VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Pomalé PC i prohlížení webu - proces winlog.exe?

https://forum.viry.cz:443/viewtopic.php?t=146304

Stránka 1 z 1

Pomalé PC i prohlížení webu - proces winlog.exe?

Napsal: 02 říj 2015 20:25
od Joke
Dobrý večer,
po delší době se na Vás opět obracím s prosbou. Poslední dobou se mi stále více zpomaluje počítač, procesor běží naplno, větráky hučí. Rovněž se mi výrazně zpomalilo procházení stránek na internetu či přehrávání videa na internetu. Dnešek jsem věnoval důkladnému vyčištění PC a aktualizaci všech důležitých programů, ale problém stále přetrvává. Všiml jsem si, že dle správce úloh mi nejvíce paměti žere proces winlog.exe
Proto se obracím na Vás, zda se mi náhodou v PC nepovaluje nějaká breberka.
Níže je log z RSIT:

Logfile of random's system information tool 1.10 (written by random/random)
Run by ROMAN at 2015-10-02 21:23:34
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 341 GB (72%) free of 477 GB
Total RAM: 6075 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 21:23:39, on 2.10.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18015)
Boot mode: Normal

Running processes:
C:\Windows\SysWOW64\rundll32.exe
C:\Users\ROMAN\AppData\Roaming\WinUpdate\g\windrv.exe
C:\Windows\SysWOW64\cmd.exe
C:\Users\ROMAN\AppData\Roaming\WinUpdate\g\winlog.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\ROMAN.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
O4 - HKCU\..\Run: [Windows Driver] "C:\Users\ROMAN\AppData\Roaming\WinUpdate\g\windrv.exe"
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Alcohol Virtual Drive Auto-mount Service (AxAutoMntSrv) - Alcohol Soft Development Team - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7837 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
winlogon.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"taskhost.exe"
C:\Windows\Explorer.EXE
"C:\Windows\system32\spool\DRIVERS\x64\3\HP1006MC.EXE" -Embedding
"c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER
"C:\Windows\SysWOW64\rundll32.exe" C:\Windows\Syswow64\CMICNFG3.dll,CMICtrlWnd
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"C:\Users\ROMAN\AppData\Roaming\WinUpdate\g\windrv.exe"
"c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe"
"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
"C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Windows\System32\cmd.exe" /c setx GPU_MAX_ALLOC_PERCENT 100 &&setx GPU_USE_SYNC_OBJECTS 1 &&C:\Users\ROMAN\AppData\Roaming\WinUpdate\g/winlog.exe -k x11mod -o x11.ltcrabbit.com:3332 -u Jimbo.worker -p 0 -I 9
\??\C:\Windows\system32\conhost.exe "10938168492133759818-1881563382-826761823664582641626366028-1212066307356639244
C:\Users\ROMAN\AppData\Roaming\WinUpdate\g/winlog.exe -k x11mod -o x11.ltcrabbit.com:3332 -u Jimbo.worker -p 0 -I 9
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM" PriorityLow
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe" 0
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="844.0.223703172\1031801138" --supports-dual-gpus=false --gpu-driver-bug-workarounds=2,20,45 --gpu-vendor-id=0x1002 --gpu-device-id=0x68b8 --gpu-driver-vendor="Advanced Micro Devices, Inc." --gpu-driver-version=15.200.1062.1004 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group14 pct:1e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/NewSuggestType_A1_Stable_R1/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/*PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledMin4/RefreshTokenDeviceId/Enabled/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/SessionRestoreBackgroundLoading/Restore/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group3/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-50-Percent/group_01/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="844.3.1984199212\709094998" --font-cache-shared-handle=3580 /prefetch:673131151
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
taskmgr.exe /3
C:\Windows\servicing\TrustedInstaller.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group14 pct:1e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/NewSuggestType_A1_Stable_R1/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/*PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledMin4/RefreshTokenDeviceId/Enabled/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/SessionRestoreBackgroundLoading/Restore/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group3/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-50-Percent/group_01/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="844.7.513261542\136772906" --font-cache-shared-handle=4032 /prefetch:673131151
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group14 pct:1e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/*NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/NewSuggestType_A1_Stable_R1/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/*PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledMin4/RefreshTokenDeviceId/Enabled/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/SessionRestoreBackgroundLoading/Restore/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group3/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-50-Percent/group_01/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="844.11.1484128291\598435011" --font-cache-shared-handle=5844 /prefetch:673131151
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528

"C:\Users\ROMAN\Downloads\RSITx64.exe"
C:\Windows\system32\wbem\wmiprvse.exe

======Scheduled tasks folder======

C:\Windows\tasks\Adobe Flash Player Updater.job - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\RegAce Scheduled Scan - ROMAN.job - C:\Program Files (x86)\RegAce System Suite\RegAce.exe SCHEDULE

