VIRY.CZ

Zdravím pánové prosím o pomoc - stále mi v sledování prostředků nabíhá při velkém vytížení procesoru - Host Process for Windows Services - svchost.exe (netsvcs)
po ukončení tohoto procesu výkon spadne na normál. V podstatě jsem musel tento proces ukončit abych mohl importovat log RSIT. Děkuji za pomoc.

RSIT LOG :
Logfile of random's system information tool 1.10 (written by random/random)
Run by Kirchner at 2015-12-14 09:04:25
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 430 GB (90%) free of 477 GB
Total RAM: 3328 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:04:31, on 14.12.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18098)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\MsSpellCheckingFacility.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Kirchner\Desktop\RSIT.exe
C:\Program Files\trend micro\Kirchner.exe
C:\Windows\system32\DllHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Nezapomen] C:\Program Files\Pamatuj\nezapomen.exe 42352
O4 - HKCU\..\Run: [ACDSeeCommander18] C:\Program Files\ACD Systems\ACDSee\18.0\ACDSeeCommander18.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: NitroPDFDriverCreatorReadSpool8 (NitroDriverReadSpool8) - Nitro PDF Software - C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe
O23 - Service: SAMSUNG Mobile Connectivity Service (ss_conn_service) - DEVGURU Co., LTD. - C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
O23 - Service: VRAID Log Service - Unknown owner - C:\Program Files\VIA\RAID\vialogsv.exe
O23 - Service: CryptoPlus XME Engine Service (xmengine service) - Monet+, a.s. - C:\Windows\system32\xmesrv.exe

--
End of file - 3819 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22 194504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22 194504]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2006-10-09 90191]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2006-10-09 7741440]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2006-10-09 81920]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2013-09-12 5110672]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"Nezapomen"=C:\Program Files\Pamatuj\nezapomen.exe [2000-12-11 458240]
"ACDSeeCommander18"=C:\Program Files\ACD Systems\ACDSee\18.0\ACDSeeCommander18.exe [2014-09-20 1964552]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2015-12-14 09:04:25 ----D---- C:\rsit
2015-11-23 08:19:56 ----D---- C:\ProgramData\CPInstall

======List of files/folders modified in the last 1 month======

2015-12-14 09:04:31 ----D---- C:\Program Files\trend micro
2015-12-14 09:04:28 ----D---- C:\Windows\temp
2015-12-14 08:53:20 ----D---- C:\Users\Kirchner\AppData\Roaming\Nitro PDF
2015-12-14 08:53:12 ----D---- C:\Windows\Prefetch
2015-12-14 07:53:03 ----D---- C:\Windows\system32\config
2015-12-14 07:52:18 ----D---- C:\Windows\Tasks
2015-12-14 07:52:18 ----D---- C:\Windows\system32\Tasks
2015-12-14 07:52:05 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2015-12-08 07:54:59 ----SHD---- C:\System Volume Information
2015-12-07 08:08:41 ----D---- C:\Windows\inf
2015-12-04 11:46:26 ----D---- C:\Users\Kirchner\AppData\Roaming\Skype
2015-12-02 07:54:15 ----D---- C:\Windows
2015-12-01 15:15:01 ----D---- C:\Windows\debug
2015-11-27 07:52:22 ----D---- C:\Windows\system32\wdi
2015-11-26 08:06:47 ----SHD---- C:\Windows\Installer
2015-11-26 08:06:44 ----D---- C:\Config.Msi
2015-11-26 08:06:06 ----D---- C:\Windows\System32
2015-11-23 08:19:56 ----D---- C:\ProgramData

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2013-09-17 49240]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 timounter;Acronis True Image Backup Archive Explorer; C:\Windows\system32\DRIVERS\timntr.sys [2014-10-30 441760]
R0 viamraid;viamraid; C:\Windows\system32\DRIVERS\viamraid.sys [2014-10-30 142448]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2013-09-17 188808]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2013-09-17 134248]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2013-09-17 37416]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2013-09-17 174400]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2009-07-14 96768]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 tifsfilter;Acronis True Image FS Filter; C:\Windows\system32\DRIVERS\tifsfilt.sys [2014-10-30 44384]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2014-04-07 412952]
R3 cmudax;C-Media High Definition Audio Interface; C:\Windows\system32\drivers\cmudax.sys [2004-10-21 1275584]
R3 GemCCID;GemCCID; C:\Windows\system32\DRIVERS\GemCCID.sys [2014-03-14 99840]
R3 irsir;Microsoft Serial Infrared Driver; C:\Windows\system32\DRIVERS\irsir.sys [2006-11-02 20992]
R3 usbscan;Ovladač skeneru USB; C:\Windows\system32\drivers\usbscan.sys [2013-07-03 36352]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 catchme;catchme; \??\C:\Users\Kirchner\AppData\Local\Temp\catchme.sys []
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2015-05-21 89984]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\LGBusEnum.sys [2009-11-24 19720]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver; C:\Windows\system32\drivers\LGVirHid.sys [2009-11-24 14856]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-05-13 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2011-05-13 114280]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2015-05-21 184192]
S3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 9216]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-02-12 15872]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S3 WSDPrintDevice;Podpora tisku WSD prostřednictvím funkce UMB; C:\Windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
S3 WSDScan;Podpora skenování WSD přes UMB; C:\Windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-10-28 82128]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2013-09-12 1337752]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8; C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe [2012-12-13 196616]
R2 ss_conn_service;SAMSUNG Mobile Connectivity Service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [2015-05-21 743688]
R2 VRAID Log Service;VRAID Log Service; C:\Program Files\VIA\RAID\vialogsv.exe [2014-10-30 55920]
R2 xmengine service;CryptoPlus XME Engine Service; C:\Windows\system32\xmesrv.exe [2014-10-31 34696]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-10-30 102912]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-10-30 1343400]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2014-04-11 45744]
S4 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S4 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S4 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2015-07-20 194032]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]

-----------------EOF-----------------

OK shodil jsem svchost a log tady :

Logfile of random's system information tool 1.10 (written by random/random)
Run by Kirchner at 2015-12-15 09:08:59
Microsoft Windows 7 Home Premium Service Pack 1
System drive C: has 430 GB (90%) free of 477 GB
Total RAM: 3328 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:09:10, on 15.12.2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18098)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\System32\perfmon.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Kirchner\Desktop\RSIT.exe
C:\Program Files\trend micro\Kirchner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Nezapomen] C:\Program Files\Pamatuj\nezapomen.exe 42353
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 (User 'Default user')
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: NitroPDFDriverCreatorReadSpool8 (NitroDriverReadSpool8) - Nitro PDF Software - C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe
O23 - Service: SAMSUNG Mobile Connectivity Service (ss_conn_service) - DEVGURU Co., LTD. - C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
O23 - Service: VRAID Log Service - Unknown owner - C:\Program Files\VIA\RAID\vialogsv.exe
O23 - Service: CryptoPlus XME Engine Service (xmengine service) - Monet+, a.s. - C:\Windows\system32\xmesrv.exe

