-11 08:23:54 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-03-11 08:23:53 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-03-11 08:23:53 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-03-11 08:23:53 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-03-11 08:23:53 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-03-11 08:23:53 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-11 08:23:53 ----A---- C:\Windows\system32\dxtrans.dll
2015-03-11 08:23:52 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-03-11 08:23:52 ----A---- C:\Windows\system32\msfeeds.dll
2015-03-11 08:23:51 ----A---- C:\Windows\system32\iesetup.dll
2015-03-11 08:23:51 ----A---- C:\Windows\system32\ieapfltr.dll
2015-03-11 08:23:50 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-03-11 08:23:50 ----A---- C:\Windows\system32\iertutil.dll
2015-03-11 08:23:49 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-03-11 08:23:49 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-03-11 08:23:49 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-03-11 08:23:49 ----A---- C:\Windows\system32\jsproxy.dll
2015-03-11 08:23:48 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-03-11 08:23:48 ----A---- C:\Windows\system32\ieUnatt.exe
2015-03-11 08:23:47 ----A---- C:\Windows\system32\mshtmled.dll
2015-03-11 08:23:47 ----A---- C:\Windows\system32\ieui.dll
2015-03-11 08:23:47 ----A---- C:\Windows\system32\ieframe.dll
2015-03-11 08:23:47 ----A---- C:\Windows\system32\dxtmsft.dll
2015-03-11 08:23:46 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-03-11 08:23:46 ----A---- C:\Windows\system32\jscript9diag.dll
2015-03-11 08:23:45 ----A---- C:\Windows\system32\wininet.dll
2015-03-11 08:23:45 ----A---- C:\Windows\system32\vbscript.dll
2015-03-11 08:23:45 ----A---- C:\Windows\system32\jscript9.dll
2015-03-11 08:23:44 ----A---- C:\Windows\system32\msrating.dll
2015-03-11 08:23:44 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-03-11 08:23:42 ----A---- C:\Windows\system32\mshtml.dll
2015-03-11 08:23:21 ----A---- C:\Windows\system32\WMPhoto.dll
2015-03-11 08:23:20 ----A---- C:\Windows\SYSWOW64\WMPhoto.dll

======List of files/folders modified in the last 1 month======

2015-04-06 20:58:33 ----D---- C:\Windows\Prefetch
2015-04-06 20:58:31 ----RD---- C:\Program Files
2015-04-06 20:58:17 ----D---- C:\Windows\Temp
2015-04-06 20:40:42 ----D---- C:\Windows\system32\config
2015-04-06 20:37:35 ----D---- C:\Windows\System32
2015-04-06 20:37:35 ----D---- C:\Windows\inf
2015-04-06 20:37:35 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-04-06 20:32:45 ----A---- C:\Windows\SYSWOW64\log.txt
2015-04-06 20:30:53 ----D---- C:\Windows\Tasks
2015-04-06 20:30:45 ----D---- C:\Windows
2015-04-06 20:30:45 ----A---- C:\Windows\KMSEmulator.exe
2015-04-06 20:30:20 ----D---- C:\ProgramData\Validity
2015-04-06 14:00:59 ----D---- C:\Windows\system32\Tasks
2015-04-06 14:00:54 ----RD---- C:\Program Files (x86)
2015-04-06 14:00:54 ----HD---- C:\ProgramData
2015-04-06 13:49:29 ----D---- C:\Users\richard\AppData\Roaming\TeamViewer
2015-04-06 13:49:29 ----D---- C:\Users\richard\AppData\Roaming\FileZilla
2015-04-06 13:36:42 ----D---- C:\Windows\tracing
2015-04-06 13:25:10 ----SHD---- C:\System Volume Information
2015-04-06 13:23:21 ----D---- C:\Windows\Panther
2015-04-06 13:23:15 ----D---- C:\Windows\Logs
2015-04-06 13:23:15 ----D---- C:\Windows\debug
2015-04-03 07:10:35 ----SHD---- C:\Windows\Installer
2015-03-26 04:20:08 ----D---- C:\Windows\winsxs
2015-03-26 04:18:24 ----SD---- C:\Windows\system32\CompatTel
2015-03-26 04:18:24 ----D---- C:\Windows\system32\wbem
2015-03-26 04:18:24 ----D---- C:\Windows\system32\appraiser
2015-03-26 04:18:24 ----D---- C:\Windows\AppPatch
2015-03-25 14:21:38 ----D---- C:\Windows\SysWOW64
2015-03-25 14:21:02 ----D---- C:\Program Files (x86)\Java
2015-03-25 14:18:35 ----D---- C:\Windows\Downloaded Program Files
2015-03-25 08:46:58 ----D---- C:\Windows\system32\catroot2
2015-03-17 12:32:04 ----D---- C:\OrsoftCS
2015-03-17 08:19:56 ----D---- C:\Windows\Microsoft.NET
2015-03-17 08:19:24 ----RSD---- C:\Windows\assembly
2015-03-12 10:04:44 ----D---- C:\Windows\rescache
2015-03-12 08:00:00 ----D---- C:\Windows\SYSWOW64\Dism
2015-03-12 08:00:00 ----D---- C:\Windows\SYSWOW64\cs-CZ
2015-03-12 08:00:00 ----D---- C:\Program Files\Windows Media Player
2015-03-12 08:00:00 ----D---- C:\Program Files (x86)\Windows Media Player
2015-03-12 07:59:59 ----D---- C:\Windows\system32\drivers
2015-03-12 07:59:59 ----D---- C:\Windows\system32\Dism
2015-03-12 07:59:58 ----D---- C:\Windows\system32\en-US
2015-03-12 07:59:58 ----D---- C:\Windows\system32\cs-CZ
2015-03-12 07:59:56 ----D---- C:\Windows\system32\Boot
2015-03-12 07:59:51 ----D---- C:\Program Files\Internet Explorer
2015-03-12 07:59:50 ----D---- C:\Windows\SYSWOW64\en-US
2015-03-12 07:59:48 ----D---- C:\Program Files (x86)\Internet Explorer
2015-03-11 13:37:17 ----D---- C:\ProgramData\Microsoft Help
2015-03-11 13:30:45 ----D---- C:\Windows\system32\MRT
2015-03-11 13:23:08 ----A---- C:\Windows\system32\MRT.exe
2015-03-11 13:21:15 ----A---- C:\Windows\win.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 iaStor;Intel AHCI Controller; C:\Windows\system32\DRIVERS\iaStor.sys [2012-06-12 568640]
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver; C:\Windows\system32\DRIVERS\iusb3hcs.sys [2012-05-21 19264]
R0 MpFilter;Microsoft Malware Protection Driver; C:\Windows\system32\DRIVERS\MpFilter.sys [2014-11-15 274696]
R0 nvpciflt;nvpciflt; C:\Windows\system32\DRIVERS\nvpciflt.sys [2013-10-31 32544]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-21 213888]
R0 Shockprf;Shockprf; C:\Windows\System32\DRIVERS\Apsx64.sys [2012-07-23 148328]
R0 Soluto;Soluto; C:\Windows\system32\Drivers\Soluto.sys [2013-09-17 54728]
R0 speedfan;speedfan; C:\Windows\SysWOW64\speedfan.sys [2012-12-29 28664]
R0 TPDIGIMN;TPDIGIMN; C:\Windows\System32\DRIVERS\ApsHM64.sys [2012-09-06 25448]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-21 514560]
R1 TPPWRIF;TPPWRIF; C:\Windows\System32\drivers\Tppwr64v.sys [2013-03-18 20328]
R2 NisDrv;Microsoft Network Inspection System; C:\Windows\system32\DRIVERS\NisDrvWFP.sys [2014-11-15 124560]
R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® + High Speed Virtual Adapter; C:\Windows\system32\DRIVERS\AMPPAL.sys [2012-07-18 198144]
R3 CnxtHdAudService;Conexant UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\CHDRT64.sys [2012-09-20 1609376]
R3 cpuz136;cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys []
R3 IBMPMDRV;IBMPMDRV; C:\Windows\system32\DRIVERS\ibmpmdrv.sys [2014-02-27 57144]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2012-08-25 9000256]
R3 IntcDAud;Intel(R) Display Audio; C:\Windows\system32\DRIVERS\IntcDAud.sys [2012-06-19 342528]
R3 iusb3hub;Ovladač rozbočovače Intel(R) USB 3.0; C:\Windows\system32\DRIVERS\iusb3hub.sys [2012-05-21 357184]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver; C:\Windows\system32\DRIVERS\iusb3xhc.sys [2012-05-21 789824]
R3 iwdbus;IWD Bus Enumerator; C:\Windows\system32\DRIVERS\iwdbus.sys [2012-11-30 25528]
R3 MEIx64;Intel(R) Management Engine Interface ; C:\Windows\system32\DRIVERS\HECIx64.sys [2012-07-03 62784]
R3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit; C:\Windows\system32\DRIVERS\Netwsw00.sys [2012-09-30 11523072]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\Windows\system32\DRIVERS\psadd.sys [2011-12-26 40248]
R3 RSP2STOR;Realtek PCIE CardReader Driver - P2; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [2013-01-08 288992]
R3 RTL8167;Realtek 8167 NT Driver; C:\Windows\system32\DRIVERS\Rt64win7.sys [2012-06-13 726160]
R3 SmbDrvI;SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [2014-02-24 31472]
R3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 12288]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2014-02-24 552176]
R3 TVTI2C;Lenovo SM bus driver; C:\Windows\system32\DRIVERS\Tvti2c.sys [2011-05-29 40248]
R3 tvtvcamd;Camera Plus (VGA Resolution Maximum); C:\Windows\system32\DRIVERS\tvtvcamd.sys [2011-12-08 27432]
R3 usb3Hub;USB-IF USB 3.0 Hub; C:\Windows\system32\DRIVERS\usb3Hub.sys [2012-11-30 47072]
R3 vm331avs;Digital Camera 1; C:\Windows\System32\Drivers\vm331avs.sys [2013-02-18 1049856]
S3 AMPPALP;Intel® Centrino® Wireless Bluetooth® + High Speed Protocol; C:\Windows\system32\DRIVERS\amppal.sys [2012-07-18 198144]
S3 Bridge;@%SystemRoot%\system32\bridgeres.dll,-3; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 BthEnum;Služba Bluetooth Enumerator; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-07-14 41984]
S3 BthPan;Zařízení Bluetooth (síť PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2009-07-14 118784]
S3 BTHPORT;Ovladač portu Bluetooth; C:\Windows\System32\Drivers\BTHport.sys [2013-06-02 552960]
S3 BTHUSB;Ovladač rozhraní USB radiostanice Bluetooth; C:\Windows\System32\Drivers\BTHUSB.sys [2011-12-08 80384]
S3 btmaudio;Intel Bluetooth Audio Service; C:\Windows\system32\drivers\btmaud.sys [2012-05-21 80896]
S3 btmaux;Intel Bluetooth Auxiliary Service; C:\Windows\system32\DRIVERS\btmaux.sys [2012-05-21 111104]
S3 btmhsf;btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [2012-06-09 849408]
S3 cpuz134;cpuz134; \??\C:\Users\richard\AppData\Local\Temp\cpuz134\cpuz134_x64.sys []
S3 dmvsc;dmvsc; C:\Windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2009-07-14 145920]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2010-11-21 19968]
S3 dot4usb;Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2009-07-14 43008]
S3 Fastboot;Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [2012-11-21 71472]
S3 ibtfltcoex;ibtfltcoex; C:\Windows\system32\DRIVERS\iBtFltCoex.sys [2012-07-10 60928]
S3 intaud_WaveExtensible;Intel WiDi Audio Device; C:\Windows\system32\drivers\intelaud.sys [2012-11-30 35256]
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-21 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 RFCOMM;Zařízení Bluetooth (RFCOMM protokol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-07-14 158720]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-21 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-21 34688]
S3 TPM;TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-14 38400]
S3 TsUsbFlt;TsUsbFlt; C:\Windows\system32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device; C:\Windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]
S3 usbscan;Ovladač skeneru USB; C:\Windows\system32\DRIVERS\usbscan.sys [2013-07-03 42496]
S3 usbser;Lumina LED Controller; C:\Windows\system32\DRIVERS\usbser.sys [2013-08-29 33280]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 602XML Updater;602Updater; C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [2011-10-10 85344]
R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2014-12-19 81088]
R2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® + High Speed Service; C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2012-07-18 659472]
R2 Bluetooth Device Monitor;Bluetooth Device Monitor; C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2012-06-18 1095616]
R2 Bluetooth Media Service;Bluetooth Media Service; C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2012-06-18 1333184]
R2 Bluetooth OBEX Service;Bluetooth OBEX Service; C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2012-06-18 1124288]
R2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) + High Speed Security Service; C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2012-08-23 135984]
R2 c2cautoupdatesvc;Skype Click to Call Updater; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-07-14 1390176]
R2 c2cpnrsvc;Skype Click to Call PNR Service; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-07-14 1767520]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 CxAudMsg;@C:\Windows\system32\CxAudMsg64.exe,-100; C:\Windows\system32\CxAudMsg64.exe [2012-06-08 201376]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2012-08-24 629040]
R2 FastbootService;FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [2012-11-21 160048]
R2 IBMPMSVC;Lenovo PM Service; C:\Windows\system32\ibmpmsvc.exe [2014-02-27 68440]
R2 IconMan_R;IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-11-15 2468496]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-06-20 634632]
R2 Intel(R) ME Service;Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2012-07-19 129856]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-07-19 166720]
R2 LENOVO.CAMMUTE;Lenovo Camera Mute; C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe [2012-12-11 58224]
R2 LENOVO.MICMUTE;Lenovo Microphone Mute; C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe [2014-04-07 110128]
R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction; C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2012-12-11 61296]
R2 LENOVO.TVTVCAM;ThinkVantage Virtual Camera Controller; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [2012-12-11 187760]
R2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [2012-08-11 136288]
R2 LMS;Intel(R) Management and Security Application Local Management Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [2012-07-19 277824]
R2 MsMpSvc;Microsoft Antimalware Service; c:\Program Files\Microsoft Security Client\MsMpEng.exe [2015-01-30 23784]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2013-10-29 920864]
R2 nvUpdatusService;NVIDIA Update Service Daemon; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2013-10-31 1364256]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2012-08-24 149296]
R2 SAService;Conexant SmartAudio service; C:\Windows\system32\SAsrv.exe []
R2 SolutoLauncherService;Soluto Launcher Service; C:\Program Files\Soluto\SolutoLauncherService.exe [2013-09-17 182848]
R2 SolutoService;Soluto PCGenome Core Service; C:\Program Files\Soluto\SolutoService.exe [2013-09-17 821824]
R2 TeamViewer9;TeamViewer 9; C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [2014-04-25 5024576]
R2 ThinkVantage Registry Monitor Service;ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [2010-08-31 1028096]
R2 TPHKLOAD;Lenovo Hotkey Client Loader; C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe [2014-06-10 124400]
R2 TPHKSVC;On Screen Display; C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe [2014-04-01 126512]
R2 UNS;Intel(R) Management and Security Application User Notification Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-07-19 365376]
R2 ValBioService;ValBioService; C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe [2014-07-21 22872]
R2 valWBFPolicyService;Validity WBF Policy Service; C:\Windows\system32\valWBFPolicyService.exe [2014-07-21 49040]
R3 NisSrv;@c:\Program Files\Microsoft Security Client\MpAsDesc.dll,-243; c:\Program Files\Microsoft Security Client\NisSrv.exe [2015-01-30 366512]
R3 osppsvc;Office Software Protection Platform; C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 Power Manager DBC Service;Power Manager DBC Service; C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2013-03-18 1667368]
R3 SolutoRemoteService;Soluto Remote Service; C:\Program Files\Soluto\SolutoRemoteService.exe [2013-09-17 1942016]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-12 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S2 Garmin Core Update Service;Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [2014-12-31 451416]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-17 116648]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05 267440]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 cphs;Intel(R) Content Protection HECI Service; C:\Windows\SysWow64\IntelCpHeciSvc.exe [2012-08-26 276288]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-17 116648]
S3 gusvc;Google Updater Service; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2014-08-13 136120]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-02-20 114688]
S3 intelsba;Intel(R) Small Business Advantage; C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [2013-01-28 48832]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service; C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2013-12-19 50942144]
S3 MozillaMaintenance;Mozilla Maintenance Service; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2013-10-22 118680]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2012-08-24 272688]
S3 ose64;Office 64 Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 PwmEWSvc;Cisco EnergyWise Enabler; C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [2013-03-18 1664296]
S3 StorSvc;@%SystemRoot%\System32\StorSvc.dll,-100; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 SUService;System Update; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [2015-01-15 49648]
S3 TPHDEXLGSVC;ThinkPad HDD APS Logging Service; C:\Windows\System32\TPHDEXLG64.exe [2012-09-06 46984]
S3 TVT Backup Service;TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [2012-02-06 1492280]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]