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll [2015-10-02 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-10-02 172640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CmPCIaudio"=C:\Windows\syswow64\RunDll32.exe [2009-07-14 44544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-01-08 3674320]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"AlcoholAutomount"=C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2012-01-05 75624]
"Windows Driver"=C:\Users\ROMAN\AppData\Roaming\WinUpdate\g\windrv.exe [2014-06-26 6656]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19 1022152]
"StartCCC"=C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [2015-08-04 767176]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-08-04 597552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2015-10-02 20:28:59 ----A---- C:\Windows\SYSWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-10-02 20:28:59 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-10-02 20:20:03 ----D---- C:\Users\ROMAN\AppData\Roaming\Sun
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-10-02 20:10:10 ----A---- C:\Windows\system32\iernonce.dll
2015-10-02 20:10:10 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-10-02 20:10:10 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-10-02 20:10:10 ----A---- C:\Windows\system32\ie4uinit.exe
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-10-02 20:10:09 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-10-02 20:10:08 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-10-02 20:10:08 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-10-02 20:10:08 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-10-02 20:10:08 ----A---- C:\Windows\system32\urlmon.dll
2015-10-02 20:10:08 ----A---- C:\Windows\system32\iedkcs32.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\jscript.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-10-02 20:10:07 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-10-02 20:10:07 ----A---- C:\Windows\system32\msfeeds.dll
2015-10-02 20:10:07 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-10-02 20:10:07 ----A---- C:\Windows\system32\dxtrans.dll
2015-10-02 20:10:06 ----A---- C:\Windows\system32\iesetup.dll
2015-10-02 20:10:06 ----A---- C:\Windows\system32\ieapfltr.dll
2015-10-02 20:10:05 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-10-02 20:10:05 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-10-02 20:10:05 ----A---- C:\Windows\system32\vbscript.dll
2015-10-02 20:10:05 ----A---- C:\Windows\system32\iertutil.dll
2015-10-02 20:10:04 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-10-02 20:10:04 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-10-02 20:10:04 ----A---- C:\Windows\system32\jsproxy.dll
2015-10-02 20:10:04 ----A---- C:\Windows\system32\ieUnatt.exe
2015-10-02 20:10:04 ----A---- C:\Windows\system32\dxtmsft.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\mshtmled.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\ieui.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\ieframe.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\wininet.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\jscript9diag.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\jscript9.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\jscript.dll
2015-10-02 20:10:01 ----A---- C:\Windows\system32\msrating.dll
2015-10-02 20:10:01 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-10-02 20:10:01 ----A---- C:\Windows\system32\mshtml.dll
2015-10-02 20:04:28 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-10-02 20:04:27 ----A---- C:\Windows\system32\rdpudd.dll
2015-10-02 20:04:27 ----A---- C:\Windows\system32\rdpcorets.dll
2015-10-02 20:03:36 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2015-10-02 20:03:36 ----A---- C:\Windows\system32\wksprt.exe
2015-10-02 20:03:36 ----A---- C:\Windows\system32\rdvidcrl.dll
2015-10-02 20:03:36 ----A---- C:\Windows\system32\mstscax.dll
2015-10-02 20:03:35 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2015-10-02 20:03:35 ----A---- C:\Windows\SYSWOW64\rdvidcrl.dll
2015-10-02 20:03:35 ----A---- C:\Windows\system32\tsgqec.dll
2015-10-02 20:03:24 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\schannel.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\rpcrt4.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\ntoskrnl.exe
2015-10-02 20:03:24 ----A---- C:\Windows\system32\ntdll.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\lsasrv.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\kerberos.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\TSpkg.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\sysmain.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\ncrypt.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\msv1_0.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\kernel32.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\adtschema.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\wow32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\srclient.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\setup16.exe
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wow64win.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wow64cpu.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wow64.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\winsrv.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wdigest.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\sspisrv.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\sspicli.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\srcore.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\srclient.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\smss.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\secur32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\rstrui.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\ntvdm64.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\msobjs.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\msmmsp.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\msaudite.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\lsass.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\KernelBase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\drivers\mountmgr.sys
2015-10-02 20:03:22 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-10-02 20:03:22 ----A---- C:\Windows\system32\csrsrv.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\cryptbase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\credssp.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\conhost.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\auditpol.exe
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-10-02 20:03:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2015-10-02 20:03:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2015-10-02 20:03:20 ----A---- C:\Windows\system32\apisetschema.dll
2015-10-02 20:03:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2015-10-02 20:03:19 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-10-02 20:03:19 ----A---- C:\Windows\SYSWOW64\user.exe
2015-10-02 20:03:07 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2015-10-02 20:03:06 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2015-10-02 20:03:06 ----A---- C:\Windows\system32\setbcdlocale.dll
2015-10-02 20:03:06 ----A---- C:\Windows\system32\drivers\appid.sys
2015-10-02 20:03:06 ----A---- C:\Windows\system32\appidsvc.dll
2015-10-02 20:03:06 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2015-10-02 20:03:06 ----A---- C:\Windows\system32\appidapi.dll
2015-10-02 20:02:52 ----A---- C:\Windows\system32\basesrv.dll
2015-10-02 20:02:26 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2015-10-02 20:02:26 ----A---- C:\Windows\system32\FntCache.dll
2015-10-02 20:02:26 ----A---- C:\Windows\system32\DWrite.dll
2015-10-02 20:02:25 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2015-10-02 20:02:25 ----A---- C:\Windows\system32\d3d10warp.dll
2015-10-02 20:02:07 ----A---- C:\Windows\SYSWOW64\msi.dll
2015-10-02 20:02:07 ----A---- C:\Windows\system32\msi.dll
2015-10-02 20:02:07 ----A---- C:\Windows\system32\authui.dll
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\msimsg.dll
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\msiexec.exe
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\authui.dll
2015-10-02 20:02:06 ----A---- C:\Windows\system32\msimsg.dll
2015-10-02 20:02:06 ----A---- C:\Windows\system32\msihnd.dll
2015-10-02 20:02:06 ----A---- C:\Windows\system32\msiexec.exe
2015-10-02 20:02:06 ----A---- C:\Windows\system32\consent.exe
2015-10-02 20:02:06 ----A---- C:\Windows\system32\appinfo.dll
2015-10-02 20:02:00 ----A---- C:\Windows\SYSWOW64\InkEd.dll
2015-10-02 20:02:00 ----A---- C:\Windows\system32\jnwmon.dll
2015-10-02 20:02:00 ----A---- C:\Windows\system32\InkEd.dll
2015-10-02 20:01:57 ----A---- C:\Windows\SYSWOW64\ole32.dll
2015-10-02 20:01:57 ----A---- C:\Windows\system32\ole32.dll
2015-10-02 20:01:56 ----A---- C:\Windows\system32\schedsvc.dll
2015-10-02 20:01:54 ----A---- C:\Windows\SYSWOW64\comctl32.dll
2015-10-02 20:01:54 ----A---- C:\Windows\system32\comctl32.dll
2015-10-02 20:01:52 ----A---- C:\Windows\SYSWOW64\WebClnt.dll
2015-10-02 20:01:52 ----A---- C:\Windows\SYSWOW64\davclnt.dll
2015-10-02 20:01:52 ----A---- C:\Windows\system32\WebClnt.dll
2015-10-02 20:01:52 ----A---- C:\Windows\system32\davclnt.dll
2015-10-02 20:01:50 ----A---- C:\Windows\SYSWOW64\cewmdm.dll
2015-10-02 20:01:50 ----A---- C:\Windows\system32\cewmdm.dll
2015-10-02 20:01:48 ----A---- C:\Windows\SYSWOW64\tzres.dll
2015-10-02 20:01:48 ----A---- C:\Windows\system32\tzres.dll
2015-10-02 20:01:29 ----A---- C:\Windows\system32\shell32.dll
2015-10-02 20:01:28 ----A---- C:\Windows\SYSWOW64\shell32.dll
2015-10-02 20:01:22 ----A---- C:\Windows\SYSWOW64\msxml6.dll
2015-10-02 20:01:22 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2015-10-02 20:01:22 ----A---- C:\Windows\system32\msxml6.dll
2015-10-02 20:01:22 ----A---- C:\Windows\system32\msxml3.dll
2015-10-02 20:01:21 ----A---- C:\Windows\SYSWOW64\msxml6r.dll
2015-10-02 20:01:21 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2015-10-02 20:01:21 ----A---- C:\Windows\system32\msxml6r.dll
2015-10-02 20:01:21 ----A---- C:\Windows\system32\msxml3r.dll
2015-10-02 20:01:20 ----A---- C:\Windows\system32\wmp.dll
2015-10-02 20:01:19 ----A---- C:\Windows\SYSWOW64\wmp.dll
2015-10-02 20:01:18 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2015-10-02 20:01:18 ----A---- C:\Windows\SYSWOW64\spwmp.dll
2015-10-02 20:01:18 ----A---- C:\Windows\SYSWOW64\dxmasf.dll
2015-10-02 20:01:18 ----A---- C:\Windows\system32\spwmp.dll
2015-10-02 20:01:18 ----A---- C:\Windows\system32\dxmasf.dll
2015-10-02 20:01:17 ----A---- C:\Windows\system32\wmploc.DLL
2015-10-02 20:01:17 ----A---- C:\Windows\system32\TSWbPrxy.exe
2015-10-02 20:00:19 ----A---- C:\Windows\SYSWOW64\notepad.exe
2015-10-02 20:00:19 ----A---- C:\Windows\system32\notepad.exe
2015-10-02 20:00:19 ----A---- C:\Windows\system32\gdi32.dll
2015-10-02 20:00:19 ----A---- C:\Windows\notepad.exe
2015-10-02 20:00:18 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\lpk.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\win32k.sys
2015-10-02 19:54:07 ----A---- C:\Windows\system32\lpk.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\fontsub.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\dciman32.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\atmlib.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\atmfd.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wups.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuwebv.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wups2.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wups.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wudriver.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wucltux.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuaueng.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuauclt.exe
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuapp.exe
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuapi.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\WinSetupUI.dll
2015-10-02 19:43:00 ----D---- C:\ProgramData\ATI
2015-09-24 16:15:32 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe

======List of files/folders modified in the last 1 month======

2015-10-02 21:23:38 ----D---- C:\Windows\temp
2015-10-02 21:23:38 ----D---- C:\Program Files\trend micro
2015-10-02 21:10:38 ----D---- C:\Windows\Microsoft.NET
2015-10-02 21:10:37 ----RSD---- C:\Windows\assembly
2015-10-02 21:09:48 ----D---- C:\Windows\system32\config
2015-10-02 20:53:43 ----D---- C:\Windows\winsxs
2015-10-02 20:52:16 ----D---- C:\Windows\SysWOW64
2015-10-02 20:52:16 ----D---- C:\Windows\System32
2015-10-02 20:52:16 ----D---- C:\Config.Msi
2015-10-02 20:47:12 ----D---- C:\Windows\system32\catroot
2015-10-02 20:46:37 ----D---- C:\Program Files\Windows Media Player
2015-10-02 20:46:37 ----D---- C:\Program Files\Windows Journal
2015-10-02 20:46:37 ----D---- C:\Program Files (x86)\Windows Media Player
2015-10-02 20:46:36 ----D---- C:\Windows\SYSWOW64\cs-CZ
2015-10-02 20:46:36 ----D---- C:\Windows\system32\drivers\cs-CZ
2015-10-02 20:46:36 ----D---- C:\Windows\system32\cs-CZ
2015-10-02 20:46:35 ----D---- C:\Windows\system32\drivers
2015-10-02 20:46:35 ----D---- C:\Windows\ehome
2015-10-02 20:46:35 ----D---- C:\Windows\AppPatch
2015-10-02 20:46:30 ----D---- C:\Program Files\Internet Explorer
2015-10-02 20:46:29 ----D---- C:\Windows\SYSWOW64\en-US
2015-10-02 20:46:29 ----D---- C:\Windows\system32\en-US
2015-10-02 20:46:29 ----D---- C:\Windows\PolicyDefinitions
2015-10-02 20:46:29 ----D---- C:\Program Files (x86)\Internet Explorer
2015-10-02 20:46:28 ----D---- C:\Windows
2015-10-02 20:46:27 ----D---- C:\Windows\system32\Boot
2015-10-02 20:36:44 ----SHD---- C:\System Volume Information
2015-10-02 20:32:09 ----SHD---- C:\Windows\Installer
2015-10-02 20:27:37 ----D---- C:\Windows\system32\MRT
2015-10-02 20:20:52 ----D---- C:\Program Files (x86)\Java
2015-10-02 20:20:28 ----D---- C:\Program Files (x86)\Common Files
2015-10-02 20:19:47 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2015-10-02 20:12:57 ----D---- C:\Program Files (x86)\FastShare
2015-10-02 20:01:39 ----D---- C:\Windows\system32\catroot2
2015-10-02 19:45:49 ----RD---- C:\Program Files (x86)
2015-10-02 19:45:11 ----D---- C:\Program Files (x86)\Raptr
2015-10-02 19:43:00 ----D---- C:\ProgramData
2015-10-02 19:34:45 ----D---- C:\Windows\inf
2015-10-02 19:34:44 ----D---- C:\Windows\system32\DriverStore
2015-10-02 19:32:41 ----D---- C:\Program Files\AMD
2015-10-02 19:30:56 ----D---- C:\AMD
2015-10-02 19:14:25 ----D---- C:\Users\ROMAN\AppData\Roaming\Skype
2015-10-02 19:14:21 ----D---- C:\ProgramData\Skype
2015-10-02 19:09:23 ----D---- C:\Users\ROMAN\AppData\Roaming\IrfanView
2015-10-02 19:08:47 ----D---- C:\Program Files (x86)\GRETECH
2015-10-02 19:08:18 ----RD---- C:\Program Files
2015-10-02 18:53:24 ----D---- C:\Windows\Prefetch
2015-10-02 17:10:21 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-09-24 16:15:39 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe
2015-09-18 17:04:44 ----D---- C:\Windows\Tasks