--
End of file - 3643 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22 194504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22 194504]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2006-10-09 90191]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2006-10-09 7741440]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2006-10-09 81920]
"egui"=C:\Program Files\ESET\ESET Smart Security\egui.exe [2013-09-12 5110672]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2010-11-20 1174016]
"Nezapomen"=C:\Program Files\Pamatuj\nezapomen.exe [2000-12-11 458240]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=0
"ConsentPromptBehaviorUser"=3
"EnableLUA"=0
"EnableUIADesktopToggle"=0
"PromptOnSecureDesktop"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
"vidc.mrle"=msrle32.dll
"vidc.msvc"=msvidc32.dll
"msacm.imaadpcm"=imaadp32.acm
"msacm.msg711"=msg711.acm
"msacm.msgsm610"=msgsm32.acm
"msacm.msadpcm"=msadp32.acm
"midimapper"=midimap.dll
"wavemapper"=msacm32.drv
"vidc.uyvy"=msyuv.dll
"vidc.yuy2"=msyuv.dll
"vidc.yvyu"=msyuv.dll
"vidc.iyuv"=iyuv_32.dll
"vidc.i420"=iyuv_32.dll
"vidc.yvu9"=tsbyuv.dll
"msacm.l3acm"=C:\Windows\System32\l3codeca.acm
"vidc.cvid"=iccvid.dll
"wave"=wdmaud.drv
"midi"=wdmaud.drv
"mixer"=wdmaud.drv

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1

======List of files/folders created in the last 1 month======

2015-12-14 09:04:25 ----D---- C:\rsit
2015-11-23 08:19:56 ----D---- C:\ProgramData\CPInstall

======List of files/folders modified in the last 1 month======

2015-12-15 09:09:06 ----D---- C:\Program Files\trend micro
2015-12-15 09:09:05 ----D---- C:\Windows\temp
2015-12-15 08:16:40 ----D---- C:\Windows\system32\config
2015-12-14 11:17:18 ----D---- C:\Windows\system32\Tasks
2015-12-14 08:53:20 ----D---- C:\Users\Kirchner\AppData\Roaming\Nitro PDF
2015-12-14 08:53:12 ----D---- C:\Windows\Prefetch
2015-12-14 07:52:18 ----D---- C:\Windows\Tasks
2015-12-14 07:52:05 ----A---- C:\Windows\system32\FlashPlayerApp.exe
2015-12-08 07:54:59 ----SHD---- C:\System Volume Information
2015-12-07 08:08:41 ----D---- C:\Windows\inf
2015-12-04 11:46:26 ----D---- C:\Users\Kirchner\AppData\Roaming\Skype
2015-12-02 07:54:15 ----D---- C:\Windows
2015-12-01 15:15:01 ----D---- C:\Windows\debug
2015-11-27 07:52:22 ----D---- C:\Windows\system32\wdi
2015-11-26 08:06:47 ----SHD---- C:\Windows\Installer
2015-11-26 08:06:44 ----D---- C:\Config.Msi
2015-11-26 08:06:06 ----D---- C:\Windows\System32
2015-11-23 08:19:56 ----D---- C:\ProgramData

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 epfwwfp;epfwwfp; C:\Windows\system32\DRIVERS\epfwwfp.sys [2013-09-17 49240]
R0 rdyboost;ReadyBoost; C:\Windows\System32\drivers\rdyboost.sys [2010-11-20 173440]
R0 timounter;Acronis True Image Backup Archive Explorer; C:\Windows\system32\DRIVERS\timntr.sys [2014-10-30 441760]
R0 viamraid;viamraid; C:\Windows\system32\DRIVERS\viamraid.sys [2014-10-30 142448]
R1 eamonm;eamonm; C:\Windows\system32\DRIVERS\eamonm.sys [2013-09-17 188808]
R1 ehdrv;ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [2013-09-17 134248]
R1 EpfwLWF;Epfw NDIS LightWeight Filter; C:\Windows\system32\DRIVERS\EpfwLWF.sys [2013-09-17 37416]
R2 epfw;epfw; C:\Windows\system32\DRIVERS\epfw.sys [2013-09-17 174400]
R2 irda;IrDA Protocol; C:\Windows\system32\DRIVERS\irda.sys [2009-07-14 96768]
R2 Parvdm;Parvdm; C:\Windows\system32\DRIVERS\parvdm.sys [2009-07-14 8704]
R2 tifsfilter;Acronis True Image FS Filter; C:\Windows\system32\DRIVERS\tifsfilt.sys [2014-10-30 44384]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2014-04-07 412952]
R3 cmudax;C-Media High Definition Audio Interface; C:\Windows\system32\drivers\cmudax.sys [2004-10-21 1275584]
R3 GemCCID;GemCCID; C:\Windows\system32\DRIVERS\GemCCID.sys [2014-03-14 99840]
R3 irsir;Microsoft Serial Infrared Driver; C:\Windows\system32\DRIVERS\irsir.sys [2006-11-02 20992]
R3 usbscan;Ovladač skeneru USB; C:\Windows\system32\drivers\usbscan.sys [2013-07-03 36352]
S3 aic78xx;aic78xx; C:\Windows\system32\DRIVERS\djsvs.sys [2009-07-14 70720]
S3 amdagp;Ovladač filtru AMD portu AGP; C:\Windows\system32\drivers\amdagp.sys [2009-07-14 53312]
S3 BridgeMP;@%SystemRoot%\system32\bridgeres.dll,-1; C:\Windows\system32\DRIVERS\bridge.sys [2009-07-14 78336]
S3 catchme;catchme; \??\C:\Users\Kirchner\AppData\Local\Temp\catchme.sys []
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudbus.sys [2015-05-21 89984]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\LGBusEnum.sys [2009-11-24 19720]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver; C:\Windows\system32\drivers\LGVirHid.sys [2009-11-24 14856]
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys []
S3 pciide;pciide; C:\Windows\system32\drivers\pciide.sys [2009-07-14 12368]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver; C:\Windows\System32\drivers\rdpvideominiport.sys [2012-08-23 14848]
S3 sisagp;Filtr SIS sběrnice AGP; C:\Windows\system32\drivers\sisagp.sys [2009-07-14 52304]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\ssadbus.sys [2011-05-13 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter); C:\Windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers; C:\Windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\ssadserd.sys [2011-05-13 114280]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.); C:\Windows\system32\DRIVERS\ssudmdm.sys [2015-05-21 184192]
S3 StillCam;Ovladač digitálního fotoaparátu pro sériový port; C:\Windows\system32\DRIVERS\serscan.sys [2009-07-14 9216]
S3 TsUsbFlt;@%SystemRoot%\system32\drivers\tsusbflt.sys,-1; C:\Windows\System32\drivers\tsusbflt.sys [2013-10-02 49152]
S3 usb_rndisx;Adaptér USB RNDIS; C:\Windows\system32\DRIVERS\usb8023x.sys [2013-02-12 15872]
S3 viaagp;Filtr VIA sběrnice AGP; C:\Windows\system32\drivers\viaagp.sys [2009-07-14 53328]
S3 ViaC7;VIA C7 Processor Driver; C:\Windows\system32\DRIVERS\viac7.sys [2009-07-14 52736]
S3 WinUsb;SAMSUNG Android USB Driver; C:\Windows\system32\DRIVERS\WinUsb.sys [2010-11-20 35968]
S3 WSDPrintDevice;Podpora tisku WSD prostřednictvím funkce UMB; C:\Windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 17920]
S3 WSDScan;Podpora skenování WSD přes UMB; C:\Windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AdobeARMservice;Adobe Acrobat Update Service; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [2015-10-28 82128]
R2 DiagTrack;@%SystemRoot%\system32\UtcResources.dll,-3001; C:\Windows\System32\svchost.exe [2009-07-14 20992]
R2 ekrn;ESET Service; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2013-09-12 1337752]
R2 Irmon;@%SystemRoot%\System32\irmon.dll,-2000; C:\Windows\system32\svchost.exe [2009-07-14 20992]
R2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8; C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe [2012-12-13 196616]
R2 ss_conn_service;SAMSUNG Mobile Connectivity Service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [2015-05-21 743688]
R2 VRAID Log Service;VRAID Log Service; C:\Program Files\VIA\RAID\vialogsv.exe [2014-10-30 55920]
R2 xmengine service;CryptoPlus XME Engine Service; C:\Windows\system32\xmesrv.exe [2014-10-31 34696]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2014-04-11 103608]
S3 IEEtwCollectorService;@%SystemRoot%\system32\ieetwcollectorres.dll,-1000; C:\Windows\system32\IEEtwCollector.exe [2015-10-30 102912]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WatAdminSvc;@%SystemRoot%\system32\Wat\WatUX.exe,-601; C:\Windows\system32\Wat\WatAdminSvc.exe [2014-10-30 1343400]
S4 aspnet_state;Stavová služba ASP.NET; C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [2014-04-11 45744]
S4 gupdate;Služba Google Update (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S4 gupdatem;Služba Google Update (gupdatem); C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01 144200]
S4 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2015-07-20 194032]
S4 NetMsmqActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8195; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetPipeActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8197; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NetTcpActivator;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\\ServiceModelInstallRC.dll,-8199; C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [2014-04-11 139944]
S4 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]