-----------------EOF-----------------

Zdravim

Co si tak koupit ty Office a ne je crackovat

Stahnete Malwarebytes Anti-Rootkit http://www.bleepingcomputer.com/downloa ... i-rootkit/

• Ulozte nejlepe na Plochu a rozbalte
• Spustte kliknutim na mbar
• Nyni postupne kliknete na Next a Update
• Po dokonceni update (aktualizace) databaze kliknete opet na Next
• Nechte zaskrtnute vsechny tri moznosti a klinete na Scan cimz spustite prohledavani PC
• Po dokonceni skenu (cca 5 minutek) zkontrolujte, zda-li je u vsech nalezu (samozrejme pokud budou) zatrzitko
• Tez zkontrolujte, jetsli je zatrzitko u Create Restore point
• Nyni kliknete na CleanUp cimz nalezenou infekci odstranime
• PC bude restartovan
• Slozka mbar by mela obsahovat log (a zrejme se i sam otevre) mbar-log-rok-mesic-den (hodina-minuta-sekunda).txt, ten mi sem dejte

Stahnete AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner

• Ulozte nejlepe na plochu
• Ukoncete vsechny programy
• Po spusteni probehne stazeni databaze
• Kliknete na Scan a nasledne Clean
• Probehne oprava, restart PC a pak se objevi log, pripadne bude ulozen ve slozce c:\AdwCleaner\AdwCleaner[S?].txt, ten sem vlozte

Děkuji za pomoc...


Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
main: v2015.04.06.08
rootkit: v2015.03.31.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17691
richard :: RICHARD-THINK [administrator]

6.4.2015 21:36:24
mbar-log-2015-04-06 (21-36-24).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 400865
Time elapsed: 15 minute(s), 58 second(s)

Memory Processes Detected: 1
C:\Windows\SvcFiles\msde.exe (Worm.Spambot) -> 5780 -> Delete on reboot. [b1af6ffa4743c17585ff1281a55f2ed2]

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Services (Worm.Spambot) -> Data: C:\Windows\SvcFiles\msde.exe . -> Delete on reboot. [b1af6ffa4743c17585ff1281a55f2ed2]

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Windows\SvcFiles\msde.exe (Worm.Spambot) -> Delete on reboot. [b1af6ffa4743c17585ff1281a55f2ed2]

Physical Sectors Detected: 0
(No malicious items detected)

(end)



AdwCleaner:
# AdwCleaner v4.200 - Log vytvooen 06/04/2015 v 22:08:59
# Aktualizováno 29/03/2015 by Xplode
# Databáze : 2015-03-29.1 [Local]
# Operaení system : Windows 7 Professional Service Pack 1 (x64)
# Uživatelské jméno : richard - RICHARD-THINK
# Spuštino z : C:\Users\richard\Desktop\adwcleaner_4.200 (3).exe
# Nastavení : Eištiní

***** [ Služby ] *****


***** [ Soubory / Složky ] *****


***** [ Naplánované úlohy ] *****


***** [ Zástupci ] *****


***** [ Registry ] *****


***** [ Prohlížeee ] *****

-\\ Internet Explorer v11.0.9600.17689


-\\ Mozilla Firefox v24.0 (cs)


-\\ Google Chrome v41.0.2272.118

[C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Smazáno [Search Provider] : hxxp://websearch.coolsearches.info/?l=1&q={searchTerms}&pid=22890&r=2015/03/25&hid=9849837534345547147&lg=EN&cc=CZ&unqvl=85
[C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Smazáno [Search Provider] : hxxp://www.booking.com/searchresults.cs.html?s ... rch-plugin
[C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Smazáno [Search Provider] : hxxp://www.baresta.com/searchresult.html?page= ... Search.y=6

*************************

AdwCleaner[R0].txt - [6528 bytu] - [06/04/2015 13:59:48]
AdwCleaner[R1].txt - [1581 bytu] - [06/04/2015 22:07:11]
AdwCleaner[S0].txt - [5921 bytu] - [06/04/2015 14:00:53]
AdwCleaner[S1].txt - [1503 bytu] - [06/04/2015 22:08:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1561 bytu] ##########

Stahnete Zoek.exe http://hijackthis.nl/smeenk/ a ulozte jej na plochu

• Pokud pouzivate Win Vista ci W7, kliknete na Zoek pravym a dejte Run As Administrator ci Spustit jako spravce
• Do okna vlozte skript nize

• Kód: Vybrat vše

  autoclean;
  resethosts;
  emptyclsid;
  IEdefaults;
  FFdefaults;
  CHRdefaults;
  emptyIEcache;
  emptyFFcache;
  emptyCHRcache;
  emptyalltemp;
  emptyflash;
  emptyjava;
  emptyrecycle.bin;
  

• Nasledne kliknete na Run Script
• PC provede opravu, restartuje se a da Vam log, jeho obsah vlozte sem

Zoek.exe v5.0.0.0 Updated 08-April-2015
Tool run by richard on ne 12.04.2015 at 14:23:10,63.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\richard\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

12.4.2015 14:24:07 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\AGEIA Technologies deleted successfully
C:\PROGRA~2\UpgradeStance deleted successfully
C:\PROGRA~2\COMMON~1\Symantec Shared deleted successfully
C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) deleted successfully
C:\Users\richard\AppData\Roaming\Publish Providers deleted successfully
C:\Users\richard\AppData\Local\CrashDumps deleted successfully
C:\Users\richard\AppData\Local\MigWiz deleted successfully
C:\Users\richard\AppData\Local\VirtualStore deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Mozilla\Firefox\Extensions\{F74D5734-46F5-4B16-96F0-1E7FBF41B750} deleted successfully

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b036974b deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\b036974b deleted successfully

==== FireFox Fix ======================

Deleted from C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default\prefs.js:

Added to C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

ProfilePath: C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default

user.js not found
---- Lines {F74D5734-46F5-4B16-96F0-1E7FBF41B750} modified from prefs.js ----

user_pref("extensions.installCache", "[{\"name\":\"app-global\",\"addons\":{\"{972ce4c6-7e08-4474-a285-3208198ce6fd}\":{\"descriptor\":\"C:\\\\Program
---- FireFox user.js and prefs.js backups ----

prefs_12.04.2015_1434_.backup

==== Deleting Files \ Folders ======================

C:\PROGRA~2\AGEIA Technologies not found
C:\PROGRA~2\UpgradeStance not found
C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) not found
C:\PROGRA~2\CheAopMe deleted
C:\PROGRA~2\TrremendousCoupO deleted
C:\PROGRA~2\Block The Ads deleted
C:\PROGRA~2\Cloud Attach for Gmail by ZeroPC deleted
C:\PROGRA~2\DealNoDeal deleted
C:\PROGRA~2\Multi Search deleted
C:\PROGRA~2\Nyan Cat Fly deleted
C:\PROGRA~2\Paste Lorem ipsum deleted
C:\PROGRA~2\TheAdBlock deleted
C:\PROGRA~3\enhiencfpffafonhadogjlfekiiplkmj deleted
C:\PROGRA~3\{08a00543-05c1-dc53-08a0-0054305c150c} deleted
C:\PROGRA~3\{0e0d05ae-13d5-a607-0e0d-d05ae13d16b8} deleted
C:\Users\richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\office 2010 home and office product key.lnk deleted
C:\Users\richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\microsoft office office 2010 keygen ( 100%.lnk deleted
C:\PROGRA~3\11891872521113091656 deleted
C:\found.000 deleted
C:\Users\richard\AppData\Roaming\appdataFr3.bin deleted
C:\PROGRA~3\Package Cache deleted
C:\rei deleted
C:\Users\richard\Downloads\ReimageRepair.exe deleted
C:\Windows\SysNative\config\systemprofile\Searches deleted
C:\Windows\SysWow64\AI_RecycleBin deleted
C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default\extensions\staged deleted
C:\Users\richard\AppData\Roaming\LoJackSetup.exe deleted
"C:\PROGRA~2\BroewseerEnhhance\9dUYxMK30UpHOD.x64.dll" deleted
"C:\PROGRA~2\BrrOwssingClleearr\PobnDS4wjqNEXV.x64.dll" deleted
"C:\PROGRA~2\QQuickViewoer\mTi5OpCWlBU1cC.tlb" deleted
"C:\PROGRA~2\QQuickViewoer\mTi5OpCWlBU1cC.x64.dll" deleted
"C:\PROGRA~2\QQuickViewoer\mTi5OpCWlBU1cC.tlb" deleted
"C:\PROGRA~2\QQuickViewoer\mTi5OpCWlBU1cC.x64.dll" deleted
"C:\PROGRA~2\BroewseerEnhhance" not deleted
"C:\PROGRA~2\BrrOwssingClleearr" not deleted
"C:\PROGRA~2\QQuickViewoer" not deleted
"C:\PROGRA~2\QQuickViewoer" not deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

ProfilePath: C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default
- Undetermined - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi

==== Firefox Plugins ======================


==== Chromium Look ======================

Google Chrome Version: 41.0.2272.118 (Latest Stable version: 41.0.2272.118) [z-db]

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[14.07.2014 18:22]

Multi Search - richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\afmdpmddiokpdknaeofdnlclbpgehhce
Nyan Cat Fly - richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\bphkilcpnjgeegfnmifeifcmkgjngknk
TrremendousCoupO - richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmfggccidfjonhligbmldlppbmmdjia
Booking.com for Chrome™ - richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\fgkeilefmpmbamgcejhjpiecahcbipip
Paste Lorem ipsum - richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihmllonaidjepimjdhjdcgodgekcmhop
CheAopMe - richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\jphaifjdkofhlhpejgcpdjflionjekmn
Skype Click to Call - richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Cloud Attach for Gmail by ZeroPC - richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\milgdagkgnjgifepimndleebjabnnadl

==== Chromium Startpages ======================

C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "http://www.msn.com/?pc=UP97&ocid=UP97DHP&dt=071713",
"startup_urls": [ "https://www.google.cz/" ]


==== Chromium Fix ======================

C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\afmdpmddiokpdknaeofdnlclbpgehhce deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_afmdpmddiokpdknaeofdnlclbpgehhce_0.localstorage deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\bphkilcpnjgeegfnmifeifcmkgjngknk deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bphkilcpnjgeegfnmifeifcmkgjngknk_0.localstorage deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bphkilcpnjgeegfnmifeifcmkgjngknk_0.localstorage-journal deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bphkilcpnjgeegfnmifeifcmkgjngknk deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmfggccidfjonhligbmldlppbmmdjia deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihmllonaidjepimjdhjdcgodgekcmhop deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ihmllonaidjepimjdhjdcgodgekcmhop_0.localstorage deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ihmllonaidjepimjdhjdcgodgekcmhop_0.localstorage-journal deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ihmllonaidjepimjdhjdcgodgekcmhop deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\jphaifjdkofhlhpejgcpdjflionjekmn deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\milgdagkgnjgifepimndleebjabnnadl deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_milgdagkgnjgifepimndleebjabnnadl_0.localstorage deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_milgdagkgnjgifepimndleebjabnnadl_0.localstorage-journal deleted successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\milgdagkgnjgifepimndleebjabnnadl deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
"Search Bar"="http://www.google.com/ie"
"Default_Search_URL"="http://www.google.com/ie"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
@="http://www.google.com/search?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.google.com/ie"
"Default_Search_URL"="http://www.google.com/ie"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/ ... chasst.htm"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{68DD43AA-D3EA-454A-9566-EBE007C40C1B}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTer ... ORM=IE8SRC"
{68DD43AA-D3EA-454A-9566-EBE007C40C1B} Google Url="http://www.google.com/search?q={searchT ... utEncoding?}"

==== Reset Google Chrome ======================

C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01efe0a2-d764-479d-a2e7-9945f0d29c71} deleted successfully
HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{01efe0a2-d764-479d-a2e7-9945f0d29c71} deleted successfully
HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0bea0e09-4119-4999-862d-04c6d4238ff5} deleted successfully
HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0bea0e09-4119-4999-862d-04c6d4238ff5} deleted successfully
HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2e593176-5db1-4607-a0e4-f319c8a92939} deleted successfully
HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2e593176-5db1-4607-a0e4-f319c8a92939} deleted successfully
HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7e687903-a6c6-4947-9a5d-5319d17d5b3b} deleted successfully
HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7e687903-a6c6-4947-9a5d-5319d17d5b3b} deleted successfully
HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ee937737-2724-43a0-ba6f-11af5a2b7e90} deleted successfully
HKEY_USERS\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ee937737-2724-43a0-ba6f-11af5a2b7e90} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{01efe0a2-d764-479d-a2e7-9945f0d29c71} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{01efe0a2-d764-479d-a2e7-9945f0d29c71} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{01efe0a2-d764-479d-a2e7-9945f0d29c71} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{01efe0a2-d764-479d-a2e7-9945f0d29c71} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01efe0a2-d764-479d-a2e7-9945f0d29c71} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01efe0a2-d764-479d-a2e7-9945f0d29c71} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0bea0e09-4119-4999-862d-04c6d4238ff5} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0bea0e09-4119-4999-862d-04c6d4238ff5} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{0bea0e09-4119-4999-862d-04c6d4238ff5} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{0bea0e09-4119-4999-862d-04c6d4238ff5} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0bea0e09-4119-4999-862d-04c6d4238ff5} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0bea0e09-4119-4999-862d-04c6d4238ff5} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2e593176-5db1-4607-a0e4-f319c8a92939} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2e593176-5db1-4607-a0e4-f319c8a92939} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{2e593176-5db1-4607-a0e4-f319c8a92939} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{2e593176-5db1-4607-a0e4-f319c8a92939} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2e593176-5db1-4607-a0e4-f319c8a92939} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2e593176-5db1-4607-a0e4-f319c8a92939} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7e687903-a6c6-4947-9a5d-5319d17d5b3b} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7e687903-a6c6-4947-9a5d-5319d17d5b3b} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{7e687903-a6c6-4947-9a5d-5319d17d5b3b} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{7e687903-a6c6-4947-9a5d-5319d17d5b3b} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7e687903-a6c6-4947-9a5d-5319d17d5b3b} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7e687903-a6c6-4947-9a5d-5319d17d5b3b} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{ee937737-2724-43a0-ba6f-11af5a2b7e90} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{ee937737-2724-43a0-ba6f-11af5a2b7e90} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{ee937737-2724-43a0-ba6f-11af5a2b7e90} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{ee937737-2724-43a0-ba6f-11af5a2b7e90} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ee937737-2724-43a0-ba6f-11af5a2b7e90} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ee937737-2724-43a0-ba6f-11af5a2b7e90} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A3765211-52E8-8881-769B-454C95D646F2} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{3F7D597C-7512-F73C-B0F3-5D711BC91948} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{37476589-E48E-439E-A706-56189E2ED4C4} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9777123F-5BF8-6C86-217E-7EB783C2E885} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{b036974b} deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=177 folders=65 81965829 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\richard\AppData\Local\Temp will be emptied at reboot
C:\Users\UpdatusUser\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\richard\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\PROGRA~2\BroewseerEnhhance" not found
"C:\PROGRA~2\BrrOwssingClleearr" not found
"C:\PROGRA~2\QQuickViewoer" not found
"C:\PROGRA~2\QQuickViewoer" not found
"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted

==== EOF on ne 12.04.2015 at 14:41:17,55 ======================

Poprsim o FRST http://forum.viry.cz/viewtopic.php?f=13&t=133100

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-04-2015
Ran by richard (administrator) on RICHARD-THINK on 12-04-2015 18:59:52
Running from C:\Users\richard\Desktop
Loaded Profiles: UpdatusUser & richard (Available profiles: UpdatusUser & richard)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Software602 a.s.) C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Soluto) C:\Program Files\Soluto\SolutoLauncherService.exe
(Soluto) C:\Program Files\Soluto\SolutoService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Soluto) C:\Program Files\Soluto\Soluto.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Validity Sensors, Inc.) C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe
(Synaptics Incorporated) C:\Windows\System32\valWBFPolicyService.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
(Western Digital) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Western Digital ) C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Western Digital ) C:\Program Files\Western Digital\WD SmartWare\WDFME.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD SmartWare\WDDMStatus.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ZONER software) C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(GlavSoft LLC.) C:\Program Files\Soluto\SolutoRemoteService.exe
(Lenovo Group Limited) C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_305_ActiveX.exe
(Validity Sensors, Inc.) C:\Program Files\Lenovo Fingerprint Reader\SwipeMonitor.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(forum.viry.cz) C:\Users\richard\Desktop\FRSTLauncher.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [184112 2012-06-01] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [887968 2012-06-15] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [TpShocks] => C:\Windows\SYSTEM32\TpShocks.exe [382248 2013-02-13] (Lenovo.)
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [293232 2012-12-11] (Lenovo Group Limited)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [WD Quick View] => C:\Program Files\Western Digital\WD SmartWare\WDDMStatus.exe [4244888 2011-12-15] (Western Digital Technologies, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2809072 2014-02-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [548864 2012-12-17] (Vimicro)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508656 2012-09-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4315872 2011-06-01] (Lenovo, Inc.)
HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [1085744 2012-11-21] (Lenovo)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248040 2010-02-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [wsg32.exe] => wsg32.exe
HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe,c:\program files\soluto\soluto.exe /userinit,
Winlogon\Notify\igfxcui: C:\Windows\SYSTEM32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [Google Update] => C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-01-13] (Google Inc.)
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [GarminExpressTrayApp] => "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe"
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7451928 2015-03-13] (Piriform Ltd)
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [Zoner Photo Studio Autoupdate] => C:\PROGRAM FILES\ZONER\PHOTO STUDIO 15\Program32\ZPSTRAY.EXE [774168 2013-02-18] (ZONER software)
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\MountPoints2: D - D:\autorun.exe
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\MountPoints2: {3fc9e6c2-6be0-11e4-afae-28d2440f0701} - D:\autorun.exe
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\MountPoints2: {f4e57da7-cb6b-11e2-bea9-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [241664 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\tray.exe [1010008 2015-04-08] (Garmin Ltd. or its subsidiaries)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => No File
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => No File
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => No File
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13-comm.msn.com
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com/welcome/thinkpad
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2677794339-3578005486-2719301744-1002 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab
DPF: HKLM-x32 {F680B28A-3AEE-4C88-93ED-45AE9215C128} https://adisepo.mfcr.cz/adistc/adis/idp ... tsignx.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{3BFE0E02-2F35-4ABB-A64A-A94F09658477}: [NameServer] 8.8.8.8,8.8.4.4