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2013-08-20 564824]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-03-10 283200]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2015-08-04 21622784]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2015-08-04 665088]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2015-07-15 96256]
R3 cmuda3;C-Media PCI Audio Interface; C:\Windows\system32\drivers\cmudax3.sys [2009-12-01 1155072]
R3 e1express;Intel(R) PRO/1000 – ovladač PCI Express síťového připojení; C:\Windows\system32\DRIVERS\e1e6032e.sys [2009-06-10 278016]
R3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2009-09-18 70168]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2015-04-14 25816]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2013-12-22 82816]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-14 38400]
S3 ann0g3ml;ann0g3ml; C:\Windows\system32\drivers\ann0g3ml.sys []
S3 ap6wczlo;ap6wczlo; C:\Windows\system32\drivers\ap6wczlo.sys []
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2015-04-14 63704]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-09-23 65192]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2015-08-04 246784]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 MSSQLSERVER;SQL Server (MSSQLSERVER); c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [2012-12-29 160768]
R2 SQLBrowser;SQL Server Browser; c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2012-02-11 269912]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2012-10-20 130024]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2012-01-05 75624]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2015-04-14 1080120]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-24 269000]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-08-15 114688]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-03-11 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 SQLSERVERAGENT;SQL Server Agent (MSSQLSERVER); c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [2012-12-29 448488]

-----------------EOF-----------------

Předem děkuji.

Re: Pomalé PC i prohlížení webu - proces winlog.exe?

Napsal: 02 říj 2015 20:35
od Rudy
Zdravím!
Spusťte tuto utilitu:
Stáhněte AdwCleaner http://general-changelog-team.fr/fr/dow ... adwcleaner
Uložte na plochu
Ukončete všechny programy
Klikněte nejprve na >Scan< a pak na >Clean<.
Proběhne skenováni a pak se objeví log, který sem vložte.

Re: Pomalé PC i prohlížení webu - proces winlog.exe?

Napsal: 02 říj 2015 20:45
od Joke
# AdwCleaner v5.009 - Logfile created 02/10/2015 at 21:42:02
# Updated 27/09/2015 by Xplode
# Database : 2015-09-30.1 [Server]
# Operating system : Windows 7 Ultimate Service Pack 1 (x64)
# Username : ROMAN - ROMAN-PC
# Running from : C:\Users\ROMAN\Desktop\adwcleaner_5.009.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\SimilarSites
[-] Folder Deleted : C:\Users\ROMAN\AppData\Roaming\SimilarSites

***** [ Files ] *****

[-] File Deleted : C:\Windows\Sysnative\roboot64.exe

***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****

[-] Task Deleted : Adobe Flash Player Updater

***** [ Registry ] *****

[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{FE69C007-C452-4D3E-86D2-1730DF8BC871}]
[-] Key Deleted : HKCU\Software\APN PIP
[-] Key Deleted : HKCU\Software\InstallCore
[-] Key Deleted : HKCU\Software\PIP
[-] Key Deleted : HKLM\SOFTWARE\Description
[-] Key Deleted : HKLM\SOFTWARE\PIP
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00B2-0405-0000-0000000FF1CE}
[!] Key Not Deleted : [x64] HKCU\Software\APN PIP
[!] Key Not Deleted : [x64] HKCU\Software\InstallCore
[!] Key Not Deleted : [x64] HKCU\Software\PIP

***** [ Web browsers ] *****


*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1437 bytes] ##########

Re: Pomalé PC i prohlížení webu - proces winlog.exe?

Napsal: 02 říj 2015 21:38
od Rudy
Dejte nový log RSIT.

Re: Pomalé PC i prohlížení webu - proces winlog.exe?

Napsal: 02 říj 2015 21:47
od Joke
Logfile of random's system information tool 1.10 (written by random/random)
Run by ROMAN at 2015-10-02 22:46:48
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 328 GB (69%) free of 477 GB
Total RAM: 6075 MB (76% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:46:49, on 2.10.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18015)
Boot mode: Normal

Running processes:
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\ROMAN.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
O4 - HKCU\..\Run: [Windows Driver] "C:\Users\ROMAN\AppData\Roaming\WinUpdate\g\windrv.exe"
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Alcohol Virtual Drive Auto-mount Service (AxAutoMntSrv) - Alcohol Soft Development Team - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7637 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
C:\Windows\system32\services.exe
winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
atieclxx
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Explorer.EXE
"C:\Windows\system32\spool\DRIVERS\x64\3\HP1006MC.EXE" -Embedding
"c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER
"C:\Windows\SysWOW64\rundll32.exe" C:\Windows\Syswow64\CMICNFG3.dll,CMICtrlWnd
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe"
"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
"C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM" PriorityLow
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --channel="3188.0.1044933328\844050863" --supports-dual-gpus=false --gpu-driver-bug-workarounds=2,20,45 --gpu-vendor-id=0x1002 --gpu-device-id=0x68b8 --gpu-driver-vendor="Advanced Micro Devices, Inc." --gpu-driver-version=15.200.1062.1004 --ignored=" --type=renderer " /prefetch:822062411
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group14 pct:1e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/NewSuggestType_A1_Stable_R1/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledNoIdForLargePopulation/RefreshTokenDeviceId/Enabled/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/SessionRestoreBackgroundLoading/Restore/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group3/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-50-Percent/group_01/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="3188.2.636085869\1143125797" --font-cache-shared-handle=3304 /prefetch:673131151
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group14 pct:1e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/*IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/NewSuggestType_A1_Stable_R1/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/*PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledNoIdForLargePopulation/RefreshTokenDeviceId/Enabled/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/SessionRestoreBackgroundLoading/Restore/*SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group3/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-50-Percent/group_01/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --channel="3188.6.699169546\113533218" --font-cache-shared-handle=4020 /prefetch:673131151

"taskhost.exe"
C:\Windows\system32\wbem\wmiprvse.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe9_ Global\UsGthrCtrlFltPipeMssGthrPipe9 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
"C:\Users\ROMAN\Downloads\RSITx64.exe"

======Scheduled tasks folder======

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
C:\Windows\tasks\RegAce Scheduled Scan - ROMAN.job - C:\Program Files (x86)\RegAce System Suite\RegAce.exe SCHEDULE

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll [2015-10-02 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-10-02 172640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CmPCIaudio"=C:\Windows\syswow64\RunDll32.exe [2009-07-14 44544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-01-08 3674320]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"AlcoholAutomount"=C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2012-01-05 75624]
"Windows Driver"=C:\Users\ROMAN\AppData\Roaming\WinUpdate\g\windrv.exe [2014-06-26 6656]