-----------------EOF-----------------

Jojda to se omlouvám nějak mi to v té předvánoční honce necvaklo náprava zde a díky moc za ochotu :
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:14-12-2015
Ran by Kirchner (administrator) on MK-PC (15-12-2015 15:58:24)
Running from C:\Users\Kirchner\Desktop
Loaded Profiles: Kirchner (Available Profiles: Kirchner)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) Language: Čeština (Česká republika)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(Nitro PDF Software) C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
() C:\Program Files\VIA\RAID\vialogsv.exe
(Monet+, a.s.) C:\Windows\System32\xmesrv.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvSvc] => RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5110672 2013-09-12] (ESET)
HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\...\Run: [Nezapomen] => C:\Program Files\Pamatuj\nezapomen.exe [458240 2000-12-11] ()
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-10-31] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 127.0.0.1 acdid.acdsystems.com
Tcpip\Parameters: [DhcpNameServer] 46.33.112.42 8.8.8.8 46.33.96.2
Tcpip\..\Interfaces\{D4364ADA-4982-4922-B11C-5CAE1FCBC4D3}: [DhcpNameServer] 46.33.112.42 8.8.8.8 46.33.96.2

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxps://www.google.com/search?q={searchTerms}&r ... EB_csCZ612
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22] (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22] (Google Inc.)
Toolbar: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-22] (Google Inc.)

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @nitropdf.com/NitroPDF -> C:\Program Files\Nitro\Pro 8\npnitromozilla.dll [2012-12-13] (Nitro PDF)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3565674240-4036518550-1107183558-1000: @servis24.cz/PKIComponent -> C:\Users\Kirchner\AppData\Roaming\CSAS\lib\x86\npPKIComponentNPAPI.dll [2015-02-16] (Česká spořitelna, a.s.)
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-11-03] [not signed]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Users\Kirchner\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Platby Internetového obchodu Chrome) - C:\Users\Kirchner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-13]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1337752 2013-09-12] (ESET)
R2 NitroDriverReadSpool8; C:\Program Files\Nitro\Pro 8\NitroPDFDriverService8.exe [196616 2012-12-13] (Nitro PDF Software)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
R2 VRAID Log Service; C:\Program Files\VIA\RAID\vialogsv.exe [55920 2014-10-30] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 xmengine service; C:\Windows\system32\xmesrv.exe [34696 2014-10-31] (Monet+, a.s.)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 cmudax; C:\Windows\System32\drivers\cmudax.sys [1275584 2004-10-21] (C-Media Inc.)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [188808 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [134248 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [174400 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [37416 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [49240 2013-09-17] (ESET)
R3 GemCCID; C:\Windows\System32\DRIVERS\GemCCID.sys [99840 2014-03-14] (Gemalto)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [20992 2006-11-02] (Microsoft Corporation)
S3 LGBusEnum; C:\Windows\System32\drivers\LGBusEnum.sys [19720 2009-11-24] (Logitech Inc.)
S3 LGVirHid; C:\Windows\System32\drivers\LGVirHid.sys [14856 2009-11-24] (Logitech Inc.)
R3 nvlddmkm; C:\Windows\System32\DRIVERS\nvlddmkm.sys [4428160 2006-10-09] (NVIDIA Corporation) [File not signed]
R2 tifsfilter; C:\Windows\System32\DRIVERS\tifsfilt.sys [44384 2014-10-30] (Acronis)
R0 viamraid; C:\Windows\System32\DRIVERS\viamraid.sys [142448 2014-10-30] (VIA Technologies Inc.,Ltd)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Kirchner\AppData\Local\Temp\catchme.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-15 15:58 - 2015-12-15 15:58 - 00008737 _____ C:\Users\Kirchner\Desktop\FRST.txt
2015-12-15 15:57 - 2015-12-15 15:58 - 00000000 ____D C:\FRST
2015-12-15 15:53 - 2015-12-15 15:53 - 01720832 _____ (Farbar) C:\Users\Kirchner\Desktop\FRST.exe
2015-12-15 15:44 - 2015-12-15 15:44 - 33882556 _____ C:\Users\Kirchner\Desktop\prani-k-vanocum.psd
2015-12-15 12:21 - 2015-12-15 12:21 - 00124340 _____ C:\Users\Kirchner\Desktop\Nádraží rozvod - AN1150605343.pdf
2015-12-14 09:04 - 2015-12-14 09:04 - 00000000 ____D C:\rsit
2015-12-14 09:04 - 2015-06-26 09:34 - 01107968 _____ C:\Users\Kirchner\Desktop\RSIT.exe
2015-12-14 08:06 - 2015-12-15 07:58 - 00000000 ____D C:\Users\Kirchner\Desktop\Nádraží demontáž
2015-12-07 08:23 - 2015-12-07 08:23 - 00000000 ____D C:\Users\Kirchner\Desktop\Vodoměry krapkova
2015-12-01 09:20 - 2015-12-01 09:20 - 00000000 ____D C:\Users\Kirchner\Desktop\ART Econ
2015-11-30 09:45 - 2015-11-30 09:46 - 00000000 ____D C:\Users\Kirchner\Desktop\Globe Servis - Cíl II.etapa
2015-11-23 08:19 - 2015-11-23 08:19 - 00000000 ____D C:\ProgramData\CPInstall
2015-11-19 09:58 - 2015-11-19 10:14 - 00000000 ___HD C:\Users\Kirchner\Desktop\[Původní]