FireFox:
========
FF ProfilePath: C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default
FF NewTab: about:newtab
FF Homepage: about:home
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-08-13] (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @software602.cz/602XML Filler -> C:\Program Files (x86)\Software602\602XML\Filler\npfiller.dll [2012-08-06] (Software602 a.s.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2677794339-3578005486-2719301744-1002: @tools.google.com/Google Update;version=3 -> C:\Users\richard\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin HKU\S-1-5-21-2677794339-3578005486-2719301744-1002: @tools.google.com/Google Update;version=9 -> C:\Users\richard\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin HKU\S-1-5-21-2677794339-3578005486-2719301744-1002: intel.com/AppUp -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll [2012-12-14] (Intel)
FF Plugin HKU\S-1-5-21-2677794339-3578005486-2719301744-1002: intel.com/AppUpx64 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll [2012-12-14] (Intel)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml [2013-10-22]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2014-03-03]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF Extension: No Name - C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12 [Not Found]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-12]
CHR Extension: (Docs) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-07-17]
CHR Extension: (Google Drive) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-07-17]
CHR Extension: (YouTube) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-17]
CHR Extension: (Google Search) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-17]
CHR Extension: (Google Sheets) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-12]
CHR Extension: (Skype Click to Call) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-07-17]
CHR Extension: (Gmail) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-17]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 602XML Updater; C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [85344 2011-10-10] (Software602 a.s.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [160048 2012-11-21] (Lenovo)
S3 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [708616 2015-04-08] (Garmin Ltd. or its subsidiaries)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-19] (Intel Corporation)
S3 intelsba; C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [48832 2013-01-28] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [187760 2012-12-11] (Lenovo Group Limited)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [136288 2012-08-11] (Lenovo Group Limited)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-08-24] ()
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2012-02-08] (Hewlett-Packard) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2012-02-08] (Hewlett-Packard) [File not signed]
R2 SolutoLauncherService; C:\Program Files\Soluto\SolutoLauncherService.exe [182848 2013-09-17] (Soluto)
R3 SolutoRemoteService; C:\Program Files\Soluto\SolutoRemoteService.exe [1942016 2013-09-17] (GlavSoft LLC.) [File not signed]
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [49136 2015-03-27] ()
R2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1028096 2010-08-31] (Lenovo Group Limited) [File not signed]
S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1492280 2012-02-06] (Lenovo Group Limited)
R2 ValBioService; C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe [22872 2014-07-21] (Validity Sensors, Inc.)
R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [49040 2014-07-21] (Synaptics Incorporated)
R2 WDDMService; C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe [319384 2011-12-15] (WDC)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [246688 2011-12-16] (Western Digital)
R2 WDFMEService; C:\Program Files\Western Digital\WD SmartWare\WDFME.exe [1977224 2011-12-15] (Western Digital )
R2 WDRulesService; C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe [1338264 2011-12-15] (Western Digital )
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3342640 2012-08-24] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 btmaudio; C:\Windows\System32\drivers\btmaud.sys [80896 2012-05-21] (Motorola Solutions, Inc.)
S3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [111104 2012-05-21] (Motorola Solutions, Inc.)
S3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [849408 2012-06-09] (Motorola Solutions, Inc.)
S3 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [71472 2012-11-21] (Windows (R) Win 7 DDK provider)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [288992 2013-01-08] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2014-02-24] (Synaptics Incorporated)
R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)
R3 tvtvcamd; C:\Windows\System32\DRIVERS\tvtvcamd.sys [27432 2011-12-08] (ThinkVantage Communications Utility)
R3 usb3Hub; C:\Windows\System32\DRIVERS\usb3Hub.sys [47072 2012-11-30] (Windows (R) Win 7 DDK provider)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [1049856 2013-02-18] (Vimicro Corporation)
R3 XHCIPort; C:\Windows\System32\DRIVERS\XHCIPort.sys [188896 2012-11-30] (Windows (R) Win 7 DDK provider)
S3 cpuz134; \??\C:\Users\richard\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
R3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-12 18:59 - 2015-04-12 19:00 - 00025808 _____ () C:\Users\richard\Desktop\FRST.txt
2015-04-12 18:57 - 2015-04-12 18:57 - 02096640 _____ (Farbar) C:\Users\richard\Desktop\FRST64.exe
2015-04-12 18:57 - 2015-04-12 18:57 - 00112640 _____ (forum.viry.cz) C:\Users\richard\Desktop\FRSTLauncher.exe
2015-04-12 18:56 - 2015-04-12 18:59 - 00000000 ____D () C:\FRST
2015-04-12 18:55 - 2015-04-12 18:55 - 00017669 _____ () C:\Users\richard\Desktop\82.htm
2015-04-12 18:53 - 2015-04-12 18:54 - 00024943 _____ () C:\Users\richard\Desktop\FRST.htm
2015-04-12 14:42 - 2015-04-12 14:42 - 00000020 _____ () C:\Users\richard\AppData\Roaming\appdataFr3.bin
2015-04-12 14:41 - 2015-04-12 14:41 - 00000000 ____D () C:\Users\richard\AppData\Local\VirtualStore
2015-04-12 14:41 - 2015-04-12 14:41 - 00000000 ____D () C:\Users\richard\AppData\Local\Packages
2015-04-12 14:38 - 2015-04-12 14:23 - 00024064 _____ () C:\Windows\zoek-delete.exe
2015-04-12 14:23 - 2015-04-12 14:41 - 00021647 _____ () C:\zoek-results.log
2015-04-12 14:21 - 2015-04-12 14:40 - 00000000 ____D () C:\zoek_backup
2015-04-12 14:20 - 2015-04-12 14:20 - 00011096 _____ () C:\Users\richard\Documents\INLAJNY-ČECHIE.xlsx
2015-04-12 14:19 - 2015-04-12 14:19 - 01305600 _____ () C:\Users\richard\Desktop\zoek.exe
2015-04-12 13:53 - 2015-04-12 13:53 - 00003810 _____ () C:\Users\richard\Downloads\google (2).csv
2015-04-10 06:57 - 2015-04-10 06:57 - 00000000 ____D () C:\Users\Default\AppData\Local\Garmin_Ltd._or_its_subsid
2015-04-10 06:57 - 2015-04-10 06:57 - 00000000 ____D () C:\Users\Default User\AppData\Local\Garmin_Ltd._or_its_subsid
2015-04-10 06:56 - 2015-04-10 06:56 - 00001901 _____ () C:\Users\Public\Desktop\Garmin Express.lnk
2015-04-10 06:56 - 2015-04-10 06:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2015-04-09 07:18 - 2015-04-09 07:18 - 00000000 ____D () C:\Program Files (x86)\SystemPassword
2015-04-08 17:24 - 2015-04-08 17:24 - 00031232 _____ () C:\Users\richard\Downloads\narezove plany uprava 6.12.2013.xls
2015-04-08 15:28 - 2015-04-08 15:28 - 00000000 ____D () C:\ProgramData\{a1c70233-e3f6-14c3-a1c7-70233e3f08cf}
2015-04-07 06:21 - 2015-04-07 06:21 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-07 06:21 - 2015-04-07 06:21 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-06 22:05 - 2015-04-06 14:27 - 02208768 _____ () C:\Users\richard\Desktop\adwcleaner_4.200 (3).exe
2015-04-06 21:36 - 2015-04-06 21:36 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-06 21:36 - 2015-04-06 21:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-06 21:34 - 2015-04-06 21:34 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-06 21:33 - 2015-04-06 21:57 - 00000000 ____D () C:\Users\richard\Desktop\mbar
2015-04-06 21:33 - 2015-04-06 21:31 - 16502728 _____ (Malwarebytes Corp.) C:\Users\richard\Desktop\mbar-1.09.1.1004.exe
2015-04-06 21:30 - 2015-04-06 21:31 - 16502728 _____ (Malwarebytes Corp.) C:\Users\richard\Downloads\mbar-1.09.1.1004.exe
2015-04-06 20:58 - 2015-04-06 20:58 - 01222144 _____ () C:\Users\richard\Downloads\RSITx64.exe
2015-04-06 20:58 - 2015-04-06 20:58 - 00000000 ____D () C:\rsit
2015-04-06 20:58 - 2015-04-06 20:58 - 00000000 ____D () C:\Program Files\trend micro
2015-04-06 20:25 - 2015-04-06 21:58 - 00000000 ____D () C:\Windows\SvcFiles
2015-04-06 20:25 - 2015-04-06 20:39 - 00000000 ____D () C:\Windows\sdmf
2015-04-06 19:46 - 2015-04-06 19:46 - 02030237 _____ () C:\Users\richard\Downloads\kuska_install.zip
2015-04-06 19:02 - 2015-04-06 19:02 - 00017359 _____ () C:\Users\richard\Downloads\detailBill_776664022 (3).csv
2015-04-06 19:01 - 2015-04-06 19:01 - 00017359 _____ () C:\Users\richard\Downloads\detailBill_776664022 (2).csv
2015-04-06 14:37 - 2015-04-06 14:37 - 00388608 _____ (Trend Micro Inc.) C:\Users\richard\Downloads\hijackthis.exe
2015-04-06 14:27 - 2015-04-06 14:27 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200 (3).exe
2015-04-06 14:23 - 2015-04-06 14:23 - 00000000 ____D () C:\_OTM
2015-04-06 14:21 - 2015-04-06 14:21 - 00522240 _____ (OldTimer Tools) C:\Users\richard\Downloads\OTM.exe
2015-04-06 14:21 - 2015-04-06 14:21 - 00522240 _____ (OldTimer Tools) C:\Users\richard\Desktop\OTM.exe
2015-04-06 14:05 - 2015-04-06 14:05 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200 (2).exe
2015-04-06 14:04 - 2015-04-12 14:41 - 00004224 _____ () C:\Windows\AutoKMS.log
2015-04-06 14:02 - 2015-04-12 14:40 - 00002048 _____ () C:\Windows\PFRO.log
2015-04-06 14:02 - 2015-04-12 14:40 - 00000728 _____ () C:\Windows\setupact.log
2015-04-06 14:02 - 2015-04-06 14:02 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-06 13:59 - 2015-04-06 22:09 - 00000000 ____D () C:\AdwCleaner
2015-04-06 13:58 - 2015-04-06 13:58 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200 (1).exe
2015-04-06 13:57 - 2015-04-06 13:57 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200.exe
2015-04-06 13:17 - 2015-04-06 13:17 - 00190214 _____ () C:\Users\richard\Documents\cc_20150406_131723.reg
2015-04-06 13:16 - 2015-04-06 13:16 - 00002804 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-04-06 13:16 - 2015-04-06 13:16 - 00000833 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-04-06 13:16 - 2015-04-06 13:16 - 00000000 ____D () C:\Program Files\CCleaner
2015-04-06 13:15 - 2015-04-06 13:15 - 05344528 _____ (Piriform Ltd) C:\Users\richard\Downloads\ccsetup504.exe
2015-04-03 07:10 - 2015-04-03 07:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Apps Sync
2015-03-31 16:17 - 2015-03-31 16:17 - 00001438 _____ () C:\Users\richard\Downloads\DPFDP5-0073595012-20150331-161646-pracovni.xml
2015-03-30 14:55 - 2015-03-30 14:55 - 00206341 _____ () C:\Users\richard\Downloads\led2015_14_130.htm
2015-03-25 14:21 - 2015-03-25 14:21 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-03-25 14:21 - 2015-03-25 14:21 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-25 14:21 - 2015-03-25 14:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-03-25 13:59 - 2015-03-25 13:59 - 00000000 ____D () C:\Windows\SysWOW64\X86
2015-03-25 13:59 - 2015-03-25 13:59 - 00000000 ____D () C:\Windows\SysWOW64\AMD64
2015-03-25 13:56 - 2015-03-25 13:56 - 00481792 _____ () C:\Users\richard\Downloads\microsoft office office 2010 keygen ( 100%.exe
2015-03-25 13:55 - 2015-03-25 13:55 - 00481792 _____ () C:\Users\richard\Downloads\office 2010 home and office product key.exe
2015-03-25 08:49 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 08:49 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 08:49 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 08:49 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 08:49 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 08:49 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 08:49 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 08:49 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-24 14:44 - 2015-03-24 09:53 - 00005315 _____ () C:\Users\richard\Desktop\Vyúčtování poplatků za topení.odt garzonka 2014.odt
2015-03-24 11:23 - 2015-03-24 11:23 - 03144728 _____ () C:\Users\richard\Downloads\iSignum.exe
2015-03-24 11:21 - 2015-03-24 11:21 - 00001687 _____ () C:\Users\richard\Downloads\QCA1777370.crt
2015-03-22 10:54 - 2015-03-22 10:54 - 00231407 _____ () C:\Users\richard\Downloads\led2015_13_39.htm
2015-03-22 10:54 - 2015-03-22 10:54 - 00231407 _____ () C:\Users\richard\Downloads\led2015_13_39 (1).htm
2015-03-19 09:44 - 2015-03-19 09:44 - 00246658 _____ () C:\Users\richard\Downloads\led2015_12_130 (1).htm
2015-03-17 12:31 - 2015-03-17 12:33 - 00001810 _____ () C:\Users\richard\Desktop\OrsoftCS 3.lnk
2015-03-16 17:36 - 2015-03-16 17:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft ASP.NET
2015-03-16 10:50 - 2015-03-16 10:50 - 00232538 _____ () C:\Users\richard\Downloads\led2015_12_130.htm
2015-03-13 16:46 - 2015-03-13 16:46 - 11636736 _____ () C:\Users\richard\Downloads\PowerQuery_2.20.3945.242 (64-bit) [cs-CZ].msi