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19 1022152]
"StartCCC"=C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [2015-08-04 767176]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-08-04 597552]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2015-10-02 22:46:33 ----SD---- C:\ComboFix
2015-10-02 21:40:23 ----D---- C:\AdwCleaner
2015-10-02 20:28:59 ----A---- C:\Windows\SYSWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-10-02 20:28:59 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-10-02 20:20:03 ----D---- C:\Users\ROMAN\AppData\Roaming\Sun
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-10-02 20:10:10 ----A---- C:\Windows\system32\iernonce.dll
2015-10-02 20:10:10 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-10-02 20:10:10 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-10-02 20:10:10 ----A---- C:\Windows\system32\ie4uinit.exe
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-10-02 20:10:09 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-10-02 20:10:08 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-10-02 20:10:08 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-10-02 20:10:08 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-10-02 20:10:08 ----A---- C:\Windows\system32\urlmon.dll
2015-10-02 20:10:08 ----A---- C:\Windows\system32\iedkcs32.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\jscript.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-10-02 20:10:07 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-10-02 20:10:07 ----A---- C:\Windows\system32\msfeeds.dll
2015-10-02 20:10:07 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-10-02 20:10:07 ----A---- C:\Windows\system32\dxtrans.dll
2015-10-02 20:10:06 ----A---- C:\Windows\system32\iesetup.dll
2015-10-02 20:10:06 ----A---- C:\Windows\system32\ieapfltr.dll
2015-10-02 20:10:05 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-10-02 20:10:05 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-10-02 20:10:05 ----A---- C:\Windows\system32\vbscript.dll
2015-10-02 20:10:05 ----A---- C:\Windows\system32\iertutil.dll
2015-10-02 20:10:04 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-10-02 20:10:04 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-10-02 20:10:04 ----A---- C:\Windows\system32\jsproxy.dll
2015-10-02 20:10:04 ----A---- C:\Windows\system32\ieUnatt.exe
2015-10-02 20:10:04 ----A---- C:\Windows\system32\dxtmsft.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\mshtmled.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\ieui.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\ieframe.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\wininet.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\jscript9diag.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\jscript9.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\jscript.dll
2015-10-02 20:10:01 ----A---- C:\Windows\system32\msrating.dll
2015-10-02 20:10:01 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-10-02 20:10:01 ----A---- C:\Windows\system32\mshtml.dll
2015-10-02 20:04:28 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-10-02 20:04:27 ----A---- C:\Windows\system32\rdpudd.dll
2015-10-02 20:04:27 ----A---- C:\Windows\system32\rdpcorets.dll
2015-10-02 20:03:36 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2015-10-02 20:03:36 ----A---- C:\Windows\system32\wksprt.exe
2015-10-02 20:03:36 ----A---- C:\Windows\system32\rdvidcrl.dll
2015-10-02 20:03:36 ----A---- C:\Windows\system32\mstscax.dll
2015-10-02 20:03:35 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2015-10-02 20:03:35 ----A---- C:\Windows\SYSWOW64\rdvidcrl.dll
2015-10-02 20:03:35 ----A---- C:\Windows\system32\tsgqec.dll
2015-10-02 20:03:24 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\schannel.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\rpcrt4.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\ntoskrnl.exe
2015-10-02 20:03:24 ----A---- C:\Windows\system32\ntdll.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\lsasrv.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\kerberos.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\TSpkg.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\sysmain.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\ncrypt.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\msv1_0.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\kernel32.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\adtschema.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\wow32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\srclient.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\setup16.exe
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wow64win.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wow64cpu.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wow64.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\winsrv.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wdigest.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\sspisrv.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\sspicli.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\srcore.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\srclient.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\smss.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\secur32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\rstrui.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\ntvdm64.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\msobjs.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\msmmsp.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\msaudite.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\lsass.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\KernelBase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\drivers\mountmgr.sys
2015-10-02 20:03:22 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-10-02 20:03:22 ----A---- C:\Windows\system32\csrsrv.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\cryptbase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\credssp.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\conhost.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\auditpol.exe
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-10-02 20:03:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2015-10-02 20:03:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2015-10-02 20:03:20 ----A---- C:\Windows\system32\apisetschema.dll
2015-10-02 20:03:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2015-10-02 20:03:19 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-10-02 20:03:19 ----A---- C:\Windows\SYSWOW64\user.exe
2015-10-02 20:03:07 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2015-10-02 20:03:06 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2015-10-02 20:03:06 ----A---- C:\Windows\system32\setbcdlocale.dll
2015-10-02 20:03:06 ----A---- C:\Windows\system32\drivers\appid.sys
2015-10-02 20:03:06 ----A---- C:\Windows\system32\appidsvc.dll
2015-10-02 20:03:06 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2015-10-02 20:03:06 ----A---- C:\Windows\system32\appidapi.dll
2015-10-02 20:02:52 ----A---- C:\Windows\system32\basesrv.dll
2015-10-02 20:02:26 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2015-10-02 20:02:26 ----A---- C:\Windows\system32\FntCache.dll
2015-10-02 20:02:26 ----A---- C:\Windows\system32\DWrite.dll
2015-10-02 20:02:25 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2015-10-02 20:02:25 ----A---- C:\Windows\system32\d3d10warp.dll
2015-10-02 20:02:07 ----A---- C:\Windows\SYSWOW64\msi.dll
2015-10-02 20:02:07 ----A---- C:\Windows\system32\msi.dll
2015-10-02 20:02:07 ----A---- C:\Windows\system32\authui.dll
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\msimsg.dll
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\msiexec.exe
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\authui.dll
2015-10-02 20:02:06 ----A---- C:\Windows\system32\msimsg.dll
2015-10-02 20:02:06 ----A---- C:\Windows\system32\msihnd.dll
2015-10-02 20:02:06 ----A---- C:\Windows\system32\msiexec.exe
2015-10-02 20:02:06 ----A---- C:\Windows\system32\consent.exe
2015-10-02 20:02:06 ----A---- C:\Windows\system32\appinfo.dll
2015-10-02 20:02:00 ----A---- C:\Windows\SYSWOW64\InkEd.dll
2015-10-02 20:02:00 ----A---- C:\Windows\system32\jnwmon.dll
2015-10-02 20:02:00 ----A---- C:\Windows\system32\InkEd.dll
2015-10-02 20:01:57 ----A---- C:\Windows\SYSWOW64\ole32.dll
2015-10-02 20:01:57 ----A---- C:\Windows\system32\ole32.dll
2015-10-02 20:01:56 ----A---- C:\Windows\system32\schedsvc.dll
2015-10-02 20:01:54 ----A---- C:\Windows\SYSWOW64\comctl32.dll
2015-10-02 20:01:54 ----A---- C:\Windows\system32\comctl32.dll
2015-10-02 20:01:52 ----A---- C:\Windows\SYSWOW64\WebClnt.dll
2015-10-02 20:01:52 ----A---- C:\Windows\SYSWOW64\davclnt.dll
2015-10-02 20:01:52 ----A---- C:\Windows\system32\WebClnt.dll
2015-10-02 20:01:52 ----A---- C:\Windows\system32\davclnt.dll
2015-10-02 20:01:50 ----A---- C:\Windows\SYSWOW64\cewmdm.dll
2015-10-02 20:01:50 ----A---- C:\Windows\system32\cewmdm.dll
2015-10-02 20:01:48 ----A---- C:\Windows\SYSWOW64\tzres.dll
2015-10-02 20:01:48 ----A---- C:\Windows\system32\tzres.dll
2015-10-02 20:01:29 ----A---- C:\Windows\system32\shell32.dll
2015-10-02 20:01:28 ----A---- C:\Windows\SYSWOW64\shell32.dll
2015-10-02 20:01:22 ----A---- C:\Windows\SYSWOW64\msxml6.dll
2015-10-02 20:01:22 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2015-10-02 20:01:22 ----A---- C:\Windows\system32\msxml6.dll
2015-10-02 20:01:22 ----A---- C:\Windows\system32\msxml3.dll
2015-10-02 20:01:21 ----A---- C:\Windows\SYSWOW64\msxml6r.dll
2015-10-02 20:01:21 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2015-10-02 20:01:21 ----A---- C:\Windows\system32\msxml6r.dll
2015-10-02 20:01:21 ----A---- C:\Windows\system32\msxml3r.dll
2015-10-02 20:01:20 ----A---- C:\Windows\system32\wmp.dll
2015-10-02 20:01:19 ----A---- C:\Windows\SYSWOW64\wmp.dll
2015-10-02 20:01:18 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2015-10-02 20:01:18 ----A---- C:\Windows\SYSWOW64\spwmp.dll
2015-10-02 20:01:18 ----A---- C:\Windows\SYSWOW64\dxmasf.dll
2015-10-02 20:01:18 ----A---- C:\Windows\system32\spwmp.dll
2015-10-02 20:01:18 ----A---- C:\Windows\system32\dxmasf.dll
2015-10-02 20:01:17 ----A---- C:\Windows\system32\wmploc.DLL
2015-10-02 20:01:17 ----A---- C:\Windows\system32\TSWbPrxy.exe
2015-10-02 20:00:19 ----A---- C:\Windows\SYSWOW64\notepad.exe
2015-10-02 20:00:19 ----A---- C:\Windows\system32\notepad.exe
2015-10-02 20:00:19 ----A---- C:\Windows\system32\gdi32.dll
2015-10-02 20:00:19 ----A---- C:\Windows\notepad.exe
2015-10-02 20:00:18 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\lpk.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\win32k.sys
2015-10-02 19:54:07 ----A---- C:\Windows\system32\lpk.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\fontsub.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\dciman32.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\atmlib.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\atmfd.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wups.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuwebv.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wups2.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wups.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wudriver.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wucltux.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuaueng.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuauclt.exe
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuapp.exe
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuapi.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\WinSetupUI.dll
2015-10-02 19:43:00 ----D---- C:\ProgramData\ATI
2015-09-24 16:15:32 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe

======List of files/folders modified in the last 1 month======

2015-10-02 22:46:48 ----D---- C:\Windows\temp
2015-10-02 22:46:48 ----D---- C:\Program Files\trend micro
2015-10-02 22:46:37 ----D---- C:\Qoobox
2015-10-02 22:46:31 ----D---- C:\Windows\system32\drivers
2015-10-02 22:46:07 ----D---- C:\ProgramData\Origin
2015-10-02 22:10:17 ----D---- C:\ProgramData\Electronic Arts
2015-10-02 22:10:01 ----D---- C:\Program Files (x86)\Origin
2015-10-02 21:42:31 ----D---- C:\Windows\system32\config
2015-10-02 21:42:03 ----D---- C:\Windows\Tasks
2015-10-02 21:42:03 ----D---- C:\Windows\system32\Tasks
2015-10-02 21:42:02 ----RD---- C:\Program Files (x86)
2015-10-02 21:42:02 ----D---- C:\Windows\System32
2015-10-02 21:10:38 ----D---- C:\Windows\Microsoft.NET
2015-10-02 21:10:37 ----RSD---- C:\Windows\assembly
2015-10-02 20:53:43 ----D---- C:\Windows\winsxs
2015-10-02 20:52:16 ----D---- C:\Windows\SysWOW64
2015-10-02 20:52:16 ----D---- C:\Config.Msi
2015-10-02 20:47:12 ----D---- C:\Windows\system32\catroot
2015-10-02 20:46:37 ----D---- C:\Program Files\Windows Media Player
2015-10-02 20:46:37 ----D---- C:\Program Files\Windows Journal
2015-10-02 20:46:37 ----D---- C:\Program Files (x86)\Windows Media Player
2015-10-02 20:46:36 ----D---- C:\Windows\SYSWOW64\cs-CZ
2015-10-02 20:46:36 ----D---- C:\Windows\system32\drivers\cs-CZ
2015-10-02 20:46:36 ----D---- C:\Windows\system32\cs-CZ
2015-10-02 20:46:35 ----D---- C:\Windows\ehome
2015-10-02 20:46:35 ----D---- C:\Windows\AppPatch
2015-10-02 20:46:30 ----D---- C:\Program Files\Internet Explorer
2015-10-02 20:46:29 ----D---- C:\Windows\SYSWOW64\en-US
2015-10-02 20:46:29 ----D---- C:\Windows\system32\en-US
2015-10-02 20:46:29 ----D---- C:\Windows\PolicyDefinitions
2015-10-02 20:46:29 ----D---- C:\Program Files (x86)\Internet Explorer
2015-10-02 20:46:28 ----D---- C:\Windows
2015-10-02 20:46:27 ----D---- C:\Windows\system32\Boot
2015-10-02 20:36:44 ----SHD---- C:\System Volume Information
2015-10-02 20:32:09 ----SHD---- C:\Windows\Installer
2015-10-02 20:27:37 ----D---- C:\Windows\system32\MRT
2015-10-02 20:20:52 ----D---- C:\Program Files (x86)\Java
2015-10-02 20:20:28 ----D---- C:\Program Files (x86)\Common Files
2015-10-02 20:19:47 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2015-10-02 20:12:57 ----D---- C:\Program Files (x86)\FastShare
2015-10-02 20:01:39 ----D---- C:\Windows\system32\catroot2
2015-10-02 19:45:11 ----D---- C:\Program Files (x86)\Raptr
2015-10-02 19:43:00 ----D---- C:\ProgramData
2015-10-02 19:34:45 ----D---- C:\Windows\inf
2015-10-02 19:34:44 ----D---- C:\Windows\system32\DriverStore
2015-10-02 19:32:41 ----D---- C:\Program Files\AMD
2015-10-02 19:30:56 ----D---- C:\AMD
2015-10-02 19:14:28 ----D---- C:\ProgramData\Skype
2015-10-02 19:14:25 ----D---- C:\Users\ROMAN\AppData\Roaming\Skype
2015-10-02 19:09:23 ----D---- C:\Users\ROMAN\AppData\Roaming\IrfanView
2015-10-02 19:08:47 ----D---- C:\Program Files (x86)\GRETECH
2015-10-02 19:08:18 ----RD---- C:\Program Files
2015-10-02 18:53:24 ----D---- C:\Windows\Prefetch
2015-10-02 17:10:21 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-09-24 16:15:39 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2013-08-20 564824]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-03-10 283200]
R3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2015-08-04 21622784]
R3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2015-08-04 665088]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2015-07-15 96256]
R3 cmuda3;C-Media PCI Audio Interface; C:\Windows\system32\drivers\cmudax3.sys [2009-12-01 1155072]
R3 e1express;Intel(R) PRO/1000 – ovladač PCI Express síťového připojení; C:\Windows\system32\DRIVERS\e1e6032e.sys [2009-06-10 278016]
R3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2009-09-18 70168]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2015-04-14 25816]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2013-12-22 82816]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-14 38400]
S3 adnl5ndc;adnl5ndc; C:\Windows\system32\drivers\adnl5ndc.sys []
S3 anjeq96k;anjeq96k; C:\Windows\system32\drivers\anjeq96k.sys []
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2015-04-14 63704]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-09-23 65192]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2015-08-04 246784]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 MSSQLSERVER;SQL Server (MSSQLSERVER); c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [2012-12-29 160768]
R2 SQLBrowser;SQL Server Browser; c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2012-02-11 269912]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2012-10-20 130024]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2012-01-05 75624]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2015-04-14 1080120]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-24 269000]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-08-15 114688]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-03-11 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 SQLSERVERAGENT;SQL Server Agent (MSSQLSERVER); c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [2012-12-29 448488]

-----------------EOF-----------------

Re: Pomalé PC i prohlížení webu - proces winlog.exe?

Napsal: 03 říj 2015 10:39
od Rudy
Stáhněte OTM: http://oldtimer.geekstogo.com/OTM.exe a uložte na plochu. Spusťte a do levého okna zkopírujte:
:files
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Users\ROMAN\AppData\Roaming\WinUpdate\g

:reg
[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=-

:commands
[Purity]
[Emptytemp]
[Emptyflash]
a klikněte na >MoveIt!<. Po skenu restartujte PC a dejte nový log RSIT.

Re: Pomalé PC i prohlížení webu - proces winlog.exe?

Napsal: 03 říj 2015 16:48
od Joke
Logfile of random's system information tool 1.10 (written by random/random)
Run by ROMAN at 2015-10-03 17:47:26
Microsoft Windows 7 Ultimate Service Pack 1
System drive C: has 364 GB (76%) free of 477 GB
Total RAM: 2002 MB (49% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:47:36, on 3.10.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18015)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files\trend micro\ROMAN.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount
O4 - HKCU\..\Run: [Windows Driver] "C:\Users\ROMAN\AppData\Roaming\WinUpdate\g\windrv.exe"
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Odeslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Od&eslat do aplikace OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Alcohol Virtual Drive Auto-mount Service (AxAutoMntSrv) - Alcohol Soft Development Team - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Služba Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Služba Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7308 bytes

======Listing Processes======



\SystemRoot\System32\smss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
wininit.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
atieclxx
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
C:\Windows\System32\svchost.exe -k utcsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
"taskhost.exe"
"C:\Windows\system32\Dwm.exe"
C:\Windows\Explorer.EXE
taskeng.exe {B1C7B971-C98A-481F-B2B9-60102AA0CD1E}
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /c
"c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER
"C:\Windows\system32\spool\DRIVERS\x64\3\HP1006MC.EXE" -Embedding
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
"c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe"
"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
"C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe"
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k secsvcs
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM" PriorityLow
"C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe" 0
C:\Windows\system32\SearchIndexer.exe /Embedding
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3282807805-2806067595-984373187-10011_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3282807805-2806067595-984373187-10011 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
"C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\sppsvc.exe
"C:\Users\ROMAN\Desktop\RSITx64.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=cs --force-fieldtrials="AffiliationBasedMatching/Enabled/AudioProcessing48kHzSupport/Default/CaptivePortalInterstitial/Enabled/ChildAccountDetection/Disabled/ChromeDashboard/Default/*ClientSideDetectionModel/Model0/*DomRel-Enable/enable/*EmbeddedSearch/Group14 pct:1e stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/EnableSessionCrashedBubbleUI/Enabled/*EnhancedBookmarks/Default/*ExtensionContentVerification/Enforce/ExtensionDeveloperModeWarning/Enabled/*ExtensionInstallVerification/Enforce/*GoogleNow/Enable/*IconNTP/Default/InstanceID/Enabled/IntelligentSessionRestore/Disabled/*NetworkQualityEstimator/Enabled/*NewProfileManagement/Enabled/NewVideoRendererTrial/Enabled/*OmniboxBundledExperimentV1/NewSuggestType_A1_Stable_R1/*PasswordGeneration/Disabled/PasswordLinkInSettings/Enabled/*PluginPowerSaver/Enabled/PrerenderFromOmnibox/OmniboxPrerenderEnabled/*QUIC/EnabledNoId/RefreshTokenDeviceId/Enabled/ReportCertificateErrors/ShowAndPossiblySend/SHA1IdentityUIWarning/Enabled/SHA1ToolbarUIJanuary2016/Warning/SHA1ToolbarUIJanuary2017/Error/*SRTPromptFieldTrial/On/*SafeBrowsingIncidentReportingService/Default/SafeBrowsingSocialEngineeringStrings/Disabled/SessionRestoreBackgroundLoading/Restore/SlimmingPaint/EnableSlimmingPaint/SyncBackingDatabase32K/Enabled/*UMA-Dynamic-Binary-Uniformity-Trial/default/*UMA-Dynamic-Uniformity-Trial/Group3/*UMA-Population-Restrict/normal/*UMA-Uniformity-Trial-100-Percent/group_01/*UMA-Uniformity-Trial-20-Percent/group_01/*UMA-Uniformity-Trial-50-Percent/group_01/*UseDelayAgnosticAEC/DefaultEnabled/VoiceTrigger/Install/WebRTC-UDPSocketNonBlockingIO/Default/" --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3924.0.2047941522\1057119072" --font-cache-shared-handle=1608 /prefetch:673131151