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-15 15:57 - 2009-07-14 03:37 - 00000000 ____D C:\Windows
2015-12-15 14:52 - 2015-09-21 08:27 - 00000000 ____D C:\Users\Kirchner\AppData\Roaming\Nitro
2015-12-15 09:20 - 2014-11-04 08:22 - 00007633 _____ C:\Users\Kirchner\AppData\Local\Resmon.ResmonCfg
2015-12-15 09:13 - 2009-07-14 05:34 - 00022464 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-15 09:13 - 2009-07-14 05:34 - 00022464 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-15 09:09 - 2014-11-03 17:09 - 00000000 ____D C:\Program Files\trend micro
2015-12-15 09:09 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-15 09:08 - 2009-07-14 05:53 - 00032548 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-12-14 10:02 - 2014-10-31 11:12 - 00014857 _____ C:\Users\Kirchner\intlname.ols
2015-12-14 08:53 - 2015-09-24 10:56 - 00000000 ____D C:\Users\Kirchner\AppData\Roaming\Nitro PDF
2015-12-14 07:52 - 2014-11-24 10:13 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-12-14 07:52 - 2014-11-24 10:13 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-12-11 08:42 - 2015-07-27 07:18 - 00000000 ____D C:\Users\Kirchner\Desktop\RD Přerov Kosmákova 9
2015-12-07 08:08 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\inf
2015-12-04 11:46 - 2014-11-03 12:01 - 00000000 ____D C:\Users\Kirchner\AppData\Roaming\Skype
2015-12-03 16:35 - 2014-10-30 16:45 - 00000000 ____D C:\Users\Kirchner\Desktop\MyFiles
2015-12-01 15:18 - 2014-11-04 12:32 - 00000000 ____D C:\Users\Kirchner\Documents\CCleaner záloha
2015-11-26 08:06 - 2015-11-09 11:55 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-11-23 12:32 - 2014-10-30 15:40 - 00000000 ____D C:\Users\Kirchner\AppData\Local\ElevatedDiagnostics
2015-11-23 08:53 - 2015-09-07 09:56 - 00000128 _____ C:\Users\Kirchner\Desktop\Hotovost.txt
2015-11-20 15:21 - 2015-04-08 07:54 - 00000000 ____D C:\Users\Kirchner\Desktop\PU RD Dolany
2015-11-18 15:49 - 2015-10-22 10:27 - 00000000 ____D C:\Users\Kirchner\Desktop\Grunfoss OL

==================== Files in the root of some directories =======

2014-11-04 08:22 - 2015-12-15 09:20 - 0007633 _____ () C:\Users\Kirchner\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-11-30 11:53

==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version:14-12-2015
Ran by Kirchner (2015-12-15 15:59:12)
Running from C:\Users\Kirchner\Desktop
Microsoft Windows 7 Home Premium Service Pack 1 (X86) (2014-10-30 13:08:20)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3565674240-4036518550-1107183558-500 - Administrator - Disabled)
Guest (S-1-5-21-3565674240-4036518550-1107183558-501 - Limited - Disabled)
Kirchner (S-1-5-21-3565674240-4036518550-1107183558-1000 - Administrator - Enabled) => C:\Users\Kirchner

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ESET Smart Security 7.0 (Enabled - Up to date) {19259FAE-8396-A113-46DB-15B0E7DFA289}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: ESET Smart Security 7.0 (Enabled - Up to date) {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
FW: ESET Personální firewall (Enabled) {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\...\uTorrent) (Version: 3.4.5.41202 - BitTorrent Inc.)
ACDSee 18 (HKLM\...\{6D0F6DF4-553E-43CD-AA95-69AB3644A8FF}) (Version: 18.0.0.225 - ACD Systems International Inc.)
ACDSee 18 Build 225 - odinstalovat češtinu (HKLM\...\ACDSee 18 Build 225) (Version: - Michellin & Cehos)
Adobe Acrobat Reader DC - Czech (HKLM\...\{AC76BA86-7AD7-1029-7B44-AC0F074E4100}) (Version: 15.009.20079 - Adobe Systems Incorporated)
Adobe Flash Player 20 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 20.0.0.228 - Adobe Systems Incorporated)
Adobe Photoshop CS6 (HKLM\...\{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}) (Version: 13.0 - Adobe Systems Incorporated)
Balíček ovladače systému Windows - Hewlett-Packard Image (12/28/2006 8.0.0.0) (HKLM\...\4C806F98217A7FD4E853F458FF399F052625F21C) (Version: 12/28/2006 8.0.0.0 - Hewlett-Packard)
BS.Player PRO (HKLM\...\BSPlayerp) (Version: 2.66.1075 - AB Team, d.o.o.)
CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform)
C-Media High Definition Audio Driver (HKLM\...\C-Media Audio Driver) (Version: - )
CryptoPlus CS v1.0e (HKLM\...\CryptoPlus CS v1.0e) (Version: 2.0.9 - Monet+,a.s.)
DLL Suite 2014 (HKLM\...\{885843E7-6CAC-4791-B7BF-1CD516017954}_is1) (Version: - )
ESET Smart Security (HKLM\...\{1A8FE52B-983B-46B6-A2EF-9A75DDCAFCEF}) (Version: 7.0.302.26 - ESET, spol s r. o.)
Google Chrome (HKLM\...\Google Chrome) (Version: 45.0.2454.101 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.28.15 - Google Inc.) Hidden
LockHunter 3.1, 32/64 bit (HKLM\...\LockHunter_is1) (Version: - Crystal Rich Ltd)
Microsoft .NET Framework 4.5.2 (čeština) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1029) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM\...\{90110405-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM\...\MPE) (Version: 1.8.6 - F.J. Wechselberger)
Nero 7 Ultra Edition (HKLM\...\{4F2CE68F-EDBB-4592-BF07-5AC930A51029}) (Version: 7.02.6446 - Nero AG)
Nitro Pro 8 (HKLM\...\{8EEAF4C4-FCA7-4558-AF65-CCD3B9AD634D}) (Version: 8.0.10.7 - Nitro)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
PDF Settings CS6 (Version: 11.0 - Adobe Systems Incorporated) Hidden
Platform (Version: 1.34 - VIA Technologies, Inc.) Hidden
PrimoPDF -- by Nitro PDF Software (HKLM\...\PrimoPDF) (Version: 5.0.0.19 - Nitro PDF Software)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Sada Compatibility Pack pro systém Office 2007 (HKLM\...\{90120000-0020-0405-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.15075.2 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.6.3.15075.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.55.0 - Samsung Electronics Co., Ltd.)
Skype™ 6.22 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.104 - Skype Technologies S.A.)
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 8.50 RC1 - Ghisler Software GmbH)
VIA Platforma Ovladače zařízení (HKLM\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WinRAR 5.10 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000_Classes\CLSID\{6614FE97-812C-4B8B-AD6F-83D07279BF02}\InprocServer32 -> C:\Users\Kirchner\AppData\Roaming\CSAS\lib\x86\PKIComponentAX.dll (Česká spořitelna, a.s.)
CustomCLSID: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000_Classes\CLSID\{8616ED07-7CEA-47D2-912D-79BF20C02290}\InprocServer32 -> C:\Users\Kirchner\AppData\Roaming\CSAS\lib\x86\PKIComponentAX.dll (Česká spořitelna, a.s.)