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-12 18:43 - 2014-01-13 13:29 - 00000970 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002UA.job
2015-04-12 18:41 - 2013-07-20 12:51 - 00000914 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-12 18:33 - 2013-06-02 12:13 - 02076134 _____ () C:\Windows\WindowsUpdate.log
2015-04-12 15:52 - 2009-07-14 06:45 - 00034432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-12 15:52 - 2009-07-14 06:45 - 00034432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-12 14:47 - 2013-06-02 11:51 - 00672370 _____ () C:\Windows\system32\perfh005.dat
2015-04-12 14:47 - 2013-06-02 11:51 - 00142934 _____ () C:\Windows\system32\perfc005.dat
2015-04-12 14:47 - 2009-07-14 07:13 - 01593078 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-12 14:45 - 2013-08-30 13:47 - 00000000 ____D () C:\Users\richard\Documents\Soubory aplikace Outlook
2015-04-12 14:41 - 2014-11-24 08:08 - 00000202 _____ () C:\Windows\Tasks\AutoKMSDaily.job
2015-04-12 14:41 - 2014-10-27 11:23 - 00002740 _____ () C:\Windows\System32\Tasks\AutoKMSDaily
2015-04-12 14:41 - 2014-02-04 08:04 - 00078848 _____ () C:\Windows\KMSEmulator.exe
2015-04-12 14:41 - 2013-08-30 12:19 - 00000204 _____ () C:\Windows\Tasks\AutoKMS.job
2015-04-12 14:40 - 2014-03-06 12:52 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-04-12 14:40 - 2013-06-02 12:23 - 00000000 ____D () C:\ProgramData\Validity
2015-04-12 14:40 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-10 07:43 - 2014-01-13 13:29 - 00000918 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002Core.job
2015-04-10 07:14 - 2013-09-12 07:04 - 00000000 ____D () C:\Users\richard\Documents\AB_HP
2015-04-10 06:57 - 2014-08-17 14:13 - 00000000 ____D () C:\Program Files (x86)\Garmin
2015-04-10 06:56 - 2014-08-17 14:13 - 00003556 _____ () C:\Windows\System32\Tasks\GarminUpdaterTask
2015-04-10 06:56 - 2014-08-17 14:13 - 00000000 ____D () C:\ProgramData\Garmin
2015-04-08 17:09 - 2013-10-14 09:48 - 00000000 ____D () C:\Users\richard\Documents\soukrome
2015-04-08 08:33 - 2014-03-19 16:17 - 00011182 _____ () C:\Users\richard\Documents\lcioc3.xlsx
2015-04-08 07:19 - 2013-06-02 12:31 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2015-04-08 07:19 - 2013-06-01 19:42 - 00000000 ____D () C:\ProgramData\Lenovo
2015-04-08 07:18 - 2013-06-02 12:21 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2015-04-08 07:18 - 2013-06-02 12:14 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2015-04-06 18:19 - 2013-07-17 17:37 - 00002194 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-06 13:49 - 2014-02-17 16:08 - 00000000 ____D () C:\Users\richard\AppData\Roaming\FileZilla
2015-04-06 13:49 - 2013-09-01 16:51 - 00000000 ____D () C:\Users\richard\AppData\Roaming\TeamViewer
2015-04-06 13:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
2015-04-06 13:23 - 2011-02-24 19:03 - 00000000 ____D () C:\Windows\Panther
2015-03-26 04:18 - 2014-12-11 09:37 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 04:18 - 2014-05-13 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-25 14:21 - 2013-08-06 21:37 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-17 12:32 - 2013-09-18 10:59 - 00000000 ____D () C:\OrsoftCS
2015-03-17 08:04 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-13 15:20 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

==================== Files in the root of some directories =======

2014-11-10 09:13 - 2014-11-10 16:25 - 0000665 _____ () C:\Program Files (x86)\FOXUSER.DBF
2014-11-10 09:13 - 2014-11-10 16:26 - 0000704 _____ () C:\Program Files (x86)\FOXUSER.FPT
2013-07-17 23:28 - 2013-09-03 09:36 - 0016610 _____ () C:\Users\richard\AppData\Roaming\AbsoluteReminder.xml
2015-04-12 14:42 - 2015-04-12 14:42 - 0000020 _____ () C:\Users\richard\AppData\Roaming\appdataFr3.bin
2014-04-10 15:04 - 2014-04-10 15:04 - 0038495 _____ () C:\Users\richard\AppData\Roaming\Microsoft Excel 97-2003.ADR
2014-01-14 14:48 - 2014-01-14 14:48 - 0000600 _____ () C:\Users\richard\AppData\Roaming\winscp.rnd
2014-04-25 13:40 - 2014-04-25 13:40 - 0004096 ____H () C:\Users\richard\AppData\Local\keyfile3.drm
2013-06-02 12:19 - 2013-06-02 12:19 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-09-24 14:11 - 2013-09-24 14:11 - 0000098 ____N () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
2013-06-02 12:26 - 2013-06-02 12:27 - 0000107 ____N () C:\ProgramData\{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}.log
2013-06-02 12:24 - 2013-06-02 12:25 - 0000105 ____N () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2013-06-02 12:25 - 2013-06-02 12:26 - 0000110 ____N () C:\ProgramData\{B7A0CE06-068E-11D6-97FD-0050BACBF861}.log
2013-06-02 12:26 - 2013-06-02 12:26 - 0000115 ____N () C:\ProgramData\{D6E853EC-8960-4D44-AF03-7361BB93227C}.log

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed



===***===***===***=== Extract of Additional scan result of Farbar Recovery Scan Tool ===***===***===***===

==================== Drive and Memory info ===================



==================== MBR and Partition Table ==================


==================== Scheduled Tasks (whitelisted) ==================

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS.exe
Task: C:\Windows\Tasks\AutoKMSDaily.job => C:\Windows\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002Core.job => C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002UA.job => C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Alternate Data Streams (whitelisted) ==================


==================== Security Center ==================

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}



===***===***===***=== Supplementary Scan createdy by FRSTLauncher ===***===***===***===
Posledni aktualizace FRSTLauncheru: 25_11_2013 (01)
Posledni aktualizace Modifikacniho skriptu: 30_09_2013 (01)


***** Velikost "Plochy" *****

Velikost slozky "C:\Users\richard\Desktop" je 53 MB.


***** Startup Programs *****


***** Firewall rules *****

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0
DefaultOutboundAction REG_DWORD 0x0
DefaultInboundAction REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
EnableFirewall REG_DWORD 0x1
DisableNotifications REG_DWORD 0x0
DefaultOutboundAction REG_DWORD 0x0
DefaultInboundAction REG_DWORD 0x1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]


***** System Restore *****

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"Generalize_DisableSR"=dword:00000000


==================== End Of Log ==============================

log

Tvorba fixlistu pro FRST

• Spustte poznamkovy blok (Start-spustit-notepad)
• Zkopirujte skript nize

• Kód: Vybrat vše

  Start
  CloseProcesses:
  CreateRestorePoint:
  
  HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4315872 2011-06-01] (Lenovo, Inc.)
  HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248040 2010-02-18] (Sun Microsystems, Inc.)
  HKLM-x32\...\Run: [wsg32.exe] => wsg32.exe
  HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [Google Update] => C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-01-13] (Google Inc.)
  HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [GarminExpressTrayApp] => "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe"
  HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7451928 2015-03-13] (Piriform Ltd)
  HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [Zoner Photo Studio Autoupdate] => C:\PROGRAM FILES\ZONER\PHOTO STUDIO 15\Program32\ZPSTRAY.EXE [774168 2013-02-18] (ZONER software)
  HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\MountPoints2: D - D:\autorun.exe
  HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\MountPoints2: {3fc9e6c2-6be0-11e4-afae-28d2440f0701} - D:\autorun.exe
  HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\MountPoints2: {f4e57da7-cb6b-11e2-bea9-806e6f6e6963} - Q:\LenovoQDrive.exe
  ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => No File
  ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => No File
  ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => No File
  ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => No File
  
  HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13-comm.msn.com
  HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com/welcome/thinkpad
  SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
  SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
  Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
  Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
  
  FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml [2013-10-22]
  FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
  FF Extension: No Name - C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [Not Found]
  FF Extension: No Name - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12 [Not Found]
  
  CHR Extension: (Skype Click to Call) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-07-17]
  CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
  
  R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
  R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
  S3 cpuz134; \??\C:\Users\richard\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
  R3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]
  