======Scheduled tasks folder======

C:\Windows\tasks\RegAce Scheduled Scan - ROMAN.job - C:\Program Files (x86)\RegAce System Suite\RegAce.exe SCHEDULE

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23 60568]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_60\bin\ssv.dll [2015-10-02 460384]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-10-02 172640]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CmPCIaudio"=C:\Windows\syswow64\RunDll32.exe [2009-07-14 44544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [2013-01-08 3674320]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1475584]
"AlcoholAutomount"=C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2012-01-05 75624]
"Windows Driver"=C:\Users\ROMAN\AppData\Roaming\WinUpdate\g\windrv.exe []

[HKEY_LOCAL_MACHINE\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"=C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19 1022152]
"StartCCC"=C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [2015-08-04 767176]

[HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PEVSystemStart]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv
"aux"=wdmaud.drv
"wave2"=wdmaud.drv
"midi2"=wdmaud.drv
"mixer2"=wdmaud.drv
"wave1"=wdmaud.drv
"midi1"=wdmaud.drv
"mixer1"=wdmaud.drv
"aux1"=wdmaud.drv
"wave3"=wdmaud.drv
"midi3"=wdmaud.drv
"mixer3"=wdmaud.drv
"aux2"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2015-10-03 13:21:53 ----D---- C:\_OTM
2015-10-02 22:55:55 ----D---- C:\Users\ROMAN\AppData\Roaming\AMD
2015-10-02 22:51:06 ----SHD---- C:\$RECYCLE.BIN
2015-10-02 22:46:33 ----SD---- C:\ComboFix
2015-10-02 21:40:23 ----D---- C:\AdwCleaner
2015-10-02 20:28:59 ----A---- C:\Windows\SYSWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-10-02 20:28:59 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-10-02 20:20:03 ----D---- C:\Users\ROMAN\AppData\Roaming\Sun
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\mshtmled.dll
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\MshtmlDac.dll
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\iernonce.dll
2015-10-02 20:10:10 ----A---- C:\Windows\SYSWOW64\ieetwproxystub.dll
2015-10-02 20:10:10 ----A---- C:\Windows\system32\iernonce.dll
2015-10-02 20:10:10 ----A---- C:\Windows\system32\ieetwproxystub.dll
2015-10-02 20:10:10 ----A---- C:\Windows\system32\ieetwcollector.exe
2015-10-02 20:10:10 ----A---- C:\Windows\system32\ie4uinit.exe
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\vbscript.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\urlmon.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\mshtml.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\msfeeds.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\JavaScriptCollectionAgent.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\iedkcs32.dll
2015-10-02 20:10:09 ----A---- C:\Windows\SYSWOW64\dxtrans.dll
2015-10-02 20:10:09 ----A---- C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-10-02 20:10:08 ----A---- C:\Windows\SYSWOW64\iesetup.dll
2015-10-02 20:10:08 ----A---- C:\Windows\SYSWOW64\iertutil.dll
2015-10-02 20:10:08 ----A---- C:\Windows\SYSWOW64\ieapfltr.dll
2015-10-02 20:10:08 ----A---- C:\Windows\system32\urlmon.dll
2015-10-02 20:10:08 ----A---- C:\Windows\system32\iedkcs32.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\jsproxy.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\jscript9diag.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\jscript.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\ieUnatt.exe
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\ieui.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\ieframe.dll
2015-10-02 20:10:07 ----A---- C:\Windows\SYSWOW64\dxtmsft.dll
2015-10-02 20:10:07 ----A---- C:\Windows\system32\MsSpellCheckingFacility.exe
2015-10-02 20:10:07 ----A---- C:\Windows\system32\msfeeds.dll
2015-10-02 20:10:07 ----A---- C:\Windows\system32\ieetwcollectorres.dll
2015-10-02 20:10:07 ----A---- C:\Windows\system32\dxtrans.dll
2015-10-02 20:10:06 ----A---- C:\Windows\system32\iesetup.dll
2015-10-02 20:10:06 ----A---- C:\Windows\system32\ieapfltr.dll
2015-10-02 20:10:05 ----A---- C:\Windows\SYSWOW64\mshtmlmedia.dll
2015-10-02 20:10:05 ----A---- C:\Windows\SYSWOW64\jscript9.dll
2015-10-02 20:10:05 ----A---- C:\Windows\system32\vbscript.dll
2015-10-02 20:10:05 ----A---- C:\Windows\system32\iertutil.dll
2015-10-02 20:10:04 ----A---- C:\Windows\SYSWOW64\wininet.dll
2015-10-02 20:10:04 ----A---- C:\Windows\SYSWOW64\msrating.dll
2015-10-02 20:10:04 ----A---- C:\Windows\system32\jsproxy.dll
2015-10-02 20:10:04 ----A---- C:\Windows\system32\ieUnatt.exe
2015-10-02 20:10:04 ----A---- C:\Windows\system32\dxtmsft.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\mshtmlmedia.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\mshtmled.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\ieui.dll
2015-10-02 20:10:03 ----A---- C:\Windows\system32\ieframe.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\wininet.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\jscript9diag.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\jscript9.dll
2015-10-02 20:10:02 ----A---- C:\Windows\system32\jscript.dll
2015-10-02 20:10:01 ----A---- C:\Windows\system32\msrating.dll
2015-10-02 20:10:01 ----A---- C:\Windows\system32\MshtmlDac.dll
2015-10-02 20:10:01 ----A---- C:\Windows\system32\mshtml.dll
2015-10-02 20:04:28 ----A---- C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-10-02 20:04:27 ----A---- C:\Windows\system32\rdpudd.dll
2015-10-02 20:04:27 ----A---- C:\Windows\system32\rdpcorets.dll
2015-10-02 20:03:36 ----A---- C:\Windows\SYSWOW64\mstscax.dll
2015-10-02 20:03:36 ----A---- C:\Windows\system32\wksprt.exe
2015-10-02 20:03:36 ----A---- C:\Windows\system32\rdvidcrl.dll
2015-10-02 20:03:36 ----A---- C:\Windows\system32\mstscax.dll
2015-10-02 20:03:35 ----A---- C:\Windows\SYSWOW64\tsgqec.dll
2015-10-02 20:03:35 ----A---- C:\Windows\SYSWOW64\rdvidcrl.dll
2015-10-02 20:03:35 ----A---- C:\Windows\system32\tsgqec.dll
2015-10-02 20:03:24 ----A---- C:\Windows\SYSWOW64\kerberos.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\schannel.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\rpcrt4.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\ntoskrnl.exe
2015-10-02 20:03:24 ----A---- C:\Windows\system32\ntdll.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\lsasrv.dll
2015-10-02 20:03:24 ----A---- C:\Windows\system32\kerberos.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\schannel.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\rpcrt4.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ntoskrnl.exe
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ntkrnlpa.exe
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ntdll.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\ncrypt.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\msv1_0.dll
2015-10-02 20:03:23 ----A---- C:\Windows\SYSWOW64\adtschema.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\TSpkg.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\sysmain.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\ncrypt.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\msv1_0.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\kernel32.dll
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\drivers\ksecpkg.sys
2015-10-02 20:03:23 ----A---- C:\Windows\system32\adtschema.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-file-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-10-02 20:03:22 ----AH---- C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\wow32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\wdigest.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\TSpkg.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\sspicli.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\srclient.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\setup16.exe
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\secur32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\ntvdm64.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\msobjs.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\msaudite.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\KernelBase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\kernel32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\cryptbase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\credssp.dll