==================== Restore Points =========================

12-11-2015 16:32:09 Windows Update
18-11-2015 07:58:27 Windows Update
24-11-2015 07:51:55 Windows Update
27-11-2015 07:53:30 Windows Update
01-12-2015 07:54:11 Windows Update
04-12-2015 16:05:34 Windows Update
08-12-2015 07:54:17 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:04 - 2015-11-06 12:22 - 00000067 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 acdid.acdsystems.com

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1749B3E6-6982-4AEB-B6D9-02A75B1D3A08} - System32\Tasks\ESET Windows 10 upgrade – Refresh settings => C:\Program Files\Common Files\AV\ESET Smart Security 7.0\upgrade.exe [2015-11-23] (ESET)
Task: {2D975173-34EB-4F1A-A341-057472940CF2} - System32\Tasks\{8B3FA506-C56C-4D28-AB51-84CD6F8A9A84} => pcalua.exe -a C:\Users\Kirchner\Desktop\CMedia\Driver\Setup.exe -d C:\Users\Kirchner\Desktop\CMedia\Driver
Task: {2E927AD3-8778-4C77-AD7D-FCDA49BB5167} - System32\Tasks\GoogleUpdateTaskMachineUA1d0f20150d5e35d => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {395C9569-2AB9-4577-8A95-F82DFF060FA6} - System32\Tasks\{0019B8DE-8B4D-4F8B-BE62-BDDD1A1C3D4B} => pcalua.exe -a "E:\Install\Driver záloha\Driver\Audio\Setup.exe" -d "E:\Install\Driver záloha\Driver\Audio"
Task: {48167A34-9FED-4E86-A360-53B507633661} - System32\Tasks\GoogleUpdateTaskMachineCore1d0e47ba2a6d531 => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {5A498A90-EE68-4F58-853B-741F397E1678} - System32\Tasks\{F57F0CF3-5303-4B84-AA28-41AA8CC7900B} => pcalua.exe -a "E:\Install\Driver záloha\Zvukovka PC praceWIN9x_1096\Setup.exe" -d "E:\Install\Driver záloha\Zvukovka PC praceWIN9x_1096"
Task: {89CB926D-504E-495D-B833-F4A8C70CCF76} - System32\Tasks\GoogleUpdateTaskMachineCore1d0f2015016daf1 => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {A06B0565-5776-4680-A394-3DDB1193B167} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {A1C7A2B5-7E7F-47FB-B093-401303260E3C} - System32\Tasks\GoogleUpdateTaskMachineCore1d091f9452c46bb => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {B31746BF-E01B-4346-8A7F-2BEB9A6BB310} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd)
Task: {B5F2E1A3-A719-485C-8F2E-2D7C58D1267A} - System32\Tasks\GoogleUpdateTaskMachineUA1d091f945a5dea9 => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {BADF5A9E-19B8-4FDF-96F3-6045AEEC9293} - System32\Tasks\{7DFB258A-2FAF-4277-9CD2-13F57C27B321} => pcalua.exe -a "F:\Programy\ACDSee\ACDSee170build42_CZ\ACDSee.v17.0.42.Keymaker\ACDSee.v17.0.42.Keymaker\ACDSee 17.0 build 42 CZ.exe" -d F:\Programy\ACDSee\ACDSee170build42_CZ\ACDSee.v17.0.42.Keymaker\ACDSee.v17.0.42.Keymaker
Task: {F39B1E5E-192C-49E2-83B4-1E162379A1CB} - System32\Tasks\DriverNavigator Scheduled Scan => C:\Program Files\Easeware\DriverNavigator\DriverNavigator.exe
Task: {FB717B3A-E1FC-46ED-8967-950206836505} - System32\Tasks\GoogleUpdateTaskMachineUA1d0e47ba34ba3be => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2014-11-03 10:40 - 2009-07-31 02:44 - 00176235 _____ () C:\Windows\System32\Primomonnt.dll
2014-10-30 15:15 - 2014-10-30 15:14 - 00055920 _____ () C:\Program Files\VIA\RAID\vialogsv.exe
2014-10-30 15:15 - 2014-10-30 15:14 - 00200704 _____ () C:\Program Files\VIA\RAID\drvInterface.dll
2014-10-30 15:15 - 2011-02-14 10:53 - 00581632 ____R () C:\Program Files\VIA\RAID\language.dll
2003-07-15 06:44 - 2003-07-15 06:44 - 00102968 _____ () C:\Program Files\Microsoft Office\OFFICE11\OUTLCTL.DLL

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\...\business24.cz -> hxxps://www.business24.cz
IE trusted site: HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\...\servis24.cz -> hxxps://www.servis24.cz

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3565674240-4036518550-1107183558-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Kirchner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 46.33.112.42 - 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{1D0ABF3E-8D02-4E0A-BE57-A34D38EA1434}] => (Allow) C:\Users\Kirchner\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{E678EEB9-9EBD-4C15-B30C-077BE3CC1392}] => (Allow) C:\Users\Kirchner\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{74ACEE00-E5B3-42C3-8774-B8EAFEE962A9}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{5510F6B6-D9E9-42E9-B00A-66716411C947}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{C9882147-3FA9-459C-9458-04DD6E4BB4EB}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{A7C66559-8818-4EB2-8CA1-3FE1ACBE877F}] => (Allow) C:\Users\Kirchner\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{D99DBC1B-9E37-4635-9814-90F30FA35054}] => (Allow) C:\Users\Kirchner\AppData\Roaming\uTorrent\uTorrent.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/15/2015 09:13:12 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 08:18:09 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 08:13:44 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: MK-PC)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 08:10:37 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 08:01:34 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: MK-PC)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 07:56:56 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: MK-PC)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 07:53:48 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: MK-PC)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/15/2015 07:52:24 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/14/2015 09:19:12 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.