  C:\Program Files (x86)\Skype\Toolbars
  2015-04-12 18:59 - 2015-04-12 19:00 - 00025808 _____ () C:\Users\richard\Desktop\FRST.txt
  2015-04-12 18:57 - 2015-04-12 18:57 - 00112640 _____ (forum.viry.cz) C:\Users\richard\Desktop\FRSTLauncher.exe
  2015-04-12 14:38 - 2015-04-12 14:23 - 00024064 _____ () C:\Windows\zoek-delete.exe
  2015-04-12 14:23 - 2015-04-12 14:41 - 00021647 _____ () C:\zoek-results.log
  2015-04-12 14:21 - 2015-04-12 14:40 - 00000000 ____D () C:\zoek_backup
  2015-04-06 22:05 - 2015-04-06 14:27 - 02208768 _____ () C:\Users\richard\Desktop\adwcleaner_4.200 (3).exe
  2015-04-06 21:36 - 2015-04-06 21:36 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
  2015-04-06 21:36 - 2015-04-06 21:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
  2015-04-06 21:34 - 2015-04-06 21:34 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
  2015-04-06 21:33 - 2015-04-06 21:57 - 00000000 ____D () C:\Users\richard\Desktop\mbar
  2015-04-06 21:33 - 2015-04-06 21:31 - 16502728 _____ (Malwarebytes Corp.) C:\Users\richard\Desktop\mbar-1.09.1.1004.exe
  2015-04-06 21:30 - 2015-04-06 21:31 - 16502728 _____ (Malwarebytes Corp.) C:\Users\richard\Downloads\mbar-1.09.1.1004.exe
  2015-04-06 20:58 - 2015-04-06 20:58 - 01222144 _____ () C:\Users\richard\Downloads\RSITx64.exe
  2015-04-06 20:58 - 2015-04-06 20:58 - 00000000 ____D () C:\rsit
  2015-04-06 20:58 - 2015-04-06 20:58 - 00000000 ____D () C:\Program Files\trend micro
  2015-04-06 14:37 - 2015-04-06 14:37 - 00388608 _____ (Trend Micro Inc.) C:\Users\richard\Downloads\hijackthis.exe
  2015-04-06 14:27 - 2015-04-06 14:27 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200 (3).exe
  2015-04-06 14:23 - 2015-04-06 14:23 - 00000000 ____D () C:\_OTM
  2015-04-06 14:21 - 2015-04-06 14:21 - 00522240 _____ (OldTimer Tools) C:\Users\richard\Downloads\OTM.exe
  2015-04-06 14:21 - 2015-04-06 14:21 - 00522240 _____ (OldTimer Tools) C:\Users\richard\Desktop\OTM.exe
  2015-04-06 14:05 - 2015-04-06 14:05 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200 (2).exe
  2015-04-06 14:04 - 2015-04-12 14:41 - 00004224 _____ () C:\Windows\AutoKMS.log
  2015-04-06 14:02 - 2015-04-12 14:40 - 00002048 _____ () C:\Windows\PFRO.log
  2015-04-06 14:02 - 2015-04-12 14:40 - 00000728 _____ () C:\Windows\setupact.log
  2015-04-06 14:02 - 2015-04-06 14:02 - 00000000 _____ () C:\Windows\setuperr.log
  2015-04-06 13:59 - 2015-04-06 22:09 - 00000000 ____D () C:\AdwCleaner
  2015-04-06 13:58 - 2015-04-06 13:58 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200 (1).exe
  2015-04-06 13:57 - 2015-04-06 13:57 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200.exe
  2015-04-06 13:17 - 2015-04-06 13:17 - 00190214 _____ () C:\Users\richard\Documents\cc_20150406_131723.reg
  2015-04-06 13:15 - 2015-04-06 13:15 - 05344528 _____ (Piriform Ltd) C:\Users\richard\Downloads\ccsetup504.exe
  2015-03-25 13:56 - 2015-03-25 13:56 - 00481792 _____ () C:\Users\richard\Downloads\microsoft office office 2010 keygen ( 100%.exe
  2015-03-25 13:55 - 2015-03-25 13:55 - 00481792 _____ () C:\Users\richard\Downloads\office 2010 home and office product key.exe
  2015-04-12 14:41 - 2014-11-24 08:08 - 00000202 _____ () C:\Windows\Tasks\AutoKMSDaily.job
  2015-04-12 14:41 - 2014-10-27 11:23 - 00002740 _____ () C:\Windows\System32\Tasks\AutoKMSDaily
  2015-04-12 14:41 - 2014-02-04 08:04 - 00078848 _____ () C:\Windows\KMSEmulator.exe
  2015-04-12 14:41 - 2013-08-30 12:19 - 00000204 _____ () C:\Windows\Tasks\AutoKMS.job
  2013-06-02 12:26 - 2013-06-02 12:27 - 0000107 ____N () C:\ProgramData\{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}.log
  2013-06-02 12:24 - 2013-06-02 12:25 - 0000105 ____N () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
  2013-06-02 12:25 - 2013-06-02 12:26 - 0000110 ____N () C:\ProgramData\{B7A0CE06-068E-11D6-97FD-0050BACBF861}.log
  2013-06-02 12:26 - 2013-06-02 12:26 - 0000115 ____N () C:\ProgramData\{D6E853EC-8960-4D44-AF03-7361BB93227C}.log
  
  Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
  Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS.exe
  Task: C:\Windows\Tasks\AutoKMSDaily.job => C:\Windows\AutoKMS.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002Core.job => C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe
  Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002UA.job => C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe
  C:\Windows\AutoKMS.exe
  
  Hosts:
  EmptyTemp:
  Reboot:
  End
  

• Ulozte vytvoreny TXT jako fixlist.txt
• Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe

• Kliknete na Fix
• Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-04-2015
Ran by richard at 2015-04-13 10:29:22 Run:1
Running from C:\Users\richard\Desktop
Loaded Profiles: UpdatusUser & richard (Available profiles: UpdatusUser & richard)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
CreateRestorePoint:

HKLM-x32\...\Run: [Lenovo Registration] => C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4315872 2011-06-01] (Lenovo, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248040 2010-02-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [wsg32.exe] => wsg32.exe
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [Google Update] => C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-01-13] (Google Inc.)
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [GarminExpressTrayApp] => "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe"
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [CCLEANER Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7451928 2015-03-13] (PIRIFORM Ltd)
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [Zoner Photo Studio Autoupdate] => C:\PROGRAM FILES\ZONER\PHOTO STUDIO 15\Program32\ZPSTRAY.EXE [774168 2013-02-18] (ZONER software)
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\MountPoints2: D - D:\autorun.exe
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\MountPoints2: {3fc9e6c2-6be0-11e4-afae-28d2440f0701} - D:\autorun.exe
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\MountPoints2: {f4e57da7-cb6b-11e2-bea9-806e6f6e6963} - Q:\LenovoQDrive.exe
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => No File
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => No File
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => No File
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => No File

HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13-comm.msn.com
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com/welcome/thinkpad
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml [2013-10-22]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF Extension: No Name - C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12 [Not Found]

CHR Extension: (Skype Click to Call) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-07-17]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S3 cpuz134; \??\C:\Users\richard\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
R3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]

C:\Program Files (x86)\Skype\Toolbars
2015-04-12 18:59 - 2015-04-12 19:00 - 00025808 _____ () C:\Users\richard\Desktop\FRST.txt
2015-04-12 18:57 - 2015-04-12 18:57 - 00112640 _____ (forum.viry.cz) C:\Users\richard\Desktop\FRSTLauncher.exe
2015-04-12 14:38 - 2015-04-12 14:23 - 00024064 _____ () C:\Windows\zoek-delete.exe
2015-04-12 14:23 - 2015-04-12 14:41 - 00021647 _____ () C:\zoek-results.log
2015-04-12 14:21 - 2015-04-12 14:40 - 00000000 ____D () C:\zoek_backup
2015-04-06 22:05 - 2015-04-06 14:27 - 02208768 _____ () C:\Users\richard\Desktop\adwcleaner_4.200 (3).exe
2015-04-06 21:36 - 2015-04-06 21:36 - 00136408 _____ (MALWAREBYTES Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-06 21:36 - 2015-04-06 21:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-06 21:34 - 2015-04-06 21:34 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-06 21:33 - 2015-04-06 21:57 - 00000000 ____D () C:\Users\richard\Desktop\mbar
2015-04-06 21:33 - 2015-04-06 21:31 - 16502728 _____ (Malwarebytes Corp.) C:\Users\richard\Desktop\mbar-1.09.1.1004.exe
2015-04-06 21:30 - 2015-04-06 21:31 - 16502728 _____ (Malwarebytes Corp.) C:\Users\richard\Downloads\mbar-1.09.1.1004.exe
2015-04-06 20:58 - 2015-04-06 20:58 - 01222144 _____ () C:\Users\richard\Downloads\RSITx64.exe
2015-04-06 20:58 - 2015-04-06 20:58 - 00000000 ____D () C:\rsit
2015-04-06 20:58 - 2015-04-06 20:58 - 00000000 ____D () C:\Program Files\trend micro
2015-04-06 14:37 - 2015-04-06 14:37 - 00388608 _____ (Trend Micro Inc.) C:\Users\richard\Downloads\hijackthis.exe
2015-04-06 14:27 - 2015-04-06 14:27 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200 (3).exe
2015-04-06 14:23 - 2015-04-06 14:23 - 00000000 ____D () C:\_OTM
2015-04-06 14:21 - 2015-04-06 14:21 - 00522240 _____ (OldTimer Tools) C:\Users\richard\Downloads\OTM.exe
2015-04-06 14:21 - 2015-04-06 14:21 - 00522240 _____ (OldTimer Tools) C:\Users\richard\Desktop\OTM.exe
2015-04-06 14:05 - 2015-04-06 14:05 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200 (2).exe
2015-04-06 14:04 - 2015-04-12 14:41 - 00004224 _____ () C:\Windows\AutoKMS.log
2015-04-06 14:02 - 2015-04-12 14:40 - 00002048 _____ () C:\Windows\PFRO.log
2015-04-06 14:02 - 2015-04-12 14:40 - 00000728 _____ () C:\Windows\setupact.log
2015-04-06 14:02 - 2015-04-06 14:02 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-06 13:59 - 2015-04-06 22:09 - 00000000 ____D () C:\AdwCleaner
2015-04-06 13:58 - 2015-04-06 13:58 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200 (1).exe
2015-04-06 13:57 - 2015-04-06 13:57 - 02208768 _____ () C:\Users\richard\Downloads\adwcleaner_4.200.exe
2015-04-06 13:17 - 2015-04-06 13:17 - 00190214 _____ () C:\Users\richard\Documents\cc_20150406_131723.reg
2015-04-06 13:15 - 2015-04-06 13:15 - 05344528 _____ (Piriform Ltd) C:\Users\richard\Downloads\ccsetup504.exe
2015-03-25 13:56 - 2015-03-25 13:56 - 00481792 _____ () C:\Users\richard\Downloads\MICROSOFT OFFICE office 2010 keygen ( 100%.exe
2015-03-25 13:55 - 2015-03-25 13:55 - 00481792 _____ () C:\Users\richard\Downloads\office 2010 home and office product key.exe
2015-04-12 14:41 - 2014-11-24 08:08 - 00000202 _____ () C:\Windows\Tasks\AutoKMSDaily.job
2015-04-12 14:41 - 2014-10-27 11:23 - 00002740 _____ () C:\Windows\System32\Tasks\AutoKMSDaily
2015-04-12 14:41 - 2014-02-04 08:04 - 00078848 _____ () C:\Windows\KMSEmulator.exe
2015-04-12 14:41 - 2013-08-30 12:19 - 00000204 _____ () C:\Windows\Tasks\AutoKMS.job
2013-06-02 12:26 - 2013-06-02 12:27 - 0000107 ____N () C:\ProgramData\{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}.log
2013-06-02 12:24 - 2013-06-02 12:25 - 0000105 ____N () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2013-06-02 12:25 - 2013-06-02 12:26 - 0000110 ____N () C:\ProgramData\{B7A0CE06-068E-11D6-97FD-0050BACBF861}.log
2013-06-02 12:26 - 2013-06-02 12:26 - 0000115 ____N () C:\ProgramData\{D6E853EC-8960-4D44-AF03-7361BB93227C}.log

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS.exe
Task: C:\Windows\Tasks\AutoKMSDaily.job => C:\Windows\AutoKMS.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002Core.job => C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002UA.job => C:\Users\richard\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Windows\AutoKMS.exe

HOSTS:
EmptyTemp:
Reboot:
End
*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\Lenovo Registration => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\wsg32.exe => value deleted successfully.
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Run\\Google Update => value deleted successfully.
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Run\\GarminExpressTrayApp => value deleted successfully.
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Run\\CCLEANER Monitoring => value deleted successfully.
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Windows\CurrentVersion\Run\\Zoner Photo Studio Autoupdate => value deleted successfully.
"HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D" => Key deleted successfully.
"HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3fc9e6c2-6be0-11e4-afae-28d2440f0701}" => Key deleted successfully.
HKCR\CLSID\{3fc9e6c2-6be0-11e4-afae-28d2440f0701} => Key not found.
"HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f4e57da7-cb6b-11e2-bea9-806e6f6e6963}" => Key deleted successfully.
HKCR\CLSID\{f4e57da7-cb6b-11e2-bea9-806e6f6e6963} => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncBackedUp" => Key deleted successfully.
HKCR\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncPending" => Key deleted successfully.
HKCR\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncRoot" => Key deleted successfully.
HKCR\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351} => Key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SugarSyncShared" => Key deleted successfully.
HKCR\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51} => Key not found.
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully.
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Software\Microsoft\Internet Explorer\Main\\Default_Secondary_Page_URL => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKCR\PROTOCOLS\Handler\skypec2c" => Key deleted successfully.
"HKCR\CLSID\{91774881-D725-4E58-B298-07617B9B86A8}" => Key deleted successfully.
HKCR\Wow6432Node\PROTOCOLS\Handler\skypec2c => Key not found.
"HKCR\Wow6432Node\CLSID\{91774881-D725-4E58-B298-07617B9B86A8}" => Key deleted successfully.
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\jyxo-cz.xml => Moved successfully.
C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi => Moved successfully.
C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} not found.
C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12 not found.
C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl => Moved successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl" => Key deleted successfully.
C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx => Moved successfully.
c2cautoupdatesvc => Service deleted successfully.
c2cpnrsvc => Service deleted successfully.
cpuz134 => Service deleted successfully.
cpuz136 => Service stopped successfully.
cpuz136 => Service deleted successfully.
C:\Program Files (x86)\Skype\Toolbars => Moved successfully.
C:\Users\richard\Desktop\FRST.txt => Moved successfully.
C:\Users\richard\Desktop\FRSTLauncher.exe => Moved successfully.
C:\Windows\zoek-delete.exe => Moved successfully.
C:\zoek-results.log => Moved successfully.
C:\zoek_backup => Moved successfully.
C:\Users\richard\Desktop\adwcleaner_4.200 (3).exe => Moved successfully.
C:\Windows\system32\Drivers\MBAMSwissArmy.sys => Moved successfully.
C:\ProgramData\Malwarebytes => Moved successfully.
C:\Windows\system32\Drivers\mbamchameleon.sys => Moved successfully.
C:\Users\richard\Desktop\mbar => Moved successfully.
C:\Users\richard\Desktop\mbar-1.09.1.1004.exe => Moved successfully.
C:\Users\richard\Downloads\mbar-1.09.1.1004.exe => Moved successfully.
C:\Users\richard\Downloads\RSITx64.exe => Moved successfully.
C:\rsit => Moved successfully.
C:\Program Files\trend micro => Moved successfully.
C:\Users\richard\Downloads\hijackthis.exe => Moved successfully.
C:\Users\richard\Downloads\adwcleaner_4.200 (3).exe => Moved successfully.
C:\_OTM => Moved successfully.
C:\Users\richard\Downloads\OTM.exe => Moved successfully.
C:\Users\richard\Desktop\OTM.exe => Moved successfully.
C:\Users\richard\Downloads\adwcleaner_4.200 (2).exe => Moved successfully.
C:\Windows\AutoKMS.log => Moved successfully.
C:\Windows\PFRO.log => Moved successfully.
C:\Windows\setupact.log => Moved successfully.
C:\Windows\setuperr.log => Moved successfully.
C:\AdwCleaner => Moved successfully.
C:\Users\richard\Downloads\adwcleaner_4.200 (1).exe => Moved successfully.
C:\Users\richard\Downloads\adwcleaner_4.200.exe => Moved successfully.
C:\Users\richard\Documents\cc_20150406_131723.reg => Moved successfully.
C:\Users\richard\Downloads\ccsetup504.exe => Moved successfully.
C:\Users\richard\Downloads\MICROSOFT OFFICE office 2010 keygen ( 100%.exe => Moved successfully.
C:\Users\richard\Downloads\office 2010 home and office product key.exe => Moved successfully.
C:\Windows\Tasks\AutoKMSDaily.job => Moved successfully.
C:\Windows\System32\Tasks\AutoKMSDaily => Moved successfully.
"C:\Windows\KMSEmulator.exe" => File/Directory not found.
C:\Windows\Tasks\AutoKMS.job => Moved successfully.
C:\ProgramData\{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}.log => Moved successfully.
C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log => Moved successfully.
C:\ProgramData\{B7A0CE06-068E-11D6-97FD-0050BACBF861}.log => Moved successfully.
C:\ProgramData\{D6E853EC-8960-4D44-AF03-7361BB93227C}.log => Moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job => Moved successfully.
C:\Windows\Tasks\AutoKMS.job not found.
C:\Windows\Tasks\AutoKMSDaily.job not found.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002Core.job => Moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2677794339-3578005486-2719301744-1002UA.job => Moved successfully.
"C:\Windows\AutoKMS.exe" => File/Directory not found.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 208.2 MB temporary data.


The system needed a reboot.

==== End of Fixlog 10:31:11 ====

Jak se chova PC??

Dobrý den,
mám pocit, že stále stejně, jenom SalePlus se změnilo na Ad by CoupMania | Close - ale to už asi po 3 zásahu...

...

Aplikujte znovu AdwCleaner

Dejte novy log z FRST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-04-2015
Ran by richard (administrator) on RICHARD-THINK on 15-04-2015 11:29:13
Running from C:\Users\richard\Desktop
Loaded Profiles: UpdatusUser & richard (Available profiles: UpdatusUser & richard)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Software602 a.s.) C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Soluto) C:\Program Files\Soluto\Soluto.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Soluto) C:\Program Files\Soluto\SolutoLauncherService.exe
(Soluto) C:\Program Files\Soluto\SolutoService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Validity Sensors, Inc.) C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Synaptics Incorporated) C:\Windows\System32\valWBFPolicyService.exe
(Validity Sensors, Inc.) C:\Program Files\Lenovo Fingerprint Reader\SwipeMonitor.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe
(Western Digital) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Western Digital ) C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Western Digital ) C:\Program Files\Western Digital\WD SmartWare\WDFME.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Western Digital Technologies, Inc.) C:\Program Files\Western Digital\WD SmartWare\WDDMStatus.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ZONER software) C:\Program Files\Zoner\Photo Studio 15\Program32\ZPSTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(GlavSoft LLC.) C:\Program Files\Soluto\SolutoRemoteService.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(Lenovo Group Limited) C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [184112 2012-06-01] (Intel Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [887968 2012-06-15] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [TpShocks] => C:\Windows\SYSTEM32\TpShocks.exe [382248 2013-02-13] (Lenovo.)
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [293232 2012-12-11] (Lenovo Group Limited)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [WD Quick View] => C:\Program Files\Western Digital\WD SmartWare\WDDMStatus.exe [4244888 2011-12-15] (Western Digital Technologies, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2809072 2014-02-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [548864 2012-12-17] (Vimicro)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508656 2012-09-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [1085744 2012-11-21] (Lenovo)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe,c:\program files\soluto\soluto.exe /userinit,
Winlogon\Notify\igfxcui: C:\Windows\SYSTEM32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\...\Run: [Zoner Photo Studio Autoupdate] => C:\PROGRAM FILES\ZONER\PHOTO STUDIO 15\Program32\ZPSTRAY.EXE [774168 2013-02-18] (ZONER software)
HKU\S-1-5-21-2677794339-3578005486-2719301744-1002\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [241664 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\tray.exe [1010008 2015-04-08] (Garmin Ltd. or its subsidiaries)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2677794339-3578005486-2719301744-1002 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab
DPF: HKLM-x32 {F680B28A-3AEE-4C88-93ED-45AE9215C128} https://adisepo.mfcr.cz/adistc/adis/idp ... tsignx.cab
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.8.4
Tcpip\..\Interfaces\{3BFE0E02-2F35-4ABB-A64A-A94F09658477}: [NameServer] 8.8.8.8,8.8.4.4

FireFox:
========
FF ProfilePath: C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default
FF NewTab: about:newtab
FF Homepage: about:home
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-08-13] (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @software602.cz/602XML Filler -> C:\Program Files (x86)\Software602\602XML\Filler\npfiller.dll [2012-08-06] (Software602 a.s.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2677794339-3578005486-2719301744-1002: @tools.google.com/Google Update;version=3 -> C:\Users\richard\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin HKU\S-1-5-21-2677794339-3578005486-2719301744-1002: @tools.google.com/Google Update;version=9 -> C:\Users\richard\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin HKU\S-1-5-21-2677794339-3578005486-2719301744-1002: intel.com/AppUp -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll [2012-12-14] (Intel)
FF Plugin HKU\S-1-5-21-2677794339-3578005486-2719301744-1002: intel.com/AppUpx64 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll [2012-12-14] (Intel)
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2014-03-03]
FF Extension: No Name - C:\Users\richard\AppData\Roaming\Mozilla\Firefox\Profiles\7vm8wtrp.default\extensions\{ea614400-e918-4741-9a97-7a972ff7c30b} [Not Found]
FF Extension: No Name - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12 [Not Found]

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-04-12]
CHR Extension: (Google Docs) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-07-17]
CHR Extension: (Google Drive) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-07-17]
CHR Extension: (YouTube) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-17]
CHR Extension: (Google Search) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-17]
CHR Extension: (Google Sheets) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-04-12]
CHR Extension: (Gmail) - C:\Users\richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-17]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 602XML Updater; C:\Program Files (x86)\Common Files\soft602\602updsvc\602updsvc.exe [85344 2011-10-10] (Software602 a.s.)
R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [160048 2012-11-21] (Lenovo)
S3 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [708616 2015-04-08] (Garmin Ltd. or its subsidiaries)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-07-19] (Intel Corporation)
S3 intelsba; C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [48832 2013-01-28] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 LENOVO.TVTVCAM; C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [187760 2012-12-11] (Lenovo Group Limited)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [136288 2012-08-11] (Lenovo Group Limited)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-08-24] ()
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2012-02-08] (Hewlett-Packard) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2012-02-08] (Hewlett-Packard) [File not signed]
R2 SolutoLauncherService; C:\Program Files\Soluto\SolutoLauncherService.exe [182848 2013-09-17] (Soluto)
R3 SolutoRemoteService; C:\Program Files\Soluto\SolutoRemoteService.exe [1942016 2013-09-17] (GlavSoft LLC.) [File not signed]
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [49136 2015-03-27] ()
R2 ThinkVantage Registry Monitor Service; C:\Program Files (x86)\Common Files\Lenovo\tvt_reg_monitor_svc.exe [1028096 2010-08-31] (Lenovo Group Limited) [File not signed]
S3 TVT Backup Service; C:\Program Files (x86)\Lenovo\Rescue and Recovery\rrservice.exe [1492280 2012-02-06] (Lenovo Group Limited)
R2 ValBioService; C:\Program Files\Lenovo Fingerprint Reader\ValBioService.exe [22872 2014-07-21] (Validity Sensors, Inc.)
R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [49040 2014-07-21] (Synaptics Incorporated)
R2 WDDMService; C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe [319384 2011-12-15] (WDC)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [246688 2011-12-16] (Western Digital)
R2 WDFMEService; C:\Program Files\Western Digital\WD SmartWare\WDFME.exe [1977224 2011-12-15] (Western Digital )
R2 WDRulesService; C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe [1338264 2011-12-15] (Western Digital )
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3342640 2012-08-24] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 btmaudio; C:\Windows\System32\drivers\btmaud.sys [80896 2012-05-21] (Motorola Solutions, Inc.)
S3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [111104 2012-05-21] (Motorola Solutions, Inc.)
S3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [849408 2012-06-09] (Motorola Solutions, Inc.)
S3 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [71472 2012-11-21] (Windows (R) Win 7 DDK provider)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [288992 2013-01-08] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2014-02-24] (Synaptics Incorporated)
R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)
R3 tvtvcamd; C:\Windows\System32\DRIVERS\tvtvcamd.sys [27432 2011-12-08] (ThinkVantage Communications Utility)
R3 usb3Hub; C:\Windows\System32\DRIVERS\usb3Hub.sys [47072 2012-11-30] (Windows (R) Win 7 DDK provider)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [1049856 2013-02-18] (Vimicro Corporation)
R3 XHCIPort; C:\Windows\System32\DRIVERS\XHCIPort.sys [188896 2012-11-30] (Windows (R) Win 7 DDK provider)
R3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-15 11:29 - 2015-04-15 11:29 - 00022321 _____ () C:\Users\richard\Desktop\FRST.txt
2015-04-15 11:23 - 2015-04-15 11:24 - 00000000 ____D () C:\AdwCleaner
2015-04-15 11:23 - 2015-04-15 11:22 - 02217984 _____ () C:\Users\richard\Desktop\adwcleaner_4.201.exe
2015-04-15 11:22 - 2015-04-15 11:22 - 02217984 _____ () C:\Users\richard\Downloads\adwcleaner_4.201.exe
2015-04-15 11:21 - 2015-04-15 11:21 - 00049423 _____ () C:\Users\richard\Desktop\adw.htm
2015-04-13 11:09 - 2015-04-13 11:10 - 00243577 _____ () C:\Users\richard\Downloads\led2015_16_130 (2).htm
2015-04-13 11:09 - 2015-04-13 11:09 - 00243577 _____ () C:\Users\richard\Downloads\led2015_16_130 (1).htm
2015-04-13 10:32 - 2015-04-15 11:25 - 00000224 _____ () C:\Windows\setupact.log
2015-04-13 10:32 - 2015-04-13 10:32 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-12 19:57 - 2015-04-12 19:57 - 00001117 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-04-12 19:57 - 2015-04-12 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-04-12 19:57 - 2015-04-12 19:57 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-04-12 19:57 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-12 19:57 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-12 19:31 - 2015-04-12 19:31 - 00243577 _____ () C:\Users\richard\Downloads\led2015_16_130.htm
2015-04-12 19:04 - 2015-04-12 19:04 - 00018876 _____ () C:\Users\richard\Desktop\Desktop.rar
2015-04-12 19:00 - 2015-04-12 19:01 - 00023267 _____ () C:\Users\richard\Desktop\Addition.txt
2015-04-12 18:59 - 2015-04-12 18:59 - 00015327 _____ () C:\Users\richard\Desktop\LM.bat
2015-04-12 18:57 - 2015-04-12 18:57 - 02096640 _____ (Farbar) C:\Users\richard\Desktop\FRST64.exe
2015-04-12 18:56 - 2015-04-15 11:29 - 00000000 ____D () C:\FRST
2015-04-12 18:55 - 2015-04-12 18:55 - 00017669 _____ () C:\Users\richard\Desktop\82.htm
2015-04-12 18:53 - 2015-04-12 18:54 - 00024943 _____ () C:\Users\richard\Desktop\FRST.htm
2015-04-12 14:42 - 2015-04-15 07:51 - 00000020 _____ () C:\Users\richard\AppData\Roaming\appdataFr3.bin
2015-04-12 14:41 - 2015-04-12 14:41 - 00000000 ____D () C:\Users\richard\AppData\Local\VirtualStore
2015-04-12 14:41 - 2015-04-12 14:41 - 00000000 ____D () C:\Users\richard\AppData\Local\Packages
2015-04-12 14:20 - 2015-04-12 14:20 - 00011096 _____ () C:\Users\richard\Documents\INLAJNY-ČECHIE.xlsx
2015-04-12 14:19 - 2015-04-12 14:19 - 01305600 _____ () C:\Users\richard\Desktop\zoek.exe
2015-04-12 13:53 - 2015-04-12 13:53 - 00003810 _____ () C:\Users\richard\Downloads\google (2).csv
2015-04-10 06:57 - 2015-04-10 06:57 - 00000000 ____D () C:\Users\Default\AppData\Local\Garmin_Ltd._or_its_subsid
2015-04-10 06:57 - 2015-04-10 06:57 - 00000000 ____D () C:\Users\Default User\AppData\Local\Garmin_Ltd._or_its_subsid
2015-04-10 06:56 - 2015-04-10 06:56 - 00001901 _____ () C:\Users\Public\Desktop\Garmin Express.lnk
2015-04-10 06:56 - 2015-04-10 06:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2015-04-08 17:24 - 2015-04-08 17:24 - 00031232 _____ () C:\Users\richard\Downloads\narezove plany uprava 6.12.2013.xls
2015-04-08 15:28 - 2015-04-08 15:28 - 00000000 ____D () C:\ProgramData\{a1c70233-e3f6-14c3-a1c7-70233e3f08cf}
2015-04-07 06:21 - 2015-04-07 06:21 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-07 06:21 - 2015-04-07 06:21 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-06 20:25 - 2015-04-06 21:58 - 00000000 ____D () C:\Windows\SvcFiles
2015-04-06 20:25 - 2015-04-06 20:39 - 00000000 ____D () C:\Windows\sdmf
2015-04-06 19:46 - 2015-04-06 19:46 - 02030237 _____ () C:\Users\richard\Downloads\kuska_install.zip
2015-04-06 19:02 - 2015-04-06 19:02 - 00017359 _____ () C:\Users\richard\Downloads\detailBill_776664022 (3).csv
2015-04-06 19:01 - 2015-04-06 19:01 - 00017359 _____ () C:\Users\richard\Downloads\detailBill_776664022 (2).csv
2015-04-06 13:16 - 2015-04-06 13:16 - 00002804 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-04-06 13:16 - 2015-04-06 13:16 - 00000833 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-04-06 13:16 - 2015-04-06 13:16 - 00000000 ____D () C:\Program Files\CCleaner
2015-04-03 07:10 - 2015-04-03 07:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Apps Sync
2015-03-31 16:17 - 2015-03-31 16:17 - 00001438 _____ () C:\Users\richard\Downloads\DPFDP5-0073595012-20150331-161646-pracovni.xml
2015-03-30 14:55 - 2015-03-30 14:55 - 00206341 _____ () C:\Users\richard\Downloads\led2015_14_130.htm
2015-03-25 14:21 - 2015-03-25 14:21 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-03-25 14:21 - 2015-03-25 14:21 - 00000000 ____D () C:\ProgramData\Oracle
2015-03-25 14:21 - 2015-03-25 14:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-03-25 13:59 - 2015-03-25 13:59 - 00000000 ____D () C:\Windows\SysWOW64\X86
2015-03-25 13:59 - 2015-03-25 13:59 - 00000000 ____D () C:\Windows\SysWOW64\AMD64
2015-03-25 08:49 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 08:49 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 08:49 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 08:49 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 08:49 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 08:49 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 08:49 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 08:49 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-24 14:44 - 2015-03-24 09:53 - 00005315 _____ () C:\Users\richard\Desktop\Vyúčtování poplatků za topení.odt garzonka 2014.odt
2015-03-24 11:23 - 2015-03-24 11:23 - 03144728 _____ () C:\Users\richard\Downloads\iSignum.exe
2015-03-24 11:21 - 2015-03-24 11:21 - 00001687 _____ () C:\Users\richard\Downloads\QCA1777370.crt
2015-03-22 10:54 - 2015-03-22 10:54 - 00231407 _____ () C:\Users\richard\Downloads\led2015_13_39.htm
2015-03-22 10:54 - 2015-03-22 10:54 - 00231407 _____ () C:\Users\richard\Downloads\led2015_13_39 (1).htm
2015-03-19 09:44 - 2015-03-19 09:44 - 00246658 _____ () C:\Users\richard\Downloads\led2015_12_130 (1).htm
2015-03-17 12:31 - 2015-03-17 12:33 - 00001810 _____ () C:\Users\richard\Desktop\OrsoftCS 3.lnk
2015-03-16 17:36 - 2015-03-16 17:36 - 00000000 ____D () C:\Program Files (x86)\Microsoft ASP.NET
2015-03-16 10:50 - 2015-03-16 10:50 - 00232538 _____ () C:\Users\richard\Downloads\led2015_12_130.htm

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-15 11:25 - 2014-03-06 12:52 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2015-04-15 11:25 - 2013-06-02 12:23 - 00000000 ____D () C:\ProgramData\Validity
2015-04-15 11:25 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-15 11:24 - 2013-06-02 12:13 - 01502932 _____ () C:\Windows\WindowsUpdate.log
2015-04-15 11:21 - 2013-08-30 13:47 - 00000000 ____D () C:\Users\richard\Documents\Soubory aplikace Outlook
2015-04-15 08:04 - 2013-10-14 09:48 - 00000000 ____D () C:\Users\richard\Documents\soukrome
2015-04-15 07:45 - 2009-07-14 06:45 - 00034432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-15 07:45 - 2009-07-14 06:45 - 00034432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-15 07:03 - 2013-06-02 11:51 - 00672370 _____ () C:\Windows\system32\perfh005.dat
2015-04-15 07:03 - 2013-06-02 11:51 - 00142934 _____ () C:\Windows\system32\perfc005.dat
2015-04-15 07:03 - 2009-07-14 07:13 - 01593078 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-13 15:10 - 2013-09-12 07:04 - 00000000 ____D () C:\Users\richard\Documents\AB_HP
2015-04-13 10:30 - 2013-07-17 20:03 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-10 06:57 - 2014-08-17 14:13 - 00000000 ____D () C:\Program Files (x86)\Garmin
2015-04-10 06:56 - 2014-08-17 14:13 - 00003556 _____ () C:\Windows\System32\Tasks\GarminUpdaterTask
2015-04-10 06:56 - 2014-08-17 14:13 - 00000000 ____D () C:\ProgramData\Garmin
2015-04-08 08:33 - 2014-03-19 16:17 - 00011182 _____ () C:\Users\richard\Documents\lcioc3.xlsx
2015-04-08 07:19 - 2013-06-02 12:31 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2015-04-08 07:19 - 2013-06-01 19:42 - 00000000 ____D () C:\ProgramData\Lenovo
2015-04-08 07:18 - 2013-06-02 12:21 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2015-04-08 07:18 - 2013-06-02 12:14 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2015-04-06 18:19 - 2013-07-17 17:37 - 00002194 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-06 13:49 - 2014-02-17 16:08 - 00000000 ____D () C:\Users\richard\AppData\Roaming\FileZilla
2015-04-06 13:49 - 2013-09-01 16:51 - 00000000 ____D () C:\Users\richard\AppData\Roaming\TeamViewer
2015-04-06 13:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
2015-04-06 13:23 - 2011-02-24 19:03 - 00000000 ____D () C:\Windows\Panther
2015-03-26 04:18 - 2014-12-11 09:37 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 04:18 - 2014-05-13 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-25 14:21 - 2013-08-06 21:37 - 00000000 ____D () C:\Program Files (x86)\Java
2015-03-17 12:32 - 2013-09-18 10:59 - 00000000 ____D () C:\OrsoftCS
2015-03-17 08:04 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD

==================== Files in the root of some directories =======

2014-11-10 09:13 - 2014-11-10 16:25 - 0000665 _____ () C:\Program Files (x86)\FOXUSER.DBF
2014-11-10 09:13 - 2014-11-10 16:26 - 0000704 _____ () C:\Program Files (x86)\FOXUSER.FPT
2013-07-17 23:28 - 2013-09-03 09:36 - 0016610 _____ () C:\Users\richard\AppData\Roaming\AbsoluteReminder.xml
2015-04-12 14:42 - 2015-04-15 07:51 - 0000020 _____ () C:\Users\richard\AppData\Roaming\appdataFr3.bin
2014-04-10 15:04 - 2014-04-10 15:04 - 0038495 _____ () C:\Users\richard\AppData\Roaming\Microsoft Excel 97-2003.ADR
2014-01-14 14:48 - 2014-01-14 14:48 - 0000600 _____ () C:\Users\richard\AppData\Roaming\winscp.rnd
2014-04-25 13:40 - 2014-04-25 13:40 - 0004096 ____H () C:\Users\richard\AppData\Local\keyfile3.drm
2013-06-02 12:19 - 2013-06-02 12:19 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-09-24 14:11 - 2013-09-24 14:11 - 0000098 ____N () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

Some content of TEMP:
====================
C:\Users\richard\AppData\Local\Temp\Quarantine.exe
C:\Users\richard\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-14 07:42

==================== End Of Log ============================