2015-10-02 20:03:22 ----A---- C:\Windows\SYSWOW64\auditpol.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wow64win.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wow64cpu.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wow64.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\winsrv.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\wdigest.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\sspisrv.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\sspicli.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\srcore.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\srclient.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\smss.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\secur32.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\rstrui.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\ntvdm64.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\msobjs.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\msmmsp.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\msaudite.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\lsass.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\KernelBase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\drivers\mountmgr.sys
2015-10-02 20:03:22 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2015-10-02 20:03:22 ----A---- C:\Windows\system32\csrsrv.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\cryptbase.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\credssp.dll
2015-10-02 20:03:22 ----A---- C:\Windows\system32\conhost.exe
2015-10-02 20:03:22 ----A---- C:\Windows\system32\auditpol.exe
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-io-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-10-02 20:03:21 ----AH---- C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-security-base-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-util-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-string-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-10-02 20:03:20 ----AH---- C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-10-02 20:03:20 ----A---- C:\Windows\SYSWOW64\instnm.exe
2015-10-02 20:03:20 ----A---- C:\Windows\SYSWOW64\apisetschema.dll
2015-10-02 20:03:20 ----A---- C:\Windows\system32\apisetschema.dll
2015-10-02 20:03:19 ----AH---- C:\Windows\SYSWOW64\api-ms-win-core-console-l1-1-0.dll
2015-10-02 20:03:19 ----AH---- C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-10-02 20:03:19 ----A---- C:\Windows\SYSWOW64\user.exe
2015-10-02 20:03:07 ----A---- C:\Windows\system32\appidpolicyconverter.exe
2015-10-02 20:03:06 ----A---- C:\Windows\SYSWOW64\appidapi.dll
2015-10-02 20:03:06 ----A---- C:\Windows\system32\setbcdlocale.dll
2015-10-02 20:03:06 ----A---- C:\Windows\system32\drivers\appid.sys
2015-10-02 20:03:06 ----A---- C:\Windows\system32\appidsvc.dll
2015-10-02 20:03:06 ----A---- C:\Windows\system32\appidcertstorecheck.exe
2015-10-02 20:03:06 ----A---- C:\Windows\system32\appidapi.dll
2015-10-02 20:02:52 ----A---- C:\Windows\system32\basesrv.dll
2015-10-02 20:02:26 ----A---- C:\Windows\SYSWOW64\DWrite.dll
2015-10-02 20:02:26 ----A---- C:\Windows\system32\FntCache.dll
2015-10-02 20:02:26 ----A---- C:\Windows\system32\DWrite.dll
2015-10-02 20:02:25 ----A---- C:\Windows\SYSWOW64\d3d10warp.dll
2015-10-02 20:02:25 ----A---- C:\Windows\system32\d3d10warp.dll
2015-10-02 20:02:07 ----A---- C:\Windows\SYSWOW64\msi.dll
2015-10-02 20:02:07 ----A---- C:\Windows\system32\msi.dll
2015-10-02 20:02:07 ----A---- C:\Windows\system32\authui.dll
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\msimsg.dll
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\msihnd.dll
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\msiexec.exe
2015-10-02 20:02:06 ----A---- C:\Windows\SYSWOW64\authui.dll
2015-10-02 20:02:06 ----A---- C:\Windows\system32\msimsg.dll
2015-10-02 20:02:06 ----A---- C:\Windows\system32\msihnd.dll
2015-10-02 20:02:06 ----A---- C:\Windows\system32\msiexec.exe
2015-10-02 20:02:06 ----A---- C:\Windows\system32\consent.exe
2015-10-02 20:02:06 ----A---- C:\Windows\system32\appinfo.dll
2015-10-02 20:02:00 ----A---- C:\Windows\SYSWOW64\InkEd.dll
2015-10-02 20:02:00 ----A---- C:\Windows\system32\jnwmon.dll
2015-10-02 20:02:00 ----A---- C:\Windows\system32\InkEd.dll
2015-10-02 20:01:57 ----A---- C:\Windows\SYSWOW64\ole32.dll
2015-10-02 20:01:57 ----A---- C:\Windows\system32\ole32.dll
2015-10-02 20:01:56 ----A---- C:\Windows\system32\schedsvc.dll
2015-10-02 20:01:54 ----A---- C:\Windows\SYSWOW64\comctl32.dll
2015-10-02 20:01:54 ----A---- C:\Windows\system32\comctl32.dll
2015-10-02 20:01:52 ----A---- C:\Windows\SYSWOW64\WebClnt.dll
2015-10-02 20:01:52 ----A---- C:\Windows\SYSWOW64\davclnt.dll
2015-10-02 20:01:52 ----A---- C:\Windows\system32\WebClnt.dll
2015-10-02 20:01:52 ----A---- C:\Windows\system32\davclnt.dll
2015-10-02 20:01:50 ----A---- C:\Windows\SYSWOW64\cewmdm.dll
2015-10-02 20:01:50 ----A---- C:\Windows\system32\cewmdm.dll
2015-10-02 20:01:48 ----A---- C:\Windows\SYSWOW64\tzres.dll
2015-10-02 20:01:48 ----A---- C:\Windows\system32\tzres.dll
2015-10-02 20:01:29 ----A---- C:\Windows\system32\shell32.dll
2015-10-02 20:01:28 ----A---- C:\Windows\SYSWOW64\shell32.dll
2015-10-02 20:01:22 ----A---- C:\Windows\SYSWOW64\msxml6.dll
2015-10-02 20:01:22 ----A---- C:\Windows\SYSWOW64\msxml3.dll
2015-10-02 20:01:22 ----A---- C:\Windows\system32\msxml6.dll
2015-10-02 20:01:22 ----A---- C:\Windows\system32\msxml3.dll
2015-10-02 20:01:21 ----A---- C:\Windows\SYSWOW64\msxml6r.dll
2015-10-02 20:01:21 ----A---- C:\Windows\SYSWOW64\msxml3r.dll
2015-10-02 20:01:21 ----A---- C:\Windows\system32\msxml6r.dll
2015-10-02 20:01:21 ----A---- C:\Windows\system32\msxml3r.dll
2015-10-02 20:01:20 ----A---- C:\Windows\system32\wmp.dll
2015-10-02 20:01:19 ----A---- C:\Windows\SYSWOW64\wmp.dll
2015-10-02 20:01:18 ----A---- C:\Windows\SYSWOW64\wmploc.DLL
2015-10-02 20:01:18 ----A---- C:\Windows\SYSWOW64\spwmp.dll
2015-10-02 20:01:18 ----A---- C:\Windows\SYSWOW64\dxmasf.dll
2015-10-02 20:01:18 ----A---- C:\Windows\system32\spwmp.dll
2015-10-02 20:01:18 ----A---- C:\Windows\system32\dxmasf.dll
2015-10-02 20:01:17 ----A---- C:\Windows\system32\wmploc.DLL
2015-10-02 20:01:17 ----A---- C:\Windows\system32\TSWbPrxy.exe
2015-10-02 20:00:19 ----A---- C:\Windows\SYSWOW64\notepad.exe
2015-10-02 20:00:19 ----A---- C:\Windows\system32\notepad.exe
2015-10-02 20:00:19 ----A---- C:\Windows\system32\gdi32.dll
2015-10-02 20:00:19 ----A---- C:\Windows\notepad.exe
2015-10-02 20:00:18 ----A---- C:\Windows\SYSWOW64\gdi32.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\lpk.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\fontsub.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\dciman32.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\atmlib.dll
2015-10-02 19:54:07 ----A---- C:\Windows\SYSWOW64\atmfd.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\win32k.sys
2015-10-02 19:54:07 ----A---- C:\Windows\system32\lpk.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\fontsub.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\dciman32.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\atmlib.dll
2015-10-02 19:54:07 ----A---- C:\Windows\system32\atmfd.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wuwebv.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wups.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wudriver.dll
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wuapp.exe
2015-10-02 19:54:04 ----A---- C:\Windows\SYSWOW64\wuapi.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuwebv.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wups2.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wups.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wudriver.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wucltux.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuaueng.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuauclt.exe
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuapp.exe
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wuapi.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\wu.upgrade.ps.dll
2015-10-02 19:54:04 ----A---- C:\Windows\system32\WinSetupUI.dll
2015-10-02 19:43:00 ----D---- C:\ProgramData\ATI
2015-09-24 16:15:32 ----A---- C:\Windows\SYSWOW64\FlashPlayerInstaller.exe