Error: (12/14/2015 08:41:35 AM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3002) (User: NT AUTHORITY)
Description: Hodnota řetězce vysvětlujícího textu čítače výkonu v registru je nesprávně naformátovaná. Chybně vytvořený řetězec je 䕍き왐婃. První hodnota DWORD v datové oblasti obsahuje hodnotu indexu chybně vytvořeného řetězce, zatímco druhá a třetí hodnota DWORD v datové oblasti obsahují poslední platné hodnoty indexu.


System errors:
=============
Error: (12/15/2015 09:13:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Správce služeb se pokusil o opravnou akci (Restartovat službu) po nečekaném ukončení služby Služba WMI, ale tato akce selhala kvůli následující chybě:
%%1056

Error: (12/15/2015 09:13:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Správce služeb se pokusil o opravnou akci (Restartovat službu) po nečekaném ukončení služby Služba IKE and AuthIP IPsec Keying Modules, ale tato akce selhala kvůli následující chybě:
%%1056

Error: (12/15/2015 09:13:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Správce služeb se pokusil o opravnou akci (Restartovat službu) po nečekaném ukončení služby Prohledávání počítačů, ale tato akce selhala kvůli následující chybě:
%%1056

Error: (12/15/2015 09:10:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Správce služeb se pokusil o opravnou akci (Restartovat službu) po nečekaném ukončení služby Služba Plánovač multimédií, ale tato akce selhala kvůli následující chybě:
%%1056

Error: (12/15/2015 09:10:46 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Správce služeb se pokusil o opravnou akci (Restartovat službu) po nečekaném ukončení služby Server, ale tato akce selhala kvůli následující chybě:
%%1056

Error: (12/15/2015 09:08:46 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Služba Windows Update byla neočekávaně ukončena. Tento stav nastal již 2krát.

Error: (12/15/2015 09:08:46 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Služba WMI byla nečekaně ukončena. Stalo se to 2 krát. Následující opravná akce bude spuštěna za 300000 milisekund: Restartovat službu.

Error: (12/15/2015 09:08:46 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Motivy byla nečekaně ukončena. Stalo se to 2 krát. Následující opravná akce bude spuštěna za 60000 milisekund: Restartovat službu.

Error: (12/15/2015 09:08:46 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Rozpoznávání hardwaru byla nečekaně ukončena. Stalo se to 2 krát. Následující opravná akce bude spuštěna za 60000 milisekund: Restartovat službu.

Error: (12/15/2015 09:08:46 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Služba Služba oznamování událostí systému byla nečekaně ukončena. Stalo se to 2 krát. Následující opravná akce bude spuštěna za 300000 milisekund: Restartovat službu.


CodeIntegrity:
===================================
Date: 2014-10-31 11:42:11.062
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-31 11:42:10.328
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-31 11:41:59.359
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-31 11:41:59.343
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\RpcRtRemote.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz
Percentage of memory in use: 40%
Total physical RAM: 3327.55 MB
Available physical RAM: 1990.1 MB
Total Virtual: 6651.35 MB
Available Virtual: 5256.28 MB

==================== Drives ================================

Drive c: (Disk 500 GB) (Fixed) (Total:465.66 GB) (Free:419.25 GB) NTFS
Drive e: (Kikos 160) (Fixed) (Total:152.66 GB) (Free:107.27 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: F510F510)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 152.7 GB) (Disk ID: C5F42EA5)
Partition 1: (Not Active) - (Size=152.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Vkládám log : tu zmíněnou službu musím 3 denně vypínat možná byla zrovna v dobu scanu vypnutá.

ComboFix 15-12-16.01 - Kirchner 16.12.2015 8:18.4.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.3328.1789 [GMT 1:00]
Spuštěný z: c:\users\Kirchner\Desktop\ComboFix.exe
AV: ESET Smart Security 7.0 *Enabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289}
FW: ESET Personální firewall *Enabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2}
SP: ESET Smart Security 7.0 *Enabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Rezidentní štít AV je zapnutý
.
.
.
((((((((((((((((((((((((( Soubory vytvořené od 2015-11-16 do 2015-12-16 )))))))))))))))))))))))))))))))
.
.
2015-12-16 07:08 . 2015-10-29 09:46 8991856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4915F557-AA5D-49F7-88E7-5D949D25BB0A}\mpengine.dll
2015-12-15 14:57 . 2015-12-15 14:59 -------- d-----w- C:\FRST
2015-12-14 08:04 . 2015-12-14 08:04 -------- d-----w- C:\rsit
2015-11-23 07:19 . 2015-11-23 07:19 -------- d-----w- c:\programdata\CPInstall
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-12-14 06:52 . 2014-11-24 09:13 796864 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-12-14 06:52 . 2014-11-24 09:13 142528 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-12-02 12:25 . 2014-10-30 13:14 247976 ------w- c:\windows\system32\MpSigStub.exe
2015-11-03 17:46 . 2015-11-12 07:36 2386944 ----a-w- c:\windows\system32\win32k.sys
2015-10-30 22:58 . 2015-11-11 07:41 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2015-10-30 22:58 . 2015-11-11 07:41 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2015-10-30 22:47 . 2015-11-11 07:41 504832 ----a-w- c:\windows\system32\vbscript.dll
2015-10-30 22:46 . 2015-11-11 07:41 62464 ----a-w- c:\windows\system32\iesetup.dll
2015-10-30 22:45 . 2015-11-11 07:41 47616 ----a-w- c:\windows\system32\ieetwproxystub.dll
2015-10-30 22:45 . 2015-11-11 07:41 341504 ----a-w- c:\windows\system32\html.iec
2015-10-30 22:44 . 2015-11-11 07:41 64000 ----a-w- c:\windows\system32\MshtmlDac.dll
2015-10-30 22:36 . 2015-11-11 07:41 102912 ----a-w- c:\windows\system32\ieetwcollector.exe
2015-10-30 22:36 . 2015-11-11 07:41 115712 ----a-w- c:\windows\system32\ieUnatt.exe
2015-10-30 22:36 . 2015-11-11 07:41 620032 ----a-w- c:\windows\system32\jscript9diag.dll
2015-10-30 22:31 . 2015-11-11 07:41 667648 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2015-10-30 22:23 . 2015-11-11 07:41 60416 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2015-10-30 22:16 . 2015-11-11 07:41 4527616 ----a-w- c:\windows\system32\jscript9.dll
2015-10-30 22:09 . 2015-11-11 07:41 1155072 ----a-w- c:\windows\system32\mshtmlmedia.dll
2015-10-30 22:09 . 2015-11-11 07:41 2052608 ----a-w- c:\windows\system32\inetcpl.cpl
2015-10-30 21:51 . 2015-11-11 07:41 2011136 ----a-w- c:\windows\system32\wininet.dll
2015-10-29 17:50 . 2015-11-11 07:42 5120 ----a-w- c:\windows\system32\shimeng.dll
2015-10-29 17:49 . 2015-11-11 07:42 295936 ----a-w- c:\windows\system32\apphelp.dll
2015-10-29 17:49 . 2015-11-11 07:42 62464 ----a-w- c:\windows\system32\aelupsvc.dll
2015-10-29 17:49 . 2015-11-11 07:42 562176 ----a-w- c:\windows\apppatch\AcLayers.dll
2015-10-29 17:49 . 2015-11-11 07:42 470528 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2015-10-29 17:49 . 2015-11-11 07:42 2178560 ----a-w- c:\windows\apppatch\AcGenral.dll
2015-10-29 17:49 . 2015-11-11 07:42 211968 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2015-10-29 17:49 . 2015-11-11 07:42 20992 ----a-w- c:\windows\system32\sdbinst.exe
2015-10-29 17:39 . 2015-11-11 07:42 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2015-10-20 17:46 . 2015-11-11 07:39 93696 ----a-w- c:\windows\system32\wudriver.dll
2015-10-20 17:46 . 2015-11-11 07:39 35840 ----a-w- c:\windows\system32\wups2.dll
2015-10-20 17:46 . 2015-11-11 07:39 30208 ----a-w- c:\windows\system32\wups.dll
2015-10-20 17:46 . 2015-11-11 07:39 2955776 ----a-w- c:\windows\system32\wucltux.dll
2015-10-20 17:46 . 2015-11-11 07:39 2061824 ----a-w- c:\windows\system32\wuaueng.dll
2015-10-20 17:46 . 2015-11-11 07:39 174080 ----a-w- c:\windows\system32\wuwebv.dll
2015-10-20 17:46 . 2015-11-11 07:39 566784 ----a-w- c:\windows\system32\wuapi.dll
2015-10-20 17:45 . 2015-11-11 07:39 73728 ----a-w- c:\windows\system32\WinSetupUI.dll
2015-10-20 17:45 . 2015-11-11 07:39 11776 ----a-w- c:\windows\system32\wu.upgrade.ps.dll
2015-10-20 17:45 . 2015-11-11 07:39 35328 ----a-w- c:\windows\system32\wuapp.exe
2015-10-20 17:45 . 2015-11-11 07:39 136192 ----a-w- c:\windows\system32\wuauclt.exe
2015-10-20 00:52 . 2015-11-11 07:42 3991488 ----a-w- c:\windows\system32\ntkrnlpa.exe
2015-10-20 00:52 . 2015-11-11 07:42 3935680 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-10-20 00:52 . 2015-11-11 07:42 67520 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2015-10-20 00:52 . 2015-11-11 07:42 138176 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2015-10-20 00:48 . 2015-11-11 07:42 1308160 ----a-w- c:\windows\system32\ntdll.dll
2015-10-20 00:45 . 2015-11-11 07:42 172032 ----a-w- c:\windows\system32\wdigest.dll
2015-10-20 00:45 . 2015-11-11 07:42 65536 ----a-w- c:\windows\system32\TSpkg.dll
2015-10-20 00:45 . 2015-11-11 07:42 400896 ----a-w- c:\windows\system32\srcore.dll
2015-10-20 00:45 . 2015-11-11 07:42 100352 ----a-w- c:\windows\system32\sspicli.dll
2015-10-20 00:45 . 2015-11-11 07:42 43008 ----a-w- c:\windows\system32\srclient.dll
2015-10-20 00:45 . 2015-11-11 07:42 15872 ----a-w- c:\windows\system32\sspisrv.dll
2015-10-20 00:45 . 2015-11-11 07:42 251392 ----a-w- c:\windows\system32\schannel.dll
2015-10-20 00:45 . 2015-11-11 07:42 22016 ----a-w- c:\windows\system32\secur32.dll
2015-10-20 00:45 . 2015-11-11 07:42 655360 ----a-w- c:\windows\system32\rpcrt4.dll
2015-10-20 00:45 . 2015-11-11 07:42 223232 ----a-w- c:\windows\system32\ncrypt.dll
2015-10-20 00:45 . 2015-11-11 07:42 259584 ----a-w- c:\windows\system32\msv1_0.dll
2015-10-20 00:45 . 2015-11-11 07:42 1061376 ----a-w- c:\windows\system32\lsasrv.dll
2015-10-20 00:45 . 2015-11-11 07:42 552960 ----a-w- c:\windows\system32\kerberos.dll
2015-10-20 00:45 . 2015-11-11 07:42 38912 ----a-w- c:\windows\system32\csrsrv.dll
2015-10-20 00:45 . 2015-11-11 07:42 36864 ----a-w- c:\windows\system32\cryptbase.dll
2015-10-20 00:45 . 2015-11-11 07:42 17408 ----a-w- c:\windows\system32\credssp.dll
2015-10-20 00:45 . 2015-11-11 07:42 69632 ----a-w- c:\windows\system32\smss.exe
2015-10-20 00:45 . 2015-11-11 07:42 262656 ----a-w- c:\windows\system32\rstrui.exe
2015-10-20 00:44 . 2015-11-11 07:42 22528 ----a-w- c:\windows\system32\lsass.exe
2015-10-20 00:44 . 2015-11-11 07:42 50176 ----a-w- c:\windows\system32\auditpol.exe
2015-10-20 00:39 . 2015-11-11 07:42 60416 ----a-w- c:\windows\system32\msobjs.dll
2015-10-20 00:39 . 2015-11-11 07:42 146432 ----a-w- c:\windows\system32\msaudite.dll
2015-10-20 00:35 . 2015-11-11 07:42 6656 ----a-w- c:\windows\system32\apisetschema.dll
2015-10-20 00:35 . 2015-11-11 07:42 686080 ----a-w- c:\windows\system32\adtschema.dll
2015-10-19 23:29 . 2015-11-11 07:42 225792 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2015-10-19 23:28 . 2015-11-11 07:42 98304 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2015-10-19 23:28 . 2015-11-11 07:42 124416 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2015-10-13 16:31 . 2015-11-11 07:42 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2015-10-13 16:31 . 2015-11-11 07:42 74752 ----a-w- c:\windows\system32\drivers\tdx.sys
2015-10-13 04:50 . 2015-11-11 07:41 712640 ----a-w- c:\windows\system32\drivers\ndis.sys
2015-10-13 00:29 . 2015-10-13 00:29 875720 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2015-10-01 17:50 . 2015-10-14 05:52 50176 ----a-w- c:\windows\system32\setbcdlocale.dll
2015-10-01 17:50 . 2015-11-11 07:39 22528 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\jnwppr.dll
2015-10-01 17:50 . 2015-11-11 07:39 216064 ----a-w- c:\windows\system32\InkEd.dll
2015-10-01 17:50 . 2015-11-11 07:39 19968 ----a-w- c:\windows\system32\jnwmon.dll
2015-10-01 17:50 . 2015-10-14 05:52 50688 ----a-w- c:\windows\system32\appidapi.dll
2015-10-01 17:50 . 2015-10-14 05:52 28160 ----a-w- c:\windows\system32\appidsvc.dll
2015-10-01 17:50 . 2015-10-14 05:52 96768 ----a-w- c:\windows\system32\appidpolicyconverter.exe
2015-10-01 17:50 . 2015-10-14 05:52 16896 ----a-w- c:\windows\system32\appidcertstorecheck.exe
2015-10-01 16:53 . 2015-10-14 05:52 50176 ----a-w- c:\windows\system32\drivers\appid.sys
2015-09-23 13:09 . 2015-11-11 07:39 371920 ----a-w- c:\windows\system32\drivers\cng.sys
2015-09-23 13:09 . 2015-11-11 07:39 251000 ----a-w- c:\windows\system32\bcryptprimitives.dll
2015-09-18 17:47 . 2015-10-15 05:53 23384 ----a-w- c:\windows\system32\CompatTelRunner.exe
2015-09-18 17:44 . 2015-10-15 05:53 587776 ----a-w- c:\windows\system32\invagent.dll
2015-09-18 17:44 . 2015-10-15 05:53 615936 ----a-w- c:\windows\system32\generaltel.dll
2015-09-18 17:44 . 2015-10-15 05:53 423936 ----a-w- c:\windows\system32\devinv.dll
2015-09-18 17:44 . 2015-10-15 05:53 1120768 ----a-w- c:\windows\system32\appraiser.dll
2015-09-18 17:44 . 2015-10-15 05:53 62976 ----a-w- c:\windows\system32\acmigration.dll
2015-09-18 17:35 . 2015-10-15 05:53 999936 ----a-w- c:\windows\system32\aeinv.dll
.
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Nezapomen"="c:\program files\Pamatuj\nezapomen.exe" [2000-12-11 458240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2006-10-09 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-09 7741440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-09 81920]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-09-12 5110672]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2014-10-31 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2015-05-21 89984]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-10-30 102912]
R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 19720]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-24 14856]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 121064]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 12776]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 136808]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-05-13 114280]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2015-05-21 184192]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]
R3 WatAdminSvc;Služba Technologie aktivace Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2014-10-30 1343400]
R3 WSDScan;Podpora skenování WSD přes UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2013-09-17 49240]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2013-09-17 188808]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2013-09-17 134248]
S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [2013-09-17 37416]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2013-09-12 1337752]
S2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8;c:\program files\Nitro\Pro 8\NitroPDFDriverService8.exe [2012-12-13 196616]
S2 ss_conn_service;SAMSUNG Mobile Connectivity Service;c:\program files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [2015-05-21 743688]
S2 VRAID Log Service;VRAID Log Service;c:\program files\VIA\RAID\vialogsv.exe [2014-10-30 55920]
S2 xmengine service;CryptoPlus XME Engine Service;c:\windows\system32\xmesrv.exe [2014-10-31 34696]
S3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [2004-10-21 1275584]
S3 GemCCID;GemCCID;c:\windows\system32\DRIVERS\GemCCID.sys [2014-03-14 99840]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
utcsvc REG_MULTI_SZ DiagTrack
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-09-29 06:00 997704 ----a-w- c:\program files\Google\Chrome\Application\45.0.2454.101\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A6EADE66-0000-0000-484E-7E8A45000000}]
2015-11-18 16:22 286904 ----a-w- c:\program files\Adobe\Acrobat Reader DC\Esl\AiodLite.dll
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.google.com/
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: business24.cz\www
Trusted Zone: servis24.cz\www
TCP: DhcpNameServer = 46.33.112.42 8.8.8.8 46.33.96.2
.
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.032"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.abr"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.acdc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.acdc"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ani"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.apd"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.arw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.bay"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.bmp"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cr2"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.crw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cs1"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cur"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dcr"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dcx"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dib"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.djv"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.djvu"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dng"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.emf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.eps"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.erf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.fff"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.gif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.hdr"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.icl"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.icn"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.iw4"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.j2c"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.j2k"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jbr"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jfif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jp2"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpc"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpe"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpeg"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpg"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpk"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpx"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.kdc"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mef"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mos"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mrw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.nef"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.nrw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.orf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pbr"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pct"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pcx"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pef"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pic"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pict"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.png"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.psd"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.psp"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pspbrush"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pspimage"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.raf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.raw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rle"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rw2"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rwl"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.sr2"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.srf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.srw"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tga"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.thm"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tiff"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ttc"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ttf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v18o\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.v18o"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v18p\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.v18p"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v18pf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.v18pf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wbm"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wbmp"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.webp"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wmf"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.xif"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.xmp"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.032"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.abr"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ani"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.apd"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.arw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.bay"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.bmp"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cr2"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.crw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cs1"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.cur"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dcr"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dcx"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dib"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.djv"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.djvu"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.dng"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.emf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.eps"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.erf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.fff"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.gif"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.hdr"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.icl"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.icn"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.iw4"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.j2c"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.j2k"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jbr"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jfif"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jif"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jp2"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpc"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpe"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpeg"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpg"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpk"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.jpx"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.kdc"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mef"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mos"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.mrw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.nef"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.nrw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.orf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pbr"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pct"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pcx"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pef"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pic"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pict"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.png"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.psd"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.psp"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pspbrush"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.pspimage"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.raf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.raw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rle"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rw2"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.rwl"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.sr2"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.srf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srw\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.srw"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tga"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.thm"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tif"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.tiff"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ttc"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.ttf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wbm"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wbmp"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webp\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.webp"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.wmf"
.
[HKEY_USERS\S-1-5-21-3565674240-4036518550-1107183558-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (S-1-5-21-3565674240-4036518550-1107183558-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee 18.xif"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_20_0_0_228_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_20_0_0_228_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Celkový čas: 2015-12-16 08:38:15
ComboFix-quarantined-files.txt 2015-12-16 07:38
.
Před spuštěním: Volných bajtů: 450 433 888 256
Po spuštění: Volných bajtů: 450 104 782 848
.
- - End Of File - - D29F4829F1FAF770E77F0D45A470E507
A36C5E4F47E84449FF07ED3517B43A31

Provedeno ..... jen pro info dnes jsem již 5x vypínal Host Process - svchost.exe (netsvcs)

Zasílám v TXT mělo to moc znaků ...jinak program nezapomeň je OK je to připomínač událostí.

Zdá se že neovlivnil po ránu naskakuje a vytěžuje procesor na 100% musím 2-3x vypínat. Pokusím se udělat znovu při max.zatížení. Děkuji za ochotu.

Tak teď nevím je tam spuštěný několikrát

OK podařilo se vkládám.

Tak zdá se že win update po tom výkon spadl rychle dolů.

Tak se zdá že po aktualizovaní a vypnutí se to zlepšilo budu pozorovat a dam report.

Takže od tohoto problému již klid, ale zase se mi objevil starý známy několikrát řešený DeviceDisplayObjectProvider jež vytěžuje procesor na 100% po vypnutí jede normálně

Většinou to 1-2x za den vypnu ve správci někdy je pokoj i na pár dní tady jsem se s tím trápil velmi často ( http://forum.viry.cz//viewtopic.php?f=13&t=142525) pokoušeli jsme se to i smazat a nahradit začínám přemýšlet o novém PC

Jojo tam je všechno cajk

Myslíš jako win znova všechno smáznout ... no asi budu muset ač jsem se chtěl tomu vyhnout