======List of files/folders modified in the last 1 month======

2015-10-03 17:47:34 ----D---- C:\Program Files\trend micro
2015-10-03 17:47:28 ----D---- C:\Windows\temp
2015-10-03 17:43:07 ----D---- C:\Windows\SysWOW64
2015-10-03 17:43:07 ----D---- C:\Windows\System32
2015-10-03 17:43:06 ----D---- C:\Windows\system32\drivers
2015-10-03 17:36:07 ----D---- C:\Windows\system32\config
2015-10-03 17:20:12 ----D---- C:\Windows\Prefetch
2015-10-03 17:06:11 ----D---- C:\Windows\Microsoft.NET
2015-10-03 17:05:19 ----D---- C:\Windows\SoftwareDistribution
2015-10-03 15:20:52 ----RSD---- C:\Windows\assembly
2015-10-03 13:22:25 ----D---- C:\Windows
2015-10-03 13:21:53 ----D---- C:\Windows\Tasks
2015-10-03 13:21:53 ----D---- C:\Users\ROMAN\AppData\Roaming\WinUpdate
2015-10-02 22:50:06 ----SHD---- C:\System Volume Information
2015-10-02 22:46:37 ----D---- C:\Qoobox
2015-10-02 22:46:07 ----D---- C:\ProgramData\Origin
2015-10-02 22:10:17 ----D---- C:\ProgramData\Electronic Arts
2015-10-02 22:10:01 ----D---- C:\Program Files (x86)\Origin
2015-10-02 21:42:03 ----D---- C:\Windows\system32\Tasks
2015-10-02 21:42:02 ----RD---- C:\Program Files (x86)
2015-10-02 20:53:43 ----D---- C:\Windows\winsxs
2015-10-02 20:52:16 ----D---- C:\Config.Msi
2015-10-02 20:47:12 ----D---- C:\Windows\system32\catroot
2015-10-02 20:46:37 ----D---- C:\Program Files\Windows Media Player
2015-10-02 20:46:37 ----D---- C:\Program Files\Windows Journal
2015-10-02 20:46:37 ----D---- C:\Program Files (x86)\Windows Media Player
2015-10-02 20:46:36 ----D---- C:\Windows\SYSWOW64\cs-CZ
2015-10-02 20:46:36 ----D---- C:\Windows\system32\drivers\cs-CZ
2015-10-02 20:46:36 ----D---- C:\Windows\system32\cs-CZ
2015-10-02 20:46:35 ----D---- C:\Windows\ehome
2015-10-02 20:46:35 ----D---- C:\Windows\AppPatch
2015-10-02 20:46:30 ----D---- C:\Program Files\Internet Explorer
2015-10-02 20:46:29 ----D---- C:\Windows\SYSWOW64\en-US
2015-10-02 20:46:29 ----D---- C:\Windows\system32\en-US
2015-10-02 20:46:29 ----D---- C:\Windows\PolicyDefinitions
2015-10-02 20:46:29 ----D---- C:\Program Files (x86)\Internet Explorer
2015-10-02 20:46:27 ----D---- C:\Windows\system32\Boot
2015-10-02 20:32:09 ----SHD---- C:\Windows\Installer
2015-10-02 20:27:37 ----D---- C:\Windows\system32\MRT
2015-10-02 20:20:52 ----D---- C:\Program Files (x86)\Java
2015-10-02 20:20:28 ----D---- C:\Program Files (x86)\Common Files
2015-10-02 20:19:47 ----A---- C:\Windows\SYSWOW64\WindowsAccessBridge-32.dll
2015-10-02 20:12:57 ----D---- C:\Program Files (x86)\FastShare
2015-10-02 20:01:39 ----D---- C:\Windows\system32\catroot2
2015-10-02 19:45:11 ----D---- C:\Program Files (x86)\Raptr
2015-10-02 19:43:00 ----D---- C:\ProgramData
2015-10-02 19:34:45 ----D---- C:\Windows\inf
2015-10-02 19:34:44 ----D---- C:\Windows\system32\DriverStore
2015-10-02 19:32:41 ----D---- C:\Program Files\AMD
2015-10-02 19:30:56 ----D---- C:\AMD
2015-10-02 19:14:28 ----D---- C:\ProgramData\Skype
2015-10-02 19:14:25 ----D---- C:\Users\ROMAN\AppData\Roaming\Skype
2015-10-02 19:09:23 ----D---- C:\Users\ROMAN\AppData\Roaming\IrfanView
2015-10-02 19:08:47 ----D---- C:\Program Files (x86)\GRETECH
2015-10-02 19:08:18 ----RD---- C:\Program Files
2015-10-02 17:10:21 ----A---- C:\Windows\system32\PerfStringBackup.INI
2015-09-24 16:15:39 ----A---- C:\Windows\SYSWOW64\FlashPlayerApp.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12352]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 213888]
R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2013-08-20 564824]
R0 vmbus;@%SystemRoot%\system32\vmbusres.dll,-1000; C:\Windows\system32\drivers\vmbus.sys [2010-11-20 199552]
R1 CSC;@%systemroot%\system32\cscsvc.dll,-202; C:\Windows\system32\drivers\csc.sys [2010-11-20 514560]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver; C:\Windows\system32\DRIVERS\dtsoftbus01.sys [2013-03-10 283200]
R3 e1express;Intel(R) PRO/1000 – ovladač PCI Express síťového připojení; C:\Windows\system32\DRIVERS\e1e6032e.sys [2009-06-10 278016]
R3 HECIx64;Intel(R) Management Engine Interface; C:\Windows\system32\DRIVERS\HECIx64.sys [2009-09-18 70168]
R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd64.sys [2009-06-10 6108416]
R3 MBAMProtector;MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [2015-04-14 25816]
R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [2013-12-22 82816]
R3 TPM;Čip TPM; C:\Windows\system32\drivers\tpm.sys [2009-07-14 38400]
S3 a69j22f9;a69j22f9; C:\Windows\system32\drivers\a69j22f9.sys []
S3 amdkmdag;amdkmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2015-08-04 21622784]
S3 amdkmdap;amdkmdap; C:\Windows\system32\DRIVERS\atikmpag.sys [2015-08-04 665088]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service; C:\Windows\system32\drivers\AtihdW76.sys [2015-07-15 96256]
S3 azxh32w3;azxh32w3; C:\Windows\system32\drivers\azxh32w3.sys []
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 95232]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 cmuda3;C-Media PCI Audio Interface; C:\Windows\system32\drivers\cmudax3.sys [2009-12-01 1155072]
S3 MBAMWebAccessControl;MBAMWebAccessControl; \??\C:\Windows\system32\drivers\mwac.sys [2015-04-14 63704]
S3 RDPDR;Terminal Server Device Redirector Driver; C:\Windows\System32\drivers\rdpdr.sys [2010-11-20 165888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 19456]
S3 s3cap;s3cap; C:\Windows\system32\drivers\vms3cap.sys [2010-11-20 6656]
S3 storvsc;storvsc; C:\Windows\system32\drivers\storvsc.sys [2010-11-20 34688]
S3 Synth3dVsc;Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys []
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 56832]
S3 tsusbhub;@%SystemRoot%\system32\drivers\tsusbhub.sys,-1; C:\Windows\system32\drivers\tsusbhub.sys []
S3 VGPU;VGPU; C:\Windows\System32\drivers\rdvgkmd.sys []
S3 VMBusHID;VMBusHID; C:\Windows\system32\drivers\VMBusHID.sys [2010-11-20 21760]
S3 WinUsb;WinUsb; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 41984]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-09-23 65192]
R2 AMD External Events Utility;AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [2015-08-04 246784]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 27136]
R2 MSSQLSERVER;SQL Server (MSSQLSERVER); c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\sqlservr.exe [2012-12-29 160768]
R2 SQLBrowser;SQL Server Browser; c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2012-02-11 269912]
R2 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2012-10-20 130024]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
S2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [2012-01-05 75624]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2014-04-11 124088]
S2 gupdate;Služba Google Update (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S2 MBAMService;MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2015-04-14 1080120]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service; C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-24 269000]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2009-07-14 27136]
S3 gupdatem;Služba Google Update (gupdatem); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-08-15 114688]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PeerDistSvc;@%SystemRoot%\system32\peerdistsvc.dll,-9000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2009-07-14 27136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2013-03-11 1255736]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [2014-04-11 50864]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [2014-04-12 139944]
S4 SQLSERVERAGENT;SQL Server Agent (MSSQLSERVER); c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE [2012-12-29 448488]

-----------------EOF-----------------

Re: Pomalé PC i prohlížení webu - proces winlog.exe?

Napsal: 03 říj 2015 17:40
od Rudy
Smazáno. Znovu spusťte OTM a klikněte na >CleanUp!<. OTM po sobě uklidí. Nakonec restartujte PC. Nastala nějaká změna?

Re: Pomalé PC i prohlížení webu - proces winlog.exe?

Napsal: 03 říj 2015 17:59
od Joke
Dobrý večer,
moc Vám děkuji za pomoc. Prohlížení webu i práce na PC je opět zrychlená. Jen to vypadá, že mi odešla jedna větev zdroje a musel jsem odpojit grafickou kartu a polovinu RAM, abych PC vůbec rozběhl. Je možné, že to nějak souviselo s havětí nebo je to jen shoda náhod? Každopádně velmi děkuji.

Re: Pomalé PC i prohlížení webu - proces winlog.exe?

Napsal: 03 říj 2015 19:03
od Rudy
Žádná havěť vám nezníčí hw. Jestli je zdroj starší, nebo méně kvalitní, je to klidně možné. Nemáte zač! :)
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz